FTC Endorsement Guides for practices: testimonials and influencers

What the Endorsement Guides cover

The formal name is the Guides Concerning Use of Endorsements and Testimonials in Advertising, codified at 16 CFR Part 255 (opens in a new tab) and last revised at 88 FR 48102 on July 26, 2023 (checked in the eCFR on October 23, 2026). The FTC describes them as "administrative interpretations" of the laws it enforces. They aren't a rule with their own penalties, but they show how the FTC reads deception under the FTC Act.

An endorsement is any advertising or promotional message that people are likely to read as the opinion or experience of someone other than the advertiser. For a practice, that covers:

The core principles, in the Guides' own order:

• Honest opinion. "Endorsements must reflect the honest opinions, findings, beliefs, or experience of the endorser" (§ 255.1(a)). You may shorten a quote, but you may not present it "out of context or reworded so as to distort" what the person said (§ 255.1(b)).
• You're liable for it. Advertisers can be liable for "misleading or unsubstantiated statements made through endorsements," even when the endorser isn't (§ 255.1(d)).
• Real people. An ad that presents "actual consumers" must use them or clearly say they aren't (§ 255.2(c)).
• Real expertise. A doctor endorsing something must have the expertise the ad implies and must actually use it to evaluate the product (§ 255.3).
• Disclosed connections. Payment, free or discounted treatment, family or business ties must be disclosed "clearly and conspicuously" (§ 255.5).

A separate FTC rule, Part 465, turns several review practices into violations with civil penalties. It's covered in our guide to the FTC fake reviews rule.

Patient testimonials: typical results and disclosures

When a testimonial talks about a key result, the FTC assumes viewers read it as "representative of what consumers will generally achieve" (§ 255.2(b)). If you can't back that up, the ad must clearly disclose the generally expected performance in the circumstances shown. The Guides' weight-loss example puts it plainly: the ad "should clearly and conspicuously disclose what they can expect to lose in the depicted circumstances."

What that means for a practice:

1. "Results not typical" doesn't work. The FTC's business guidance says an ad featuring an exceptional result "must make clear to the audience what the generally expected results" are (FTC Endorsement Guides FAQ (opens in a new tab)). A vague disclaimer doesn't do that.
2. A testimonial isn't evidence. Consumer endorsements "themselves are not competent and reliable scientific evidence" (§ 255.2(a)). If a patient says your treatment fixed her migraines, you need the same proof as if you'd said it yourself.
3. You need records. "Generally expected results" means outcome data or published evidence, not a guess.

For collecting and displaying them day to day, see our guide to patient testimonials.

Medfy doesn't collect testimonials or run influencer programs. If you want a baseline before changing your ads, the free marketing audit scores your website, Google listing, social and ads from public information and lists the top five fixes.

Influencers, affiliates and paid partnerships

The Guides define material connections broadly. They "can include a business, family, or personal relationship," "monetary payment or the provision of free or discounted products," and other benefits such as early access (§ 255.5(a)). Disclosure is required when "a significant minority of the audience" wouldn't expect the connection.

The FTC's own example is a healthcare one. In § 255.5(b)(3), a tennis player credits a laser vision correction clinic in a TV interview without saying the clinic pays him. The Guides say a disclosure "during the show's closing credits would not be clear and conspicuous." On social media, he should disclose the relationship even if the clinic didn't pay for that particular post and even if what he received was free or discounted surgery. If the clinic reposts him without an adequate disclosure, the clinic must add one.

What the FTC's business guidance says about how to disclose:

• Put it in the content itself, ideally in the video, not only in a bio, a description, the comments or behind a link.
• Put it near the start, in clear words: "Ad," "Paid ad," "Sponsored by [practice]," "Gifted by [practice]." A "thank you" to the practice isn't enough, and tags like "#ambassador," "#client" or "partner" are ambiguous.
• Platform paid-partnership labels help, but the FTC says you and the creator stay responsible for a clear disclosure.
• Advertisers need "reasonable programs in place to train and monitor" their endorsers, and hiring an agency "doesn't relieve you of responsibility."

Dentists have an extra constraint. The ADA Code treats paying an influencer, or a current, past or prospective patient, "a specific amount or percentage of professional fees collected" as fee splitting, and names "social media influencers" and "social media coupons" specifically (ADA Code, advisory opinion 4.E.1 (opens in a new tab), revised to October 2025). A disclosed flat fee is a different arrangement from a cut of every case.

Reviews from staff, family or incentivized patients

The Guides apply to reviews too. Employees posting reviews should disclose the job; the rule applies "equally to employees posting their own reviews," and listing your employer on your profile "isn't enough."

