Social media policy for a medical practice

Practice social media problems often do not start with a marketing plan. They can start with a front desk employee answering an angry review late at night, a hygienist posting a before and after photo from their own phone, or a friend of the owner leaving a glowing review without saying who they are. A written social media policy is how a practice decides these things once, in a calm moment, instead of in the comment box.

This guide covers what a practice social media policy should address and why: patient information, photos and video, replies to reviews and comments, staff personal accounts, employees and relatives who review or promote the practice, paid creators and influencers, and the training and follow-up that make the policy real. A short sample policy outline is at the end. If your team wants to stream or film procedures, see our guide to livestreaming procedures and patient care. Calls and messages from reporters are covered in our guide to HIPAA and media inquiries about patients. Owners and staff posting about the practice on Reddit, forums or Wikipedia are covered in our guide to staff posting on Reddit, forums and Wikipedia. If your website blog takes comments, our guide to blog comments on a practice website covers patient posts, replies and moderation rules. What TikTok allows practices and paid creators to post is in our guide to TikTok for medical practices. For ad and paid post rules on X, see our guide to X (formerly Twitter) for medical practices. For platform rules on two newer apps, see our guide to Threads and Bluesky for medical practices.

This is general information for practice owners, not legal advice. HIPAA applies to covered entities, which include health care providers that transmit health information electronically in standard transactions such as insurance claims, and state law can add stricter rules. The employee posting, labor law and training sections were updated on November 1, 2026, with 16 CFR Part 255 and 45 CFR 164.530 checked in the eCFR version up to date as of October 29, 2026, the FTC staff guidance FTC’s Endorsement Guides: What People Are Asking (June 2023) read through an archived copy captured October 27, 2026, 29 USC 152, 157 and 158 on Cornell’s Legal Information Institute, and the NLRB page on interfering with employee rights, all read that day. Have your privacy officer or a healthcare attorney review your policy before you adopt it. Every rule below links to its primary source in the list at the end.

Why a practice needs a written policy

Two sets of federal rules meet on a practice’s social media accounts. The HIPAA Privacy Rule controls what the practice and its workforce may disclose about patients. The FTC Act, through the Endorsement Guides in 16 CFR Part 255 and the consumer review rule in 16 CFR Part 465, controls how the practice uses reviews, testimonials and people who promote it.

Both put weight on what the business does to guide its people, not only on what each person posts:

HIPAA requires written policies, training and sanctions. Under 45 CFR 164.530, a covered entity must train its workforce on its privacy policies and procedures as needed for their jobs, and must have and apply appropriate sanctions against workforce members who do not follow them.
The FTC expects guidance and monitoring. Section 255.1(d) says advertisers can be liable for misleading endorsements and for undisclosed connections with their endorsers, and that they should give endorsers guidance, monitor compliance and act to fix problems. The FTC says this is not a safe harbor, but that good faith guidance, monitoring and remedial action should reduce deceptive claims and the odds of enforcement.

A social media policy is the document that does this for your accounts. It also gives staff a clear answer when a patient asks them to post something, or when they are not sure whether a photo is fine.

Patient information: the default is no

The simplest rule for a practice account is that it does not confirm, deny or discuss any person’s care. That covers posts, replies, comments, direct messages that get screenshotted, and stories. Under HIPAA, the fact that someone is your patient is itself protected health information when it is tied to your practice.

The Office for Civil Rights (OCR) at HHS has enforced this against practices that replied to online reviews. In December 2022 OCR announced that New Vision Dental in California paid $23,000 and agreed to a corrective action plan after disclosing patient information in responses to online reviews. OCR described this as an inappropriate use of social media to respond to patient reviews, and its 2019 announcement about Elite Dental Associates in Dallas describes a similar case involving Yelp replies.

Your policy should say plainly that staff never post anything about a patient, including:

Names, initials, nicknames or tagged accounts of patients
Appointment details, procedures, diagnoses, treatment plans or outcomes
Photos or video where a patient, a chart, a schedule screen or an X-ray could be seen, even in the background
Stories about “a patient today” that people in a small town could easily connect to a real person
Replies that confirm someone is a patient, even to correct something they posted

Our guide to replying to patient reviews has reply templates that answer without confirming anyone is a patient.

Patient photos, video and testimonials

Before and after photos, patient stories and video testimonials are some of the most effective content a practice can post, and they are also where the HIPAA marketing rules come in. Full face photographs and comparable images are on HIPAA’s list of identifiers in 45 CFR 164.514(b), and using a patient’s information to promote the practice’s own services generally falls under the Privacy Rule’s definition of marketing.

