Healthcare services and senior care: the numbers, the rules, the AI picture.

• HIPAA Privacy Rule: marketing authorization and review replies, 45 CFR 164.501 and 164.508(a)(3)

  A covered entity must obtain a written authorization before it uses or discloses protected health information for marketing. Marketing means a communication that encourages people to buy or use a product or service. Describing your own health services is excluded unless a third party pays you for the communication. If a third party pays, the authorization must say so. OCR enforces this on review replies: in June 2023 Manasa Health Center paid $30,000 after a reply to an online review disclosed a patient’s diagnosis and treatment.

  What it means: Get a signed authorization before you publish a resident’s or patient’s name, photo, video or story. Never confirm in a review reply that someone was in your care, and never mention a diagnosis, room or visit. Home health agencies, hospices and nursing facilities that bill insurers are usually covered entities. Some private-pay home care and assisted living operators may not be, but state privacy laws and resident rights still apply, so follow the same discipline.

  [9] law.cornell.edu

• Federal Anti-Kickback Statute and the beneficiary inducement CMP, 42 USC 1320a-7b(b) and 1320a-7a(a)(5)

  The Anti-Kickback Statute makes it a felony to knowingly and willfully pay anything of value to induce referrals for federally funded care. Penalties reach $100,000 in fines and 10 years in prison. A separate civil law penalises offering remuneration to a Medicare or Medicaid beneficiary that is likely to influence their choice of provider. OIG’s December 2016 policy statement treats gifts as nominal up to $15 each and $75 a year per patient. Cash and cash equivalents never qualify.

  What it means: Do not pay discharge planners, facility staff, marketers or lead sellers per referral or per admission for Medicare or Medicaid services without counsel confirming a safe harbor fits fully. Keep event giveaways, tour gifts and family thank-yous under the nominal value limits, and never use gift cards. Free services, waived copays and move-in incentives tied to federally paid care need a legal review before they appear in an ad.

  [10] oig.hhs.gov

• CMS Care Compare star ratings and hospital discharge planning, 42 CFR 482.43

  CMS publishes provider quality on Care Compare: two home health star ratings updated quarterly, nursing home five-star ratings and hospice caregiver survey results. Hospitals must list available home health agencies and nursing facilities in the discharge plan and tell patients they are free to choose. They must respect patient preferences and share quality and resource use data.

  What it means: Your public ratings are part of your marketing whether you cite them or not. When you quote a star rating, name which rating it is, the date and the source, and update it when CMS refreshes the data. Do not present a single component as an overall score. Build relationships with discharge planners on quality and responsiveness, never on payments.

  [11] law.cornell.edu

• FTC Consumer Reviews and Testimonials Rule, 16 CFR Part 465, and the Endorsement Guides, 16 CFR 255.5

  The rule took effect on October 21, 2024. It bans fake reviews and testimonials, and incentives conditioned on positive or negative sentiment. It also bans undisclosed insider reviews, fake independent review sites and review suppression through unfounded threats. Courts can impose civil penalties for knowing violations. The Endorsement Guides require clear disclosure of any material connection between an advertiser and an endorser.

  What it means: You may ask every family for an honest review, but never reward only good ones. Staff and their relatives must disclose their connection if they post. Do not run a best senior care in the city site that ranks your own communities. If you pay a referral platform, ask how it discloses that relationship to families, because a paid ranking presented as neutral advice is the problem the guides target.

  [12] ftc.gov

• Telephone Consumer Protection Act rules, 47 CFR 64.1200

  Telemarketing calls and texts to mobile numbers that use an autodialer or a prerecorded or artificial voice need prior express written consent. That consent must be signed, name the number and authorise the seller, and state that agreeing is not a condition of purchase. Consumers may revoke consent by any reasonable means, and revocation must be honoured within ten business days. The FCC’s one-to-one consent rule was vacated by the Eleventh Circuit in January 2025.

  What it means: Every web form that leads to automated calls or texts needs clear consent language naming your organisation. Honour stop and opt-out replies quickly. If you buy leads, demand proof of consent that names you, because the lead seller’s consent may not cover your calls. State telemarketing laws can be stricter, so check where your families live.

  [13] law.cornell.edu

• Website accessibility: ADA Title III and the HHS Section 504 rule, 45 CFR 84.84

  The Department of Justice says the ADA applies to the goods and services businesses open to the public offer online, and points to WCAG as a helpful standard. Separately, HHS requires recipients of its federal financial assistance to make web content and mobile apps meet WCAG 2.1 Level AA. The current compliance dates are May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for smaller ones.

  What it means: Your audience includes older adults with low vision, hearing loss and tremors. Use large readable type, strong contrast, captions on tour videos, labelled forms and full keyboard navigation. Ask counsel whether your Medicare or Medicaid participation makes you a Section 504 recipient, and plan your redesign around WCAG 2.1 AA either way.

  [14] law.cornell.edu

• State licensing and referral agency laws: California Health and Safety Code 1569.681 and Washington RCW 18.330

  States license most senior care types and some regulate their advertising. In California, every licensed residential care facility for the elderly must show its license number in advertisements meant to attract residents, including directory listings and radio or TV commercials. In Washington, elder referral agencies must give a written disclosure before a referral, covering fees, refund policy and any ownership interest in recommended providers. They may not take payment for referrals to services payable under the state’s Medicaid law.

  What it means: Show your license or certification number in ads, profiles and footers where your state requires it, and describe only the services your license allows. Do not market assisted living as skilled nursing or hospice care unless you are licensed for it. If you pay referral agencies, check your state’s referral law and keep the contracts on file.

  [15] california.public.law

• United Kingdom: CQC rating display, regulation 20A of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014

  Providers rated by the Care Quality Commission must show their most recent rating on every website maintained by or for them. The website must give the CQC address and say where the latest report is. It must label which rating applies to which location or service, and show each rating’s date. Premises and the principal place of business must also display the rating.

  What it means: A UK care home or home care provider cannot hide a weak rating or show only the best location’s result. Place the rating, date and report link where visitors see it on each location page. This is stricter than US practice, where no federal rule requires a provider to display its Care Compare rating.

  [16] legislation.gov.uk

This is general information, not legal advice. Fraud and abuse, privacy, telemarketing and licensing rules depend on your license type, your payers and your state or country, and they change. Check your state licensing agency, your regulator and a qualified healthcare attorney before you publish or launch a campaign.