HIPAA GUIDE · Updated October 15, 2026
HIPAA-Safe Marketing: Reviews, Testimonials, Social, Texting and Email
Most HIPAA trouble in marketing comes from revealing that someone is a patient without permission.
Not legal advice. This is general information for small practices, summarized from HHS.gov. Talk to a healthcare attorney or qualified compliance professional about your specific situation.
Reviews
- Ask for reviews, but do not confirm someone is a patient when you reply. Reply generically (e.g., "Thanks for the feedback; please call our office").
- Never mention treatment details in a public reply.
Testimonials and photos
- Get signed patient authorization before using a name, photo, story or before/after image. HHS marketing guidance explains when authorization is required.
Social media
- No patient photos, names or recognizable details without authorization.
- Train staff not to post from the treatment room.
Texting and email
- Use a platform that signs a BAA for appointment reminders and patient messages (see our BAA table).
- Keep general newsletters free of health details, and do not upload patient lists to tools without a BAA.
FAQ
Can I reply to a Google review from a patient?
Yes, but don't confirm they are a patient or discuss their care. Keep replies generic.
Do I need permission to use a testimonial?
Generally yes: get a signed authorization first. Check with your attorney.