X (Twitter) for medical practices: the rules

A practice can post on X for free, pay to promote those posts as ads, or pay a creator to mention it. Each route runs under a different set of X rules, and each one sits on top of the same federal rules on patient privacy and endorsements. X’s health ad policy is written as a list of exceptions to a ban, so the details of what is listed, and for which country, decide whether an ad can run at all.

This guide covers what X’s health ad policy says for practices targeting the United States, what X allows in targeting and custom audiences, why a paid creator post about a practice is not eligible under X’s paid partnership rules, and what HIPAA and the FTC require when a practice posts or replies in public. For other platforms, see our guides to TikTok for medical practices and LinkedIn for healthcare companies; for the staff side, see our practice social media policy guide. For ads on Reddit, see our guide to Reddit Ads for medical practices. For the two newer text-first apps, see our guide to Threads and Bluesky for medical practices. Answer sites have their own disclosure and credential rules; see Quora for healthcare practices.

This is general information, not legal advice. Sources cited were checked on November 1, 2026: the X Help Center pages for the Health and pharmaceutical products and services ad policy, the Targeting of Sensitive Categories Policy, the Policies for Conversion Tracking and Custom Audiences, the Deceptive and Fraudulent Content ad policy, the Paid Partnerships Policy and the Private information policy (no date shown on the pages); the HHS OCR bulletin on online tracking technologies (content last reviewed June 26, 2024, with its note on American Hospital Association v. Becerra); 45 CFR 164.501, 164.502(a), 164.508(a)(3) and 164.514(b)(2)(i)(Q); 16 CFR 255.1(d) and 255.5(a); and 15 USC 45(a)(1). X changes its policies, so check the current versions before you launch. We found no federal rule or agency guidance written for X campaigns by practices as such. State rules differ, so have a health care attorney review your ads and posts.

The short version

X’s health ad policy says that unless a product or service is listed for the targeted country, promoting health and pharmaceutical products and services is prohibited.
The policy says it does not generally apply to hospitals, medical and dental practices. It does apply to listed medical and cosmetic services, including botulinum toxin treatment, which the policy names by brand, and telemedicine.
For the United States, X lists telemedicine by licensed providers as permitted only with prior authorization from X, and only in states where the provider is licensed and permitted to advertise. botulinum toxin treatment is not on the US list.
X prohibits targeting by health, and it prohibits custom audiences or conversion events based on health information.
Ads may not assert or imply knowledge of a person’s sensitive information, even when the targeting did not use it.
X’s Paid Partnerships Policy lists pharmaceutical and medicine-related products or services, including medical institutions, as not eligible, unless X grants an exception.
HIPAA bars a practice from posting or replying with patient information without a permitted basis, and the FTC requires disclosure of material connections in endorsements.

What X’s health ad policy says

X’s policy page is titled Health and pharmaceutical products and services. It applies to X’s paid advertising products and to monetization. It says X restricts the promotion of health and pharmaceutical products and services based on the product or service and the country targeted, and that unless listed for a country, the promotion is prohibited. Where a case needs prior authorization, X says authorization starts with being in touch with an X account team.

Two lists on the page matter for practices. The policy says it generally does not apply to prescription glasses and sunglasses, hospitals, medical and dental practices, STI and STD clinics, and certain non-prescription contraceptives. It does apply to a list that includes pharmacies, prescription and non-prescription drugs, regulated medical devices, clinical trials, health and wellness supplements, products that claim to diagnose, cure, treat or prevent disease or that claim to influence weight loss or muscle growth, and medical and cosmetic services such as abortion clinics, botulinum toxin treatment, prenatal gender selection and telemedicine.

The United States section lists these as permitted:

Brick and mortar pharmacies, if they do not promote the online sale or refill of prescription drugs, targeting only the United States and only with prior authorization.
Online pharmacies accredited by the National Association of Boards of Pharmacy, with restrictions, targeting only the United States and only with prior authorization.
Pharmaceutical manufacturers, with restrictions, targeting only the United States and only with prior authorization.
Medical devices. Devices that require FDA pre-market approval or notification need prior authorization and may target only the United States.
Telemedicine providing patient-to-provider services by licensed medical providers, targeting only states in which they are licensed to provide services and permitted to advertise, and only with prior authorization.

Over-the-counter medication ads are permitted when targeting the countries X lists, and the United States is on that list. Read with the rule that anything not listed is prohibited, a med spa ad for botulinum toxin treatment targeting the United States has no listed exception. That is our reading of the page, not a statement from X, so confirm your plan with an X account team before you spend.

