Patient testimonials and before-and-after rules

Patient stories and before-and-after photos are among the most persuasive things a practice can show. They are also where marketing runs into the most rules at once: FTC rules on endorsements and reviews, HIPAA rules on patient information, your state board’s advertising rules, and the policies of each ad platform you use.

This guide explains those rules in plain terms. It does not include sample testimonials or sample photos, on purpose. What you can show depends on what your real patients agreed to in writing, and on whether what they say is typical. If patients speak for you on an ongoing basis, see patient ambassador and peer advocate programs. If you use models or actors in place of patients, see our guide to stock photos, models and actors in healthcare ads. For how these rules meet Pinterest’s ad policy, see our guide to Pinterest for medical practices. For removal photos in particular, see our guide to laser tattoo removal marketing.

This is general information, not legal advice. Federal sources cited were checked on October 28, 2026. State licensing boards set their own advertising rules for each profession, and they differ. Have a health care attorney review your authorization form and any testimonial or photo campaign before it runs.

Why testimonials and photos get extra scrutiny

A testimonial is not just an opinion. The FTC treats it as a claim made by the business. Under the Endorsement Guides (16 CFR Part 255, revised effective July 26, 2023), an endorsement may not convey any express or implied representation that would be deceptive if the advertiser made it directly, and the advertiser can be liable for a deceptive endorsement even when the endorser is not.

In health care the claim is usually about results: less pain, clearer skin, a better smile, weight lost. That makes the questions simple to state and hard to answer. Is the result real? Is it typical? Did the patient agree, in writing, to have their story and image used to promote you?

Rule 1: results shown must be typical, or you must say what is typical

Section 255.2(b) says an ad featuring a consumer’s experience on a central attribute of a product will likely be read as saying that experience is what consumers will generally achieve. If you cannot substantiate that, the ad should clearly and conspicuously disclose the generally expected performance, and you need substantiation for that disclosure too.

The FTC’s own example in that section uses before-and-after pictures. It says that before-and-after pictures with a claim of a large result are likely to convey that the result is representative, and if consumers cannot generally expect it, the ad would be deceptive. A vague line such as “results may vary” does not fix this. The disclosure has to change the overall impression of the ad.

Only feature results you can document in the patient’s record.
Know what results your patients generally get for that treatment, from your own records or reliable evidence, before you show an exceptional one.
If a result is not typical, say what is typical in words patients will notice and understand.
Keep claims inside what the treatment can actually do. The FTC’s Health Products Compliance Guidance explains the evidence it expects for health claims.

Rule 2: testimonials must be real, current and in context

Section 255.1 says endorsements must reflect the honest opinions or experience of the endorser. You may edit for length, but you may not present a testimonial out of context or reword it in a way that distorts the patient’s experience. If you put words in quotation marks, they must be the patient’s exact words. If the ad says the person used the service, they must have been a real patient.

The FTC’s rule on consumer reviews and testimonials (16 CFR Part 465, effective October 21, 2024) makes several of these points directly enforceable. Under section 465.2, a business may not write, create or sell a testimonial that misrepresents whether the person exists, whether they actually had experience with the service, or what that experience was. That covers made-up patients and testimonials generated by software or AI.

Rule 3: disclose any connection between the patient and the practice

Section 255.5 requires a clear and conspicuous disclosure when a connection between the endorser and the business might materially affect how much weight people give the endorsement and the audience would not expect it. That includes payment, free or discounted treatment, and family or employment relationships.

A staff member who is also a patient should not appear as an ordinary patient without saying they work for you. Section 465.5 addresses testimonials by officers, managers and employees.
A patient who received a free or discounted treatment in exchange for a testimonial or photos must be identified as such.
Under section 465.4, you may not offer anything in exchange for reviews that express a particular sentiment, positive or negative.

Rule 4: patient stories and photos need a written HIPAA authorization

If your practice is a HIPAA covered entity, using a patient’s information to promote your services is marketing. HIPAA defines marketing as a communication about a product or service that encourages recipients to purchase or use it (45 CFR 164.501). Section 164.508(a)(3) says a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions for face-to-face communications and promotional gifts of nominal value.

Photos are patient information. HIPAA lists full face photographic images and any comparable images among the identifiers in its de-identification rule (45 CFR 164.514(b)(2)), and a photo taken during treatment is part of the patient’s health information. Cropping out a face does not by itself make an image de-identified: the safe harbor method requires removing every listed identifier and having no actual knowledge that the remaining information could identify the person. A distinctive tattoo, a visible room or a caption with a first name and a treatment date can still point to someone.

If your practice is not a covered entity, for example a cash-only practice that never bills insurance electronically, HIPAA may not apply. FTC rules and state privacy and licensing rules still do. Ask counsel which apply to you; we cover the basics in our guide to HIPAA marketing rules.

