The Fear of HIPAA Is Costing You More Than a Violation Would
A dermatologist refusing before-and-after photos because "it might violate HIPAA" watches competitors grow by 50 patients per month. HIPAA prevents unauthorized disclosure of PHI. It does not prevent marketing.
Green Zone: Post Without Concern
General health education. Doctor-to-camera videos (no specific patients). Facility photos (no identifiable patients). Staff content. De-identified case discussions. Aggregate statistics.
Yellow Zone: Requires Authorization
Patient testimonial videos — need signed HIPAA authorization specifying: info disclosed, purpose, audience, right to revoke, expiration.
Before-and-after showing identifiable patients — authorization required. Showing only treated area with no identifying features — de-identified, no authorization needed.
Patient names in posts — authorization required if connecting name to condition.
Red Zone: Never Post
Identifiable patient without authorization. Patients in background of videos. Responding to reviews with clinical details. Sharing patient message screenshots.
Outside the US: India and Elsewhere
HIPAA authorisation is a US idea. Other markets work differently, and some ban the yellow-zone content outright.
In India, the DPDP Act 2023 requires consent for processing health data in marketing. On top of that, the National Medical Commission's guidelines of 6 October 2026 bar doctors from requesting or sharing patient testimonials or reviews for promotion, rule out promotional before-and-after images, and say consent does not make either permissible (Expl. V to para 3.2; para 6.2, 8.1(v)). Superlatives, discounts and free procedures are out too (para 8.1(iii), (ix), (x)), and every post needs the doctor's name, qualifications and SMR/NMR number (Expl. III). Educational content is fine. See our NMC guidelines summary.
In Australia, AHPRA bans testimonials about clinical aspects of care, whatever the patient has signed.
Checklist Before Every Post
Does this contain patient-identifiable info? If yes, signed authorization? Patients visible? Claims with disclaimers? Medical council compliant? Would a regulator be comfortable?