A general ad for a medical or dental practice, about the practice, its location and its hours, falls on the side of the page that says the policy generally does not apply. The word generally matters. An ad for the same practice that promotes a listed service, such as telemedicine visits or injectables, is back inside the policy. Our guide to telehealth marketing for practices covers the licensing side of telemedicine ads.

Claims and other ad rules

X’s Deceptive and Fraudulent Content policy applies to all ads. Under the heading Impractical Outcomes, it says ads must not promise or suggest unjustified results, and it gives as examples unrealistic claims, results within a specific period, and health or economic opportunities. It also bars clickbait, misleading claims, offers that are not available, and leaving out vital information on pricing or payment terms.

Federal law sets the floor under those rules. The FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful (15 USC 45(a)(1)). No federal rule we found sets an X-specific standard for health claims. We recommend that a practice keep a short file for each ad with the claim, the evidence behind it and who approved it. Our guide to patient testimonials and before-and-after photos covers the FTC rules on results claims.

Targeting, custom audiences and the X pixel

X’s Targeting of Sensitive Categories Policy prohibits targeting people based on a list of sensitive categories, and health is on that list. It also prohibits use of public personal information in ad creatives, and ad copy that asserts or implies knowledge of personally identifiable or sensitive information, even when the ad was created and targeted without that information. An ad that says “Still living with back pain?” to a person in the feed can read as knowing something about them; an ad that says “Back pain care in [city]” does not.

X’s Policies for Conversion Tracking and Custom Audiences add two rules. First, X prohibits creating custom audiences or conversion events based on sensitive information, including health. Second, an advertiser that uses these products on its website must give visitors legally sufficient notice that it works with third parties to collect data for conversion tracking and interest-based ads, including cookies, obtain legally sufficient consent, and give instructions on how to opt out of X’s interest-based advertising.

HIPAA adds its own layer. A covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires (45 CFR 164.502(a)). A patient list is protected health information, and using it for marketing needs the patient’s written authorization, with narrow exceptions (45 CFR 164.508(a)(3)). The HHS Office for Civil Rights bulletin on online tracking technologies is still posted, with a note. On June 20, 2024, in American Hospital Association v. Becerra, the US District Court for the Northern District of Texas vacated the bulletin to the extent it said HIPAA obligations are triggered when a technology connects an IP address with a visit to an unauthenticated public page about specific health conditions or providers. The rest of the bulletin stands, including its guidance on tracking technologies on user-authenticated pages, such as a patient portal. Our guide to tracking pixels on practice websites covers this in detail.

Paid creator posts and staff posts

X’s Paid Partnerships Policy covers organic posts where a brand gives a user compensation or incentives to promote its product or service, including gifted products, payment, affiliate commissions or discount codes, and brand ambassador agreements. A paid partnership post must have the Paid Partnership disclosure turned on in the post’s content disclosure settings. X also says the poster is responsible for complying with advertising law, including the FTC’s Guides Concerning the Use of Endorsements and Testimonials in Advertising.

The same policy lists categories that are not eligible for paid partnership promotion. The list includes pharmaceutical and medicine-related products or services, with medical institutions named, as well as health and wellness supplements, and weight loss products and services and content focused on weight loss. X says it may consider exceptions on a case-by-case basis through a sales representative. X also says its paid partnership rules are separate from its ad policies, so content that cannot run as a paid partnership may still be allowed as an X ad.

The FTC rules apply whatever X allows. An endorser’s material connection to the advertiser that the audience would not expect must be disclosed clearly and conspicuously (16 CFR 255.5(a)), and an advertiser can be liable for misleading statements its endorsers make (16 CFR 255.1(d)). Staff who post about their employer have a material connection. Our guide to healthcare influencer marketing covers disclosures in more depth.

Posting and replying in public

X’s Private information policy says users cannot share certain types of private information without the permission of the person it belongs to, and it names health-related private information, such as biometric data or medical records. That is X’s rule. HIPAA’s rule is broader for a practice: a practice may not disclose protected health information except as the Privacy Rule permits (45 CFR 164.502(a)), and a public reply that confirms someone is a patient discloses protected health information even when the patient posted first.

Photos and video need the same care. Full face photographs and comparable images are on HIPAA’s list of identifiers that must be removed for information to count as de-identified (45 CFR 164.514(b)(2)(i)(Q)). Posting a patient’s photo to promote the practice is a marketing use under HIPAA’s definition (45 CFR 164.501), which needs written authorization (45 CFR 164.508(a)(3)). Our guides to patient photo consent and HIPAA and negative review replies cover both topics, including OCR settlements over review replies.

