Social media marketing for medical practices: teach in public, get a signed authorization before a patient appears, and never confirm a patient in a reply

Social media marketing for a medical practice works when the feed teaches, shows the clinicians, and makes booking easy, and when it treats every patient detail as protected health information. In the US, that means a signed HIPAA authorization before any patient's photo, story or testimonial is posted, replies to reviews and comments that never confirm someone is a patient, and FTC disclosure whenever a staff member or paid creator promotes the practice.

This page is written for US physician groups, specialty practices and outpatient clinics. Practices in India work under different conduct rules, and our guide to social media for doctors and clinics in India covers those.

What a practice feed is for

A practice account has three jobs, and every post should serve one of them.

• Help the patients you already have. Opening hours, new locations, portal sign up, flu shot clinics, what to bring to a first visit.
• Introduce the clinicians. People choose a doctor before they choose a practice. A short video of each physician explaining how they work does more than any slogan.
• Give a new patient a reason to book. Clear explanations of the conditions you treat and the services you offer, with one link to book or call.

Facebook is still where local community news and older patients are. Instagram suits visual specialties and short video. YouTube holds longer explainers that keep working for years and can be embedded on your service pages. LinkedIn matters if referrals from other physicians are a large share of your new patients. Pick two and do them well.

The HIPAA line a social post must not cross

The rule that matters most for social media is not the marketing rule. It is the general rule on using patient information. Under 45 CFR 164.508(a)(1), a covered entity "may not use or disclose protected health information without an authorization that is valid under this section," unless another part of the rule permits it. A patient's face in a waiting room photo, a before and after image, a thank you card with a name on it, or a story about a recovery are all patient information once your practice posts them.

So the practice needs a signed authorization before the post, not a verbal yes in the exam room. Section 164.508(c)(1) lists the core elements a valid authorization must contain, including:

• a specific description of the information to be used, such as the named photographs or the written story;
• who will use it and who will receive it, which for a public post is anyone who sees it;
• a description of each purpose;
• an expiration date or event;
• the patient's signature and the date.

Give the social team one rule: no patient appears in any post without a signed form on file.

The marketing definition is still worth knowing. Under 45 CFR 164.501, a communication describing a health-related product or service "provided by" the covered entity is not marketing, except where the practice receives financial remuneration from a third party for making it. A post about your own new sleep clinic is not HIPAA marketing. A post about a device that a manufacturer pays you to mention is, and patient information may not be used for it without an authorization that says payment is involved, under 164.508(a)(3).

Comments, messages and reviews

The fastest way for a practice to break the privacy rule on social media is a reply. A patient posts an angry review, and somebody at the practice answers with the dates of the visit or the reason for it. HHS's Office for Civil Rights has reached settlements with dental and medical practices over exactly this kind of reply.

Write two or three approved replies and use them:

• "We take every comment seriously. Our privacy obligations stop us discussing anyone's care here, so please call our practice manager on our main number."
• "Thank you for the kind words. We will pass them to the team."

Neither reply confirms that the writer is a patient. Move clinical questions in comments or direct messages to the phone or the patient portal, and never give medical advice in a public thread.

If an agency or a freelancer will read patient messages in your inbox, they are handling protected health information for you. Under 45 CFR 164.502(e), you need "satisfactory assurance" that they will safeguard it, and that assurance "must be documented through a written contract," which is the business associate agreement your compliance lead will recognise.

Testimonials, staff posts and paid creators

The FTC's rules apply to a practice like any other advertiser. We read them in the eCFR on 21 October 2026.

• Typical results. Under 16 CFR 255.2(b), a patient testimonial about a key result is likely to be read as what most patients can expect. If you cannot support that, disclose the generally expected result.
• Staff and paid creators. Under 16 CFR 255.5, a connection that "might materially affect the weight or credibility of the endorsement" must be disclosed clearly and conspicuously. That covers a local creator given a free treatment, and staff posting about the practice where readers would not know they work there.
• Reviews. 16 CFR 465.4 bars giving "compensation or other incentives" for reviews that express a particular sentiment. Asking every patient for an honest review is fine. A gift card for a five star review is not.
• Followers. 16 CFR 465.8 bars buying fake indicators of social media influence, such as purchased followers or views.

A content plan a practice can keep up

Three posts a week is enough for most practices if they are real. Batch film the explainers once a month, so the physicians give an hour rather than a little of every day.

Campaign ideas that suit healthcare: a month of short answers to the questions your front desk hears most, a "meet the team" series when a new location opens, a screening awareness month tied to a booking link, and a series that walks a new patient through a first visit from parking to checkout.

Boosting posts and the pixel

Paid promotion follows different rules from the organic feed. Meta's Business Tools terms list prohibited information that advertisers must not send, including information about "diseases, medical conditions and injuries," "medical procedures, treatments and testing," and "physical locations that identify a health condition, or places of treatment and counseling" (Meta help article 361948878201809, read 21 October 2026). That has consequences for any pixel on appointment and condition pages. Our page on Facebook ads for hospitals covers the paid side in detail.

Choosing a healthcare social media agency

Ask any agency or freelancer four questions before you sign. How do they collect and store patient authorizations? Who in their team replies to comments, and with what approved wording? Will they sign a business associate agreement if they see patient messages? And what do they report each month beyond follower counts? Useful answers point to booked appointments, calls from the profile and portal sign ups. This is general guidance, not legal advice, so run your authorization form and reply wording past your compliance lead or a healthcare lawyer.

Questions about social media for medical practices

Can a medical practice post patient photos on social media?

Only with a signed HIPAA authorization that meets 45 CFR 164.508. A verbal yes is not enough, and the form should name the specific images and the purpose.

Can we reply to a negative review on Facebook or Google?

Yes, but without confirming that the reviewer is a patient or mentioning any detail of care. Invite them to call the practice manager instead.

Can doctors at the practice post on their own accounts?

Yes. When they promote the practice, the connection should be clear to readers, and the same patient privacy rules apply on a personal account as on the practice page.

Are posts about our own services HIPAA marketing?

Not under the 45 CFR 164.501 definition, unless a third party pays you to make them. The privacy rule still applies to any patient information in the post.

How often should a medical practice post?

Two or three times a week is a sustainable rhythm. Consistency matters more than volume.

When a patient asks an assistant which practice to choose

A patient choosing a new doctor can now ask ChatGPT or Gemini something like "which family doctor near me takes new patients and has good reviews?" before they look at a single feed. The assistant names a handful of practices, drawing on review sites, directories and practice websites, and the explainer videos you post help only if that public record also describes you clearly. AI Knows Us belongs to a new category that checks exactly that: whether the assistants name your practice when a patient asks, and which sources they used to decide.