Medical practice press releases and privacy

A press release or a local news interview can put your practice in front of people who would never click an ad. It also creates three risks that ordinary marketing does not: saying something about a patient to a reporter, paying for coverage that looks independent, and distributing links that Google treats as spam. Each has a published rule or enforcement record behind it.

This guide covers what the HIPAA Privacy Rule allows when you talk to the media, five published HHS Office for Civil Rights (OCR) settlements that started with a press release, a reporter or a film crew, the FTC rules for paid placements and paid appearances, and what Google says about links in press releases. It ends with an illustration, a checklist and answers to the questions practice owners ask. When a reporter calls about a named patient, our guide to HIPAA and media inquiries about patients covers the facility directory rule and a front desk script. Before you turn coverage into an “as seen on” badge, see our guide to media badges on a practice website. For paid articles that run as features in a publication, see our guide to sponsored articles and advertorials.

This is general information, not legal advice. Sources cited were checked on October 29, 2026: 45 CFR 164.502, 164.508, 164.514 and 164.530; HHS press releases and OCR resolution agreements for New York and Presbyterian Hospital (April 21, 2016), Memorial Hermann Health System (May 10, 2017), Boston Medical Center, Brigham and Women’s Hospital and Massachusetts General Hospital (September 20, 2018), Allergy Associates of Hartford (November 26, 2018) and St. Joseph’s Medical Center (November 20, 2023); the FTC guide Native Advertising: A Guide for Businesses (December 2015); 16 CFR 255.1 and 255.5; 15 U.S.C. 45; the FTC Health Products Compliance Guidance (December 2022); and Google Search spam policies (last updated August 28, 2026). Rules change and state rules differ, so check current versions and ask a qualified health care attorney before you rely on any of this.

What HIPAA allows when you talk to the media

If your practice is a HIPAA covered entity, 45 CFR 164.502(a) says it may not use or disclose protected health information except as the Privacy Rule permits or requires. Talking to a reporter, writing a press release and letting a camera into the office are all disclosures if patient information is involved. Publicity is not one of the purposes the rule lets you disclose for without the patient’s permission, so the route that works is a written authorization under 45 CFR 164.508 that meets that section’s content requirements.

Removing the name does not make a story safe. Under 45 CFR 164.514(b)(2), information counts as de-identified by the safe harbor method only when a list of identifiers is removed, including names, geographic subdivisions smaller than a state, all elements of dates except the year that relate directly to the person, and full face photographs and comparable images, and only when the practice has no actual knowledge that what remains could identify the person. A story about “a local teacher in their forties who came in last Tuesday” can identify someone in a small town without any name at all.

Two more points from the rules shape media work. If a patient story is used to promote your services, it is also marketing under 45 CFR 164.501, which our guide to HIPAA marketing rules covers. And 45 CFR 164.530(e)(1) requires a covered entity to have and apply appropriate sanctions against workforce members who fail to comply with its privacy policies or the Privacy Rule. Two of the cases below cited a failure on sanctions as well as the disclosure itself.

Five published OCR cases involving the media

OCR announces only some of its resolutions, so these are the published examples we found, not a count of every case. Each was resolved by a resolution agreement and a corrective action plan. The agreements we read for Memorial Hermann, Allergy Associates and St. Joseph’s each state that the agreement is not an admission of liability.

New York and Presbyterian Hospital (announced April 21, 2016). The resolution agreement says OCR received a complaint alleging that on April 28, 2011, the hospital disclosed protected health information to a film crew and other staff of a television program being filmed in the hospital. HHS says the hospital agreed to pay $2.2 million to settle potential violations, specifically the impermissible disclosure of two patients’ protected health information to news media and the lack of appropriate safeguards, with a corrective action plan that includes two years of monitoring.

Memorial Hermann Health System (announced May 10, 2017). According to the HHS press release, a patient at one of the system’s clinics presented an allegedly fraudulent identification card in September 2015, staff alerted the authorities and the patient was arrested. HHS says that disclosure to law enforcement was permitted. The system then published a press release about the incident, and senior management approved adding the patient’s name to its title. The resolution agreement says the releases went to fifteen media outlets and/or reporters, that senior leaders disclosed the information again in three meetings with an advocacy group, state representatives and a state senator, and that a statement on the system’s website did the same, all without the patient’s written authorization. It also cites a failure to document sanctions in a timely way. The system agreed to pay $2.4 million and adopt a corrective action plan.

Boston Medical Center, Brigham and Women’s Hospital and Massachusetts General Hospital (announced September 20, 2018). HHS says the three hospitals compromised patients’ privacy by inviting film crews on the premises to film a television network documentary series without first obtaining authorization from patients. They paid $100,000, $384,000 and $515,000, a total of $999,000, and each agreed to workforce training that includes OCR’s guidance on disclosures to film and media.

