Livestreaming procedures: patient privacy rules

A live video from the procedure room can feel like the plainest, least staged marketing a practice can make. Viewers see the team at work, the surgeon explains each step, and questions come in as it happens. It is also the format with the least room for error. A recorded post can be reviewed, trimmed and held back. A live stream goes out as it happens, to an audience the practice does not choose, with whatever is in the frame and whatever is said in the room.

This guide is for owners, office managers and marketing staff at independent practices, dental offices, med spas, chiropractic and integrative clinics who are thinking about streaming or filming procedures and patient care for social media. It covers the HIPAA authorization a patient signs before they appear, the people and screens in the background, state laws on recording conversations, what a state medical board did in a livestreaming case, and what the AMA and the Federation of State Medical Boards say about filming patients and social media. For the wider staff rules, see our social media policy guide, for paid creators filming in your office, our influencer marketing guide, and for the consent form itself, our guide to patient photo and video consent. If you stream on YouTube, our guide to running a YouTube channel for a medical practice covers channel permissions, the medical misinformation policy and comment settings.

This is general information, not legal advice. Sources cited were checked on October 30, 2026: HIPAA rules 45 CFR 164.501, 164.508, 164.514 and 164.530, the HHS Office for Civil Rights guidance on media and film crews and its 2016 and 2018 filming settlements, the State Medical Board of Ohio’s July 2023 formal action report and meeting minutes, the Federation of State Medical Boards policy on social media and electronic communications (April 2019), AMA Code of Medical Ethics Opinions 2.3.2 and 3.1.4, and recording laws in California, Florida and Washington. State rules on recording, filming and office-based procedures differ, so check yours, and have a health care attorney review your filming policy and consent form before anyone goes live.

The short version

A patient on camera needs a signed HIPAA authorization first. Posting a patient’s image, voice, name or care to the public is a disclosure the Privacy Rule does not otherwise permit, and a post that promotes the practice is marketing under 45 CFR 164.508(a)(3).
Blurring afterward is not a substitute. OCR guidance says it is not sufficient to mask patients’ identities after the fact when film crews record where patient information is accessible. Prior, express authorization is required.
Everything in the frame counts. Wristbands, screens, whiteboards, schedules, other patients and conversations in the room can all identify someone or reveal their care.
Audio raises state recording laws. California, Florida and Washington are examples of states that require the consent of all parties before certain private conversations are recorded.
Boards look at the care, not only the post. In July 2023 the State Medical Board of Ohio permanently revoked a surgeon’s license after finding departures from minimal standards of care for three patients, tied to video recording during office liposuction procedures.
Professional guidance points the same way. The FSMB says not to post images or videos of patients without their express written consent, and AMA Opinion 3.1.4 says recording should stop if it may jeopardize patient care.

Why live is different from a recorded post

With a recorded video, the practice can check the footage before anyone sees it. A wristband with a name can be cropped, a monitor can be blurred, a comment from a staff member can be cut, and the patient can watch the final version. A live stream removes that step. What the camera sees and the microphone hears is published at once, and viewers can record their own copy.

That changes how revocation works too. Under 45 CFR 164.508(b)(5), a patient can revoke a HIPAA authorization in writing at any time, except to the extent the covered entity has already acted in reliance on it. Once a stream has gone out, the practice cannot pull it back from viewers who saved it. Explain this before the patient signs, and agree in writing how long the saved replay stays up and how the patient asks for it to come down.

Live formats also invite real-time questions from viewers. A surgeon answering comments while working splits their attention between the patient and the audience, which is the issue a licensing board raised in the Ohio case below.

HIPAA: a patient on camera is a disclosure

Under 45 CFR 164.508(a)(1), a covered entity may not use or disclose protected health information without a valid authorization, except as the Privacy Rule otherwise permits or requires. Treatment, payment and health care operations do not include broadcasting a patient’s care to the public. A livestream of a procedure shows who the patient is and what care they are receiving, so it needs the patient’s authorization before it starts.

