Brand-run patient communities: moderation, incentives and health data

A forum for people living with a condition, a members-only group for users of a device, a peer community inside a health app: health companies build these because patients value hearing from each other. The company that hosts the space also takes on rules that a practice support group or a public social media page does not raise. Rewards for posting can turn members into endorsers. Removing critical posts can make the rest of the page misleading. Member profiles hold health information. If you make a drug or device, the community can also be a source of adverse event reports that you have to review.

This guide is for health companies, device and drug makers, digital health apps, supplement and wellness brands, and service companies that run their own online patient or customer communities. It covers incentives, staff and moderator posts, moderation policy, health data in member profiles, members under 13, adverse event monitoring and the community terms. If you run an in-person or video group as a medical practice, read our guide to patient support groups at a medical practice instead. If your staff post in communities that other people run, see staff posting on Reddit, forums and Wikipedia.

The short version

• Rewards make members endorsers. Points, prizes, free product or early access given to members who post are material connections that must be disclosed when the audience would not expect them (16 CFR 255.5).
• Never pay for a sentiment. If the community has a ratings or reviews section, a reward tied to positive (or negative) reviews is prohibited by 16 CFR 465.4.
• Staff and moderators speak for you. Their posts about your products need a clear disclosure of who they are, and what they say about the product is your claim.
• Moderate by rules, not by sentiment. Removing critical reviews while implying that the page shows all of them is review suppression under 16 CFR 465.7(b).
• Member health data is regulated data. A company that is not covered by HIPAA can still fall under the FTC Health Breach Notification Rule, and sharing that data with ad platforms without authorization counts as a breach (16 CFR 318.2).
• Drug and device makers must watch for adverse events. Drug applicants review adverse experience information from any source (21 CFR 314.80(b)); device manufacturers report within 30 days of becoming aware from any source (21 CFR 803.50(a)).

Why a company community is different

A patient support group run by a practice is a care service. A thread on a public site is someone else’s space. A community your company builds, hosts, moderates and promotes is part of your marketing, whether or not you call it that. The FTC’s Endorsement Guides say advertisers are liable for misleading or unsubstantiated statements made through endorsements and for failing to disclose unexpected material connections, even when the endorser is not liable (16 CFR 255.1(d)). In a community you control, you decide who gets rewarded, which posts are pinned and featured, and which posts come down. Those choices shape what visitors believe about your product.

That does not mean every member post becomes your ad. It means the parts you influence (rewards, staff posts, featured stories, moderation and data handling) need the same review as the rest of your marketing.

Rewards, points and ambassador programs

Community platforms often reward activity: badges, points that turn into gift cards, free product for “top contributors,” early access to new features, a chance to appear in a campaign. Under 16 CFR 255.5(a), material connections include free or discounted products, early access and “the possibility of being paid, of winning a prize, or of appearing” in media promotions. When a member who received any of these posts about your product, and readers would not expect the connection, it must be disclosed clearly and conspicuously.

• Reward activity, not opinions. Points for answering questions or welcoming new members are easier to defend than points for posts about your product. A reward for positive reviews in a ratings section is a violation of 16 CFR 465.4, whatever the disclosure says.
• Label rewarded members. A visible profile badge such as “Ambassador: receives free product from [Company]” next to every post is one way to make the connection clear where the post is read.
• Put the rule in writing. Ambassadors get written guidance on disclosure and on not making health claims your company could not support. 16 CFR 255.1(d) expects advertisers to guide their endorsers and to monitor what they say.
• Watch the posts, act on the bad ones. If an ambassador claims your supplement cured their condition, remove or correct it and talk to the member. You can be liable for what a rewarded member claims (16 CFR 255.1(d)).

Our guides to healthcare influencer marketing and free samples and trial offers cover the same disclosure rules outside a community.

Employees, moderators and company accounts

Members trust people who seem to be fellow patients. When an employee posts as one, that trust is misplaced. Under 16 CFR 465.5, an officer or manager who writes a review or testimonial about the business must clearly disclose the relationship, and a business may not spread testimonials from its officers, managers, employees or agents without a clear disclosure when the relationship is not obvious and the business knew or should have known about it.