For marketing uses, HIPAA requires the patient’s written authorization meeting 45 CFR 164.508, which includes a description of the information, who may use it, the purpose, an expiration date or event, the patient’s signature and their right to revoke. A verbal “sure, post it” or a general consent form signed at the first visit is not the same thing. Our article on HIPAA marketing rules walks through the required elements.

The FTC rules apply to the same content from a different angle. Under 16 CFR 255.2, a testimonial about a key result will usually be read as typical. If you do not have support that the result is what patients generally get, the ad should clearly disclose what results patients can generally expect. Patient testimonials are not a substitute for evidence when a post makes a claim about what a treatment does.

Your policy should state who collects authorizations, where they are stored, how long they last, and how a revocation is handled, including taking down posts that use the patient’s images. For med spa and aesthetic practices, where photo content is central, see our notes on med spa website design.

Replies to reviews and comments

Replies are where the most enforcement has happened, because they are written quickly and often by someone who is upset. Your policy should cover:

Who may reply. Name one or two people who reply on behalf of the practice. Everyone else flags the review and does not respond, including from personal accounts.
What a reply may say. Thank the person, state the practice’s general commitment, and invite them to call the office. Never confirm they are a patient or discuss their care.
When to wait. A reply to a hostile review is reviewed by a second person or written the next morning.
What is never done. No offering refunds, discounts or gifts in exchange for posting, removing or changing a review, and no flagging honest negative reviews as a way to bury them.

The last point comes from the FTC review rule. Under 16 CFR 465.4, a business may not offer compensation or other incentives conditioned on reviews expressing a particular sentiment. Section 255.2(d) of the Endorsement Guides also says advertisers should not procure, suppress, boost, edit or report reviews in ways that distort what consumers think of them. Asking every patient for honest feedback is fine. Asking only happy patients, or rewarding five-star reviews, is not.

Staff personal accounts

Employees have their own social media lives and a policy should not try to control everything they post. It should make clear where the practice’s interests begin:

Patients are off limits everywhere. The HIPAA rules on patient information apply to workforce members on their personal accounts too. A personal post about “the patient who came in today” is the same disclosure as a post from the practice page.
No posting from clinical areas. Photos and video in operatories, treatment rooms or at the front desk are where patient information leaks by accident.
Speaking for the practice. Staff should not present personal posts as the practice’s official position or answer patient questions about care in comments.
Workplace concerns. Do not write a rule that bans all criticism of the practice. The labor law reasons are in the section on workplace speech below; have your attorney check this part of the policy.

When staff, family or friends promote the practice

Practices often ask employees to share posts, leave a review or tell friends about a new service. The FTC rules treat these people as having a material connection to the practice, and that connection has to be disclosed when the audience would not expect it.

Material connections must be disclosed. Under 16 CFR 255.5, a business, family or personal relationship, payment, or free or discounted services can be a material connection that must be disclosed clearly and conspicuously. The Guides give the example of an employee posting about their employer’s product in an online community, and say the employee should disclose the relationship and the employer should train employees.
Owners and managers writing reviews. Under 16 CFR 465.5(a), an officer or manager may not write a review or testimonial of their own business without clearly disclosing their relationship to it.
Asking staff and relatives for reviews. Section 465.5(c) makes it a violation for an officer or manager to ask employees, agents or their own immediate relatives for reviews when the resulting reviews do not disclose the relationship and the manager discouraged disclosure, did not tell them to disclose, or knew or should have known a review appeared without one and did not fix it.
Testimonials from staff. Under 465.5(b), a business may not publish a testimonial from its officers, managers, employees or agents without a clear disclosure of the relationship when it is not already clear to the audience.

The practical rule for your policy: if staff or relatives post about the practice, they say they work there or are related to the owner, in the post itself, every time. The simplest approach is to not ask employees or family for public reviews at all.

