Reposting patient posts and tags: HIPAA and FTC rules

A patient posts a photo from the chair after a whitening appointment and tags the dental practice. A med spa client shares a video of their results and mentions the spa by name. A chiropractic patient writes a story about getting back to running and tags the clinic. Someone checks in at a physical therapy office and posts a selfie in the waiting room. The practice’s social media manager sees the notification and the obvious move is to repost, share to the practice story, or reply with thanks.

Each of those moves has the practice say something in public about a person it treats. This guide reads the HIPAA Privacy Rule provisions that decide whether a practice may do that, the FTC’s endorsement guides that apply once a patient post becomes practice advertising, and TikTok’s help page on its repost feature, and sets out a process a social media manager can follow. Replies to reviews are covered in our guides to patient review replies and HIPAA and negative review replies; consent for photos the practice takes itself in patient photo consent for marketing; and paid creators in healthcare influencer marketing.

The short version

• The patient can post; the practice is a different case. HIPAA’s use and disclosure limits in 45 CFR 164.502(a) apply to covered entities and business associates, not to patients talking about their own care.
• A repost tells the world this person is your patient. Under 45 CFR 160.103, information a provider created or received that relates to the provision of health care to an identifiable person is individually identifiable health information. Treat a repost, share, quote or reply that confirms the relationship as a disclosure.
• Get a written authorization first. 45 CFR 164.508(a)(1) bars uses and disclosures without a valid authorization unless the rule permits them, and 164.508(c) lists what the form must contain. A comment saying “feel free to share!” is not that form.
• Once reposted, it is your ad. 16 CFR 255.0(b) defines an endorsement to include tags in social media posts. Under 255.2(a), the practice needs the same support for claims made through a patient’s post as if it made them directly.
• Disclose anything you gave. If the patient got a discount, a free service, a raffle entry or a gift for posting or tagging, 16 CFR 255.5 requires clear and conspicuous disclosure of that connection, including in the repost.
• Likes and replies count too. A reply that names a treatment or a visit confirms the relationship as much as a repost does.

Why the patient’s post does not make yours safe

HIPAA regulates covered entities. 45 CFR 164.502(a) says a covered entity or business associate may not use or disclose protected health information except as the Privacy Rule permits or requires. A patient who posts about their own treatment is not a covered entity and is not bound by that sentence. The practice is.

The definitions in 45 CFR 160.103 explain why the practice’s repost is a different act. Individually identifiable health information is information, including demographic information, that is created or received by a health care provider, relates to the provision of health care to an individual, and identifies the individual or could reasonably be used to identify them. Protected health information is individually identifiable health information transmitted or maintained in any form or medium, with narrow exclusions. Disclosure means the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding it.

The practice knows this person is a patient because it treated them and holds their records. When the practice account reposts a patient’s photo, quotes their story, or replies “So glad your crown feels good!”, it releases that knowledge, under its own name, to everyone who follows the practice. The patient chose to tell their followers. The practice account’s audience is different, the post now carries the practice’s confirmation, and a reply can add details the patient did not share. Whether or not a particular repost would be treated as a violation, the safe reading of the definitions is that the practice is the one disclosing, so it needs a basis in the rule to do it.

The bases in 164.502(a)(1) include disclosures to the individual, for treatment, payment or health care operations under 164.506, and under a valid authorization under 164.508. Promoting the practice to the public is not treatment, and our HIPAA marketing rules guide explains why practices treat marketing uses as needing authorization. For a repost, the authorization route is the one that fits.

What a valid authorization needs

45 CFR 164.508(a)(1) says that, except as otherwise permitted or required, a covered entity may not use or disclose protected health information without a valid authorization, and that when it has one, the use or disclosure must be consistent with it. Under 164.508(c)(1), the core elements are:

• A specific and meaningful description of the information to be used or disclosed, such as the patient’s post of a named date, their name and handle, and the fact that they are a patient.
• Who is authorized to make the disclosure: the practice.
• Who the disclosure may go to: for social media, the public on named platforms.
• A description of each purpose, such as reposting on the practice’s Instagram and Facebook accounts.
• An expiration date or event.
• The patient’s signature and the date, with a description of authority when a personal representative signs.

164.508(c)(2) adds required statements, including the right to revoke in writing, and 164.508(b)(5) lets a patient revoke at any time in writing, except to the extent the practice has already acted in reliance on it. A revocation does not pull back what other users already saved or shared, which is worth saying in plain words on the form. Our photo consent guide covers how to set up and store marketing authorizations, minors and other people in the frame.

A practical process: when a patient tags the practice, do not repost, like or reply with treatment details. Send a private message that thanks them and asks whether they would like the practice to share it, with a link to the authorization form. Repost only after the signed form is on file, and only the post the form describes.

Likes, replies and comments

The same reasoning applies to smaller acts. A heart or like from the practice account on a post that says “Finally got my implants at [Practice]” is visible confirmation from the practice. A reply that thanks the patient for coming in, names the procedure or wishes them a good recovery says more. The patient review cases in our HIPAA and negative review replies guide show how replies to patients online have led to enforcement.

Two habits keep the practice account safe without ignoring people:

• Reply without confirming. “Thank you for the kind words. We love hearing from our community.” works whether or not the person is a patient. Do not name a provider, a treatment, a date or an outcome.
• Move the conversation private. If the person needs something, ask them to call or message the practice. Clinical questions do not get answered in comments.

Platforms differ in how far a repost travels and who can respond to it. TikTok’s support page says reposted content is labeled with the profile photo and nickname of the person who reposted it, that on a public account reposted content, repost text and repost replies are visible in the profile, that people who can see the repost can reply to it, and that comment privacy settings do not apply to repost replies. A TikTok repost from a practice account can draw public replies that the practice’s usual comment filters will not catch.

