Patient photo and video consent for marketing

A practice that wants to show real patients in its marketing needs more than a good camera. It needs a process: which photos may be taken, which form the patient signs, where the signed form and the images live, and what happens when a patient changes their mind. Without that process, the same photo can be fine in the chart and a privacy problem on the website.

This guide covers that process for practices that are HIPAA covered entities: the difference between clinical photos and marketing photos, why the marketing permission has to be its own document, rules for minors and patients who have died, revocation, record keeping, storage, people in the background, and releases for staff and models. Our guide to patient testimonials and before-and-after photos already has a checklist of what the authorization form itself must contain, and our guide to healthcare video marketing covers film crews, so this guide links to those instead of repeating them. For how long to keep signed consents and the ads that used them, see our guide to keeping advertising records. For live streams of procedures and patient care, see our guide to livestreaming procedures on social media. For patient photos and stories in posts on your Google profile, see our guide to Google Business Profile posts. Posts that patients publish themselves and tag the practice in are covered in reposting patient posts and tags.

This is general information, not legal advice. Sources cited were checked on October 29, 2026: 45 CFR 164.501, 164.502, 164.506, 164.508, 164.514 and 164.530; the HHS HIPAA FAQ on media and film crews in treatment areas (content last reviewed January 9, 2023); 16 CFR 255.5; and the Cornell Legal Information Institute overview of the right of publicity. Rules change and state rules differ, so check current versions and ask a qualified health care attorney before you rely on any of this.

Clinical photos and marketing photos are different uses

A photo taken to document a wound, a skin lesion or the result of a procedure is protected health information. Using it for treatment, payment or health care operations is permitted under 45 CFR 164.506(c) without a separate authorization. Putting the same photo on your website, in an ad or on social media is a different use. HIPAA defines marketing as a communication about a product or service that encourages recipients to purchase or use it (45 CFR 164.501), and 45 CFR 164.508(a)(3) requires a written authorization for marketing uses, with narrow exceptions that do not cover posting a patient’s photo.

A general consent to treatment does not close that gap. Section 164.506(b)(2) says a consent for treatment, payment or operations is not effective to permit a use or disclosure that requires an authorization under 164.508. So the line in an intake packet that says the practice may take photos for the medical record does not let you use those photos in marketing.

Removing the face does not settle the question either. The de-identification safe harbor lists full face photographs and any comparable images, and also any other unique identifying characteristic (45 CFR 164.514(b)(2)(i)(Q) and (R)), and it requires that the practice have no actual knowledge that what remains could identify the person. A tattoo, a birthmark, a recognizable room or a caption can be enough.

Keep the marketing authorization on its own form

Section 164.508(b)(3) says an authorization may not be combined with any other document to create a compound authorization, apart from listed exceptions that mainly concern research. In practice, that means the marketing photo authorization should be its own signed document, not a paragraph inside the new patient intake form, the treatment consent or the financial policy.

Section 164.508(b)(4) says a covered entity may not condition treatment on an authorization, apart from exceptions for research and health plans that do not fit a practice photographing patients for marketing. Patients must be able to say no and still get the same care. An authorization that breaks the compound or conditioning rules is defective under 164.508(b)(2)(iv), so it does not give you the permission you think you have.

Ask for the authorization after the care decision is made, not as part of scheduling or check-in.
Have someone other than the treating clinician present the form where you can, so the patient does not feel the request is tied to their care.
Write it in plain language, which 164.508(c)(3) requires, and give the patient a copy of the signed form, which 164.508(c)(4) requires.
Describe the specific images or footage, where they will appear and when the permission ends. The full list of required elements is in our testimonials and photos guide.

If the patient receives anything for taking part, such as free or discounted treatment, that is a separate question under the FTC Endorsement Guides: 16 CFR 255.5 says a connection the audience would not expect, which could materially affect how much weight they give the endorsement, must be disclosed clearly and conspicuously. Our testimonials guide covers how that applies to patient stories.

