Patient testimonials: how to use them under HIPAA and FTC rules

When a testimonial counts as marketing under HIPAA

HIPAA's definition in 45 CFR 164.501 (opens in a new tab) says marketing means "to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service." A patient story on your website, in an ad or on Instagram is built to do exactly that.

The identifiable part is what triggers the rule. Under 45 CFR 160.103 (opens in a new tab), information relating to "the provision of health care to an individual" is protected when it identifies the person, or when there's "a reasonable basis to believe" it could. A first name plus a photo plus "after my hip replacement" clearly qualifies. So can initials and a town in a small community.

45 CFR 164.508(a)(3) (opens in a new tab) then says a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing," with two narrow exceptions (face-to-face communication and promotional gifts of nominal value) that don't fit testimonials. And even if a particular testimonial didn't fit the marketing definition, the general rule in 164.508(a)(1) still bars using or disclosing PHI without an authorization unless another permission applies, and publishing a patient's story isn't treatment, payment or routine operations.

Practical conclusion: if a testimonial identifies a patient, get a signed authorization before it goes anywhere. That includes reposting a patient's own social post or Google review, because your repost confirms they're your patient.

What a valid HIPAA authorization must contain

Section 164.508(c) lists the required content. A valid authorization needs these core elements:

1. A specific description of the information to be used or disclosed (for example, the written quote, photos, video, first name, and the procedure mentioned).
2. Who is authorized to use or disclose it (your practice).
3. Who may receive it (for a testimonial, the public, through the channels you name).
4. Each purpose (for example, promoting the practice's services on its website, social media and ads).
5. An expiration date or an expiration event.
6. The patient's signature and date, and, if a personal representative signs, a description of their authority.

It must also include statements telling the patient about their right to revoke in writing and how, whether treatment can be conditioned on signing (for testimonials it can't), and that information disclosed "may be subject to redisclosure by the recipient and no longer be protected." It must be in plain language, the patient gets a copy, and if a third party pays you for the marketing, the authorization must say so.

Keep signed forms for six years from creation or the date last in effect, whichever is later (45 CFR 164.530(j) (opens in a new tab)). Our HIPAA authorization form guide walks through each line.

FTC rules: typical results, disclosures and fake testimonials

HIPAA decides whether you may publish a testimonial. The FTC decides whether the testimonial misleads. Three sources apply.

Typicality. The Endorsement Guides (opens in a new tab) (16 CFR 255.2(b)) say a testimonial about "a central or key attribute" of a service "will likely be interpreted as representing that the endorser's experience is representative of what consumers will generally achieve." If you can't substantiate that, the ad "should clearly and conspicuously disclose the generally expected performance in the depicted circumstances." A patient who lost 60 pounds on your program implies others will. If the typical patient loses far less, say what's typical, with data to support it.

Substantiation. Under 255.2(a), claims made through testimonials need the same support as claims you make directly, and "consumer endorsements themselves are not competent and reliable scientific evidence." A patient's "this cured my migraines" is a claim your practice is making.

Material connections. Under 255.5(a), connections that might affect how much weight people give an endorsement must be disclosed clearly and conspicuously. These include payment, "free or discounted products," and "the possibility of being paid, of winning a prize." A patient who received a free treatment in exchange for a video is a paid endorser; say so in the video.

Fake and AI-generated testimonials. The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465 (opens in a new tab)), in effect since October 21, 2024, makes it a violation for a business to write or create a testimonial that misrepresents that the testimonialist exists, used the service, or what their experience was (465.2). The FTC's announcement (opens in a new tab) named "AI-generated fake reviews" as a target. Staff testimonials need a disclosure of the relationship when it isn't otherwise clear (465.5(b)).

The FTC's Q&A (opens in a new tab) adds that "a business that puts testimonials on its own website is disseminating them," so you're responsible for what they say. More detail is in our FTC endorsement guides explainer.

Never invent a testimonial, composite one from several patients, or let anyone (agency or software) write one. Medfy doesn't.

Specialty limits: therapists, plastic surgery and others

Professional ethics codes can be stricter than HIPAA or the FTC.

ACA's ethics page (opens in a new tab) says the 2014 code remains current while a revision is underway; check for the new version before relying on the wording above.

State licensing boards often add their own advertising rules, and those rules vary by state and profession. Check your board's rules before you publish. For photo-specific consent in aesthetic practices, see before-and-after photo consent.

Video and photo testimonials

Faces, voices, tattoos and the inside of your office all identify people. Plan for that:

• Scope the authorization to the media. Name video, still photos and audio specifically, and say whether you may edit, shorten or caption them.
• Name the channels. Website, social media accounts, paid ads, office screens. If it's not named, don't use it there.
• Pick an expiration. A date ("three years from signing") or event ("when the practice stops offering this service").
• Check the background. Other patients in the waiting room, a monitor showing a schedule, a whiteboard with names. Reshoot rather than blur where you can.
• Minors and personal representatives. A parent or guardian signs, with a description of their authority, as 164.508(c)(1)(vi) requires.
• Plan for revocation. A patient can revoke in writing at any time, except to the extent you've already acted in reliance. In practice, stop new uses and take the content down from channels you control.

Paid endorsers in video need the same clear disclosure as in text, and it should appear in the video itself, not only in a caption people may never expand.

Release form: the fields to include

These are the fields, not legal wording. Have your attorney review the final form.

Store the signed form with the content it covers, and log where each testimonial is published so you can take it down quickly if the patient revokes.

Where testimonials can appear: website, ads, social

Google's own review management page (opens in a new tab) suggests sharing links to positive reviews as testimonials. For a practice, the HIPAA analysis comes first: copying a review into your marketing needs the reviewer's authorization.

If you run Meta ads with Medfy's Meta ads add-on, ad copy is written for healthcare ad policies, and ad platforms never receive patient data. Testimonials still need your patients' signed authorizations before they appear in any ad. To see how your current site and ads look from the outside, start with a free marketing audit; for how Medfy stores patient information, see how Medfy handles patient data.

Testimonials sit next to reviews in the same rulebook. Incentives for reviews are covered in the review incentive rules, and the full picture in our guide to online reviews and reputation.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Do I need written permission to post a patient testimonial?

Yes. If the testimonial identifies a patient or shows that they received care from you, publishing it uses and discloses protected health information, and 45 CFR 164.508 requires a signed authorization with specific elements. A verbal yes, an email or a checkbox buried in intake paperwork isn't enough. Keep the signed form for six years from the date it was last in effect.

Can we share a Google review on our website or in ads?

Get a HIPAA authorization from the reviewer first. The review is theirs to post, but copying it into your own marketing confirms they're your patient and makes it a testimonial you're disseminating, which the FTC says makes you responsible for it. Linking to your Google profile, where patients read reviews in place, avoids copying anyone's words into your own ads.

Can therapists use client testimonials?

Very cautiously, if at all. The APA Ethics Code, Standard 5.05, says psychologists don't solicit testimonials from current therapy clients or others vulnerable to undue influence. The ACA Code of Ethics, C.3.b, says counselors don't solicit them from current or former clients or others who may be vulnerable to undue influence. State licensing boards may add limits, so check your board first.

Do testimonials need a 'results not typical' disclaimer?

Not that phrase. The FTC's Endorsement Guides say a testimonial about a key result will likely be read as typical. Unless you can back that up, the ad should clearly disclose the results patients can generally expect, and you need evidence for that figure too. 'Results not typical' alone doesn't tell anyone what to expect. Specialty codes, such as the ASPS code, add their own limits.