If the stream promotes the practice, it is also marketing. The definition in 45 CFR 164.501 covers a communication about a product or service that encourages recipients to purchase or use it, and 164.508(a)(3) requires an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions for face-to-face communications and promotional gifts of nominal value. A live demonstration of a procedure you sell fits that description.

A patient’s face is an identifier. The de-identification standard in 45 CFR 164.514(b)(2)(i) lists full face photographic images and any comparable images among the identifiers that must be removed before health information counts as de-identified. Tattoos, a voice the audience recognizes, a name said aloud or a familiar room can also point to a person, so do not rely on keeping the face out of frame.

The HHS Office for Civil Rights has addressed filming directly. Its guidance on media access says HIPAA does not permit covered health care providers to give the media, including film crews, access to areas where patients’ information will be accessible in any form, written, electronic, oral or other visual or audio form, without first obtaining a written HIPAA authorization from each patient whose information would be accessible. It also says that masking identities after the fact, by blurring, pixelation or voice alteration, is not sufficient, and that prior, express authorization is required. The guidance is written about outside media. When your own staff hold the camera and post to the public, the practice is making the disclosure itself, and the same authorization rule in 164.508(a)(1) applies.

OCR has enforced this. In April 2016 it announced a 2.2 million dollar settlement with New York Presbyterian Hospital over the impermissible disclosure of two patients’ information to news media during the filming of a television series, with a corrective action plan that included two years of monitoring. In September 2018 it announced settlements totaling 999,000 dollars with three Boston hospitals for inviting film crews on premises to film a documentary series without first obtaining authorization from patients. Each hospital also agreed to workforce training.

What the authorization needs to say for video

A valid authorization under 45 CFR 164.508(c) contains a specific description of the information to be used or disclosed, who may make the disclosure, who receives it, each purpose, an expiration date or event, and the patient’s signature and date. It must also tell the patient they can revoke it in writing and how, whether treatment can be conditioned on signing, and that information disclosed under it may be redisclosed by the recipient and no longer protected. It must be in plain language, and the patient gets a signed copy.

For a live stream, make the description concrete. Name the procedure, the date, the account or channels, whether the stream is live, whether a replay stays posted and for how long, whether clips will be cut from it for ads, and whether the patient’s face, voice, name or body areas will appear. Under 164.508(b)(4), a covered entity may not condition treatment on the patient signing, so the form should say that saying no does not change their care, and the front desk should mean it.

Under 164.508(b)(3), an authorization generally may not be combined with another document such as a treatment consent form, so keep it on its own page. Our guide to patient photo and video consent covers the form, minors and record keeping in more detail.

Everyone else in the frame

The OCR guidance describes how much information surrounds a patient during care: names or record numbers on doors and identification bracelets, notes about conditions or medications on boards, real-time displays of heart or lung function, and conversations about their care. It adds that a patient’s presence in an area dedicated to treating a specific condition can reveal the diagnosis. Each of those can be in the background of a stream.

According to the guidance, filming in such areas is possible only when each patient who is or will be in the area, or whose information will otherwise be accessible, has first signed a valid authorization, and even then reasonable safeguards must be in place. It gives examples: privacy screens on computer monitors and opaque barriers that block access to information about patients who did not sign. 45 CFR 164.530(c) requires a covered entity to reasonably safeguard protected health information from uses or disclosures that violate the rule and to limit incidental disclosures.

In practice, that means a room setup for each stream: close the schedule on screen, turn monitors away, clear the whiteboard, remove charts and labels, check what the window or doorway shows, and keep other patients out of the hallway the camera faces. Visitors and family members who come into the frame are a separate question under state privacy law, so ask before they appear. Staff who appear should agree too, and your social media policy should say who may film and where.

Audio and state recording laws

A stream with sound records conversations. Federal law, 18 U.S.C. 2511(2)(d), allows a party to a conversation to record it with one party’s consent, but certain states require the consent of all parties. Our call recording consent guide covers these laws for phone calls.

