Posting patient photos: what the rules actually require, and where practices get caught.

In an aesthetic or dental practice, the content that performs best is almost always the same thing: the image before beside the image after. It is also the content that carries the most exposure, and rarely for the reason people expect.

The exposure is not really about taste or tone. A photograph of a patient that shows a face, a tattoo, a distinctive scar or any other identifier is protected health information. That puts it under HIPAA, and HIPAA is specific about what has to happen before it appears anywhere.

The first thing worth separating is consent from authorisation, because most practices treat them as one document and they are not. Consent to treat covers the clinical work. Using an image for marketing, education or publication is a different purpose, and it needs its own written authorisation.

That authorisation has to be specific, and this is where the paperwork usually falls short. A line at intake saying the practice may use images is not enough. The authorisation should name what will be used, for what purpose, and where it will appear, including the platforms. A form written before the practice had a social account does not describe what you are about to do with the photograph.

There is a second detail that surprises people, and it is worth stating plainly because it runs against instinct. If a patient posts their own before and after publicly and tags you, resharing it to your practice account is still a marketing use of protected health information. Their post is theirs. Your repost is yours, and it needs written authorisation like any other.

Then there is revocation, which is the part almost nobody plans for. A patient has the right to withdraw authorisation. A post that has circulated, been screenshotted, saved and reshared cannot be meaningfully withdrawn. You can delete your copy. You cannot delete the copies.

The honest way to handle that is not to hide it. Say it at the moment you ask: once this is published it may be shared beyond our control, and taking it down later will not undo that. Patients who agree after hearing it agree properly, and the ones who hesitate were going to regret it.

HIPAA is only one of the two layers, and the second one catches practices that got the first one right. Advertising claims are the FTC's territory, and a before and after is an advertising claim about what your treatment produces.

That means the images have to be truthful and not misleading. Retouching, filtering, changing the lighting between the two shots, or shooting the after at a flattering angle the before did not get, turns a real result into a misleading one. So does showing only exceptional outcomes with nothing indicating how typical they are.

The item most often missed sits one step earlier. If a patient received a discount, a free treatment or anything else of value in exchange for appearing in your content, that is a material connection, and it has to be disclosed clearly in the post itself. Not in a bio, not in a story that expires. It is an easy thing to fix and an awkward one to explain after the fact.

On top of both, state boards write their own advertising rules, and they vary. Some are stricter than the federal floor on before and after imagery specifically. Your board is the last word on your licence, so its rules are the ones worth reading in full.

Read the three layers together and a pattern shows up that none of them states directly. Almost everything restricted is a way of asserting a result. Almost nothing restricted has to do with explaining judgement.

Which means the rules, without intending to, describe an editorial line. They push a practice toward content about criteria: what indicates a procedure and what rules it out, who is not a candidate and why, what recovery actually looks like week by week, what tends to go wrong and how it is handled. None of that is restricted. None of it requires a patient photograph. And none of it can be copied by someone without the training to sustain it.

There is a commercial effect here worth naming, because it is the opposite of what most people assume. Results content attracts people comparing price, because that is precisely what it communicates: the same procedure, now find the cheapest one. Criteria content attracts people deciding who to trust. The first fills your inbox with how much. The second fills the calendar.

One last point, and it argues against my own business. Nothing written here requires hiring anybody. The three most valuable corrections in this piece are free: rewrite the authorisation form so it names purpose and platform, stop resharing patient posts without one, and replace result carousels with explanations of judgement. Do only that and your account becomes both safer and better.

Hiring makes sense at a different moment, and it helps to recognise it. Not when you do not know what to publish. When you already know, and the constraint has become sustaining it every week with somebody answering the messages it generates before the patient gives up and books elsewhere.

A necessary note. This piece reflects published guidance on HIPAA authorisation requirements and FTC advertising standards as they stood in August 2026, and it is not legal advice. Requirements change, state boards add their own, and your own counsel is the one who can read your forms against your situation. If you take one thing to them, make it the authorisation form.