What does HIPAA actually restrict in marketing?
- Protected Health Information. You cannot share, suggest, or imply specific patient information without written authorization, even in a positive context and even with names removed if the patient remains identifiable. A patient who self-identifies in their own review is fine. Creating or curating content that exposes their information on your end is not.
Can I use patient reviews in my marketing?
- Reviews where the patient chose to identify themselves are generally fine to display as they stand. What you cannot do is create, edit, or curate review content in a way that exposes protected information. Using a testimonial in your own materials is a separate step that needs written authorization from that patient.
What do I need before publishing before-and-after photos?
- Explicit written authorization from the patient, scoped to each specific use. Naming the website, the social accounts, and the advertising separately matters, because a general permission is not a permission for every channel. Some specialty boards, cosmetic surgery in particular, add disclosure requirements about typical results on top of that.
Do staff and facility photos have compliance requirements?
- They carry no protected-information issues, which makes them the safest visual content a practice has. You should still get written model releases from staff for marketing use, because that is an employment and likeness question rather than a health-privacy one, and it protects you if someone leaves.
What health claims can I make in marketing?
- Only ones you can substantiate. Avoid cures, guarantees, and specific outcome promises unless peer-reviewed evidence supports them. The FTC enforces claim substantiation, and state medical and dental boards layer their own advertising rules on top, which vary state to state and can be stricter than the federal baseline.
Who enforces healthcare marketing rules?
- Several bodies at once, which is what makes the area tricky. HIPAA governs protected information, the FTC enforces claim substantiation, state medical and dental boards set advertising rules that differ by state, and the FDA constrains certain claims. A campaign can satisfy one and violate another, so the review has to cover all of them.
Should my agency involve compliance counsel?
- Yes, and by default rather than on request. Briefing a practice's compliance counsel on every public-facing change before it ships costs about 30 minutes of legal review, which is far cheaper than a state-board complaint. An agency that does not do this as standard practice in healthcare is a risk you are carrying.
Is it safer to say nothing at all in healthcare marketing?
- No, and that failure is as common as over-sharing. Practices that under-share lose patients to bolder competitors who stayed inside the rules. The line is finer than most owners think in both directions, and the goal is to say everything you are permitted to say clearly rather than to say as little as possible.
Can healthcare practices run online ads?
- Yes, within the same constraints, and with extra care on targeting. Health-related audience targeting is restricted on the major platforms, claim rules still apply to ad copy, and landing pages carry the same substantiation burden as any other page. Compliance review should cover the ad, the targeting, and the page it points to.
Do state rules really differ that much?
- They do, and that catches multi-state practices out. Advertising rules from medical and dental boards vary state to state on disclosures, testimonial use, and specialty designations. A campaign cleared in one state can breach the rules in another, so multi-state marketing needs the strictest applicable standard or a per-state review.
How does compliance affect a multi-location practice's local SEO?
- It compounds the usual complexity. Each location needs its own accurate profile, and the profile content, photos, and review handling all sit inside the same compliance frame as the website. The location pages carry claim rules too, so the local SEO work and the compliance review have to run together rather than sequentially.
What is the most common healthcare marketing compliance mistake?
- Publishing patient content without properly scoped written authorization, usually because a happy patient said yes verbally. The second most common is an outcome claim written by a marketer rather than a clinician. Both are avoidable with a review step, and both are expensive to unwind once a board complaint exists.
