Patient testimonials without violating HIPAA: the three rule sets and the ask
Yes, you can use patient testimonials in healthcare marketing. But a testimonial triggers three rule sets at the same time, and "she agreed to it" satisfies only one of them. Before a patient's story appears in your marketing you need the patient's written HIPAA authorization, the endorsement has to meet the FTC's truthfulness rules, and the placement has to survive the ad platform's health policies. Miss any one and the other two do not save you.
The glossary version of this lives in the definitions page; this is the working version, rule set by rule set.
Rule set one: HIPAA, and why a review is patient information
The fact that a specific person is your patient is itself protected health information. That surprises operators, because a happy patient volunteering their story feels like the opposite of a privacy problem. But the Privacy Rule is explicit: under 45 CFR 164.508(a)(3), "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing," with exceptions only for a face-to-face communication and a promotional gift of nominal value. This authorization is distinct from consent to treatment, and it has to describe the use "in a specific and meaningful fashion." A signature buried in intake paperwork covering "communications" does not cover a Facebook ad with the patient's face on it.
Two practical consequences. First, the authorization is a document your marketing team must be able to produce, per testimonial, on request. If you cannot point to the file, treat the testimonial as unusable. Second, the rule says an individual "may revoke an authorization provided under this section at any time" in writing, which means your process needs a way to actually take the material down everywhere it ran, and a record of where it ran.
Rule set two: the FTC, and what the endorsement itself may claim
HIPAA governs whether you may use the patient's story. The FTC governs what the story may say. Under the endorsement guides, 16 CFR 255.2, a testimonial has to reflect the honest experience of a real patient, and a consumer endorsement "will likely be interpreted as representing that the endorser's experience is representative of what consumers will generally achieve." If you cannot substantiate that typical patients get that result, the guides require the ad to "clearly and conspicuously disclose the generally expected performance in the depicted circumstances." A "results not typical" disclaimer does not cut it; the FTC's own testing found that disclaimer fails to change what people take away.
The trap in health categories: an outlier result, honestly told. The patient who did spectacularly well is precisely the patient most eager to give a testimonial, and precisely the story that misleads if presented as representative. This is the testimonial version of the denominator problem: a true story about the wrong sample. And the guides close the door on the workaround directly, in a sentence worth having on the wall: "Consumer endorsements themselves are not competent and reliable scientific evidence." A testimonial can carry trust. It cannot carry substantiation.
Material connections get disclosed. If the reviewer got a discount, free product, or works for you, the audience has to be told, in the post itself, plainly.
Rule set three: the platform, because the placement is an ad
A testimonial that clears HIPAA and the FTC can still be rejected, or worse, by the platform it runs on. Health advertisers operate under restricted policies that limit personal-attribute framing and health claims, and a patient story is dense with both. A first-person account of a condition, boosted as an ad, is your ad under the same policies that reject health creative every day. The practical rule: every testimonial placement gets the same policy review as your paid creative, because the moment you boost, share, or feature it, it is your paid creative.
How do you actually ask?
The mechanics above are the safe container. The awkwardness of asking is what stops most practices, and it produces the worst pattern: no process at all, so the only testimonials that surface are the spontaneous outliers.
The structural fixes are simple. Ask at the right moment, which is after an outcome the patient has named themselves, not after a visit you thought went well. Make the authorization part of the ask, not a surprise afterward. Offer degrees: a first-name review, an anonymous story with identifying details removed still needs the authorization, a full named testimonial. And never trade anything of value for a positive review, which converts a testimonial into a paid endorsement with its own disclosure duties, and on many review platforms is banned outright.
Frequently asked questions
Do I need a patient's permission to use their public review in my ads?
Yes. A review the patient posted publicly still becomes your marketing use of their patient status when you feature it, which requires written HIPAA authorization. The platform's terms and the FTC's endorsement rules apply on top.
Can I use anonymous patient stories without authorization?
De-identification is narrower than removing the name. If the story's details could reasonably identify the patient, it is still their information. The safe operating rule: get the authorization anyway, and let anonymity be a presentation choice rather than a legal strategy.
Are before-and-after photos treated like testimonials?
They are endorsements and patient information at once, so both rule sets apply, plus platform policies that restrict before-and-after imagery in health categories specifically. Many health advertisers stop using them not because they cannot be done lawfully, but because the platform-rejection and typicality risks outweigh the lift.
This page describes marketing operations, not legal advice. Authorization forms and endorsement disclosures need review by your counsel. Regulatory language is quoted from the eCFR as of the last-updated date; the linked sections are the living source.