What Can a Medical Practice Legally Publish in Its Marketing?
You want to sell the practice and you’ve been told most of it is not permitted and no one has told you where. So, what can a medical practice publish in marketing? The lines are not as scary as they seem and this guide explains what is generally safe and the 4 questions to ask before anything goes out.
This page is general information, not legal advice, and no article can tell a specific practice what it may publish. Have a healthcare attorney confirm your own position.
In this Guide
- What is generally safe to publish
- Why testimonials are handled differently
- Where patient information leaks into marketing
- The four-question check before you publish
What can a medical practice legally publish in its marketing?
Clinical education, staff and facility content, logistics and requests for review can be uniformly and generally published by most practices. Written authorization is usually required before anything that identifies a patient can be done.
| Material | Generally straightforward | Needs written authorization first | Generally avoid |
|---|---|---|---|
| Clinical education | Conditions, procedures, what to expect | Anything identifying a patient | |
| Photographs | Building, staff, equipment | Any patient image, including before and after | A patient image used because it was “unrecognizable” |
| Patient stories | A testimonial in the patient’s own words | Editing or improving their words | |
| Reviews | Asking every patient the same way | A reply that confirms someone is a patient | |
| Website tracking | Measurement on general pages | Tracking that ties a person to a condition page |
This table starts a conversation with counsel and is not a determination. The middle column is based on documentation that the practice needs to have.
The middle column is where practices go wrong, because authorization has to be on file before the post goes live. That’s the beginning of HIPAA compliant marketing.
Why are patient testimonials different here?
The person who is giving the testimonial reveals that she is a patient, and the testimonial is the disclosure. Therefore, healthcare testimonials typically require written permission, whereas other industries only require permission to quote.
According to a plumbing testimonial, someone had a leak. A practice testimonial states that someone was suffering from a problem. The sentence is the same shape and the exposure is not, which answers whether doctors use patient testimonials.
Even with the patient’s consent, three things are wrong with practices: They edit the patient’s words, reuse a testimonial that wasn’t authorized and hang it up after the patient has withdrawn. Ask these questions of counsel, but don’t tell them to do anything or give any advice here.
What about before-and-after photographs?
A patient image is patient information regardless of whether or not a face is visible, so most practices adopt a rule that a patient image is not published without authorization on file for that image and use.
Patient photos in marketing are a common trap; they believe they are de-identified if they are cropped. There are also some procedures that have additional advertising expectations. Note the location of each authorization and who has access to it in a year.
Where does patient information leak into ordinary marketing?
Typically via discreet means: forms on websites, chat widgets, audience uploads and tracking that links an individual to a page on a condition.
| How it happens | Safer substitute |
|---|---|
| A contact form emails details in plain text to a shared inbox | A form that captures a name and callback request, nothing clinical |
| A chat widget asks about symptoms | Chat that books, answers logistics and routes clinical questions to a call |
| A patient list is uploaded to build an audience | Audiences built on geography and interest |
| A tracking pixel sits on a page about one condition | Measurement that reports page totals, not individuals |
| A reply says “thank you for trusting us with your procedure” | A reply that thanks the reviewer and names nothing |
The first leak at the front desk will typically be website forms, so make sure that forms that handle information properly are first in line, particularly in front of a patient portal or an intake form.
Chat widgets leak in the same way, which is why the aim is chat that collects nothing it should not, one that books, answers logistics and sends clinical questions to a person by phone.
A practice should be responsible for what its vendors collect, and “the agency set it up” is not a job anyone wants to have. If the vendor is dealing with protected information, they could be a business associate, so consult with counsel. That is healthcare social media compliance in practice.
How do I reply to a patient review?
Respond (without confirming the reviewer is a patient), without mentioning anything about their care, and with an offline option (typically one sentence and a phone number) for substantive responses.
Positive: “Thank you for your nice comments. We are glad you shared it. Negative: “Thank you for the feedback. We’d like to hear more, please call our office.
A good practice for all review responses is replying without confirming anything, using language that has been reviewed by counsel and then reused by the entire team at a busy front desk.
If a review is not just displeased, but actually false, and you think it may not have been written by a real patient, check the time when a review can be challenged, and don’t reply hastily, or you risk confirming everything about someone’s treatment.
What is the safest thing a practice can do?
Ask every patient for a review the same way at the same point in the visit, with no inducement and no selection, because a uniform request is both the strongest reputation action and the least exposed.
At eleven in the morning, with two phones ringing, the front desk cannot run a six-step process, so asking patients the careful way means one moment, one sentence, one link, and a record that the same request went to everyone.
Medical practice review requests face two gates, platform rules and healthcare rules, and you must pass both. Google’s guidelines for representing your business cover the platform side only, which is a separate question from what healthcare rules permit.
Rewards in exchange for reviews are a different issue, and for any business, the page on why incentives are a separate problem explains the platform rules and why healthcare adds another layer on top.
What can go on the practice profile and website instead?
All high intent, none touching patient information: clinicians, credentials, conditions treated, patient visits, insurance, hours, parking and booking.
Patients look for logistics and procedures, and very few people provide them with helpful answers, so a clinical education written to Google’s helpful content standard is the least a practice can do, and it’s the most nobody can do.
Treat the profile itself as a short and simple content brief, one where what belongs on the practice listing is hours, services, clinicians and booking links, never anything about a patient’s care.
How a dental practice fills the chair answers the second question for a dental practice asking the compliance question on the way to the patient-acquisition question.
Do state rules change this?
Often, state law and professional board rules impose additional requirements beyond federal requirements, and they are not consistent. For instance, Texas has unique practices, and practices we work with in Texas will require their own review by counsel before going into print or online.
Ask counsel once, in writing, for a one-page list of what the practice may publish, and keep it at the front desk.
What can a medical practice publish in marketing? The four questions to ask first
Ask these four before you publish, and nothing else:
- Does this identify a patient?
- Do we hold written authorization for this exact use?
- Does this reply or caption confirm anything about someone’s care?
- Would we be comfortable if the patient saw it tomorrow?
For clinics and doctors, learn more about how we work with practices and marketing within medical constraints in the context of a busy front desk.
A marketing agency is not the place to get a compliance answer and that includes us. This is general information; consult a healthcare attorney for your own situation.
We are a digital marketing agency at 13121 Louetta Rd, Cypress, Texas. Pink Socials can build your review process around the four questions, with a uniform request at the front desk and a record of each one.
Leave a Reply