Guide
Patient UGC: consent, disclosure and HIPAA basics
If a patient appears in your marketing, your practice generally needs their written HIPAA authorization first, collected through your own process. If they received anything of value, say so clearly in the content. Show experiences rather than promised results, and never repost a patient's own content without permission.
When do you have to disclose a relationship?
The FTC's Endorsement Guides expect any material connection between the business and the person endorsing it to be disclosed clearly and conspicuously (16 CFR Part 255). For a practice, material connections include:
- A free, discounted or upgraded treatment in exchange for content.
- Payment, gifts or affiliate commissions.
- Being an employee, contractor or relative of someone at the practice.
- Entry into a contest or giveaway for posting about the practice.
Put the disclosure in the content itself, where people will see it: said in the video and shown on screen, not only in a profile or behind a 'more' link. Platform tools for branded content help, but they don't replace a clear disclosure.
What can patient content say about results?
A testimonial describes one person's experience. Under FTC guidance it can't stand in for the evidence a health claim needs, and if the results shown aren't what people can generally expect, the FTC expects you to say what they can expect. A 'results not typical' line isn't enough. Keep patient content to what the patient genuinely experienced, and keep before-and-after images honest: same lighting and angle, no editing that changes the result, and written authorization.
Can you repost a patient's own post about your practice?
Ask first, in writing. A patient tagging your practice is not permission for you to use their content in your marketing, and reposting it can confirm they are your patient. Get permission to reuse the content, and the HIPAA authorization your counsel advises.
Can you use AI-generated patients or reviews?
No, not presented as real. The FTC rule on reviews and testimonials prohibits fake reviews and testimonials, including AI-generated ones attributed to people who don't exist or didn't have the experience. If you use illustrative AI imagery, never imply it shows real patients or real results.
A checklist before any patient content goes live
- Signed, current written authorization from the patient, on your counsel-approved form.
- Any material connection disclosed in the content itself.
- No outcome claims beyond what the patient experienced, and nothing implying it is typical.
- Clinician review of anything that describes treatment, risks or results.
- Platform rules checked, including restrictions on before-and-after images.
- Removal process ready in case the patient revokes their authorization.
Questions
Is a verbal OK enough?
No. HIPAA marketing authorizations must be in writing and signed. Keep the signed form.
Do staff who appear in videos need a HIPAA authorization?
Not as staff. HIPAA protects patient information. Staff appearing as employees should agree to it in line with your employment policies, and if they are also patients, don't reveal that without authorization.
Can patients withdraw permission later?
Yes. A HIPAA authorization can be revoked in writing. Plan how you will take content down if that happens.