Minors and patients who have died

For a child, the authorization comes from a parent or guardian when they are the child’s personal representative. Under 45 CFR 164.502(g)(3), a parent, guardian or other person acting in loco parentis who has authority under applicable law to make health care decisions for an unemancipated minor is treated as the minor’s personal representative, with exceptions. One exception applies where the minor lawfully consents to the care on their own and no other consent is required by law. Rules on when a minor can consent to care vary by state, so ask counsel before you photograph a teenager for marketing, and see our guide to pediatric practice marketing for photos of children more generally.

Privacy protection does not end at death. Section 164.502(f) says a covered entity must comply with the Privacy Rule for a deceased person’s protected health information for 50 years after the death, and 164.502(g)(4) says an executor, administrator or other person with authority under applicable law to act for the deceased person or their estate is treated as the personal representative. A memorial post or a story about a long-time patient who has died still needs an authorization from that person.

When a patient revokes

Section 164.508(b)(5) lets a patient revoke an authorization at any time, in writing, except to the extent the covered entity has already taken action in reliance on it. Once you know the authorization has been revoked, it is no longer valid (164.508(b)(2)(iii)), so you need to stop new uses of those images.

The exception is about action already taken. It may cover a printed brochure already in patients’ hands, but on its face it does not reach new uses, such as running the same ad again or reposting the photo. Plan the takedown before the first post:

Keep a list of every place each patient’s images appear: website pages, social posts, ads, printed pieces and anything given to an agency.
Name one person who receives revocations and logs the date.
Set a target for removing the images from your own website, accounts and active ads once a revocation arrives.
Remember that content shared or saved by others may stay online. The authorization form must already warn patients that information disclosed under it may be redisclosed by the recipient and no longer protected (164.508(c)(2)(iii)).

Track expiration dates the same way. An authorization whose expiration date has passed, or whose expiration event the practice knows has happened, is not valid (164.508(b)(2)(i)).

Keep the signed forms and the images under control

Section 164.508(b)(6) requires a covered entity to document and retain each signed authorization as required by 164.530(j), which sets a retention period of six years from the date the document was created or the date it was last in effect, whichever is later. Store the signed form where you can find it from the image, for example with a reference number in the file name or the asset list.

Section 164.530(c) requires appropriate administrative, technical and physical safeguards to protect the privacy of protected health information. Patient photos on a staff member’s personal phone, in a shared photo album or in a messaging app are hard to protect and hard to remove later. Decide which devices and which storage your practice uses for patient images, and write that into your social media policy so staff know the answer before a patient asks for a photo.

If an outside photographer, videographer or agency will handle patient images, the HHS FAQ on media and film crews says a business associate agreement is needed where patients’ information will be accessible to a film crew. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Photos taken at an open house or a grand opening raise the same questions, with the added step of telling guests in advance that photos will be taken. Our guide to medical office grand openings and open houses covers the gift, prize and follow-up rules for those events.

Other patients in the background

The HHS FAQ on media and film crews in treatment areas, last reviewed January 9, 2023, says providers cannot invite or allow media personnel into areas where patients’ information will be accessible without prior written authorization from each person who is or will be in the area, and that asking the crew to blur or pixelate faces afterward is not sufficient. It also says authorizations from patients whose information is included in any materials are required before those materials are posted online, printed in brochures for the public or otherwise publicly disseminated.

Even when your own staff hold the camera, 45 CFR 164.502(a)(1)(iii) only permits incidental disclosures when reasonable safeguards and minimum necessary rules are met. For a photo session, that means a closed room or a time with no other patients present, and nothing in the frame that shows a schedule, a screen, a chart or a name on a whiteboard. Our video marketing guide covers filming in the office in more detail.

Staff, models and family members

HIPAA authorizations are about patients’ health information. Staff who appear in marketing as staff, and paid models or actors, are not covered by that form, but using a person’s image to promote a business can still raise legal issues. The Cornell Legal Information Institute describes the right of publicity as protection against unauthorized commercial use of a person’s name, likeness or other recognizable aspects of their persona, largely governed by state common or statutory law. Because the rules vary, a short written release from every person shown is a sensible habit, including staff, models and patients’ family members who appear in a shot.