Three examples, paraphrased from the state code text:

California: Penal Code 632 makes it a crime to intentionally record a confidential communication without the consent of all parties.
Florida: section 934.03(2)(d) of the Florida Statutes makes it lawful to intercept a wire, oral or electronic communication when all parties have given prior consent.
Washington: RCW 9.73.030 makes it unlawful to record a private conversation without first obtaining the consent of all persons engaged in it.

A conversation between a clinician and a patient in a closed room is the kind of private exchange these laws protect. The patient’s HIPAA authorization does not cover what a nurse, another patient or a family member says nearby. Before the stream, tell each person in the room that audio is being broadcast, and mute or move the camera when someone has not agreed. State law can also limit filming in other ways, so check yours.

What a licensing board did in a livestreaming case

In July 2023 the State Medical Board of Ohio permanently revoked a surgeon’s license and imposed a fine of four thousand five hundred dollars. The board’s formal action report says the decision was based on the finding that the doctor violated minimal standards of care in the treatment of three identified patients when she video recorded patients during liposuction surgeries in an office setting that was not licensed as an ambulatory surgical facility, and that this also violated the board’s office-based surgery and office liposuction rules.

The board’s meeting minutes for July 12, 2023 record a board member describing a video of the surgeon talking to her social media audience and looking at the camera during the procedure instead of paying attention to the patient, and stating that it is not appropriate to put patients in danger for the social media world. The surgeon told the board that filming in the operating room can make it appear she is not giving the patient her undivided attention.

The lesson for a practice is not that filming is banned. It is that a board reviews the care in the video. If the camera, the comments or the performance change how a procedure is done, or where it is done, the post becomes evidence about the standard of care.

What professional guidance says

The Federation of State Medical Boards adopted its policy on social media and electronic communications in April 2019. Its first recommendation is not to disclose individually identifiable patient health information or post images or videos online without the express written consent of the patient. The policy says boards have the authority to discipline physicians for unprofessional conduct involving social media, with actions ranging from a letter of concern to revocation of a license, and lists online violations of patient confidentiality among its examples. It also recommends not giving medical advice to specific patients online unless through a secure patient portal, and following advertising codes of conduct when marketing a practice online.

The AMA Code of Medical Ethics addresses both sides. Opinion 2.3.2, on professionalism in the use of social media, says physicians should refrain from publishing patient information online without appropriate consent, publicly disclose financial interests related to their social media content, and ensure that health care information they share is useful and accurate. Opinion 3.1.4, on recording patients for public education, says filming cannot benefit a patient medically and may cause harm. Among its points, physicians should restrict participation to patients with decision-making capacity, tell patients they may have the recording stopped at any time, have consent obtained by a disinterested third party not involved with the production, and request that recording be stopped if it may jeopardize patient care.

These are professional standards, not federal law, but boards can draw on them, and they set a clear baseline: consent first, care first, and accurate content.

Answering viewer questions while live

Comments arrive fast during a stream, and viewers may describe their own symptoms. The FSMB recommendation against giving medical advice to specific patients outside a secure portal applies here. Answer general questions in general terms, and invite anyone with a personal question to book a visit or call the office.

Do not confirm that a commenter is a patient, mention their visit or reply with details of their care, even if they share it first. A reply like that discloses protected health information without an authorization under 164.508(a)(1). If the stream is sponsored or the clinician has a financial interest in a product shown, say so on screen and in the caption, as Opinion 2.3.2 recommends. Our influencer marketing guide covers disclosure of paid connections.

Questions to ask before going live

Does the patient have the capacity to decide, and did someone outside the marketing team obtain their signed authorization?
Does the authorization name live streaming, the channels, the replay period and clip use?
Who else could appear or be heard, and has each of them agreed?
Have we checked the room for screens, boards, labels, charts and views through doors or windows?
Who is watching the stream and the comments, so the clinician doing the procedure is not?
Is the procedure being done where and how it would be done without a camera?
Who can stop the stream at once, and does the team know they should if care needs full attention?

