How long to keep advertising records at a medical practice: ad copies, substantiation files and consents

A licensing board writes to a practice about an ad that ran two years ago. A patient complaint, a competitor or a routine audit started it, and the letter asks for a copy of the ad as it ran, who approved it and what supported its claims. The practice changed its website since then, the agency that ran the ads has moved on, and the before and after photo consent sits in an old inbox. Keeping advertising records is dull work until the day someone asks for them, and then it decides whether the answer is a short reply or a long problem.

This guide is for owners, office managers and marketing staff at independent practices, dental offices, med spas, chiropractic and integrative clinics. It covers state board rules that set a period for keeping copies of ads, the FTC expectation that you hold evidence for a claim before it runs, HIPAA rules on keeping signed authorizations, Medicare Advantage record rules where they reach a provider, and what to put in the file for each ad. For the wider advertising rules, see our physician advertising rules guide, and for the evidence behind numbers, our guide to success rates and outcome claims.

The short version

• Certain boards set a period by rule. The Texas Medical Board asks for two years from the last date of communication, the Texas dental board four years after the final appearance, New Jersey’s medical board three years from the last authorized publication, and Virginia’s Board of Medicine two years for supporting documentation.
• The clock runs from the last use, not the first. In the Texas and New Jersey rules, the period starts when the ad last ran, so a homepage claim that stays up for years stays inside the window the whole time.
• The FTC expects the evidence first. Its 1984 substantiation statement says advertisers need a reasonable basis for objective claims before the claims are disseminated. Evidence gathered after a complaint does not replace it.
• For health claims, the file needs the studies and why they fit. FTC staff guidance expects competent and reliable scientific evidence, generally randomized controlled trials, that matches your product, dose and audience. Surveys, testimonials and practitioner observations do not count as proof.
• Signed HIPAA authorizations have their own period. A covered entity keeps them for six years from creation or the date last in effect, whichever is later.
• Medicare Advantage rules reach a provider in specific roles. A provider that contracts with a plan agrees to federal audit rights over related records for ten years, and a provider paid for lead generation or enrollment work can be a third-party marketing organization with call recording duties.
• Keep one file per ad. The final version as it ran, the dates, the placements, who approved it, the evidence for each claim and the consents behind any patient content.

Why a practice keeps advertising records at all

Three things come back to an old ad. A licensing board can open a complaint and ask what ran. The FTC can ask what supported a claim. A patient who appears in an ad can ask what they agreed to. In each case the question is about the past, and the answer depends on what the practice saved at the time.

Ads are also harder to recreate than they look. A search ad rotates headlines, a social post is edited after it goes up, a landing page changes each quarter, and a vendor account can close. Without a saved copy, the practice may not be able to show what a patient saw on a given date, even when the ad was accurate.

State board rules that set a retention period

Certain licensing boards write a retention period into their advertising rules. The four below are examples, checked on October 30, 2026, not a complete list. Other states and other boards (dental, chiropractic, nursing, podiatry) set their own rules or none, so look up the advertising rule for each license your practice holds.

• Texas Medical Board, 22 Tex. Admin. Code 164.2. A recording or copy of any advertisement must be retained by the physician for two years from the last date of communication. The same rule says patients must consent before any use of photographs or other representations in advertising by a physician, practice or entity, and it treats physicians in the practice as having reviewed and approved its advertisements. The rule was last amended effective January 9, 2025.
• Texas State Board of Dental Examiners, 22 Tex. Admin. Code 108.60. A pre-recorded copy of broadcast ads and a copy of print and electronic ads must be retained for four years following the final appearance or communication of the ad. If a dentist discovers an ad was false or misleading, the dentist documents the date of discovery and the date and substance of each corrective measure, and keeps that documentation for four years following the latest appearance of the ad. The advertising dentist must make copies available to the board on request. The rule took effect May 1, 2013.
• New Jersey Board of Medical Examiners, N.J. Admin. Code 13:35-6.10(k). A licensee retains a video or audio recording of each ad communicated by electronic media and a copy of each ad in print media, makes them available to the board on request, and keeps them for three years from the date of the last authorized publication or dissemination.
• Virginia Board of Medicine, 18VAC85-20-30. This chapter covers medicine, osteopathic medicine, podiatry and chiropractic. For an ad for a practice with more than one practitioner, the practice documents the name of the practitioner responsible for the content and keeps it for at least two years. Documentation, scientific and otherwise, supporting claims in an ad must be kept and available for the board’s review for at least two years.