Allergy Associates of Hartford (announced November 26, 2018). A practice of three doctors at four locations. According to the HHS press release, a patient contacted a local television station in February 2015 about a dispute with one of the practice’s doctors. The reporter contacted the doctor for comment, and the doctor disclosed the patient’s protected health information. OCR found the discussion demonstrated a reckless disregard for the patient’s privacy rights, and that it happened after the privacy officer had told the doctor to either not respond or respond with “no comment”. OCR also found the practice took no disciplinary or corrective action afterwards. The practice agreed to pay $125,000 and to a corrective action plan with two years of monitoring.

St. Joseph’s Medical Center (announced November 20, 2023). The resolution agreement says that on April 20, 2020, the hospital allowed a news reporter to observe three patients who were being treated for COVID, with access to the patients and their clinical information, without first obtaining valid authorizations. The hospital agreed to pay $80,000 and to a two year corrective action plan.

What the cases teach a practice

The patient going public first did not open the door. In the Allergy Associates case the patient contacted the station, and OCR still treated the doctor’s reply as an impermissible disclosure. OCR’s director said in the release that when a patient complains about a medical practice, doctors cannot respond by disclosing private patient information to the media. The same reasoning applies to online reviews, which our guide to HIPAA and negative review replies covers with three more settlements.

A permitted disclosure does not carry over to publicity. In the Memorial Hermann case, telling law enforcement was allowed and the press release was not. OCR’s director said organizations can cooperate with law enforcement without violating HIPAA, but must continue to protect patient privacy when making statements to the public.

Cameras and reporters in clinical areas need authorization from every patient who could be seen or heard, not only the one being featured. The HHS guidance on media and film crews, and how to plan a shoot around it, are covered in our guide to healthcare video marketing, so this guide does not repeat it.

Senior approval is not a defense. In the Memorial Hermann case it was senior management that approved the name in the title.

Writing a press release that stays inside the rules

The safest press releases are about the practice, not about a patient. Topics that need no patient information:

A new clinician joining, with their training and the services they offer.
A new location, extended hours, or a new service line.
A community event, a free public talk or a health fair you are hosting.
A recognition your practice received, described accurately. Our guide to top doctor awards in advertising covers paid and pay to display awards.
General education from a clinician, such as seasonal health advice, with the clinical content reviewed before release.

If a patient wants to share their story, get a written authorization under 45 CFR 164.508 that names the press release or interview as the purpose, before anything is drafted. Treat it the same way as a testimonial, which our guide to patient testimonials and before and after photos covers. Let the patient approve the final wording, and remember that a story you publish keeps circulating after the authorization is revoked.

Claims in a release are advertising claims. The FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce (15 U.S.C. 45), and while the FTC Health Products Compliance Guidance is written for health products, the same caution makes sense: the FTC approach generally requires that health-related claims be backed by competent and reliable scientific evidence. “First in the region” or “best outcomes” in a release needs the same support it would need in an ad.

Media interviews: one spokesperson and a holding line

The Allergy Associates case turned on a doctor answering a reporter after being told not to. A short written media policy reduces that risk:

Name one spokesperson and one backup. Every media call goes to them, including calls to clinicians’ personal phones about practice matters.
Have the privacy officer review any statement that touches a patient, a complaint or an incident before it goes out.
Keep a holding line that does not confirm or deny whether anyone is a patient, for example: “Privacy law does not allow us to discuss any individual. We are happy to talk about our policies in general.” Even confirming that someone is a patient tells a reporter something about them.
For general health topics, prepare two or three talking points and stay on them. Do not discuss “a patient I saw last week”, even without a name.
Train the team once a year and after any incident, and record the training. Apply and document sanctions when the policy is broken, as 45 CFR 164.530(e)(1) requires.

Paid placements, sponsored articles and paid appearances

Some coverage is bought: a sponsored article on a local news site, a paid segment on a morning show, a paid spot on a podcast. The FTC guide Native Advertising: A Guide for Businesses (December 2015) says a basic truth in advertising principle is that it is deceptive to mislead consumers about the commercial nature of content, and that ads are deceptive if they convey that they are independent, impartial, or from a source other than the sponsoring advertiser.

The guide says terms likely to be understood include “Ad”, “Advertisement”, “Paid Advertisement” and “Sponsored Advertising Content”. It says advertisers should not use “Promoted” or “Promoted Stories”, and that consumers may read “Sponsored by” or “Brought to you by” to mean the advertiser funded the content but did not create or influence it. It says consumers are most likely to notice disclosures placed immediately in front of or above a native ad’s headline. If you pay for an article that you or your agency wrote, “Sponsored by” alone may not tell readers that.

Paid appearances fall under the Endorsement Guides. 16 CFR 255.5 says a connection between an endorser and the seller that might materially affect the weight or credibility of the endorsement, and that the audience does not reasonably expect, must be disclosed clearly and conspicuously, and that connections can include payment, free or discounted products, and the chance to appear on television or in other media promotions. One of its examples is close to home: a well known athlete on a television talk show praises laser vision surgery at a named clinic without disclosing that the clinic pays them to speak about it. The FTC says that without a clear disclosure during the interview the endorsement is likely deceptive, and that a disclosure in the closing credits would not be clear and conspicuous.

