The result was excellent, the patient was thrilled, and the office manager asked by text whether it was all right to post the before-and-after. The patient replied "sure!" The photo, with the patient's face, went up on the practice's Instagram that afternoon with a caption describing the procedure. Three months later the patient's new employer found it, and the patient found a lawyer.
On October 2, 2019, OCR announced that a dental practice paid $10,000 "to settle social media disclosures of patients' protected health information." A year earlier, on September 20, 2018, unauthorized disclosure of patients' information during the filming of a television documentary produced settlements totaling $999,000. Photos and stories are the friendliest form of P.H.I. (Protected Health Information), and the regulation treats them exactly like a lab result. This post covers why a photo is P.H.I., when a use needs an authorization, what the authorization must contain, the testimonial and review problem, and what to write into policy.
HIPAA Patient Photos and Testimonials: The Authorization Rule
1. A Face Is an Identifier
45 CFR 164.514(b)(2)(i) lists the identifiers that must be removed for health information to count as de-identified. Item (Q) is "Full face photographic images and any comparable images." Item (A) is names; item (C) is dates related to the individual. A before-and-after photo of a patient's face, captioned with a procedure and a date, contains three identifiers plus a description of health care. Under 160.103, P.H.I. is individually identifiable health information "transmitted or maintained in any other form or medium," which includes a JPEG.
Cropping out the eyes does not fix it. The de-identification standard in 164.514(b)(2)(ii) also requires that the practice "does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual." A distinctive tattoo, a rare condition, a small town, or a caption that identifies the patient as a local firefighter can each defeat the crop. The full list is in the 18 HIPAA identifiers post, and the two lawful de-identification methods are in the de-identification guide.
2. Treatment Photo Versus Marketing Photo
The same image can be lawful or unlawful depending on what it is for. A clinical photograph taken to document a lesion, plan a procedure, or track healing is a treatment use, permitted without authorization under 164.506(c)(1), and it belongs in the chart under the same safeguards as everything else in it. The moment that image is used to attract new patients, it is marketing. 164.501 defines marketing as "a communication about a product or service that encourages recipients of the communication to purchase or use the product or service," and 164.508(a)(3)(i) states that "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing," with only two exceptions: a face-to-face communication with the individual, and a promotional gift of nominal value. A social media post is neither.
Two more rules apply. 164.508(a)(3)(ii): if the marketing "involves financial remuneration" to the practice from a third party (a device maker paying for the post, for example), "the authorization must state that such remuneration is involved." And 164.502(a)(5)(ii) bars the sale of P.H.I. without an authorization that says the practice will be paid; licensing a patient image to a manufacturer in exchange for payment is a sale.
3. What the Authorization Must Contain
A text reply, a verbal okay, or a generic "media release" line buried in the intake packet is not an authorization. 164.508(b)(2)(ii) makes an authorization invalid if it "has not been filled out completely" with respect to the required elements. Those elements, from 164.508(c), are below, translated for a photo or testimonial.
| 164.508(c) element | Regulation text | For a photo or testimonial |
|---|---|---|
| (c)(1)(i) Description | "A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion" | Which images or quotes, whether the face is shown, whether the name and the procedure are stated |
| (c)(1)(ii) Who discloses | "The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure" | The practice, and the marketing agency if it will handle the files |
| (c)(1)(iii) Who receives | "The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure" | "The public, via the practice website and social media accounts," named platform by platform |
| (c)(1)(iv) Purpose | "A description of each purpose of the requested use or disclosure" | "Marketing and promotion of the practice"; say the word |
| (c)(1)(v) Expiration | "An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure" | A date, or an event such as "until revoked"; posts come down when it passes |
| (c)(1)(vi) Signature | "Signature of the individual and date," with the representative's authority described if a representative signs | The patient, or a parent or guardian with the authority stated (relevant for minors) |
| (c)(2)(i) Revocation statement | Notice of "the individual's right to revoke the authorization in writing" and how | An email address for revocation and a stated takedown timeline |
| (c)(2)(ii) Conditioning statement | Whether treatment or payment may be conditioned on signing | "Your care does not depend on signing this" (164.508(b)(4) forbids conditioning treatment on a marketing authorization) |
| (c)(2)(iii) Redisclosure statement | "The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient and no longer be protected by this subpart" | "Once posted, the image can be copied and shared by anyone, and the practice cannot recall those copies" |
| (c)(3) and (c)(4) | "Written in plain language"; "provide the individual with a copy of the signed authorization" | One page, readable, copy handed over or emailed |
The redisclosure statement is the honest one. Under 164.508(b)(5), a patient "may revoke an authorization provided under this section at any time, provided that the revocation is in writing, except to the extent that" the practice "has taken action in reliance thereon." Revocation obligates the practice to stop using the image and to take its own posts down; it cannot pull the copies strangers already saved. Saying that in the form, out loud, is what informed consent looks like. The complete form anatomy, including compound-authorization traps, is in the authorization requirements guide, and signed authorizations are retained for six years under 164.508(b)(6) and 164.530(j).
