QR codes in practice print ads: the rules

A QR code is the easiest way to connect a printed piece to a web page: a postcard, a waiting room poster, a flyer at a health fair, a print ad in a local magazine or the back of a business card. For a practice it also looks like a neat way to save space. The fine print, the offer terms and the disclaimer can live on the page behind the code, and the printed piece can stay clean. That is the part the rules do not allow, and it is not the only place a QR code can cause trouble.

This guide is for owners and managers of independent practices, dental offices, med spas, chiropractic and integrative clinics. It covers which disclosures must stay on the printed piece, what the page behind the code has to say, how to track a print campaign without sending patient data to analytics tools, QR code fraud, accessibility, and review requests by QR code in the office. For the print pieces themselves, see our guides to direct mail and printed newsletters and billboard advertising. For the rest of what goes on waiting room walls and screens, including sponsored content and patient names, see our waiting room screens and in-office marketing guide. Hand-delivered flyers, door hangers and neighborhood app posts are covered in our guide to door hangers, flyers and neighborhood apps.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: the FTC guidance .com Disclosures (March 2013), Florida Statutes section 456.062, 45 CFR 164.501, 45 CFR 84.84, 16 CFR 465.4, the HHS OCR bulletin on online tracking technologies with its June 2024 court notice, the FBI IC3 public service announcement on QR codes (January 18, 2022), the FTC consumer alert on QR codes (December 6, 2023), and Google’s help pages on campaign URLs, personal information in Analytics and Maps user contributed content. State advertising rules differ by profession and change, so check yours, and have a health care attorney review a print campaign that carries an offer, a price or a health claim before it goes to the printer.

The short version

The printed piece is the ad. The FTC Act covers advertising in print as it covers advertising online, and a disclosure that is needed to keep a claim from misleading belongs next to the claim, not behind a code.
State statements stay in print. Florida, for one, requires a 72-hour refusal statement in capital letters in any advertisement for a free or discounted service by a licensed practitioner. A QR code to a page that carries the statement does not put it in the ad.
The page behind the code must match the offer. Send the scan to a page about that offer, with the same terms, and plan for the day the offer ends, because printed codes stay in drawers and on walls.
Track the campaign, not the patient. Use campaign parameters that name the mailing or the poster. Do not put names, record numbers or other patient identifiers in the URL.
Use your own domain. A code that points to your website, or to a short link on a domain you control, keeps working when you change vendors and is easier for a patient to recognize.
Print the web address and phone number next to the code. A reader may not be able or willing to scan, and federal agencies warn people to check where a code leads before they trust it.
Review codes at the front desk follow Google’s rules. No incentives, no asking only happy patients, and no pressure to post while the patient is still in the office.

What a QR code is, in legal terms

A QR code is a printed link. Scanning it opens a web address, starts a phone call, opens a text message or does one of a few other things the code was set to do. Nothing about the code changes the legal status of the piece it is printed on. A postcard that promotes a treatment is an advertisement whether or not it carries a code, and the claims on it are judged by the same rules as any other ad for the practice.

The FTC said so directly in its guidance on online disclosures: the FTC Act’s ban on unfair or deceptive acts or practices is not limited to any particular medium, and it covers advertising in print, television, telephone and radio as well as online. State licensing board rules on advertising, such as the Texas Medical Board’s rule on misleading or deceptive advertising at 22 Texas Administrative Code section 164.3, likewise apply to the piece in the patient’s hand.

Required disclosures stay on the printed piece

The tempting layout puts a big headline and a code on the front, and the details on the web page. The FTC’s .com Disclosures guidance addresses that pattern for hyperlinks, and a QR code works like one. The guidance says that disclosures that are an integral part of a claim, or inseparable from it, should not be communicated through a hyperlink. They belong on the same page and next to the claim, prominent enough that the claim and the disclosure are read together. The FTC said this is particularly true for cost information and for certain health and safety disclosures.