Plan for staff who leave. A release that says how long the practice may keep using the images after employment ends avoids a hard conversation later. Our guide to medical practice job ads covers staff photos on careers pages. If a staff member is also a patient and the image shows their care, treat it as a patient image and use the HIPAA authorization.

If you use models or actors to show a visit, the audience should not be led to think they are real patients. Our video marketing guide explains the FTC rule on that.

Illustration

Illustration: a dermatology practice wants to post three before-and-after photo sets on its website. The clinical photos already exist in the chart. The practice gives each patient a separate one-page authorization after the follow-up visit, presented by the practice manager rather than the treating clinician. Each form names the specific photo set, the website and the practice’s social accounts as places of use, and an expiration date two years out, and it states that signing is not required to receive care. Each patient gets a copy. The manager logs the forms with reference numbers matching the image files, stored in the practice’s approved storage, not on a phone. A year later one patient revokes in writing. The manager removes the set from the website and deletes the posts from the practice’s accounts the same week, logs the revocation, and keeps the signed form and the revocation for the retention period.

Checklist

Clinical photos stay clinical: no marketing use without a separate written authorization (45 CFR 164.508(a)(3)).
The marketing authorization is its own document, not part of intake or treatment consent (164.508(b)(3); 164.506(b)(2)).
Care is never conditioned on signing (164.508(b)(4)).
Plain language, every required element, and a copy to the patient (164.508(c)).
Parents or guardians sign for minors where they are the personal representative, with counsel checking the exceptions (164.502(g)(3)).
Deceased patients’ information stays protected for 50 years; the estate’s representative signs (164.502(f), (g)(4)).
One person logs revocations and expirations, with a list of where each image is used (164.508(b)(5)).
Signed forms kept six years from creation or last effective date, whichever is later (164.530(j)).
Approved devices and storage for patient images; no personal phones or chat apps (164.530(c)).
No other patients, screens, charts or schedules in the frame.
Written releases for staff, models and family members shown.
Any free or discounted care for participating patients disclosed with the content (16 CFR 255.5).

Staff who appear on the team page by name and photo need their own release, with choices for first name only or no name and a plan for when they leave. Our guide to staff photos, names and bios on a practice website covers it.

How we help

We build websites, local search, Google Ads and AI front desk tools for independent practices. On a medical website design project, we use only images your practice has the right to use: your own photos of your team and office, and patient images only when you confirm a signed authorization covers that use. We do not use stock or AI-generated images presented as your patients. We can set up the page structure so a patient image can be removed quickly if a patient revokes. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it.

Frequently asked questions

Can we use a clinical photo from the chart in our marketing?

Not without a written HIPAA authorization from the patient for that marketing use. Using the photo for treatment and operations is permitted under 45 CFR 164.506(c), but 164.508(a)(3) requires an authorization for marketing, and a general treatment consent does not substitute for it (164.506(b)(2)).

Can we add a photo release paragraph to our new patient intake form?

Not for marketing. Section 164.508(b)(3) says an authorization may not be combined with any other document to create a compound authorization, apart from listed exceptions that mainly concern research. Use a separate form, and do not make care depend on signing it (164.508(b)(4)).

If a patient revokes, do we have to take the photos down?

You must stop new uses once you know of the revocation, because a revoked authorization is not valid (164.508(b)(2)(iii)). The exception under 164.508(b)(5) only covers action already taken in reliance on the authorization, such as material already printed and distributed.

How long do we keep the signed authorization?

Six years from the date it was created or the date it was last in effect, whichever is later, under 45 CFR 164.530(j), which 164.508(b)(6) applies to authorizations.

Who signs for a child or a patient who has died?

A parent or guardian who is the minor’s personal representative, with exceptions where the minor lawfully consented to the care themselves (164.502(g)(3)). For a deceased patient, the executor, administrator or other person with authority over the estate (164.502(g)(4)). Protection lasts 50 years after death (164.502(f)).

Do staff photos need a HIPAA authorization?

Not when they appear as staff and no health information is shown. A written release is still sensible because the right of publicity, largely governed by state law, can limit commercial use of a person’s likeness. If the image shows a staff member’s own care, treat it as a patient image.

Patient photo and video consent for marketing: a working process for practices