Employee posts: what the FTC staff guidance adds

The FTC staff FAQ on the endorsement guides has a section on employee endorsements. It is staff guidance, which the FTC says is not binding on the Commission, but it answers several practical questions directly:

A profile line is not a disclosure. The FAQ says listing your employer on your profile page is not enough, because people who just read the post will not see it, and even those who do might not connect the employer with what is being promoted.
Shares can need a disclosure too. For employees who share a company post on their own initiative, the FAQ says the answer depends on whether the share could be viewed as promoting the company’s products or services. If so, the employee should disclose the relationship, for example “Check out my company’s great new product.”
Reviews on review sites always need one. The FAQ says people reading a review probably will not know who the reviewer is or where they work, so an employee should definitely disclose the employment relationship when reviewing the employer on a site that features consumer reviews.
Use words, not a hashtag code. The FAQ says consumers will likely not understand “#employee” and would more likely understand “I work for XYZ,” and that it is clearer still to say “my employer’s” or “my company’s” in the body of the message. For a practice that means “I work at [practice name]” in the post or caption.
What the practice owes. The FAQ says it would not be reasonable to expect an employer to monitor every post by every employee, but the employer should have a formal program that reminds employees of the policy periodically, and should ask employees to remove or properly disclose reviews it learns about. If the employer actively encouraged employees to write reviews, it is responsible for monitoring them, both for disclosure and for problematic claims.

Those answers rest on the guides themselves: 16 CFR 255.5(b), Example 8, says an employee promoting the employer’s product in an online community should disclose the relationship, that the same applies to employees posting reviews on retail sites or review platforms, and that the employer should train employees and, where it directs the posts or has reason to know of them, monitor them.

Workplace speech: what the labor law says

A social media policy is also a work rule, so federal labor law reads it too. Section 7 of the National Labor Relations Act, 29 USC 157, gives employees the right to self-organization and to engage in “other concerted activities for the purpose of collective bargaining or other mutual aid or protection.” The text is not limited to union activity. Under 29 USC 158(a)(1), it is an unfair labor practice for an employer to interfere with, restrain or coerce employees in the exercise of those rights. The NLRB’s page on interfering with employee rights lists, among the things an employer may not do, promulgating, maintaining or enforcing work rules that reasonably tend to inhibit employees from exercising their rights under the Act.

Two definitions in 29 USC 152 matter for a practice. Section 152(3) excludes from “employee” anyone employed as a supervisor and anyone with the status of an independent contractor, and 152(11) defines a supervisor by authority, used with independent judgment, to hire, discipline, assign or responsibly direct other employees, or to effectively recommend those actions. So whether a given office manager or associate clinician is covered depends on their actual authority, not their title.

What that means for the policy, in practical terms:

Write rules about what you protect. Patient information, posting from clinical areas, speaking officially for the practice and undisclosed promotion each have a stated reason in the rules above.
Do not write a blanket ban. A rule against “negative comments about the practice” or “discussing pay or schedules online” reaches what employees discuss together about their working conditions.
Keep the patient line absolute. A post about working conditions still may not include anything about a patient. Say so in the policy and in training.
Send the draft to counsel. This guide reads the statute and one NLRB page. It does not cover Board decisions or state employee speech laws, which an employment attorney should apply to your wording.

Influencers, paid creators and partner posts

Aesthetic practices in particular work with local creators who receive a free or discounted treatment in exchange for posting about it. The FTC Endorsement Guides cover these arrangements directly:

Free or discounted services count as a material connection under 16 CFR 255.5, even if you do not require a post in return.
The disclosure must be clear and conspicuous in the post itself. The Guides give the example of an influencer who discloses only on their profile page and say that is not clear and conspicuous. They also say a platform’s built-in disclosure tool may not be enough if it is easy to miss.
If you repost a creator’s post on the practice account, the Guides’ example of a clinic reposting a paid athlete’s post says the clinic should disclose its relationship in the repost.
Claims the creator makes about results are your responsibility too. Under 255.1(d) the practice can be liable for misleading or unsubstantiated statements made through endorsements, so the creator should not say things your practice could not say itself.

Your policy should require a short written agreement for every creator arrangement that says what they receive, that they will disclose it in each post, what they may and may not claim, and that the practice will check posts and ask for corrections. The same patient authorization rules apply if the creator is also your patient and the practice uses their treatment photos.

Followers, likes and engagement

Buying followers, likes or views to make an account look more popular is now addressed in the FTC review rule. Under 16 CFR 465.8, it is a violation to buy or procure fake indicators of social media influence that the buyer knew or should have known were fake and that misrepresent influence or importance for a commercial purpose. Your policy can simply say the practice does not buy followers, likes, views or reviews, from any vendor, under any package name.

Ask any agency you hire how they grow your accounts. Under 255.1(f), agencies, review brokers and reputation management companies can also be liable for their role in deceptive endorsements, but the practice is still the advertiser.