Use and avoid

Use: “Authorization: live stream on the practice’s public account on [date], replay posted for 30 days, clips may be used in ads for up to 12 months, signed [date], copy given to patient.” Avoid: a line in the intake packet saying the practice may use photos and video.
Use: a staff member who is not in the procedure runs the camera and reads comments. Avoid: the clinician answering comments while working.
Use: “Thanks for the question. We can’t advise on your situation here, please call the office or book a visit.” Avoid: “Good to see you back, your results look great after last month’s treatment.”
Use: a room check before each stream, with monitors off or turned away. Avoid: relying on blurring a replay afterward.
Use: “Sponsored by [Brand]” on screen and in the caption when a sponsor is involved. Avoid: showing a product the clinician is paid to promote without saying so.

An illustration

This example is invented. [Practice name] is a med spa that wants to stream a laser skin treatment on its public account. The office manager gives the patient a separate authorization that names the live stream, the date, a 30-day replay and two short clips for ads, and explains that viewers can save their own copy once it airs. The patient signs and receives a copy. A front desk staff member, not the treating provider, handles the paperwork.

On the day, a second staff member checks the room, turns the scheduling screen away and closes the door to the hallway. They run the camera and read comments. When a viewer asks whether the treatment would fix their own scarring, the staff member replies with a general answer and a link to book a consultation. Midway through, the provider needs to change settings and asks to pause, and the stream stops until the provider says to resume. The replay comes down on day 30, and the practice saves the authorization and stream record in its files.

Checklist

Write a filming policy that says who may stream, where, and who approves each stream.
Use a stand-alone HIPAA authorization that names live streaming, replay length and clip use.
Have someone outside the marketing team obtain consent, and give the patient a signed copy.
Confirm that treatment does not depend on signing, and say so on the form.
Check the room for screens, boards, labels, charts and views through doors before each stream.
Tell each person in the room that audio is live, and get agreement from staff and visitors who appear.
Assign a camera and comments operator who is not part of the procedure.
Agree on a stop signal, and stop the stream whenever care needs full attention.
Answer viewer questions in general terms only, and never confirm someone is a patient.
Disclose sponsors and financial interests on screen and in the caption.
Take the replay down on the agreed date, and keep the authorization and stream record.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. For video, that means pages that present your team and procedures without patients on camera, captions and transcripts for the clips you approve, and a simple record of which authorization supports each video, with your attorney reviewing the consent form. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Can a practice livestream a procedure on social media?

HIPAA does not ban it, but the patient must sign a valid authorization under 45 CFR 164.508 first, and anyone else whose information could be seen or heard needs to be kept out of the stream or authorize it too. State recording laws, board rules and office-based procedure rules also apply, so have a health care attorney review your plan.

Is blurring the patient’s face enough?

Not as a substitute for authorization. OCR guidance on film crews says masking identities after the fact by blurring, pixelation or voice alteration is not sufficient, and that prior, express authorization is required. A live stream also gives no chance to blur before viewers see it.

Does a general photo and video consent in our intake forms cover a livestream?

It is risky to rely on it. A valid authorization describes the information and each purpose in a specific way, and it generally may not be combined with other documents such as a treatment consent. Use a separate form that names live streaming, the channels and the replay period.

What if the patient changes their mind after the stream?

They can revoke the authorization in writing, and the practice should stop further use, such as the replay and clips. Revocation does not undo what the practice already did in reliance on it, and copies viewers saved cannot be recalled, so explain this before the patient signs.

Can staff answer health questions from viewers during a live stream?

Keep answers general. The FSMB recommends not giving medical advice to specific patients online except through a secure portal, and confirming that a commenter is a patient discloses protected health information. Invite personal questions to a visit or a call.

Livestreaming procedures and patient care on social media: HIPAA authorization, recording consent and board rules