Posting patient photos and stories on social media

This is general information, not legal advice.

Is it a HIPAA violation to post pictures of patients?

It can be, if the patient has not signed an authorization. HIPAA is the Health Insurance Portability and Accountability Act. Its Privacy Rule protects health information. Here is what the rule says:

• A covered entity may not use or share protected health information without a valid authorization. Uses that the rule otherwise permits or requires, such as treatment and payment, are exceptions.
• With a valid authorization, the post must match what the form allows (45 CFR 164.508).
• A health care provider is a covered entity if it sends health information electronically for certain tasks. That means the rule applies to it. One example is insurance claims (45 CFR 160.103).

The American Medical Association (AMA) has an ethics opinion on this. It says physicians should refrain from publishing patient information online without appropriate consent (AMA Code of Medical Ethics, Opinion 2.3.2).

When is a patient photo health information?

When it shows who the patient is and ties them to your practice. The rule does not say that every photo is health information. It does list full-face photos as identifiers. Here is how the rule works:

• Health information includes what a health care provider creates or receives about a person’s health or care.
• With a few exceptions, it is protected when it identifies the person, or could reasonably be used to identify them (45 CFR 160.103).
• The rule allows two ways to remove the link to a person. One is to take out a list of identifiers. The list includes full-face photos and any comparable images.
• Information is not de-identified if the practice knows it could still identify the person (45 CFR 164.514).

So a photo of a patient in your office, with their face, is the kind of thing the rule is about. A name tag, a chart or a screen in the shot can point to a person too.

What about patient stories, quotes and reviews?

Treat them like photos. Think of a quote, a written review, a before-and-after story, or a video of a patient talking about their care. Each can show who the patient is, and that they got care from you. When the practice posts one, the same rule applies.

• Get a signed authorization first. The general rule above covers more than photos. Health information can be spoken or recorded in any form (45 CFR 160.103).
• Marketing has its own rule. The rule defines marketing as a message about a product or service that encourages people to buy or use it. Some messages about a practice’s own health services are not marketing (45 CFR 164.501). When a use does count as marketing, an authorization is required. The rule’s exceptions are face-to-face talks and promotional gifts of small value (45 CFR 164.508).
• Use its own form. An authorization may not be combined with another document, such as a consent for treatment. The rule lists a few exceptions (45 CFR 164.508).
• Name the exact story. The form needs the same parts as a photo form. The list is in the next section.

A review that a patient posts on their own is different. The patient wrote it, not the practice.

How to reply without sharing patient information is in replying to patient reviews. If you want to share a review on your own website or feed, ask the same question as for a photo. Does it show who the patient is, and that they got care from you?

What must the authorization form include?

It must be in plain language, and the patient gets a copy of the signed form. The rule lists the parts it must have (45 CFR 164.508). For a photo, quote or story, that means the form should say these things:

• Which photo, video, quote or story it covers.
• Who at the practice may share it.
• Where it will be posted, and who can see it.
• Why the practice is posting it.
• When the permission ends: a date or an event.
• That the patient can take back permission in writing, how to do it, and the limits on that right. Or it can point to the practice’s privacy notice, if the notice explains these.
• Whether care depends on signing.
• That once posted, others may share it again, and the rule may no longer protect it.
• The patient’s signature and the date.
• If a parent or other representative signs, a note on their authority to act for the patient.

A covered entity may not make treatment or payment depend on signing an authorization, except in listed cases (45 CFR 164.508). So in general, a patient can say no and still get care.

Can the patient change their mind?

Yes. A patient may take back an authorization at any time, in writing. There are limited exceptions (45 CFR 164.508).

What can you post with no patients in it?

Plenty. The simplest feed shows no patients at all. Here is a “post this, not that” list.

The rule requires a covered entity to have appropriate safeguards. Safeguards are steps that protect the privacy of health information. The rule names three kinds: administrative (office rules), technical and physical (45 CFR 164.530).

They must reasonably protect that information from uses or sharing the rule does not allow. That counts by accident or on purpose (45 CFR 164.530).

ClinicBuilds content and reels are made from the practice’s own clips and photos, or licensed footage. The practice approves every post before it is published.

Checklist before any post goes live

• No patient’s face is in the photo or video, or a signed authorization is on file.
• No patient quote, review or story, or a signed authorization covers it.
• No names, in the image or the caption.
• No charts, screens, schedules or whiteboards in the background.
• No mirrors or windows that show a patient.
• No patient voices in the audio.
• If a patient appears, the form covers this exact post, and has not ended or been taken back.
• A named person approved the post.

Next step

Want a second look at your social profiles? Ask for a free presence review.