Read these closely, because the details differ. Texas medical and New Jersey count from the last time the ad ran. Texas dental adds a record of corrections. Virginia asks for the evidence behind the claims and the name of the person responsible, not only a copy of the ad. A practice with offices in more than one state, or with both physicians and dentists, should follow the longest period that applies to each ad.

The FTC substantiation file

Section 5 of the FTC Act, 15 U.S.C. 45, makes unfair or deceptive acts or practices in or affecting commerce unlawful. The FTC Policy Statement Regarding Advertising Substantiation, dated November 23, 1984 and appended to the Thompson Medical decision, explains how the Commission applies that to claims. It says advertisers and ad agencies must have a reasonable basis for advertising claims before they are disseminated, and that failing to possess and rely on a reasonable basis for objective claims is an unfair and deceptive practice.

The statement lists the factors that decide how much evidence is enough: the type of claim, the product, the consequences of a false claim, the benefits of a truthful claim, the cost of developing substantiation, and the amount of substantiation experts in the field believe is reasonable. For a health claim, the consequences of a false claim weigh heavily. The statement also says the Commission can look at evidence gathered after a claim was made, but not as a substitute for the substantiation the advertiser had beforehand.

The statement does not set a period for keeping the evidence. What it sets is timing: the evidence has to exist, and be relied on, before the ad runs. In practice that means a dated file for each objective claim, built before launch, and kept at least as long as the claim runs and as long as any state rule that applies to you. Your attorney can tell you whether a longer period makes sense for your situation.

What goes in the substantiation file for a health claim

The 1984 statement sets the timing. For health claims, the FTC staff Health Products Compliance Guidance (December 2022) describes what the evidence should look like, and its questions make a good outline for the file. The guidance is written for health-related products such as supplements, devices and foods. Section 12 of the FTC Act, 15 U.S.C. 52, reaches false ads for services as well as products, so a practice that advertises what a treatment does can use the same outline.

1. List every claim the ad makes, including implied ones. The guidance says to judge an ad by its net impression, from the text, the product name and any charts or images together, and that when an ad has more than one reasonable interpretation the advertiser is responsible for substantiating each one. Save a copy of the ad with each claim marked and numbered, so every later item in the file points back to a claim.
2. Note the standard each claim has to meet. Health benefit claims need competent and reliable scientific evidence, which the FTC defines as tests, analyses, research or studies conducted and evaluated in an objective manner by experts in the relevant field and generally accepted in the profession to yield accurate and reliable results. The guidance says randomized, controlled human clinical trials are generally the type of substantiation experts would require for health benefit claims.
3. Keep the studies, not summaries of them. Save the full papers, and where you can, the protocol and trial registration. The guidance says outcome measures should be specified in advance, that a post hoc analysis departing from the original protocol generally does not provide reliable evidence, and that a statistically significant result must also be clinically meaningful. You can only check those points against the full study.
4. Write down why each study fits your product and your ad. The guidance lists the questions: how the dosage and formulation compare, whether the ingredients are the same, whether the product is given the same way, how the measured outcomes relate to the advertised benefit, and whether the study population matches the people the ad targets. In its Example 34, studies in people with impaired blood flow to the brain do not support an alertness claim aimed at healthy adults. A short note per study, answering those questions, is the part of the file most often missing.
5. Keep what you found against the claim. The guidance asks advertisers to weigh the totality of the evidence and says that if a stronger body of evidence runs contrary to a claimed effect, even a qualified claim is likely to be deceptive. Record the search you ran, the date, and the studies that cut the other way, with your reasoning.
6. Separate what does not count. Customer satisfaction surveys (Example 21), a practitioner’s observations of patients, and public health recommendations (Example 22) are not substantiation under the guidance. The FTC Endorsement Guides say the same of testimonials: consumer endorsements themselves are not competent and reliable scientific evidence, 16 CFR 255.2(a). Keep these in the file if the ad uses them, marked as supporting material, not as proof.
7. Back up what testimonials imply about typical results. Under 16 CFR 255.2(b), a testimonial about a central attribute will likely be read as showing what consumers generally achieve. Keep evidence that the result is representative, or disclose the generally expected performance clearly and conspicuously and keep evidence for that figure. Our guide to success rates and outcome claims covers how to build those numbers.
8. Log endorser checks over time. An advertiser may use an expert or celebrity endorsement only while it has good reason to believe the endorser still holds the views presented, and may meet that by securing the endorser’s views at reasonable intervals, 16 CFR 255.1(b). Where the ad says the endorser uses the product, the advertiser needs good reason to believe they still do, 255.1(c). Section 255.1(d) also says advertisers should guide endorsers, monitor them and act on non-compliance. Dated notes of each check, and copies of the guidance you gave, are the record of that.
9. Sign and date the review before launch, and again on change. Note who reviewed the file and the date, which should come before the ad’s first run date. Review it again when the formula, the protocol, the target audience or the published evidence changes, and keep the earlier version rather than overwriting it.