• Give every staff and contracted moderator account a visible label, such as “[Company] team” or “Community manager, employed by [Company].”
• No staff accounts that look like ordinary members. That includes employees who also live with the condition and want to share their experience; they can, with the label.
• Product answers from staff go through the same claim review as your ads. If your product is regulated by the FDA, the replies must stay within what the label and your regulatory team allow.
• Staff do not give individual medical advice. A standard reply points members to their own clinician, and to emergency services when a post describes an emergency.

Moderation: what you may remove

Every community needs moderation. The risk is moderation that quietly removes criticism of your product while the page still looks like an open forum. If the community includes a section for product reviews or ratings, 16 CFR 465.7(b) prohibits a business from implying that the displayed reviews are most or all of those submitted when reviews are being withheld because of their rating or negative sentiment.

The same section lists criteria that do not count as suppression when they are applied equally to all reviews regardless of sentiment: content with trade secrets or confidential information; defamatory, harassing, abusive, obscene, vulgar or sexually explicit content; another person’s personal information or likeness; discriminatory content; clearly false or misleading content; reviews the seller reasonably believes are fake; and reviews wholly unrelated to the products or services. A written moderation policy built from those categories, applied the same way to praise and complaints, is easier to defend than case-by-case judgment.

• Publish the community rules and the reasons a post can be removed.
• Log each removal with the rule it broke, so you can show the rule was applied to positive and negative posts alike.
• Do not answer critical posts with threats of legal action. 16 CFR 465.7(a) bars unfounded legal threats and intimidation used to get reviews removed. Our guide to review gag clauses covers the related contract rules.
• Remove posts that share another member’s health details or identity, and tell the poster why.

Health data in member profiles

Member profiles often ask for a diagnosis, a treatment, a device model, a care team or a date of surgery. Posts add more. That is health information tied to a name, an email address or a device identifier.

If your company is a HIPAA covered entity, or runs the community for one as a business associate, HIPAA governs that data. Many health companies are neither. For them, the FTC Health Breach Notification Rule (16 CFR Part 318) may apply. The rule covers vendors of personal health records and related entities that are not HIPAA covered entities or business associates. A personal health record is an electronic record of identifiable health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual (16 CFR 318.2). A community app that pulls in device readings, symptom logs or records alongside member posts should be reviewed against that definition with counsel.

• Sharing counts as a breach. Under 16 CFR 318.2, a breach of security includes an unauthorized acquisition that results from a data breach or an unauthorized disclosure. Sending member health data to an ad platform without the member’s authorization can be a breach, not just a privacy lapse.
• Notice has a deadline. Notice to affected individuals goes out without unreasonable delay and no later than 60 calendar days after discovery (16 CFR 318.4(a)), and violations are treated as violations of an FTC rule, with civil penalties (318.7).
• Keep tracking tags off logged-in pages. Ad pixels on community pages can send page titles, group names and URLs that reveal a condition. Our guide to tracking pixels explains how.
• Do not build ad audiences from the community. Retargeting members of a condition group, or uploading their emails to an ad platform, uses the health data for a purpose members did not join for.
• Say what is public. If posts can be read by search engines or by anyone with an account, say so at sign-up and next to the post box. Do not call a community “private” or “anonymous” unless it is.

Our guide to the FTC Health Breach Notification Rule covers who is covered and what the notices must say. The FTC’s Health Products Compliance Guidance covers how the FTC looks at health claims in general.

Members under 13

Communities for families of children with a condition can draw children themselves. COPPA defines a child as an individual under 13 (16 CFR 312.2), and an operator of a website or online service directed to children, or with actual knowledge that it collects personal information from a child, must get verifiable parental consent before collecting, using or disclosing that information (16 CFR 312.5(a)(1)). Either set a minimum age of 13, ask for age at sign-up and act on what you learn, or design a parent-consent flow with counsel before launch.

Adverse events when you make a drug or device

For companies whose products are regulated by the FDA, a community is also a channel where people describe side effects and device problems.

