Healthcare marketing teams tend to land in one of two failure modes. The first overshares: a patient story on the homepage with enough identifying detail (age, condition, treatment date, photo) that it constitutes a HIPAA disclosure without proper authorization. The second undershares: fear of HIPAA leads a marketing team to strip every patient story of anything specific, producing generic copy that says nothing and converts nobody. Both are avoidable once you understand what HIPAA actually requires versus what most healthcare organizations assume it requires.
This is not legal advice, and any healthcare organization should have counsel review its specific authorization forms and marketing materials. But the framework below reflects how HIPAA’s Privacy Rule actually applies to the marketing materials healthcare brands use most: testimonials, case studies, and before/after photography.
The Core Rule: Authorization, Not Prohibition
HIPAA does not prohibit using patient stories in marketing. It requires a valid, HIPAA-compliant authorization before you use any Protected Health Information (PHI) for marketing purposes. PHI includes anything that could identify the patient combined with health information: name, photo, voice, specific condition, treatment details, or dates that could be cross-referenced to identify them.
A valid marketing authorization under 45 CFR 164.508 must include, at minimum:
- A specific description of the information to be used or disclosed (e.g., “before and after photographs of my rhinoplasty procedure and a written account of my experience”)
- The name of the person or organization authorized to use the information
- The name of the person or organization to whom the disclosure will be made (in marketing use, this is typically the public via the organization’s website and social channels)
- An expiration date or event
- The patient’s signature and date
- A statement that the patient has the right to revoke the authorization in writing, and how to do so
- A statement that the practice cannot condition treatment on signing the authorization
- A statement that information disclosed under the authorization may be subject to redisclosure by the recipient and no longer protected by HIPAA
A generic “media release” form that doesn’t include these elements is not a valid HIPAA marketing authorization, even if the patient signs it willingly. This is the single most common compliance gap we see: practices using a standard photo release form borrowed from a non-healthcare context that is missing the required HIPAA-specific language.
Testimonials: What’s Actually Required
A written or video patient testimonial that includes the patient’s name, likeness, and any reference to their condition or treatment requires a signed marketing authorization meeting the elements above. Two things marketing teams frequently get wrong:
The authorization needs to describe the specific use. If a patient signs an authorization for a testimonial to appear on your website, that authorization does not automatically extend to using the same testimonial in a paid social ad campaign or a print brochure, unless the authorization explicitly covers those uses. Practices that plan to repurpose a testimonial across multiple channels should draft the authorization broadly enough to cover the intended uses upfront, rather than going back to the patient for a second signature later.
Revocation has to be honored going forward, not retroactively. If a patient revokes their authorization after their testimonial has been live on your website for six months, HIPAA requires you to stop using it going forward. It does not require you to somehow unpublish historical instances (a shared social post, for example) that are outside your control, but you must remove it from your own owned channels and stop any active use.
Case Studies: The De-Identification Path
If you want to write about a clinical case without patient authorization, you have one other compliant path: full de-identification under the HIPAA Safe Harbor method (45 CFR 164.514(b)(2)) or Expert Determination. Safe Harbor requires removing 18 specific identifiers, including name, geographic subdivisions smaller than a state, all dates directly related to the individual (except year), and any other unique identifying number or characteristic.
In practice, this means a genuinely de-identified case study cannot include the patient’s age (only broad ranges like “a patient in their 40s”), the specific city or town where they were treated, exact treatment dates, or any detail specific enough that someone in their community could identify them. Most “de-identified” case studies we review are not actually de-identified under Safe Harbor. They’ve removed the name but kept enough specific detail (a rare condition, an unusual age, a small geographic area) that the patient is still identifiable to anyone who knows them. If a case study without authorization keeps any detail that could plausibly identify the patient to their own community, it is not compliant de-identification. Either get authorization or genuinely de-identify.
Before/After Photography: The Highest-Risk Category
Before/after photos, particularly in dermatology, plastic surgery, dental, and medical spa marketing, carry the highest compliance risk because faces are inherently identifying. A few specifics:
- A blurred or cropped face does not remove the authorization requirement. If the photo is still tied to the patient’s treatment record or accompanied by identifying text, PHI protections still apply regardless of whether the face is visible.
- Stock “after” photos used to represent a real patient’s results is a separate, non-HIPAA problem that creates FTC truth-in-advertising exposure. Don’t do this regardless of HIPAA status.
- The authorization should specify the exact photos. A signed authorization referencing “photographs taken during my treatment” is weaker than one that references specific photo files or a specific photography session, particularly if a dispute arises later about which images were actually authorized.
State Advertising Rules Layer on Top of HIPAA
HIPAA compliance is necessary but not sufficient. Most states have separate advertising rules for licensed healthcare providers (particularly in dentistry, plastic surgery, chiropractic, and behavioral health) that govern claims about outcomes, use of the word “guarantee,” and required disclaimers on testimonials. A testimonial that is fully HIPAA-compliant can still violate your state medical board’s advertising rules if it implies a guaranteed outcome or omits required disclaimers about individual results varying. Any healthcare marketing review needs to check both layers, not just HIPAA.
A Practical Authorization Workflow
For healthcare organizations building a marketing content pipeline, the workflow that avoids most compliance problems:
- Draft one comprehensive marketing authorization form, reviewed by counsel, that covers all intended uses (website, social, print, paid ads) rather than a narrow single-use form
- Get the authorization signed at the time content is captured, not after the fact when memory of consent details fades
- Maintain a tracking log of active authorizations, their scope, and expiration dates, separate from the general medical record
- Build a process for handling revocation requests that includes removing content from owned channels within a defined timeframe (many organizations use 5 to 10 business days as a standard)
- Route any case study or “de-identified” content through the same review process as authorized testimonials, since the de-identification bar is higher than most marketing teams assume
Getting this right protects the organization and, done well, does not have to blunt the marketing. The most effective healthcare marketing we’ve built uses real patient stories with proper authorization, not generic copy stripped of anything specific out of compliance anxiety. The authorization process is the unlock, not the obstacle.
Splash Creative builds brand and marketing systems for healthcare organizations that need this compliance layer built in from the strategy phase, not bolted on after the creative is done. See our broader work on branding in regulated industries or talk to David about your healthcare marketing compliance needs.