For the wording side of evidence claims, such as “clinically proven” and “doctor recommended”, see our guide to clinically proven and doctor recommended claims. The per-ad file in the next sections links to this substantiation file by claim number, so one study file can serve several ads that make the same claim.

HIPAA records: authorizations and consents behind patient content

Patient testimonials, before and after photos, and stories that use protected health information need their own paper trail. Under 45 CFR 164.508(a)(3), a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions for face-to-face communications and promotional gifts of nominal value. Under 164.508(b)(6), the covered entity must document and retain any signed authorization as required by 164.530(j).

Section 164.530(j) sets the period: documentation is kept for six years from the date of its creation or the date when it last was in effect, whichever is later. An authorization that stays in effect while a testimonial runs keeps its clock from starting. A revocation should go in the same file, with the date the content came down.

State rules can add to this. The Texas Medical Board rule above requires patient consent before any use of photographs in advertising, whether or not HIPAA applies. Keep the signed form in your secure records system, and keep only a reference to it in the ad file, so the ad file itself holds no patient information. Our guide to patient photo consent for marketing covers the form itself.

Medicare and Medicare Advantage: where the record rules reach a provider

Medicare Advantage marketing rules mainly bind the plans, but three parts can reach a practice. Check which role you are in before deciding what you need to keep.

• A contracted provider is a first tier entity. 42 CFR 422.2 defines a first tier entity as any party with a written arrangement with an MA organization to provide administrative or health care services to a Medicare eligible individual under the MA program. Under 422.504(i)(2), the plan must require its first tier, downstream and related entities to agree that HHS, the Comptroller General or their designees may audit and inspect their books, contracts, records and documentation related to the plan’s contract with CMS, through ten years from the end of the contract period or the completion of an audit, whichever is later. Your network agreement will spell out what it asks you to keep.
• Plan-initiated activities in your office. Under 422.2266(d), when a provider acts at the request of an MA organization, the provider is acting on behalf of the plan, and the plan is responsible for compliance. Provider-initiated activities at a patient’s request fall outside the definition of marketing under 422.2266(c). Keep a record of any plan request, the materials the plan supplied and when you used them.
• Paid lead generation or enrollment work. 42 CFR 422.2260 defines a third-party marketing organization as an organization or individual compensated to perform lead generation, marketing, sales or enrollment functions in the chain of enrollment. Under 422.2274(g), the TPMO’s agreement must require that marketing and sales calls be recorded and kept in their entirety for at least six years, in audio form for the first three years. A practice that takes payment for this kind of work should read that section with its attorney.

For what a practice can and cannot do with plan materials, see our guide to Medicare Advantage marketing in the provider office.

What to keep for each ad

A useful ad file answers one question: what did a patient see, when, where, and why did the practice believe it was true. Build one entry per ad or per version, and include the following.

• The final version as it ran. A PDF of a print piece, a recording of a broadcast or video ad, a full-page capture of a web page with the date visible, and the text of each search ad headline and description in rotation.
• Dates. The first and last day it ran, and the date of each change. The Texas and New Jersey periods count from the last run, so the end date is the key date.
• Placement. Each channel and location: website page, search campaign, social account, print title, billboard site, mailer list source, broadcast station.
• Who approved it. The name of the responsible practitioner and the date of approval. Virginia requires this for multi-practitioner practices, and it is useful everywhere.
• Claims and evidence. A list of each objective claim in the ad, with the evidence for it: the study, the internal count, the credential, the price list, the award letter. Date each item, and note who checked it.
• Consents and endorsements. A reference to each signed authorization or photo consent, and for any endorser or reviewer, the material connection and how it was disclosed.
• Corrections. If an error was found, when it was found, what was changed and when. Texas dental requires this, and it shows good faith anywhere.
• Vendor copies. If an agency or platform ran the ad, an export of what they ran and on what dates, saved in your own system, not only in theirs.

