Before and After Photo Rules for Health Practices

Why a verbal yes is not enough

A patient photo that shows a face, a distinctive tattoo, or anything else that identifies the person is protected health information the moment it sits in your chart or your camera roll. Using it to promote your practice is a marketing use.

Under 45 CFR 164.508, a covered entity must obtain the patient's written authorization before using or disclosing protected health information for marketing, with narrow exceptions for face-to-face communications and promotional gifts of nominal value. A gallery on your website, an Instagram carousel, and a paid ad all fall outside those exceptions.

If a third party pays you to feature the images, for example a device manufacturer or product brand, the authorization must also state that such remuneration is involved.

What a valid photo authorization must contain

The regulation is specific. A generic media release or a checkbox buried in intake paperwork usually misses required elements, which makes the authorization invalid and the use noncompliant.

Per 45 CFR 164.508, a valid authorization must be written in plain language, and you must give the patient a copy of what they signed.

• A specific description of the information to be used, for example pre-treatment and post-treatment photographs of the treated area
• Who is authorized to make the disclosure, typically your practice by name
• Who will receive the images, for example the practice website, social channels, and advertising
• The purpose of the use, stated plainly as marketing
• An expiration date or expiration event tied to the patient or the purpose
• The patient's signature and the date
• Required statements: the right to revoke in writing, that treatment cannot be conditioned on signing, and that disclosed information may be redisclosed and lose federal privacy protection

Platform policies restrict how the photos can run

A signed authorization gets you the legal right to use the images. It does not get the images approved as ads. Meta's health and wellness ad standards prohibit side-by-side weight loss comparisons after use of a product, with an exception for fitness classes, and its baseline rule is that ads must not imply or attempt to generate negative self-perception.

Cosmetic procedures get more room. Meta permits general cosmetic products, procedures, and surgeries depicting before and after transformation when the ad avoids negative self-perception tactics and targets people 18 or older. Skin anti-aging treatments such as wrinkle injectables may show zoomed or close-up images of results but should not use side-by-side comparisons.

The practical read: the same gallery image can be fine on your website, allowed as a cosmetic ad with 18+ targeting, and rejected as a weight loss ad. Build creative for the destination, not just the procedure.

What licensing boards expect

State licensing boards generally treat your gallery as advertising, and advertising rules vary by state and profession. Before publishing, pull your own board's advertising regulations and confirm three things: whether consent must be documented in a particular form, whether photos may be retouched or must be labeled if altered, and how long records of consent must be retained.

Two safe defaults apply everywhere. Do not alter images in ways that misrepresent results, and keep lighting, angle, distance, and framing consistent between the before and the after so the comparison is honest on its face.

The compliant gallery workflow

Treat photo consent as a standing clinical process, not a scramble when marketing asks for images. A repeatable workflow takes minutes per patient and removes the risk of publishing first and papering later.

One person should own the log. In a 5-provider practice, an unowned consent process fails quietly until a revocation request or a board inquiry finds the gap.

• Capture photos under a standard protocol: same room, same lighting, same distance and angle
• Present the marketing authorization as a separate document, signed before any marketing use, never bundled with treatment consent
• Give the patient a copy and file yours with the date and scope
• Log every place each image appears so a written revocation can be executed quickly
• Route ad creative through a platform-policy check before launch, especially anything touching weight loss
• Audit the gallery on a schedule and remove images with expired or revoked authorizations

The bottom line

Before and after photos are among the highest-converting assets a health and wellness practice owns, and they are also regulated on two fronts at once: federal privacy law on the consent side, platform policy on the distribution side. A one-page compliant authorization and a six-step workflow cover both.

If you want your gallery, ads, and consent process reviewed as one system that fills the calendar rather than a liability list, that is the kind of audit Rank & Rejuvenate runs for practice owners who would rather see booked appointments than marketing reports.