No federal rule we found requires a practice to reply to posts about it. We recommend a reply that does not confirm or deny a patient relationship and moves the conversation to a phone number or secure channel, such as: “We take feedback seriously and cannot discuss anyone’s care here. Please call our office manager at [office phone].”

Questions to ask before a practice runs X ads or posts

Does the ad promote the practice in general, or a listed service such as telemedicine, botulinum toxin treatment or a weight loss product?
If it is listed, is the United States on the list for that service, and do we have prior authorization from X?
Does any targeting choice, keyword or audience rely on health information?
Does the ad copy imply that we know the reader has a condition?
Have we uploaded any patient list to X, and do we have written authorization for that use?
Does our website give the notice, consent and opt-out instructions X requires for its pixel?
Is anyone paid, gifted or given a discount code to post about us on X?
Who reviews replies before they go out, and what is the standard reply?

Use and avoid

Use: general ads about the practice, its location, hours and services, checked against the health policy for the targeted country.
Use: location, language and interest targeting that does not rest on health information.
Use: the Paid Partnership disclosure on each eligible paid post, and a clear FTC disclosure.
Use: a reply template that does not confirm a patient relationship.
Avoid: ads for botulinum toxin treatment, supplements or weight loss products targeting the United States without first confirming with X that they can run.
Avoid: custom audiences built from patient lists or from visits to condition pages.
Avoid: ad copy that implies the reader has a condition.
Avoid: paid creator posts about the practice; X lists medical institutions as not eligible.
Avoid: results claims within a specific period, which X’s deceptive content policy names.

An illustration

This example is invented. [Practice name], a chiropractic office, wants to promote a new evening schedule on X. The first draft says “Neck pain keeping you up? Book tonight” and targets people who follow pain relief accounts. The office manager checks it against X’s rules. The copy implies the reader has neck pain, and the targeting leans on health interests, so both change. The final ad says “Evening chiropractic visits in [city], Monday to Thursday” and targets people within [number] miles who use English or Spanish. A local fitness creator offers to post about the office in exchange for free visits. The office declines, because X’s Paid Partnerships Policy lists medical institutions as not eligible. When a patient posts a complaint and tags the office, the reply uses the standard template and gives the office phone number.

Checklist

Read X’s current health ad policy and note the date you checked it.
Sort each planned ad into general practice ads or listed services, and check the US section for each listed service.
Get prior authorization from X where the policy requires it before you build the campaign.
Remove health-based targeting, keywords and custom audiences.
Add the notice, consent and opt-out language X requires if you use its pixel, and keep it off pages behind a patient login.
Do not upload patient lists without written HIPAA authorization.
Do not pay or gift creators to post about the practice on X unless X has granted an exception in writing.
Train staff on replies, patient photos and their own posts about the practice.
Have a health care attorney review the plan, including state law.

How we help

We build websites, local and organic search, Google Ads and lead generation and an AI front desk for independent practices. For X, that means checking each ad against the platform’s health policy for the targeted country, building targeting that does not rest on health information, and keeping tracking off pages where it does not belong. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. Read our guide to healthcare marketing rules for the wider picture.

Can a medical practice advertise on X?

X’s health ad policy says it generally does not apply to hospitals, medical and dental practices, so a general ad about a practice is outside it. Ads for listed services, such as telemedicine or botulinum toxin treatment, fall under the policy, and unless a service is listed for the targeted country, its promotion is prohibited.

Can we run telehealth ads on X in the United States?

X lists telemedicine providing patient-to-provider services by licensed medical providers as permitted in the United States, only in states where the provider is licensed and permitted to advertise, and only with prior authorization from X.

Can we target people with a health condition on X?

No. X’s Targeting of Sensitive Categories Policy lists health among the categories that may not be targeted, and its custom audience policy prohibits audiences or conversion events based on health information. Ads also may not imply knowledge of a person’s sensitive information.

Can we pay a creator to post about our practice on X?

X’s Paid Partnerships Policy lists pharmaceutical and medicine-related products or services, including medical institutions, as not eligible for paid partnership promotion, unless X grants an exception. Where a paid post is allowed, the FTC requires clear disclosure of the material connection (16 CFR 255.5(a)).

Can we reply to a patient who complains about us on X?

A practice may not disclose protected health information except as the Privacy Rule permits (45 CFR 164.502(a)). A reply that confirms the person is a patient discloses it. Reply without confirming a patient relationship, and invite the person to call the office.

X (formerly Twitter) for medical practices: ad policy, targeting, paid posts and patient privacy