Setting up a retention schedule

Start with a list of each license your practice holds and the state where it is held, then look up the advertising rule for each board. Note the period and the event that starts the clock. Add the HIPAA six-year period for signed authorizations and any period in your payer contracts. The schedule for an ad is the longest period that applies to it, counted from the right event.

Assign one person to the file, keep it in a system the practice controls, and review it at a set interval, such as each quarter. When an ad ends, record the end date the same day. When the retention period passes, follow your written records policy, and do not destroy anything while a complaint, audit or legal claim is open. Ask your attorney before you set the destruction step.

Questions to ask before an ad runs

• Which boards license the people named or pictured in this ad, and what do their rules say about keeping copies?
• What objective claims does this ad make, and is the evidence for each one in the file today?
• Does the ad use any patient image, story or review, and where is the signed authorization or consent?
• Who is the responsible practitioner, and have they approved this version in writing?
• Is any part of this ad paid for or requested by a health plan, and if so, what does our agreement with the plan say about records?
• How will we capture the ad as it ran, and who records the end date?

Use and avoid

• Use: “Ad file: search campaign, headline set 3, ran March 2 to June 14, approved by Dr. [Name] on March 1, claims list and evidence attached.” Avoid: a folder of screenshots with no dates or approvals.
• Use: “Photo consent on file, reference [ID], signed [date], in effect while the post runs.” Avoid: pasting the signed form or patient details into the marketing folder.
• Use: “Retention: two years from last run under the Texas Medical Board rule, six years for the signed authorization.” Avoid: “We keep ads for a while.”
• Use: “Correction made [date]: removed outdated price, new version saved.” Avoid: editing a live page without saving the earlier version.

An illustration

This example is invented. [Practice name] is a dental office in Texas with one physician who offers sleep medicine visits. It runs a search campaign, a page on its website about implants, and a social post with a patient’s before and after photo. A board letter arrives asking about the implant page as it read eighteen months earlier.

Because the office keeps an ad file, it can send the page capture from that date, the date the page went up and each later change, the name of the dentist who approved it, the price list and credential letters that supported its claims, and a note that a typo in a fee was corrected on a specific date. The photo post has a reference to the signed authorization, which sits in the secure records system. The office counts the dental board’s four-year period from the date the page version last ran, the Texas Medical Board’s two-year period for the physician’s sleep medicine ads, and the six-year HIPAA period for the authorization.

Checklist

• List each license and board, and note each advertising rule’s retention period and start event.
• Create one file entry per ad or version, with the final copy as it ran.
• Record first and last run dates and each change.
• Record each placement and channel.
• Name the responsible practitioner and the approval date.
• List each objective claim with dated evidence, gathered before launch.
• Reference signed authorizations and consents; keep the forms in the secure records system.
• Log any correction with the date found and the date fixed.
• Export vendor and agency copies into a system the practice controls.
• Check payer and network agreements for record and audit terms.
• Review the file each quarter and hold records during any open complaint, audit or claim.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. For advertising records, that means saving each ad version with its dates and placements, keeping a claims list with the evidence your team supplies, and handing you a clean export when a campaign ends, with your attorney setting the retention schedule. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 22 Tex. Admin. Code 164.2: Physician Responsibilities (Texas Medical Board)
• 22 Tex. Admin. Code 108.60: Record Keeping of Advertisements (Texas State Board of Dental Examiners)
• N.J. Admin. Code 13:35-6.10: Advertising and solicitation practices (Board of Medical Examiners)
• 18VAC85-20-30: Advertising ethics (Virginia Board of Medicine)
• 15 U.S.C. 45: Unfair methods of competition unlawful; prevention by Commission (FTC Act Section 5)
• FTC Policy Statement Regarding Advertising Substantiation (November 23, 1984)
• FTC staff: Health Products Compliance Guidance (December 2022)
• 16 CFR 255.1: Endorsement Guides, general considerations
• 16 CFR 255.2: Endorsement Guides, consumer endorsements
• 15 U.S.C. 52: Dissemination of false advertisements
• 45 CFR 164.508: Uses and disclosures for which an authorization is required
• 45 CFR 164.530: Administrative requirements (documentation and retention, paragraph j)
• 42 CFR 422.2: Definitions (first tier entity)
• 42 CFR 422.504: Contract provisions (records and first tier entities)
• 42 CFR 422.2260: Definitions (marketing and third-party marketing organization)
• 42 CFR 422.2266: Activities with healthcare providers or in the healthcare setting
• 42 CFR 422.2274: Agent, broker, and other third-party requirements

More in Healthcare marketing rules