HIPAA and Social MediaWhat a Practice Can Post

A practice can post health tips, practice news and staff content freely, but anything that identifies a patient needs that patient's valid written HIPAA authorization first. That includes photos, success stories and replies to reviews. HHS has settled several cases over exactly these posts. This guide shows where the line sits and how to stay on the right side of it.

HIPAA and social media at a glance

• General health education, office news and team posts are fine.
• A full-face photo of a patient is an identifier under HIPAA.
• Patient stories and testimonials need written authorization.
• Never confirm someone is a patient when you reply to a review.
• Train every staff member who touches social accounts, including marketing.

What counts as patient information on social media?

More than names. HHS's de-identification guidance lists 18 identifiers. They include names, dates tied to a person, phone numbers, and "Full-face photographs and any comparable images." A smiling patient photo in your lobby can identify that person. So can a first name plus a procedure and a date.

What can a practice post without patient authorization?

Anything that contains none of the 18 identifiers and no patient's health details. These four types of post are the safest.

• Health education

  Tips, seasonal reminders and answers to common questions, with no patient in them.

• Practice news

  New hours, a new location, a new service or a holiday closure.

• Your team

  Staff introductions and events, with no patients in frame or on screens behind them.

• Community events

  Health fairs and sponsorships, with photos that show no patients unless they signed.

When do you need a patient's written authorization?

Before any post that shows or describes a patient. OCR Director Paula M. Stannard said in September 2025: "Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual's PHI in a website testimonial or through a social media campaign." She said it when HHS settled with Cadia Healthcare Facilities for $182,000. Its "success story" program had disclosed information about 150 patients.

The same rule covers marketing generally. HHS's marketing guidance requires an individual's written authorization before PHI is used for marketing, with limited exceptions. Our guide to HIPAA marketing rules covers email, ads and testimonials.

Can you reply to patient reviews on social media?

Yes, but only in general terms. In December 2022, OCR Director Melanie Fontes Rainer said: "Providers cannot disclose protected health information of their patients when responding to negative online reviews." That came with a $23,000 settlement with New Vision Dental, which had posted patient names, treatment and insurance details in review replies.

A safe reply thanks the reviewer, gives no details, and invites them to call the office. See Can You Reply to Patient Reviews Under HIPAA? for sample wording.

Do staff need social media training?

Yes. HHS required it in the Cadia settlement. The corrective action plan called for training for "all members of their workforce, including marketing personnel." Whoever runs your accounts, in-house or at an agency, needs to know the rules above.

What about social media pixels on your website?

They are a separate risk. A social media ad pixel can send visitor data to the platform. HHS's tracking guidance says regulated entities "are not permitted to use tracking technologies in a manner that would result in impermissible disclosures" of PHI. A court vacated part of that guidance in June 2024, so check the current page. Use our 5-step tracking check to see what your site sends.

How do you write a social media policy for a practice?

Keep it short enough that staff will read it. These 5 steps cover the cases in the HHS settlements above.

1. 1

   Name who can post

   List the people allowed to post or reply on practice accounts. Remove access when they leave.

2. 2

   Define what is off limits

   No patient names, faces, procedures, dates or screens with patient data unless a signed authorization is on file.

3. 3

   Use a written authorization form

   Collect a signed HIPAA authorization before any testimonial, story or patient photo is used. Store it with the post.

4. 4

   Set a review reply template

   Thank the reviewer, share no details, and invite them to contact the office directly.

5. 5

   Train and repeat

   Train all staff who touch social accounts, including marketing staff and agencies, and repeat it every year.

How Webpatch helps

Webpatch manages HIPAA compliance and security for healthcare practices. We review your website and social setup for patient data risks, audit pixels and tags, and help you put a written social media process in place. We are not a law firm, so have your attorney approve the authorization form. Contact Webpatch to review your accounts.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.