Patient Testimonial Rules, Mapped by Platform

What does HIPAA require before you publish a testimonial?

A patient testimonial that identifies the patient or their care is a marketing use of protected health information. Under 45 CFR 164.508(a)(3), a covered entity "must obtain an authorization for any use or disclosure of protected health information for marketing." A verbal yes, a review the patient posted themselves, or a signature on your general intake consent does not satisfy this.

The authorization is a specific document with required elements under 164.508(c). It must identify the information "in a specific and meaningful fashion," name who may disclose and who may receive it, state each purpose, carry an expiration date or event, and be signed and dated by the patient. It must also state the right to revoke in writing and warn that disclosed information "may no longer be protected" once released.

Two narrow exceptions exist: face-to-face communications from the practice to the patient, and promotional gifts of nominal value. Neither covers a website, social post, or ad. If a third party pays you in connection with the marketing, the authorization must state that remuneration is involved.

• Specific description of the PHI being used, in plain language
• Who discloses, who receives, and each purpose of use
• Expiration date or event, signature, and date
• Right-to-revoke statement plus redisclosure warning
• A copy of the signed authorization goes to the patient

What do FTC endorsement rules add on top of HIPAA?

HIPAA governs whether you may use the patient's information. The FTC Endorsement Guides at 16 CFR Part 255 govern what the testimonial is allowed to claim. Under 255.1, endorsements must reflect the honest opinions and actual experience of the endorser. You cannot script a result the patient did not have, and you cannot edit their words into a stronger claim.

Section 255.2 covers consumer endorsements. A testimonial that features an outcome conveys that consumers can generally expect similar results, and you need substantiation for that implied claim. One exceptional recovery presented without context is a problem even if every word of it is true.

Section 255.5 requires disclosure of material connections. If the patient received anything of value, a discount, a free visit, a gift card, or is an employee or relative, that relationship must be disclosed clearly next to the testimonial.

Where do state licensing boards fit?

Federal rules are the floor, not the ceiling. Medical, dental, chiropractic, and therapy boards regulate advertising by their licensees, and several treat testimonials more strictly than the FTC does. Positions vary by state and by profession, from disclosure requirements to limits on testimonials that cannot be verified or that describe results.

Do not assume your neighbor state's rule is yours. Pull your own board's advertising regulation, read the testimonial and advertising sections, and keep a dated copy in your compliance file. When the board rule and the federal rule differ, follow the stricter one. If your board's language is ambiguous, a short written inquiry to board staff is cheap insurance.

What do platform policies prohibit?

Platforms enforce their own layer regardless of your legal paperwork. Google's user contributed content policy prohibits fake engagement, defined as content "not based on a real experience," and bars merchants from offering "payment, discounts, free goods and/or services" in exchange for posting or revising reviews. It also prohibits selectively soliciting positive reviews and reviews based on a conflict of interest, including "current or former employment" or other professional affiliations.

That means your staff, your contractors, and your marketing agency cannot review you on Google. It also means review gating, where only happy patients get the review link, violates the policy that already aligns with the FTC's position on incentivized endorsements. Other platforms publish comparable rules, so check the current policy for each channel where testimonials will appear.

One more distinction matters. A patient posting their own Google review is their speech, and no HIPAA authorization is needed. The moment you repost, quote, or respond in a way that confirms they were a patient, you have made a disclosure, and the HIPAA analysis starts over.

A one-page workflow that clears all four layers

Run every testimonial through the same gate before it goes live. The sequence takes minutes once the authorization template exists, and it removes the judgment calls that get practices in trouble.

Store the signed authorization, the source review or recording, and the published version together. If a patient revokes, you need to find and pull every placement quickly.

• Signed HIPAA authorization on file with all 164.508(c) elements
• Testimonial text matches the patient's actual words and experience
• Outcome claims are typical or carry a clear disclosure, with substantiation
• Any compensation, discount, or relationship disclosed next to the quote
• State board advertising rule checked for this profession, this state
• Placement complies with the specific platform's review policy
• Revocation procedure documented: who pulls it, from where, how fast