US healthcare advertising answers to several regulators at once. The FTC polices deception, fake reviews and endorsements, HHS OCR enforces HIPAA on patient data, and each state board regulates its own licensees. This is how those rules shape what a practice can publish.
This is a working summary for marketing teams, not legal advice. Every rule below names the instrument it comes from so you can read the source rather than take our word for it, and so you can tell when something here has gone out of date.
Go deeper: HIPAA marketing compliance: tracking, BAAs and vendors.
Who regulates healthcare advertising in the United States
- FTC Act s5 (15 U.S.C. 45): deception and claim substantiation
- FTC Trade Regulation Rule on Consumer Reviews and Testimonials, 16 CFR Part 465 (in force 21 Oct 2024)
- FTC Endorsement Guides, 16 CFR Part 255 (revised 2023)
- HIPAA Privacy Rule, 45 CFR 164.501 and 164.508(a)(3), and HHS OCR guidance on online tracking
- Federal Anti-Kickback Statute (42 U.S.C. 1320a-7b(b)), the Beneficiary Inducements CMP and EKRA
- State medical boards and statutes, e.g. Texas Occ. Code 101.201, California Bus. & Prof. Code 651, Florida rule 64B8-11.001
More than one of these usually applies at once. A campaign can satisfy the advertising regulator and still breach the data-protection one, which is the failure mode that catches most practices: the creative gets reviewed and the tracking does not.
The rules that actually change what you can publish
- Fake reviews and testimonials, including AI-generated ones, are banned, as are reviews bought on condition of sentiment and undisclosed staff reviews. Penalties reach $53,088 per violation (16 CFR 465).
- Inviting only happy patients to leave reviews may be deceptive. Invite every recent patient (16 CFR 255.2(d)).
- Testimonials and before/after images imply typical results: substantiate them or disclose the result patients generally get (16 CFR 255.2(b)).
- Any testimonial, photo, video or story that identifies a patient needs a signed HIPAA marketing authorisation (45 CFR 164.508(a)(3)). Review replies must never confirm that someone is a patient.
- Paid influencers and paid doctors must disclose the connection clearly in the post itself (16 CFR 255.5).
- Objective claims such as “#1”, “painless” or “99% success” need proof before they run (FTC Act s5).
- States add their own rules. California requires exact prices and unaltered, comparable before/after images; Florida requires a 72-hour statement on free or discounted offers; Texas treats testimonials as high-risk.
- Per-click, per-booking or per-patient payments for marketing can implicate the Anti-Kickback Statute. Flat fees are the safer structure.
At a glance: tactic by tactic
| Tactic | Where it stands | What applies |
|---|---|---|
| Patient testimonials | Allowed with conditions | Allowed if genuine and representative, or the typical result is disclosed, with a signed HIPAA marketing authorisation. Fake or AI-written testimonials are banned; Texas treats testimonials as high-risk. Source: 16 CFR 465.2 (FTC, 2024); 16 CFR 255.2(b); 45 CFR 164.508(a)(3). |
| Asking for and showing reviews | Allowed with conditions | Ask every patient through the same neutral request. Fake, AI-written and sentiment-linked paid reviews are banned, gating may be deceptive, and replies must not reveal patient details. Source: 16 CFR 465.2, 465.4, 465.7 (FTC, 2024); 16 CFR 255.2(d); HIPAA Privacy Rule. |
| Before-and-after images | Allowed with conditions | Allowed with proof the result is typical, or disclosure of the expected result, and a signed HIPAA authorisation. California requires unaltered, comparably presented images that name the procedure. Source: 16 CFR 255.2(b); Cal. Bus. & Prof. Code 651(b)(3); 45 CFR 164.508(a)(3). |
| “Best”, “No.1” and guarantee claims | Allowed with conditions | Objective claims such as “#1”, “painless” or “99% success” need proof before they run. States treat unjustified expectations and unsubstantiated superiority as false advertising. Source: FTC Act s5; Tex. Occ. Code 101.201; Cal. Bus. & Prof. Code 651. |
| Prices, discounts and offers | Allowed with conditions | Allowed under state rules: exact prices in California, a capitalised 72-hour statement on free or discounted services in Florida. Inducements to Medicare or Medicaid patients are restricted. Source: Cal. Bus. & Prof. Code 651(c); Fla. Stat. 456.062; 42 U.S.C. 1320a-7a. |
| Influencers and endorsements | Allowed with conditions | Allowed with a clear, unavoidable disclosure of payment or free treatment in the post itself. Agencies can be liable too. Source: 16 CFR 255.5, 255.1(f) (FTC Endorsement Guides). |
| A doctor promoting their own practice | Allowed with conditions | Truthful, non-deceptive advertising is allowed. Titles such as “board certified” must meet state rules, and the doctor answers for ads an agency makes. Source: AMA Code of Medical Ethics Op. 9.6.1; 22 Tex. Admin. Code 164.4; Fla. Admin. Code 64B8-11.001(5). |
| AI-generated content | Narrow exceptions | AI-written reviews or testimonials from people who don't exist are banned, and AI avatars must not pose as real patients. California and Texas add AI disclosure duties for patient communications. Source: 16 CFR 465.2; 16 CFR 255.2(c); Cal. Health & Safety Code 1339.75; Texas TRAIGA (2026). |
| Patient images and data | Allowed with conditions | Using PHI, including patient photos or stories, for marketing needs a written HIPAA authorisation. No ad pixels on authenticated pages or booking flows without a BAA. Source: 45 CFR 164.501, 164.508(a)(3); HHS OCR online tracking bulletin (2024). |
| Regulator approval before publishing | Process | No pre-clearance for service ads, but objective claims need proof before they run, and the licensed client approves every ad. Source: FTC Act s5; Fla. Admin. Code 64B8-11.001(5). |
How Branding Pioneers handles it
- We sign a BAA before touching PHI, and PHI stays in US-hosted systems.
- Every patient asset has a signed HIPAA authorisation naming the media, channels and duration.
- One neutral review request goes to every patient. No gating, no sentiment-linked incentives, no bought reviews.
- Review replies follow a HIPAA-safe template that never confirms a patient relationship.
- Every objective claim has a substantiation file before it runs.
- We bill flat fees, never per patient or per booked appointment.
- No Meta, Google or TikTok pixels on authenticated pages, patient portals or booking flows.
- The licensed client approves every ad before it runs.
Tracking deserves the same scrutiny as copy. Analytics, pixels and remarketing tags routinely collect more than a healthcare provider is permitted to share, and the default installation of most of them is not compliant in the United States. Audit what your tags send before you audit your ad copy.
Before you run anything
- Can you substantiate every claim in the creative, today, from a document you can produce?
- Do you have written consent for every patient who appears, covering this specific use?
- Has the approval or licence this market requires been granted, and is its number on the creative where required?
- Does your tracking send anything that identifies a patient or their condition?
- Has someone qualified in the United States reviewed the campaign, not just the marketing team?
If the answer to the last one is no, that is the gap worth closing first. We work inside these rules daily and will tell you when something you want to publish is not worth the exposure, but we are a marketing agency, and a regulated market deserves a qualified reviewer as well.
Not legal advice. A planning summary of published rules, last checked on 11 October 2026. Rules change, so confirm the current text with the regulator or local counsel before relying on it.