• Drugs. An applicant with an approved application must promptly review all adverse drug experience information it obtains or receives from any source (21 CFR 314.80(b)). Serious and unexpected adverse experiences go to FDA as 15-day Alert reports, no later than 15 calendar days from initial receipt (314.80(c)(1)(i)).
• Devices. A manufacturer must report within 30 calendar days after it receives or otherwise becomes aware of information, from any source, that reasonably suggests its device may have caused or contributed to a death or serious injury, or malfunctioned in a way likely to do so if it recurred (21 CFR 803.50(a)).

A community you host and moderate is a place where your company receives information. Before launch, agree with your safety or regulatory team how moderators spot possible adverse events, how posts are routed and how fast, and how the team follows up with the member. Train moderators on that path, and keep a record of what was routed. The same duty covers side effect posts your team finds through social listening on sites you do not run. Companies that do not make FDA-regulated products still benefit from a path for posts that describe harm, so the member is told to contact a clinician and the company learns about the problem.

Community terms and sign-up

Your terms and sign-up flow are where members learn what they agreed to. Write them in plain language and keep them consistent with what the community actually does. Under 15 USC 45, a privacy promise that does not match practice can be a deceptive act.

• Who runs the community, and that it is run by a company that sells the products discussed.
• Which rewards exist and how rewarded members are labeled.
• What is public, what is visible to other members, and what staff can see.
• What the company does with posts and profile data, including whether posts may be quoted in marketing, and how a member can say no.
• That posts are not medical advice and that emergencies go to emergency services.
• How a member can leave and what happens to their posts and profile when they do.

If you want to quote a member’s post in an ad or on your website, ask the member first in writing, and then treat the quote as a consumer testimonial: it must reflect the member’s real experience, and any material connection must be disclosed.

Questions to ask before you launch

• Is our company a HIPAA covered entity or business associate for this community, and if not, does the Health Breach Notification Rule apply?
• Which tags, pixels and analytics tools run on community pages, and what do they send?
• Which rewards will we offer, and how will rewarded members be labeled on every post?
• Who moderates, are they labeled, and what is the written removal policy?
• If we make a drug or device, how do possible adverse events reach the safety team, and within what time?
• How do we handle sign-ups from people under 13?

An illustration

A company that sells a home blood pressure monitor wants a members’ community. Its first plan gives 500 points, redeemable for cuffs, for every five-star product rating, and lets the product team quietly remove one-star ratings that mention accuracy.

A safer plan: points are earned for answering other members’ questions, not for ratings; members with points or free products carry an “Ambassador: receives free product” badge; product staff post under labeled company accounts; the ratings section uses a written removal policy that applies to every rating; posts about readings that may be wrong or about injuries go to the regulatory team the same day for device reporting review; no ad pixels run on logged-in pages; and the sign-up page says members must be 13 or older and explains which posts are public.

Checklist

• Rewards are tied to activity, never to positive ratings or reviews.
• Rewarded members, staff and moderators are labeled on every post.
• Staff product statements go through claim review.
• A written removal policy is applied the same way to praise and complaints, with a log.
• Health data is mapped: HIPAA, Health Breach Notification Rule or both checked with counsel.
• No ad pixels or audience building from community pages or member lists.
• Age gate or parent-consent flow in place.
• Adverse event routing agreed with the safety team, if you make a drug or device.
• Plain-language terms match what the community actually does.

How we help

We build websites, landing pages and lead flows for health companies and practices, and we review community, sign-up and privacy wording against the rules above before launch. See how we approach medical lead generation, or browse more guides in health company marketing.

Sources

• 16 CFR 255.1: General considerations (Guides Concerning the Use of Endorsements and Testimonials in Advertising)
• 16 CFR 255.5: Disclosure of material connections
• 16 CFR Part 465: Use of Consumer Reviews and Testimonials
• 16 CFR Part 318: Health Breach Notification Rule
• 16 CFR 312.2: Definitions (Children’s Online Privacy Protection Rule)
• 16 CFR 312.5: Parental consent
• 21 CFR 314.80: Postmarketing reporting of adverse drug experiences
• 21 CFR 803.50: Manufacturer reporting requirements (Medical Device Reporting)
• FTC: Health Products Compliance Guidance
• 15 USC 45: Unfair methods of competition unlawful

More in Health companies, vendors and employers