A hyperlink at least sits on the screen the reader is already using. A QR code asks the reader to pick up a phone, open the camera and scan, and a reader who skips that step sees only the front of the card. If the headline needs a qualifier to be true, such as an exclusion, a condition, a price that only applies to new patients, or a note that results vary, put the qualifier on the card next to the headline.

State law can require specific words in the ad itself. Florida section 456.062 says that in any advertisement for a free, discounted fee or reduced fee service, examination or treatment by a practitioner licensed under the chapters it lists, a set statement shall appear in capital letters clearly distinguishable from the rest of the text. The statement tells the patient that they, and anyone responsible for payment, have a right to refuse to pay for, cancel payment for, or be reimbursed for any other service performed as a result of and within 72 hours of responding to the ad. The statute has an exception for a classified directory whose primary purpose is offering free, reduced or discounted products and services, where the statement appears prominently at least once. A practice postcard or poster is not that kind of directory.

Other states set their own content rules for health care ads, from the license type to the name of the practitioner. Check yours before you trust the page behind the code to carry anything the law says the ad must say.

The page behind the code must match the offer

A scan that lands on the home page makes the patient hunt for the offer, and a page that describes the offer differently from the card invites the question of which version is true. Point the code at a page built for that piece, with the same service, the same price or discount, the same dates and the same exclusions. Our landing page guide covers what that page should show.

Printed codes outlive campaigns. A postcard sits on a refrigerator for months, and a poster stays up until someone takes it down. When an offer ends, do not let the code lead to an error page or quietly to a different deal. Keep the page live with a short note that the offer has ended, the date it ended, and what the patient can do now. If you reuse the same page for a new offer, check that no printed piece still in circulation promises the old terms.

Tracking a print campaign without collecting patient data

To count the visits a mailer or poster brought in, add campaign parameters to the web address in the code. Google’s Analytics help explains that the utm parameters added to a destination URL, such as utm_source, utm_medium and utm_campaign, are sent to Analytics when someone follows the link, and show in the traffic acquisition report. A code on a spring postcard might carry utm_source=postcard, utm_medium=print and utm_campaign=spring-checkup. A second version of the card can use utm_content to tell the two designs apart.

Those values have to describe the campaign, never the person. Google’s Analytics help says Google policies mandate that no data be passed to Google that Google could use or recognize as personally identifiable information, that both the URL path and its parameters must be free of it, and that campaign dimensions such as source, medium and campaign are among the places to take special care. A mailing to your own patients with one unique code per patient, carrying a record number or a name, would put a patient identifier into the URL of a page that analytics and ad tags read.

HIPAA adds its own layer for covered entities. The HHS Office for Civil Rights bulletin on online tracking technologies explains how HIPAA applies to tracking tools on covered entity websites. A federal court in Texas vacated part of that bulletin on June 20, 2024, the part dealing with tools that connect an IP address to a visit to an unauthenticated public page about specific health conditions or health care providers, and HHS says it is evaluating its next steps. Our tracking pixels guide explains what remains and what it means for a practice website. For print codes, the safe pattern is one code per piece or per design, not per patient, and no tags on the page that share more than the campaign values.

Mailers to your own patients are a HIPAA marketing question first

Before the code, there is the list. HIPAA defines marketing, with exceptions, as a communication about a product or service that encourages the recipient to purchase or use it. A postcard to your patient list promoting a treatment can fall inside that definition, and whether it needs the patient’s written authorization depends on the exceptions and on whether anyone pays the practice to send it. Our direct mail guide walks through those rules, what can show on the outside of a mailer, and how to stop mail when a patient asks.

Short links, redirects and the life of a printed code

Code generators offer two kinds of code. A static code stores the web address itself. A dynamic code stores a short link on the generator’s own domain, which then redirects to your page, so you can change the destination later or see scan counts in the vendor’s dashboard. The redirect is convenient, and it also means the printed code depends on that vendor keeping your account and its service running. If the account lapses, the codes on your printed pieces stop where the vendor’s redirect stops.

