Most clinicians do not post because they are not sure what is allowed. This is the guide we use before a script is approved, written from the HHS marketing rule, not from a feeling.
The rule in one sentence
You may not use or disclose protected health information for marketing without a signed authorization from the patient, and a social post is marketing the moment it is public. That is the HHS marketing rule, stripped of its subclauses. Everything below is a way of never getting close to it.
The good news is that the content that actually builds a practice never needs to. Nobody books because they saw a stranger's chart. They book because a clinician answered the question they were too embarrassed to ask, calmly, in thirty seconds.
What counts as PHI in a post
Protected health information is any detail that could identify a patient and that relates to their care. In a caption or a clip that means more than names and faces. The list that catches people:
- A first name with a condition, a date or a location.
- A photo of a treatment room with a chart, a screen, a label or a whiteboard in frame.
- A "before and after" with a face, a tattoo, a piece of jewellery or a distinctive room behind it.
- A story about "a patient last week" that anyone in a small town could place.
- Replying to a review in a way that confirms the reviewer was ever a patient.
Changing a name is not de-identification. If someone who knows the patient could recognise the story, it is still PHI. The test is not "did I remove the name". The test is "could anyone place this person".
Consent that actually holds
If you do want to feature a patient, the only thing that works is a HIPAA authorization, in writing, that names what will be shared, where it will be posted, for how long, and that it can be revoked. A general consent to treatment does not cover it. A verbal yes in the chair does not cover it. A signed model release from a photographer does not cover it, because it is not a HIPAA document.
Keep the signed form with the post record, not in the chart. If the patient revokes, take the post down the same day and keep a note of the date. State advertising rules add their own layer for before and afters in aesthetics and dentistry; check yours before you rely on any of this.
The five safe formats
These are the formats that never start from a real case, which is why they can be filmed once and published daily.
The question answered. "Why do my gums bleed when I floss?" Explained the way you explain it in the room. No patient, no case, no risk. This is most of a good calendar.
The mechanism. What actually happens during a root canal, what a filler does at day three versus day fourteen, why cracking your own neck keeps the problem going. Anatomy and process, no people.
The red flag. When soreness is ordinary and when it is not. When a headache is a neck problem. What a cracked tooth feels like before it hurts. This format earns the most trust because it tells people when not to book.
The consultation, in advance. The questions worth asking before you choose an injector, what a good consultation refuses to sell you, what a first visit for a child is actually about. You are giving away the consult; that is the point.
The practice, not the patient. The room, the kit, the team, the day. Everything a nervous person wants to see before they walk in, with nothing about anyone who already did.
Before you post: the checklist
Run this on every piece before it goes out. In the content system it is run before a script is approved; by hand it takes a minute.
- Is there a person in this who is not on the team? If yes, stop and find the signed authorization.
- Is there a name, a date, a location or a condition attached to a story? If yes, it is a story about someone. Rewrite it as a question answered.
- Is there anything readable in the frame: a screen, a chart, a label, a form, a whiteboard? Reshoot or crop.
- Would anyone in your town be able to place this? If maybe, it is a no.
- Does a review reply confirm a visit? Thank them, invite a call, say nothing about care.
When to ask a lawyer
Before any before and after. Before any post that features a patient by arrangement, even a willing one. Before you run paid ads in a state with aesthetics or dental advertising rules you have not read this year. And any time a post has already gone out and one of the five checks above fails: take it down first, then ask.
None of this is legal advice, and it is not a substitute for a healthcare attorney who knows your state. It is the checklist we run, written down so you can run it too.