Training, monitoring and what happens when something goes wrong

A policy that sits in a binder does not meet either set of rules. Build these into it:

Training at hire and when the policy changes. Under 45 CFR 164.530(b), HIPAA requires training for new workforce members within a reasonable time and when material changes to policies affect their functions, and the training must be documented.
One owner of the accounts. Keep practice account logins with the practice, not with one employee or a former agency, and remove access when someone leaves.
A regular check. Someone looks at the practice accounts, tagged posts and creator posts on a schedule and fixes missing disclosures or problem replies.
A takedown and report path. If a post discloses patient information, it comes down at once and goes to the privacy officer, who decides whether it is a breach that needs notification under the HIPAA Breach Notification Rule. Section 164.530(f) also requires the practice to mitigate, to the extent practicable, any harmful effect it knows of from a disclosure that violated its policies.
Consistent sanctions. Under 164.530(e), HIPAA requires appropriate sanctions for workforce members who violate privacy policies, and documentation of the sanctions applied.

Sample policy outline

Illustration only. This is an outline to adapt with your privacy officer and attorney, not a finished policy.

Scope: practice accounts, staff personal accounts when they mention the practice, and anyone paid or given services to post about the practice.
Patient information: never posted or confirmed anywhere, by anyone, including in replies.
Patient images and stories: used only with a signed HIPAA authorization on file, logged with its expiration, removed on revocation.
Reviews: all patients may be asked for honest reviews; no incentives tied to ratings; no review gating; only named staff reply, using approved templates.
Staff and relatives: disclose the relationship in any post or review about the practice; managers do not ask staff or relatives for reviews.
Creators: written agreement, disclosure in every post, no claims the practice could not make itself, posts checked.
Prohibited: buying followers, likes, views or reviews; posting from clinical areas; arguing with patients online.
Training and sanctions: training at hire and on changes, documented; sanctions applied consistently; incidents go to the privacy officer.

For how this fits with the rest of your marketing, see our healthcare marketing rules guide. If you want help setting up your Business Profile and review process, see our healthcare SEO service.

Frequently asked questions

Can a practice reply to a review if the patient already said they were a patient?

OCR has resolved cases against practices that disclosed patient information in review replies, including New Vision Dental in 2022. A patient sharing their own information does not give the practice permission to discuss their care. Reply without confirming they are a patient and invite them to contact the office.

Can we post before and after photos if the face is not shown?

Images can still identify a patient through tattoos, jewelry, captions or context. A practice can get a written HIPAA authorization for any patient image used in marketing, which also covers the case where the image turns out to be identifiable.

Can employees share the practice’s posts?

Yes, and the policy should say how. The FTC staff FAQ says whether a share needs a disclosure depends on whether it could be viewed as promoting the company’s services; if so, the employee should say they work there, for example “my practice” or “I work at [practice name].” A profile line listing the employer is not enough. A review of the practice written by an employee always needs the disclosure.

Do we need to disclose if a creator got a free treatment?

Yes, if their audience would not expect it. Under 16 CFR 255.5, free or discounted services are a material connection, and the disclosure belongs in the post itself, not only on their profile.

Can we offer a discount for leaving a review?

Offering anything in exchange for a positive review violates 16 CFR 465.4. Google goes further: its Maps contribution policy does not allow incentives such as payments, discounts or free services in exchange for posting any review, positive or not, and removes incentivized reviews. Ask for honest reviews without a reward.

Does HIPAA apply to staff personal accounts?

The Privacy Rule restricts what the covered entity and its workforce disclose about patients, and that does not change because the post is on a personal account. Your policy and training should say so directly.

Can our policy ban staff from criticizing the practice online?

A blanket ban is risky. Section 7 of the National Labor Relations Act, 29 USC 157, protects concerted activity for mutual aid or protection, and the NLRB says employers may not maintain work rules that reasonably tend to inhibit employees from exercising those rights. Supervisors and independent contractors are outside the Act’s definition of employee. Patient information stays off limits in any post. Have an employment attorney review the wording.

Do we have to monitor every employee’s personal account?

The FTC staff FAQ says it would not be reasonable to expect an employer to monitor every employee post, but the employer should remind staff of the policy periodically and fix posts it learns about. If the practice asked or encouraged staff to post or review, it is responsible for monitoring those posts.

For the rights side of what staff post, including songs, images and journal figures, see our copyright, music and image rights guide.

Social media policy for a medical or dental practice: what to cover and why