A practical middle path: point the code at a short address on your own domain, such as yourpractice.com/spring, and set the redirect on your website. You can change the destination when the campaign changes, the scan counts show in your own analytics through the campaign parameters, and a patient who checks the address before opening it, as federal agencies advise, sees your name rather than an unfamiliar domain.

Test the printed proof, not the screen file. Scan it with more than one phone, in the light it will hang in, at the size it will be printed, and from the distance a reader will stand. A code printed on a glossy curved surface or behind glass on a poster frame can fail where the PDF worked.

QR code fraud: stickers over your codes

The FBI’s Internet Crime Complaint Center warned in January 2022 that criminals tamper with physical QR codes, placing a malicious code over the real one, to send people to sites that steal login and financial details or to redirect payments. Its advice to the public includes checking the web address after scanning, watching for a sticker placed on top of an original code, and avoiding payments through a site reached from a QR code, entering a known and trusted address instead. The FTC’s consumer alert of December 2023 describes scammers covering codes on parking meters and urges people to inspect the address before opening it.

For a practice, that advice points to three habits. Check posters and signs in public spaces, such as a lobby shared with other tenants or a board at a community event, for a sticker over your code. Print the web address in text so a patient can type it instead. And if your billing statements carry a code for online payment, print the payment address too, and tell patients in the same place how to reach the office by phone to confirm a bill, since the FBI tells people to avoid paying through a site reached from a code.

Accessibility: the code is not the only way in

A QR code needs a working camera, a steady hand and enough vision to aim it. A reader who is blind or has low vision, a reader with an older phone, and a reader who does not want to scan an unknown code all need another way to reach you. Print the web address in readable text next to the code, and the phone number for booking, so the offer works without the scan.

The page behind the code is web content, and federal accessibility rules can reach it. Under 45 CFR 84.84, recipients of federal financial assistance from HHS must make their web content and mobile apps meet WCAG 2.1 Level A and AA success criteria, beginning May 11, 2027 for recipients with fifteen or more employees and May 10, 2028 for recipients with fewer than fifteen, with limited exceptions. Ask your attorney whether your practice is a recipient. Our website accessibility guide covers the ADA side and a practical plan for the page itself.

QR codes for reviews in the office

A card at the front desk that opens your Google review form is a reasonable way to ask for reviews. Google’s Maps user contributed content policy sets the limits. It does not allow merchants to offer incentives, such as payment, discounts or free goods or services, in exchange for posting a review, or to discourage or prohibit negative reviews or selectively solicit positive ones. It also says that when soliciting reviews, merchants should not require or pressure users to leave ratings or write reviews while on the premises, nor request that specific content be included.

Federal rules point the same way. The FTC’s rule on consumer reviews, at 16 CFR 465.4, makes it an unfair or deceptive practice to provide compensation or other incentives in exchange for, or conditioned on, reviews expressing a particular sentiment, positive or negative. A sign that offers a discount for a five star review fails both. A card that invites each patient to share their experience, with no reward and no screening question first, fits the policy. For answering the reviews that come in, see our guide to patient review replies.

Codes that open a text or a call

A code can open a text message to your number with a keyword filled in, or start a phone call. The patient sends the first message, which makes this a clean way to start a conversation. What your practice sends back, and especially any marketing you send afterward, is governed by the texting and calling rules covered in our business texting guide. Say on the printed piece what the patient is signing up for if the keyword enrolls them in messages.

Questions to ask before a QR code goes to print

Does the printed piece carry each disclosure the claim needs, without the scan?
Does our state require a statement or other content in the ad itself, such as Florida’s 72-hour statement for free or discounted services?
Does the code lead to a page about this offer, with the same terms as the print?
What will the page say after the offer ends?
Do the campaign parameters describe only the piece, with no patient names, numbers or other identifiers?
Does the code point to our own domain, or to a vendor redirect we would lose if we left that vendor?
Is the web address printed in text next to the code, along with a phone number?
Did we scan the printed proof with more than one phone, at final size and in real light?
If the piece is a review card, does it avoid incentives, screening and pressure in the office?