A blank checklist for a patient authorization form

Section 164.508(c) lists what a valid authorization must contain. The checklist below follows that section. It is a starting point for your attorney, not a form to copy.

What will be used.A specific description of the information: for example, which photos, which written statement, which video, and whether the patient’s name, age or treatment will be shown.
Who discloses it.The name of the practice, or the class of people, authorized to use or disclose it.
Who receives it.Who the information may go to: your website, your social media accounts, an ad platform, a marketing agency.
Why.A description of each purpose, such as “advertising and promotion of the practice’s services.”
Until when.An expiration date or an expiration event.
Signature and date.If a personal representative signs, a description of their authority to act for the patient.
Right to revoke.A statement that the patient may revoke the authorization in writing, with the exceptions and how to do it, or a reference to your notice of privacy practices.
No conditioning.A statement about whether treatment can be conditioned on signing. For marketing, it generally cannot.
Redisclosure.A statement that information disclosed under the authorization may be redisclosed by the recipient and no longer protected by the Privacy Rule.
Payment, if any.If a third party pays you for the marketing, the authorization must say so (164.508(a)(3)(ii)).

Give the patient a copy, keep the signed form with the record, and track the expiration date. When a patient revokes, stop new uses. Content already posted online is harder to recall, so plan in advance how you will take it down from your own site and accounts.

Rule 5: reviews are not testimonials you control

Online reviews on Google or Yelp are written by patients, not by you, but the reviews rule still reaches how you get and handle them. You may not post fake reviews, buy reviews, or suppress negative ones on your own site while implying you show all of them (465.2, 465.4, 465.7). Google’s policies also prohibit offering incentives for reviews.

Replying to reviews is where many practices create a HIPAA problem by confirming that the reviewer is a patient or discussing their care. See our guide to replying to patient reviews. If you want to quote a review in an ad or on your website, treat it like any other testimonial: get a written authorization, and do not edit it in a way that changes its meaning.

Rule 6: check the ad platform and your state board

Each ad platform has its own health rules on top of the law. Meta’s Health and Wellness ad standard, for example, says ads for cosmetic procedures, including those depicting before and after transformation, may run only when targeted to people 18 or older, and it does not allow ads with statements that attack a person’s appearance. Google Ads has its own healthcare and medicines policy. Read the current policy for each platform before you build a campaign; we cover the Google side for aesthetics in Google Ads for med spas.

Your state licensing board may also have advertising rules for your profession that go further than federal law, including rules on testimonials, outcome claims and photos. Look up the rules for your profession and state on the board’s own website, and keep a copy with the date you checked.

A simple process that keeps you on the right side

Decide in writing who on your team may request testimonials or photos, and who approves them before anything is published.
Ask for consent separately from treatment consent, after the patient has had time to see their result.
Store the signed authorization, the original words or image, and the published version together.
Review each claim for typicality and substantiation before it goes live.
Disclose any free treatment, discount or relationship next to the testimonial.
Set a review date for every published item and remove it on expiration or revocation.
Keep the patient’s identity minimal: a first name or initials is usually enough, and only if they agreed.

How we help

We build practice websites and campaigns that explain your services clearly without leaning on claims you cannot support. When a client wants to use patient stories, we build the pages so testimonials and photos appear only with a signed authorization on file, and we leave the legal review to the practice’s attorney. See our medical website design and med spa marketing services, or the full list of rules in our healthcare marketing rules guide.

Frequently asked questions

Can a medical practice use patient testimonials?

Federal law does not ban them, but the FTC Endorsement Guides require them to be real, not distorted, and either typical or accompanied by a clear statement of what is typical. A HIPAA covered entity needs a written authorization under 45 CFR 164.508 to use a patient’s information in marketing. State licensing boards may add their own rules.

Do we need written consent for before-and-after photos?

If you are a HIPAA covered entity, using a patient’s photos to promote your services is marketing and generally requires a signed authorization that meets 45 CFR 164.508(c). Photos are patient information, and cropping out the face does not on its own make them de-identified.

Is “results may vary” enough?

Usually not. The FTC says that if you cannot substantiate that a featured result is typical, you should clearly disclose the generally expected result, and the disclosure must change the overall impression of the ad.

Can we give a discount for a testimonial or review?

Under the FTC reviews rule you may not give anything in exchange for a review of a particular sentiment, and any free or discounted treatment given to someone who appears in your marketing must be clearly disclosed. Google’s policies also prohibit incentives for reviews.

Can we use stock photos or AI-generated images as before-and-after examples?

Presenting images or stories as real patient results when they are not would be deceptive under the FTC rules described above. We recommend showing only real, authorized patient content, or none.

What if a patient changes their mind?

A HIPAA authorization can be revoked in writing. Stop new uses once you receive it, and remove the content from your own website and accounts. Plan this before you publish.

Patient testimonials and before-and-after photos: the rules for practices