When a repost becomes advertising

The FTC’s endorsement guides apply once the practice uses a patient’s post to promote itself. 16 CFR 255.0(b) defines an endorsement as an advertising, marketing or promotional message that consumers are likely to believe reflects the opinions, beliefs, findings or experiences of a party other than the advertiser, and names tags in social media posts among the forms an endorsement can take. 255.0(d) says product includes a service, brand or company, so a practice is covered.

• Claims need support. Under 255.2(a), an ad that uses consumer endorsements about performance is read as saying the service works for that purpose, the advertiser needs adequate substantiation, including competent and reliable scientific evidence when appropriate, and consumer endorsements are not themselves that evidence. A patient’s “my back pain is gone” reposted by a chiropractic clinic is a claim the clinic has to be able to support.
• Results imply typical. Under 255.2(b), an endorsement about a key attribute will likely be read as representative of what consumers generally achieve. If the practice cannot support that, the ad should clearly and conspicuously disclose the generally expected results.
• No cherry-picking that distorts. 255.2(d) says that in procuring, publishing, boosting or organizing consumer reviews, advertisers should not take actions that distort what consumers think of their products. Reposting only the glowing posts is not barred as such, but presenting them as representative of all patient feedback is the kind of distortion the section describes.
• Old posts. 255.1(h) Example 1(ii) says a historic endorsement can stay up if its date is clear, but if the advertiser shares it later, viewers would expect the endorser still holds those views, and the advertiser would need to confirm that. Reposting a patient’s year-old post about a service you have since changed needs a fresh check.

Claims rules for testimonials and before-and-after images are covered in patient testimonials and before and after photos.

Incentives, giveaways and tagged contests

A common promotion is “Tag us in your post and get entered to win” or “Post your results and get a discount on your next visit.” Under 16 CFR 255.5(a), a connection between the endorser and the advertiser that the audience would not expect, and that might materially affect the weight given to the endorsement, must be disclosed clearly and conspicuously. 255.5(b) Example 9 describes a program that awards points for social posts about an advertiser that can be exchanged for prizes, and says those incentives should be disclosed and the advertiser should take steps to make sure the disclosures are given.

When the practice then reposts an incentivized patient post, 255.5(b) Example 3 is close on point. It describes a laser vision clinic that reposts a social media post by an athlete it has a relationship with, where the original post had no clear disclosure, and says the clinic should clearly and conspicuously disclose its relationship to the athlete in its repost. The same applies to a patient who got something of value: the repost needs a disclosure the viewer can see without clicking through.

Two more limits. 255.2(d) speaks to how reviews are procured, and a giveaway open only to people who post positive content steers what gets posted. And for patients in federal health care programs, a gift tied to posting raises a separate question under the federal rules on patient inducements, covered in our patient loyalty and rewards programs guide.

A repost checklist for the social media manager

1. Do not react publicly yet. No repost, share, like or reply that confirms the person is a patient.
2. Message privately. Thank them and ask if they would like the practice to share it. Link the authorization form.
3. Check the signed form. It names the post, the platforms, the purpose and an expiration, and it is signed and dated.
4. Check the post itself. Other people in the frame, visible charts or screens, location tags, names of staff. Crop or skip.
5. Check the claims. Results or outcomes need support and, if not typical, a disclosure of generally expected results.
6. Check for incentives. If the patient got anything for posting, add a clear disclosure in the repost.
7. Post and log it. Keep the authorization, a copy of the original post, the repost and the date.
8. Honor revocations. Take the repost down when a written revocation arrives, and note the date.

Use and avoid

• Use: a private message asking permission, with the authorization form. Avoid: reposting first and asking later.
• Use: “Thank you for the kind words!” as a public reply. Avoid: “So glad your knee surgery went well, see you at your follow-up!”
• Use: a repost with a visible line such as “This patient received a discount on a future visit for sharing.” when that is true. Avoid: a tag-to-win contest with no disclosure on the entries or the reposts.
• Use: a check that a reposted result is typical, or a disclosure of generally expected results. Avoid: resharing the most dramatic result as if it were normal.
• Use: a dated authorization on file for each reposted post. Avoid: a team chat screenshot of a comment that said “sure, share it.”

An illustration

This is a made-up example, not a client. A med spa runs a monthly “tag us to win a facial” contest. A client posts a lip filler result, tags the spa and mentions the injector by name. The spa’s account likes it, reposts it to its story with “Look at these results!” and replies “Loved working with you, see you for your touch-up in March.”

The fix: the spa unlikes and removes the repost and edits the reply to a neutral thank you, then messages the client privately to ask whether they would like the spa to share the post, with the authorization form. If they sign, the repost carries a clear line that the client was entered in a giveaway for posting, the spa checks that “these results” are not presented as typical without support, and the contest rules and each entry get their own disclosure. The authorization, both posts and the date go in the marketing file.

How we help

We run social media alongside search, Google Ads and lead generation for independent practices, with reply templates and repost steps written against the rules as read on the day, and we can set up an AI front desk that sends the authorization form when a patient agrees to be featured. We do not describe any of our services as HIPAA compliant, and we are not a law firm. Related guides: healthcare social media policy, TikTok for medical practices and our guide to healthcare marketing rules.

Sources

• 45 CFR 160.103: Definitions
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 16 CFR Part 255: Guides Concerning the Use of Endorsements and Testimonials in Advertising
• TikTok Support: Repost

More in Healthcare marketing rules