Use and avoid

Use: “New patient exam, [amount], cleaning and X-rays included. Offer ends [date].” next to the code. Avoid: “New patient special, scan for details” with the price terms only on the web page.
Use: “Scan or visit yourpractice.com/spring” under the code. Avoid: a code with no text address at all.
Use: “Tell us about your visit” on a review card. Avoid: “Leave us five stars and get 10 percent off your next visit.”
Use: utm_campaign=spring-checkup on a mailer. Avoid: a parameter that carries the patient’s name, record number or date of birth.
Use: “This offer ended on [date]. Call [phone] to book a regular visit.” on an expired offer page. Avoid: a code that now opens an error page or a different promotion.

An illustration

This example is invented. [Practice name], a family dental office in [Town], plans a postcard to households nearby with a new patient offer and a QR code. The first draft has the headline “New patient special” and a code, with the price, the exclusions and the end date on the web page. Their reviewer moves the price, what the visit includes and the end date onto the card next to the headline, adds the web address and phone number in text under the code, and, because the office is in Florida, adds the 72-hour statement in capital letters on the card.

The code points to yourpractice.com/newpatient on the practice’s own domain, which redirects to the offer page with utm_source=postcard, utm_medium=print and utm_campaign=newpatient-fall. There is one code for the whole mailing. The offer page repeats the card’s terms word for word. When the offer ends, the page stays up with a note giving the end date and the office phone number.

Checklist

Each disclosure the headline needs is on the printed piece next to it.
State required statements are printed in the ad, in the form the law sets.
The code leads to a page about this offer, with the same terms.
The page has a plan for the day the offer ends.
Campaign parameters name the piece, never the patient.
The code points to our own domain or a redirect we control.
The web address and phone number are printed in text next to the code.
The printed proof was scanned with more than one phone at final size.
Codes in shared or public spaces are checked for stickers.
Review cards carry no incentive, no screening and no pressure to post on site.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For print campaigns, we build the offer pages and short addresses on your own domain that QR codes point to, set campaign tracking that names the piece and not the patient, and keep the page terms in step with what your attorney approves for print. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Can the disclaimer for a print ad be on the page the QR code opens?

Not when the disclaimer is needed to keep the printed claim from misleading. The FTC’s .com Disclosures guidance says disclosures integral to a claim should not be given through a hyperlink but placed next to the claim, particularly for cost and certain health and safety information. A QR code works like a link a reader may never open. State required statements, such as Florida’s 72-hour statement, also belong in the ad itself.

Can we track which patients scanned our mailer?

Track the mailing, not the patient. Google’s Analytics help says URL paths and parameters must be free of personally identifiable information, including campaign values. A unique code per patient that carries a name or record number would put a patient identifier into a URL that analytics and ad tools read. Use one code per mailing or design, and talk to your privacy officer and attorney before any per-patient approach.

Is it allowed to put a Google review QR code at the front desk?

Yes, within Google’s rules. Google does not allow incentives for reviews, discouraging negative reviews or selectively soliciting positive ones, and says merchants should not require or pressure people to leave reviews while on the premises. The FTC’s rule at 16 CFR 465.4 also bars incentives tied to a positive or negative review.

Do we need to print the web address next to the QR code?

We recommend it. No federal rule we found requires a text address on a print ad, but readers who cannot or will not scan need another way in, and the FBI advises people to check where a code leads and to type a known address rather than pay through a site reached from a code.

What happens to our QR codes if we stop paying the code generator?

If the code is a dynamic code that redirects through the vendor’s domain, it can stop working when the account or the service ends. A static code, or a code that points to a short address on your own domain with the redirect set on your website, keeps working as long as your site does.

QR codes on posters, mailers and print ads: rules for medical practices