HIPAA and healthcare marketing: testimonials, case studies, and photos

Splash Creative designs brand identity and marketing websites for healthcare practices. It does not provide legal advice, and it does not certify HIPAA compliance. This page is a general framework for how the Privacy Rule is commonly applied to testimonials, case studies, and photos. It is not a review of any organization's forms. Have counsel read the authorization you actually use.

The studio is at 34 S Dean St, Suite 206, Englewood, NJ 07631, and serves New York City and North Jersey. There is no New York City office. Identity from $15,000. Websites from $15,000. Brand and website from $30,000. Healthcare branding and healthcare websites are the service articles. Pricing and contact are the next steps.

The notes below were already published on this URL. They describe the rule. They do not add a clinical claim, a patient count, or a result.

Authorization, not a ban

HIPAA does not ban patient stories in marketing. It requires a valid authorization before protected health information is used for marketing. Protected health information includes anything that could identify the person together with health information: name, photo, voice, condition, treatment detail, or a date that could be cross-referenced.

A marketing authorization under 45 CFR 164.508 needs, at minimum:

• A specific description of the information to be used
• Who is authorized to use it
• Who it will be disclosed to (for marketing, often the public, through the organization's own channels)
• An expiration date or event
• The patient's signature and date
• A statement that the patient may revoke the authorization in writing, and how
• A statement that treatment cannot be conditioned on signing
• A statement that information disclosed may be redisclosed and no longer protected by HIPAA

A generic media release that skips those elements is not a valid HIPAA marketing authorization, even if the patient signs it.

Testimonials

A testimonial that uses the patient's name, likeness, and any reference to condition or treatment needs an authorization that covers the actual use. An authorization for the website does not automatically cover a paid ad or a brochure unless the form says so.

If a patient revokes, use on channels the organization controls has to stop going forward. The rule does not require erasing copies that have already left those channels.

Case studies without an authorization

The other published path is de-identification, under the Safe Harbor method in 45 CFR 164.514(b)(2) or by expert determination. Safe Harbor means removing the listed identifiers, including name, geography smaller than a state, and dates directly related to the person other than year.

A case study that drops the name and keeps a rare condition, an unusual age, or a small town can still identify the person to their own community. If it can, it is not de-identified. Get an authorization, or remove the identifying detail.

Before and after photos

Photos of a face are identifying even when the marketing use feels routine. Cropping or blurring does not, by itself, end the authorization requirement if the image is still tied to the record or to identifying text. Using a stock "after" photo to stand in for a real patient's result is a separate advertising problem. The authorization should name the photos it covers.

State advertising rules

HIPAA is one layer. State rules for licensed providers can limit outcome claims, the word "guarantee," and testimonial disclaimers. A story can meet the Privacy Rule and still miss a board's advertising rule. That check belongs with counsel, not with a design studio.

A practical workflow

Organizations that publish patient stories usually need one authorization, reviewed by counsel, that lists the channels they will actually use; a signature at the time the content is captured; a log of scope and expiration; and a way to stop use after a revocation. Case studies that are called de-identified need the same review, because removing a name is not the same as de-identification.

Frequently asked questions

Does Splash certify that a site is HIPAA compliant?

No. Splash designs the brand and the marketing site. Certification and legal review are outside that scope.

Is this legal advice?

No. It is a general description of a rule that is already public. Counsel should review the form and the materials.

How much does the design work cost?

Identity from $15,000. A website from $15,000. Brand and website from $30,000. Pricing.