A Professional Feed: Education, Boundaries, and Zero PHI

What actually counts as a PHI violation on social media

A post crosses into a PHI disclosure the moment it contains information that could let someone identify a specific patient — a diagnosis, a quote, a photo, or a detail combination like "a client this week going through X" posted the same day that client was seen. HIPAA's Marketing guidance treats any use of patient information to promote the practice as requiring authorization first, with only narrow exceptions 1Ref 1HHS Office for Civil Rights (2026).Marketing.That using patient information to promote the practice — including in a social post — requires authorization absent a narrow exception..

A social post is a use of that information just like a brochure or an ad is. The common mistake isn't posting an obvious identifier — it's the composite "client story" built from three real sessions that reads as anonymous to the writer but is recognizable to the person it's drawn from, or to their family. If a story is close enough to something that actually happened this month that you'd hesitate to show it to that patient, it's too close to post.

The three categories of content that are actually safe

Three categories of content carry essentially no PHI risk because they never touch a specific patient's facts: general psychoeducation (what a condition is, what a treatment approach does), practice logistics (hours, fees, what a first session looks like), and your own professional development (a training completed, a conference attended, a credential earned).

• Psychoeducation works best when it answers a question a prospective patient would type into a search bar, not when it summarizes a session.
• Logistics posts double as the content that actually drives inquiries — a clear answer to "do you take insurance" outperforms an inspirational quote graphic.
• Professional posts build the credibility that makes a referral source or a directory click convert, without touching anyone's care.

A fourth category — commentary on your own field, a book, a research finding — is safe on the same logic: it never requires a patient's facts to be interesting.

Consistency reads as more credible than virality: a monthly post explaining one concept in plain language builds more referral trust over a year than a single post that spikes attention and disappears. Treat the account as a slow-building professional presence, not an audience-growth project — the goal is to be findable and credible when someone already searching decides to look you up, not to go viral.

Where a boundary problem starts: comments and DMs

The riskiest moment on a clinician's account usually isn't the post — it's a comment or direct message from a follower describing their own situation and asking what to do. Responding with anything resembling clinical advice creates the appearance of a treatment relationship with someone who isn't your patient, isn't covered by your informed consent, and isn't in a jurisdiction you may even be licensed in.

The safer reply acknowledges the message without engaging its content: "I can't offer guidance on individual situations here — if you're looking for care, here's how to reach my practice, or here's how to find a crisis line if this is urgent." Decide this reply in advance, as a written house rule, rather than improvising it under a comment from a stranger describing something serious.

Turning off DMs from accounts you don't follow, or setting comment moderation to filter medical-sounding keywords, reduces how often a crisis-shaped message reaches you outside business hours in the first place. Neither setting replaces the scripted reply — it just narrows how often you need to use it.

Reviews, endorsements, and anything that looks like a testimonial

If a former patient offers to post a positive review or tag your account, the same testimonial rules that apply to your website apply on social media: the endorsement has to reflect honest experience, and any material connection between you and the person posting has to be disclosed 2Ref 2Federal Trade Commission (2023).FTC's Endorsement Guides: What People Are Asking.That a reposted or solicited patient endorsement must reflect honest experience and disclose any material connection.. Soliciting only the patients likely to say something glowing, while staying quiet with everyone else, is the review-gating pattern the FTC's 2024 rule now fines for 3Ref 3Federal Trade Commission (2024).Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials.That gating solicitation to only favorable patients is a banned review-manipulation pattern carrying civil penalties..

A repost of a patient's public praise is generally fine if you didn't pay for it and didn't cherry-pick it from a private request — but resharing it still requires the same authorization logic as any other use of patient-connected content, so get it in writing rather than assuming a public post is fair game to reshare.

Texting and automated messages that follow from a social account

A practice that captures leads through social media often follows up by text, and that follow-up sits under a different rule than the post itself: the TCPA requires prior express consent before sending autodialed or prerecorded messages, including appointment-reminder or recall texting programs run off a marketing platform 4Ref 4Federal Communications Commission (2026).Telemarketing and robocalls.That texting a lead captured through social media requires prior express consent under the TCPA before automation begins.. A social media inquiry form is not, by itself, consent to text — build the consent checkbox into the form, not into your assumption.

This matters most for practices that connect a social ad to an automated scheduling or nurture sequence; the convenience of automation is exactly where consent gets skipped.

The same consent logic applies to a newsletter signup captured through a social bio link or a giveaway: an email address collected for one purpose doesn't automatically authorize every future message, so match what the signup form actually said to what you later send.

Writing the one-page policy before you need it

A one-page written policy — what the account posts, what it never posts, the exact comment-reply language for someone describing their own situation, and who else (if anyone) has account access — resolves most of these questions before a live moment forces an improvised call. Solo practices skip this because there's no compliance officer requiring it, which is exactly why it has to be self-imposed.

Revisit the policy any time you add a new platform or a new person touches the account; a written rule that only lives in your head doesn't transfer to a virtual assistant managing your posting calendar.

Cover which platforms the policy applies to, whether anyone besides you ever posts on the account's behalf, and the specific phrase you'll use when a comment describes a crisis. None of this requires legal review to draft — it requires only that you decide it once, while calm, rather than while a difficult comment is already sitting unanswered.