4. Testimonials, Reviews, and Replies
A patient who writes a public review has spoken for themselves. The practice reposting that review with the patient's name and a note about the procedure, quoting the patient in an ad, or asking the patient to record a video about their treatment is a use of P.H.I. by the practice, and for marketing. Treat every practice-published testimonial as needing the authorization above. A written quote with no name, no face, and no identifying detail may qualify as de-identified, but the "actual knowledge" test still applies, and a small-town practice usually has that knowledge.
Replying to reviews is the other trap, because it needs no photo at all. Confirming that the reviewer is a patient, or explaining what happened at their visit, is a disclosure of P.H.I. without an authorization. The review response rules, the staff behaviors that cause most incidents, and the enforcement history are in the HIPAA and social media post. If an outside agency manages the accounts, it is a business associate handling P.H.I., as explained in the marketing agencies post.
5. Staff Phones and the Sanction Policy
Most photo incidents are not marketing decisions. They are a staff member's personal phone in a treatment area. 164.530(c)(1) requires "appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information," and 164.530(e)(1) requires the practice to "have and apply appropriate sanctions against members of its workforce who fail to comply." A policy that bans personal-device photography in clinical areas, names the practice-owned device used for clinical photos, and states the consequence for a post without an authorization is the physical safeguard, the training topic under 164.530(b), and the sanction policy in one document. Dental settings, where intraoral and smile photos are routine, get specific treatment in the dental compliance guide.
6. What to Write Into Policy
- Clinical photos are taken only on practice-owned devices, stored in the chart, and never on a personal phone or a personal cloud account.
- No image, quote, story, or review is used in marketing without a signed 164.508 authorization on the practice's form, filed before the post goes up.
- The form contains every element in the table above, names each platform, sets an expiration, and states the redisclosure reality in plain words.
- A minor's authorization is signed by a parent or guardian with their authority stated on the form.
- Revocations go to a named person; posts come down within a stated number of business days; the revocation is filed with the original.
- Any paid arrangement with a manufacturer or vendor is disclosed on the form (164.508(a)(3)(ii)) and treated as a sale if the practice is paid for the image (164.502(a)(5)(ii)).
- Review responses use an approved script that never confirms a treatment relationship.
- Signed authorizations and revocations are retained six years; the marketing agency's B.A.A. (Business Associate Agreement) covers its handling of the files.
None of this prevents a practice from showing its work. It requires the practice to ask properly, in writing, with the risks stated, and to keep the paper. The patient who signs that form is a patient who will not be surprised later, which is the entire purpose of the rule.
---
FAQ
Are patient photos considered PHI under HIPAA?
Yes. Full-face and comparable images are identifiers under 45 CFR 164.514(b)(2)(i)(Q), and an image tied to a person's care is protected health information under 160.103 in any form or medium.
Can a patient give verbal consent to post their photo?
Not for marketing. 45 CFR 164.508(a)(3) requires a written authorization containing the elements in 164.508(c), and 164.508(b)(2)(ii) makes an incomplete authorization invalid.
Do patient testimonials need a HIPAA authorization?
When the practice publishes them, yes, because the practice is using protected health information for marketing. A fully de-identified quote may not, but the actual-knowledge test in 164.514(b)(2)(ii) still applies.
What if the patient later changes their mind about a posted photo?
Under 45 CFR 164.508(b)(5) the patient may revoke in writing. The practice stops using the image and removes its own posts, but it cannot recall copies already made, which the form's redisclosure statement must say.
Can staff take clinical photos on their own phones?
Policy should say no. 45 CFR 164.530(c) requires safeguards for protected health information, and a personal phone holding clinical images is a lost-device breach waiting to happen.
Conclusion
A photo and testimonial authorization is a one-page form, and the policy around it is shorter than the caption on most posts. One Guy Consulting's Full-Scope plan includes the authorization form, the social media and device policy, and consulting time to review what is already on your accounts. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 45 CFR 164.508 (authorizations: marketing, core elements, revocation)
- 45 CFR 164.514 (de-identification identifiers)
- 45 CFR 164.501 (definition of marketing)
- 45 CFR 164.502 (sale of protected health information)
- 45 CFR 164.506 (treatment uses)
- 45 CFR 164.530 (safeguards, sanctions, documentation)
- 45 CFR 160.103 (definition of protected health information)
Related Reading