What Are Patient Testimonial Rules?

Patient testimonial rules are the legal and ethical limits on publishing a patient's words, story, name or photo, which combine privacy rules, advertising rules and, in some states, medical board rules. For a health practice, testimonials are some of the strongest proof you have and some of the easiest ways to create a problem. This page is general information, not legal advice, so confirm your setup with your compliance advisor.

How patient testimonial rules work

Three sets of rules meet in one testimonial. They ask different questions.

Privacy: did the patient authorize it? HIPAA is the federal privacy law for health care providers that are covered entities. At 45 CFR 164.508, it says a covered entity may not use or disclose protected health information without a valid authorization, unless another permission in the rule applies. A testimonial that names a person, shows a photo or describes their care is a disclosure of information about them. A valid authorization is more than a friendly yes. It must include, among other required elements and statements such as the right to revoke, a specific description of the information, who may disclose it, who may receive it, the purpose, an expiration date or event, and the patient's signature and date.

Some practices are not covered entities. Cash-only practices vary. Whether HIPAA applies depends on facts such as whether the practice conducts certain transactions electronically. Ask a compliance advisor. Where HIPAA does not apply, a written release is still the sensible practice.

Advertising: is it truthful and typical? The FTC's Endorsement Guides say an endorsement must reflect the honest opinion of the endorser. If a testimonial shows results that are better than most people get, the advertiser must show that the endorser's experience represents what people will generally achieve, or make clear what the generally expected results are. The FTC's health products guidance goes further. It says testimonials reporting results more dramatic than users can generally expect are likely to be deceptive, and that a disclaimer such as "results not typical" does not fix that problem. It says the better practice is a clear and conspicuous disclosure of the results a typical consumer can actually expect.

That guidance also treats health claims as needing competent and reliable scientific evidence. A patient's story does not substitute for that evidence. The same standard sits behind pages that follow YMYL rules, which are pages where wrong information can affect a reader's health.

Honesty about relationships: is anything hidden? The FTC says that a connection a significant minority of readers would not expect should be disclosed clearly. Its Consumer Reviews and Testimonials Rule, effective October 21, 2024, also covers fake testimonials and requires clear and conspicuous disclosure when an insider, such as an employee or a relative, gives one. A practice cannot write testimonials in a patient's name, and it cannot present staff praise as patient praise.

State rules. Your state's medical or dental board may add limits on testimonials or advertising. I have not checked every state, so look up your own board's advertising rules or ask your advisor.

There is one more reason to be careful. Anything you publish can be read, quoted and summarized by search engines and AI tools you do not control. A risky story spreads further than the page where it started. Your reviews carry similar privacy issues when you answer them, covered under review response privacy.

Example: patient testimonials at a health practice

This example is illustrative, not a transcript. A hormone clinic wants a testimonials page. The marketing coordinator collects three.

The first came by email: "Feel like myself again, you can use this anywhere." It names the patient, and the email thread mentions her thyroid. The coordinator would like to run it with a photo from the patient's social media. The email is friendly, but it does not describe what will be published, where, for how long or who may disclose it. Nothing is signed. Under HIPAA, where it applies, it would not meet the authorization test. The clinic sends the patient a form its advisor approved, which she can sign or decline.

The second is a dramatic story about losing a large amount of weight in a short time. The coordinator plans to add "results vary" in small print. The FTC's guidance says that line does not fix a testimonial that overstates typical results. The clinic either replaces the story with one that reflects a typical experience or states clearly what most patients can expect, and its clinicians check any claim before it goes up.

The third is a glowing note from the owner's cousin, who is a patient. The clinic labels the relationship or drops the note.

The clinic also starts a permissions log with six columns. It records the asset, who approved it, the date, the allowed uses, the expiration and a link to the signed form. A year later, when a patient withdraws consent, the clinic knows where every copy lives.

How to check yours in 60 seconds

1. Open your testimonials page and any pages where you quote patients.
2. Count how many testimonials include a name, a photo, a condition or a treatment.
3. For each one, ask whether you can produce the signed authorization within a minute.
4. Mark any story that describes unusual results and shows no note about what is typical.
5. Mark any testimonial from staff, family or someone you pay or reward.

Every mark goes on a fix list.

What to do about it

1. Confirm with a compliance advisor whether HIPAA covers your practice and what your state board allows.
2. Have the advisor approve a written authorization form that covers the required parts, and use it for any name, photo, story or condition.
3. Keep a permissions log with the asset, who approved it, the date, allowed uses, the expiration and a link to the signed form.
4. Remove or de-identify any testimonial for which you lack the signed form.
5. Replace stories that show unusual results with ones that reflect a typical experience, or state clearly what a typical patient can expect.
6. Have a clinician check every health claim before it goes up.
7. Disclose any relationship between the speaker and the practice.
8. Do not write testimonials for patients or offer rewards for positive wording.
9. Set a review date on each testimonial, and take it down when the permission ends or the patient withdraws.
10. Do not paste real patient stories into AI tools to rewrite them. See AI use policy.