16 CFR 255.1(d) adds that advertisers are subject to liability for misleading statements made through endorsements and for failing to disclose unexpected material connections, and says advertisers should guide their endorsers, monitor them and act on non-compliance. If you pay creators or patients to talk about you, our guide to healthcare influencer marketing covers the contract and disclosure details.

Press releases, links and search

Google’s spam policies, last updated August 28, 2026, list as link spam “links with optimized anchor text in articles, guest posts, or press releases distributed on other sites”, along with advertorials where payment is received for articles that include links that pass ranking credit. The same page says buying and selling links for advertising is not a violation as long as the links are qualified with rel=”nofollow” or rel=”sponsored”. It also says wire service or press release service sites are not considered inconsistent with its site reputation policy.

In practice, a distributed release is not a link building tool. Its value is in a reporter picking up the story and writing their own piece, a local outlet listing your event, or people searching your name and finding accurate news. Keep the link in a release to a plain link to your site or the relevant page, without keyword anchor text, and accept that a wire service may mark it nofollow anyway. Our healthcare SEO work focuses on your own pages and your Google Business Profile, where those searches land.

Illustration

Illustration: a three clinician family practice opens a second location. The press release announces the address, opening date, hours, the services offered and the clinician who will lead the site, with one quote from the practice owner about why they chose the neighborhood. It contains no patient names, photos or stories. A local TV reporter calls to ask about a patient who posted online that they were turned away. The front desk forwards the call to the practice manager, who is the named spokesperson. The manager uses the holding line, offers to explain the practice’s scheduling policy in general, and logs the call for the privacy officer. Later, a patient who has been treated at the practice offers to appear in a story about the new location. The practice gives them a written HIPAA authorization that names the story, lets them review the draft, and does not pay or discount anything in return. If it did, 16 CFR 255.5 would likely call for a clear disclosure.

Checklist

No patient names, photos, dates, places or stories in a release without a written 45 CFR 164.508 authorization for that purpose.
Remember that removing a name is not de-identification under 45 CFR 164.514(b)(2).
One named spokesperson, a holding line that does not confirm who is a patient, and privacy officer review before any statement about a patient or incident.
No reporters or cameras in clinical areas without authorization from every patient who could be seen or heard.
Sanctions applied and documented when the media policy is broken (45 CFR 164.530(e)(1)).
Claims in releases backed by evidence, held to the same standard as ads.
Paid articles labeled “Advertisement” or “Sponsored Advertising Content” above the headline, not “Promoted”.
Paid experts, patients or creators disclose the connection during the appearance, not in the credits (16 CFR 255.5).
Links in distributed releases plain, without keyword anchor text; paid links marked nofollow or sponsored.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices. Our healthcare SEO work makes sure that when a release or story sends people searching for your practice, they find accurate pages and a complete Google Business Profile, without paid link schemes. Our medical website design work can give you a simple news page for announcements that carry no patient information. We do not write statements about patients or incidents; your privacy officer and counsel do. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Frequently asked questions

Can a medical practice mention a patient in a press release?

Only with a written authorization from that patient under 45 CFR 164.508 that covers the release. In the Memorial Hermann case announced May 10, 2017, a patient’s name in the title of a press release led to a $2.4 million settlement. Removing the name is not enough if other details can identify the person (45 CFR 164.514(b)(2)).

A patient went to the media about us. Can we tell our side?

Not by disclosing their health information. In the Allergy Associates case announced November 26, 2018, the patient had contacted the station first, and OCR still found the doctor’s disclosure impermissible. You can describe your policies in general without confirming the person is a patient.

Can we let a reporter or film crew shadow our clinicians?

Only with prior written authorization from every patient who could be seen or heard. OCR has announced settlements with New York and Presbyterian Hospital (2016), three Boston hospitals (2018) and St. Joseph’s Medical Center (2023) over media access without authorization.

Do we have to label a sponsored article on a news site?

Yes, if it could be mistaken for independent content. The FTC native advertising guide says terms like “Advertisement” or “Sponsored Advertising Content” are likely to be understood, “Promoted” is not, and the label works best in front of or above the headline.

Do press releases help SEO?

Not through their links. Google’s spam policies list links with optimized anchor text in press releases distributed on other sites as link spam. The value comes from real coverage and from people who search your name finding accurate pages.

If we pay a doctor or patient to appear on a show, what must be disclosed?

16 CFR 255.5 says a material connection the audience does not expect, such as payment, must be disclosed clearly and conspicuously. Its own example says a disclosure only in the closing credits of a talk show would not be clear and conspicuous.

Medical practice press releases and media interviews: patient privacy, paid placements and links