• Family. The FTC says a small business owner may ask relatives for reviews but must ask them to disclose the family relationship (reviews rule Q&A (opens in a new tab), page dated November 2024).
• Incentives. "You can't condition an incentive – for example, a discount – on a review being positive," and incentivized reviews should be disclosed.
• Selective asking. The Guides warn against procuring or suppressing reviews in ways "distorting or otherwise misrepresenting what consumers think" (§ 255.2(d)).

Platform rules can be stricter than the FTC. Google's Maps content policy bars content "based on a conflict of interest" and lists "current or former employment" as one (Google policy (opens in a new tab)). A disclosed staff review can satisfy the FTC and still be removed by Google. The FTC's Part 465 (opens in a new tab) also makes it a violation for an owner or manager to solicit reviews from relatives or staff without instructing them to disclose the relationship.

HIPAA authorization: the second permission you need

The FTC rules govern how a testimonial is presented. HIPAA governs whether you may use a patient's information in it at all. The fact that someone is your patient, combined with what you treated, is individually identifiable health information under 45 CFR 160.103 (opens in a new tab).

HIPAA defines marketing as a communication "about a product or service that encourages recipients of the communication to purchase or use the product or service" (45 CFR 164.501 (opens in a new tab)). For marketing, "a covered entity must obtain an authorization for any use or disclosure of protected health information," with narrow exceptions for face-to-face communications and promotional gifts of nominal value (45 CFR 164.508(a)(3) (opens in a new tab)).

A valid authorization needs, among other elements:

• a specific description of the information to be used (the video, photos, quote, treatment named);
• who may disclose it and who may receive it;
• the purpose (for example, "advertising on the practice website and social media");
• an expiration date or event, plus signature and date;
• statements about the right to revoke in writing, whether treatment is conditioned on signing, and the risk of redisclosure.

Build the form once with your attorney; our guide to the HIPAA authorization form walks through the fields.

Some professions add a third permission: whether you may ask at all. The APA Ethics Code says "Psychologists do not solicit testimonials from current therapy clients/patients or other persons who because of their particular circumstances are vulnerable to undue influence" (APA Standard 5.05 (opens in a new tab), effective January 1, 2017). Counselors, social workers and marriage and family therapists should read their own code's wording. More in HIPAA for therapists.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

A testimonial compliance checklist

Copy this into your procedures and run it before any testimonial or creator post goes live. It sits alongside the platform and board rules in our overview of medical advertising regulations.

• Your professional code allows you to ask this person (no solicitation from current therapy clients for psychologists).
• A signed HIPAA authorization is on file, naming the material, the channels and an expiration.
• The person is a real patient, or the ad says clearly that it uses an actor.
• Quotes are shortened, not reworded, and keep the original meaning.
• Any health claim in the testimonial is one you can substantiate yourself.
• If the result is better than typical, the ad states the generally expected result.
• Any free or discounted treatment, payment, employment or family tie is disclosed in plain words.
• The disclosure is in the post or video itself, near the start, not only in a bio.
• Creator contracts require disclosure, and you review posts before they run.
• Dentists: the creator isn't paid a share of fees from the patients they bring in.
• You have a process to take content down when an authorization is revoked or expires.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Can a medical practice use patient testimonials?

Yes, with two permissions in place. The FTC Endorsement Guides require that a testimonial reflects a real patient's honest experience, that unusual results come with a statement of what patients generally achieve, and that any connection such as a free treatment is disclosed. HIPAA requires a signed authorization before you use a patient's story in marketing. Some licenses add limits: psychologists may not solicit testimonials from current therapy clients.

Do testimonials need a disclaimer?

Sometimes. If a testimonial describes results better than most patients get and you can't show they are typical, the FTC expects a clear statement of the generally expected results; "results not typical" alone isn't enough. If the patient received anything of value, such as a free or discounted treatment, that connection needs a clear disclosure too. A real patient with typical results and no connection to you needs neither.

Can staff leave reviews for their practice?

They can, but they should say they work there in the review itself; the FTC says listing an employer on a profile page isn't enough. Under the FTC's reviews rule, an owner or manager who asks staff for reviews should instruct them to disclose the relationship. Google's review policy also treats employment as a conflict of interest, so the cleanest course is to keep staff out of your Google reviews entirely.

Do influencers have to disclose free treatments?

Yes. A free or discounted treatment is a material connection under the Endorsement Guides. The FTC's own example involves a laser eye surgery clinic: the athlete it sponsors should disclose the relationship even when he received discounted surgery rather than cash. The disclosure belongs in the post or video itself, in plain words such as "Ad" or "Gifted by [practice name]", not buried in a bio or a pile of hashtags.