Using Patient Testimonials Without Risking a HIPAA or FTC Violation

A patient testimonial can be perfectly legal under HIPAA and still violate FTC rules, or the reverse, because a HIPAA authorization and FTC-compliant disclosure language are two separate documents answering two separate questions. This article describes what current HHS and FTC guidance says about patient testimonials. It is not legal advice: confirm your specific use case with your own healthcare attorney before publishing any patient story, and note HIPAA penalties can reach well into six figures per violation.

Two separate rules, not one compliance checklist

Direct answer: HIPAA governs whether you’re allowed to use a patient’s protected health information at all, and requires a specific signed authorization; FTC rules govern whether the testimonial misleads a viewer about typical results. Meeting one doesn’t mean you’ve met the other.

HHS’s own guidance on the intersection of HIPAA and the FTC Act makes clear these are administered by different agencies with different concerns: HIPAA protects the patient’s health information, while the FTC protects the public from misleading advertising (HHS, HIPAA and the FTC Act). A testimonial can have a flawless, patient-signed release under one framework and still cross the line under the other if it implies a typical result that isn’t typical.

What a valid HIPAA authorization for marketing must contain

Direct answer: a valid HIPAA authorization for marketing must specify what information will be used, the purpose, where it will be published, that the patient can revoke it, and that it isn’t a condition of treatment.

HHS’s FAQ on authorizations lays out these required elements for marketing uses of protected health information (HHS, HIPAA Authorizations FAQ). A generic intake-form signature or a verbal “sure, you can post that” does not meet this standard. The authorization must name the specific content and publication location (your website, a social platform, an ad) and tell the patient they can revoke consent later, in writing.

What the FTC requires for testimonials

Direct answer: under the FTC’s endorsement rule, a testimonial that shows an atypical result must clearly and conspicuously disclose that the result isn’t typical, and any material connection between the practice and the person giving the testimonial, including payment or a discount, must be disclosed.

This comes directly from the FTC’s regulation on endorsements and testimonials, 16 CFR Part 255 (FTC, 16 CFR Part 255), with plain-language guidance on the FTC’s own site (FTC, Endorsements, Influencers, and Reviews). A compliant version reads something like: “One patient reported significant improvement in mobility after six weeks of care. This result is individual and not typical; outcomes vary.” That honest framing is the difference between a testimonial that meets the standard and one implying every patient sees the same result.

The decision tree: what’s safe to post without a signed release

Direct answer: a patient’s own unprompted public review on a platform like Google is generally different from a testimonial you solicited and republished, because the patient chose to make it public themselves, but reposting it with added clinical detail can still create new HIPAA exposure.

If a patient leaves an unsolicited five-star review on Google without prompting, that’s the patient’s own public speech. Reposting it on your site without adding clinical detail they didn’t already disclose carries lower exposure than soliciting a testimonial, filming it, and publishing it yourself. The moment your practice actively asks for a testimonial, films it, or adds clinical context the patient didn’t already make public, you’re back to needing a signed HIPAA authorization plus FTC-compliant disclosure.

Before you publish any patient story this week

• Confirm whether this is an unprompted public review or a solicited testimonial. Treat solicited content as requiring a full authorization every time.
• Get a signed authorization that names the specific content, purpose, and publication location, not a blanket “you can use my story” statement.
• Confirm the authorization was not presented as a condition of receiving care.
• If the result shown is a strong or fast outcome, add a clear “results not typical, individual results vary” disclosure unless you can document that the result is typical.
• Disclose any discount, gift, or payment given in exchange for the testimonial.
• Route anything ambiguous, especially video or anything involving a minor, to your compliance officer or counsel before it goes live.

The stakes: what non-compliance actually costs

Direct answer: HIPAA civil penalties are tiered by level of culpability, from a violation you did not know about through to wilful neglect left uncorrected, and the amounts are set in regulation and adjusted for inflation each year, so confirm the current schedule with HHS or with counsel rather than relying on a figure quoted online.

The tiers are set in regulation and the dollar amounts are adjusted for inflation each year, so any figure you read online dates quickly. Confirm the current amounts against HHS’s own penalty schedule, or with counsel, before treating a number as exact.

Who this applies to

This applies to any practice that has used, or wants to use, a patient testimonial, review, or video in marketing, on the website, social media, or paid ads. It applies with extra weight to video testimonials, since video captures identifiable detail that’s harder to de-identify than a written quote.

Important considerations

This article describes published HIPAA and FTC rules; it does not resolve borderline cases or tell you what’s permitted for a specific story. Both standards carry real penalty exposure, and getting either wrong is a liability issue, not just a marketing mistake. Sachin recommends every testimonial go through your own healthcare attorney or compliance officer before publishing, not just a marketing sign-off.

The bottom line

A testimonial needs two separate approvals, not one: a signed HIPAA authorization specific to the content and its publication, and FTC-compliant disclosure if the result shown isn’t typical. Treat these as two different documents answering two different questions, confirm your specific use case with counsel, and build the review step into your process rather than relying on memory each time. Systematizing that kind of compliance step, so it happens the same way every time regardless of who’s publishing, is core to what the Precision Wellness program installs.

FAQs

Do I need a signed release to post a patient’s Google review on my website?

If the patient posted it unprompted on a public platform, reposting it as-is generally carries lower HIPAA exposure than a solicited testimonial, but confirm with counsel, especially if you plan to add any clinical detail.

Is a general intake-form signature enough to use a patient’s story in marketing?

No. HHS guidance requires an authorization that specifically names the content, purpose, and publication location, and confirms it wasn’t a condition of treatment.

Do I have to say “results not typical” on every testimonial?

You need that disclosure whenever the result shown isn’t typical and you can’t document that it is, under the FTC’s endorsement rule.

What happens if I get this wrong?

HIPAA penalties are tiered and can reach well into six figures or more per violation category, according to published penalty-tier summaries, separate from any FTC enforcement action for misleading advertising.

Professional note

This article is for informational and educational purposes only and describes published HIPAA and FTC guidance as of the time of writing. It is not legal advice, does not resolve any specific testimonial’s compliance status, and does not replace review by your own healthcare attorney or compliance officer. HIPAA and FTC penalties carry significant financial exposure; confirm every testimonial’s compliance before publishing.

Author bio

Sachin Patel, DC, is the founder of Precision Wellness Practice, a clinical and business framework program helping chiropractors, health coaches, and functional medicine doctors build automated, high-impact practices.