Photos and testimonials: written authorization or nothing

Can I use patient photos or testimonials?

Only with a valid written HIPAA authorization, signed before the material goes anywhere. Using a patient's image, name, or story to promote your practice is marketing, and the Privacy Rule requires a signed authorization before you use protected health information for marketing — there is no implied or verbal consent that will do 1Ref 1HHS Office for Civil Rights (2026).Marketing.That using PHI for marketing requires a signed HIPAA authorization, with only narrow exceptions, and how HIPAA defines marketing.. A happy patient saying 'feel free to use my story' is not authorization; the form is.

The instinct to share a glowing note is human, but the rule does not turn on how positive the content is. It turns on whether the material reveals that a specific person is your patient.

Why this counts as 'marketing' — and why marketing needs a signature

Marketing, in HIPAA terms, is a communication that encourages someone to use a service, and using PHI to make it is what triggers the authorization requirement 1Ref 1HHS Office for Civil Rights (2026).Marketing.That using PHI for marketing requires a signed HIPAA authorization, with only narrow exceptions, and how HIPAA defines marketing.. A testimonial names or identifies a patient; a photo shows one. Both are protected health information once tied to your practice, because they reveal that the person received care from you 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule governs use and disclosure of PHI and requires authorization outside treatment, payment, and operations.. That is the disclosure — not the flattering content, but the fact of the treatment relationship.

This is also where the covered-entity test matters: if HIPAA applies to your practice at all, it applies to your marketing, and the same authorization standard governs a website banner and a social post alike.

What a valid authorization must contain

A marketing authorization is a specific document, not a line in your intake packet. The rule text lists the core elements it must have to be valid 3Ref 3Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The rule text on the core elements of a valid authorization, revocation, and the de-identification standard.: a specific description of what will be used, who may use and receive it, the purpose, an expiration event or date, the individual's signature and date, and a plain statement of the right to revoke. If it does not say the material is for marketing, it is not a marketing authorization.

Photos: a treatment consent is not a marketing authorization

A form that lets you photograph a wound for the chart does not let you post it publicly — those are different permissions, and only a marketing authorization covers promotion 1Ref 1HHS Office for Civil Rights (2026).Marketing.That using PHI for marketing requires a signed HIPAA authorization, with only narrow exceptions, and how HIPAA defines marketing.. Identifiable is broader than a face: a distinctive tattoo, a visible first name, a room detail, or a rare diagnosis can identify a patient even with the face cropped. To use an image without authorization, it must clear the Privacy Rule's de-identification standard, which is a high bar 3Ref 3Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The rule text on the core elements of a valid authorization, revocation, and the de-identification standard..

When in doubt, treat the image as identifiable and get the signature. A cropped or blurred photo that still lets someone recognize the patient is not de-identified; it is an unauthorized disclosure waiting to be recognized.

Testimonials, reviews, and the reply button

You may invite feedback, but you may not publish identifiable patient content without authorization — and the sharpest trap is the reply button. Asking for reviews is fine; a public reply that confirms the person was your patient, or discusses their care, is a disclosure of PHI and has drawn OCR penalties against small practices 4Ref 4HHS Office for Civil Rights (2026).HIPAA Compliance and Enforcement.That OCR has penalized impermissible disclosures, including public responses to patient reviews, in small practices.. When a bad week brings a negative review, the safe reply never confirms treatment — speak generally about your policies and move specifics to a private channel.

The same caution applies to sharing or reposting a review someone else wrote: repackaging it as your marketing puts the authorization requirement right back on you.

Revocation, minors, and expiration

Every authorization must let the patient revoke it, and you honor a revocation going forward: you stop new uses, though you cannot always retrieve material already printed or widely shared 3Ref 3Office of the Federal Register (2026).45 CFR Part 164 — Security and Privacy.The rule text on the core elements of a valid authorization, revocation, and the de-identification standard.. Build an expiration into the form so stale permissions lapse on their own. For a minor or an incapacitated adult, the person who signs is the personal representative — usually a parent or guardian — under the same state-deferring rules that govern their records 5Ref 5HHS Office for Civil Rights (2026).Personal Representatives.That a personal representative signs for a minor or incapacitated adult under state-deferring rules..

Keep a way to act on a revocation quickly: know where each piece of authorized content lives so that 'please take it down' can actually happen, not just be promised.

A compliant workflow for photos and testimonials

Set it up once and the rule enforces itself. Keep a dedicated marketing-authorization form separate from clinical consents, collect the signature before anything is used, log it, and diary the expiration. Posting identifiable patient content without that signed form is an impermissible disclosure — and an impermissible disclosure of unsecured PHI is a breach, with its own notification duties 6Ref 6HHS Office for Civil Rights (2026).Breach Notification Rule.That an impermissible disclosure of unsecured PHI is a breach carrying notification duties.. Vet your website too.

• One marketing-authorization form, never buried in the intake packet.
• Signed before use; logged; expiration diaried.
• The reply button is a disclosure — never confirm treatment in public.
• Watch the tracking-pixel problem on your site, and prefer pixel-free measurement for analytics.

The patient in the background

Marketing photos of your own space carry a hidden risk: the patient who walks through the frame. An office-tour video, a grand-opening photo, or a waiting-room shot can capture a recognizable patient who never agreed to appear in your marketing — and their presence in your office is itself the disclosure of a treatment relationship.

Shoot promotional images when no patients are present, or review every frame for anyone identifiable before it is published. The same caution applies to what sits in the background: a schedule, a name on a monitor, a chart left on a desk. Treat the whole frame as potential PHI. When you cannot avoid an identifiable person, a signed authorization is the only fix — and if you cannot get one, the image does not run.