Healthcare marketing answers to four overlapping rulebooks at once: HIPAA (never expose patient health information in ads, testimonials, or retargeting), the FTC's truth-in-advertising and endorsement rules, written consent for testimonials and before/after photos, and each ad platform's own health policy. What follows is a plain-English map of those rules, not legal advice. When real money or a medical claim is on the line, run it past a healthcare attorney first.
Not legal advice. This is a practitioner's field guide, not a substitute for a lawyer who knows your state and specialty. Rules change, and enforcement varies by jurisdiction.
The four rulebooks you're actually marketing under
Every healthcare ad answers to at least four authorities at once, and most practices only think about one of them. HIPAA protects patient information. The FTC polices whether your claims are true and your reviews are honest. Consent law decides whether you can even use a patient's face or words. And the ad platforms layer their own health rules on top of all of it. Miss any single one and a campaign that looked fine turns into a fine. The good news: the compliant version of each rule is usually the more persuasive version anyway.
HIPAA: patient information is not marketing material
Under HIPAA, you cannot use protected health information (PHI)—any detail that ties a person to a condition or treatment—in marketing without a signed authorization. That covers the obvious, like a patient's name and diagnosis in an ad, and the sneaky: a retargeting pixel that fires on a "hair-loss treatment" page and follows that visitor around the web, or a "custom audience" built from your patient list. Even a friendly public reply to a review can confirm someone was your patient—which is itself PHI. Keep tracking off condition-specific pages, get written authorization before any patient detail appears in marketing, and treat your patient database as off-limits for ad targeting. The deeper mechanics live in our guide to HIPAA compliance for clinic websites.
FTC truth-in-advertising: if you can't prove it, don't claim it
The FTC requires that every objective claim in your marketing be truthful and substantiated before it runs—not after someone complains. "Painless." "Guaranteed results." "The #1 clinic in the state." Each of those is a factual claim you'd have to back with evidence. The rule isn't "don't sell"; it's "don't say what you can't prove." Swap absolutes for specifics you can document, qualify your outcomes, and skip manufactured urgency. Honest specifics like "most patients return to work the next day" outperform hollow superlatives anyway, and they don't invite a complaint.
Testimonials and endorsements: real, representative, disclosed
The FTC's endorsement rules say testimonials must reflect honest, typical experiences, and any incentive behind them must be disclosed. A five-star review you paid for, gifted a discount for, or wrote yourself is deceptive if that connection isn't clear. Cherry-picking your one spectacular result and presenting it as normal is the same problem in a different shirt. Ironically, most practices under-use the reviews they're actually allowed to show. In dentistry—a field we've measured directly, where a ClinicEdge audit of 6,554 dental practice websites found 22% display patient reviews nowhere on the site—clinics routinely bury the honest testimonials while the over-shared, risky ones create the exposure. Show the genuine, representative ones; disclose any material connection right next to the claim.
Before/after photos and patient consent
A HIPAA authorization and a photo release are two different documents, and you need both before a patient's image runs anywhere. The release should name exactly where the images may appear—website, Instagram, paid ads—because consent for a framed photo in the lobby is not consent for a Facebook campaign. Label individual results as individual; implying every patient gets the same outcome reopens the FTC problem. For injectables and cosmetic work the stakes climb, because the photo doubles as a medical claim—we cover that specific trap in is it illegal to advertise Botox. State dental and medical boards then add their own advertising rules on top, and our breakdown of advertising ethics and state regulations shows how far they vary from state to state.
FDA-regulated claims: Botox, devices, and prescription drugs
If you market a prescription drug or a regulated device, your claims must stay inside what the FDA-approved labeling supports. Botox is a prescription product; a laser or a filler is a regulated device. Promoting an off-label use, or claiming a treatment cures a condition it isn't approved for, crosses from marketing into a regulatory violation. Keep the language on-label, avoid disease-cure promises, and check a product's approved indications with the FDA before you write the ad. When in doubt, describe the experience and the clinician's credential, not a guaranteed medical outcome.
Platform health-ad policies stack on top of the law
Google, Meta, and other networks enforce their own healthcare rules—and they will disapprove an ad that's perfectly legal but off-policy. Google restricts certain health content, prohibits some targeting, and requires certification for regulated categories like pharmacy; the specifics live in Google's Healthcare and Medicines policy, and we unpack it for clinics in the Google Ads healthcare policy guide. Treat each platform's rulebook as a separate gate: clearing HIPAA and the FTC does not mean your ad clears Google or Meta.
The healthcare marketing compliance table
Here's the whole rulebook on one screen—each area, what it restricts, and the safe move.
| Rule area | What's restricted | The safe practice |
|---|---|---|
| HIPAA (patient privacy) | Using patient-identifying health info—names, photos, conditions, "I saw Dr. X for..."—in ads, retargeting, or testimonials without authorization | Get a signed HIPAA marketing authorization; keep pixels off condition-specific pages; never target from a patient list |
| FTC truth-in-advertising | Claims you can't substantiate; "painless," "guaranteed," "#1," manufactured urgency | Only claims you can prove; document the basis; qualify outcomes as individual |
| FTC endorsements & testimonials | Undisclosed paid or incentivized reviews; cherry-picked results shown as typical; fake reviews | Disclose any material connection near the claim; use real, representative results |
| Before/after photos | Publishing patient images without a specific written release; implying typical outcomes | Separate photo release naming each channel; label results as individual |
| FDA-regulated claims (Botox, devices, Rx) | Off-label promotion; claiming more than the approved labeling supports | Stay on-label; avoid disease-cure language; verify approved indications |
| Ad-platform health policy | Restricted health content, prohibited targeting, unapproved pharma | Follow each platform's healthcare policy; complete required certification |
Your pre-publish compliance checklist
Run every campaign through these seven checks before it goes live.
- Confirm you hold signed authorization or consent for every patient name, quote, and photo you plan to use.
- Read each claim and ask "can I prove this?"—delete or qualify anything you can't substantiate.
- Disclose any incentive behind a review or endorsement, in plain words, right next to it.
- Check that your tracking pixels and retargeting lists aren't firing on pages that reveal a health condition.
- Match the ad to each platform's healthcare policy and complete any required certification.
- Keep drug and device claims inside approved, on-label language.
- When a claim, a jurisdiction, or a fine is on the line, have a healthcare attorney review before publishing.
One quiet bonus: honest, accurate marketing is also better SEO. Search engines reward pages whose titles and content actually match what they promise, as Google's own SEO starter guide lays out—so the compliant version of your page tends to rank better, too.
Where practices go wrong and how to fix it fast
Most compliance failures aren't malice; they're a marketing vendor who has never marketed under HIPAA. A generic agency drops a tracking pixel on every page, runs a testimonial with no release, and writes "guaranteed" because it converts—none of it flagged, because they don't know the rules exist. If you're not sure whether your current site and ads are clean, that's exactly the review worth doing before the next campaign spends a dollar. Send us your site and we'll tell you where the exposure is.