Testimonials, photos and patient permission: a marketing release guide

By Blake Hickey, founder of Double Jaw Marketing. For practice owners, office managers and marketing staff. Updated October 17, 2026.

Doctors ask me this more than almost anything: can we post this patient's photo, this great review, this video from their last visit? Usually yes, with the right permission on file first. Patients who love their results are often glad to share them. A clear, optional form makes it easy for them to say yes and easy for you to keep track.

Here's when you need written permission, how to build it into your new patient paperwork, what to do with Google reviews and profile photos, how to shoot and caption before-and-after photos, how to handle staff and actors in ads, and a release template and tracker you can hand to your attorney.

When you need written permission

Under HIPAA, a practice generally can't use or disclose a patient's health information "without an authorization that is valid" under 45 CFR 164.508, unless another rule permits it. Treatment, payment and running the practice are permitted. Promoting the practice isn't on that list. HIPAA defines marketing as a communication about a product or service "that encourages recipients of the communication to purchase or use the product or service," and 164.508(a)(3) requires an authorization for marketing, with two narrow exceptions: a face-to-face communication and a promotional gift of nominal value. HHS covers both in its marketing guidance.

A patient's photo, video, name, quote or treatment story in your marketing is their information, used to promote you. That's true on your website, in organic and paid social posts, in email, in print and on a billboard. The channel doesn't change the answer: get a signed authorization first. HIPAA also lists "full face photographic images and any comparable images" among the identifiers that make information identifiable (45 CFR 164.514(b)(2)(i)), so a smile photo with a face in it counts.

What the authorization has to include

The core elements in 164.508(c)(1) are:

1. A description of the information to be used or disclosed
2. Who may make the use or disclosure
3. Who may receive it
4. A description of each purpose
5. An expiration date or expiration event
6. The patient's signature and date, and if a representative signs, a description of their authority

Under 164.508(c)(2) it also has to tell the patient they can revoke it in writing, whether treatment can be conditioned on signing (it can't, here), and that information shared under it may be shared again by others and may no longer be protected. The patient gets a copy (164.508(c)(4)). If a third party pays the practice for the marketing, the form has to say so (164.508(a)(3)(ii)).

Florida adds a likeness rule. Fla. Stat. 540.08 bars using a person's "name, portrait, photograph, or other likeness" for advertising without their express written or oral consent, and lets either parent or a guardian consent for a minor. The release below covers both in one signature.

Building it into new patient paperwork

The easiest time to ask is at the start, with the rest of the forms. A few rules keep it valid:

• Make it its own page with its own signature. An authorization "may not be combined with any other document" to create a compound authorization (164.508(b)(3)). Put it in the packet, but not inside your consent to treat or your privacy acknowledgment.
• Make it clearly optional. A practice may not condition treatment or payment on signing (164.508(b)(4)). Say so on the form, and train the front desk to say it out loud: "This one's optional."
• Keep a standalone copy. Many patients say yes later, when they see their results. Have the same release ready at the front desk and in your secure patient forms.
• Keep it six years. A signed authorization is documentation HIPAA requires you to keep "for six years from the date of its creation or the date when it last was in effect, whichever is later" (164.530(j)(2)).
• Honor a revocation. A patient may revoke at any time, in writing (164.508(b)(5)). It doesn't undo what you already did in reliance on it, but stop new uses and take posts down where you can.

Reusing Google reviews

A five-star review is a nice thing to share. Three sets of rules apply when you move it from Google into your own marketing.

Google. Google's own brand guidance on customer reviews says "User reviews belong to the person who wrote them, even if they're written on your business's listing," and "You must get consent from the reviewer if you want to use customer reviews of your business" in things like your website or ads. It also asks you to include an official Google logo and not to use unofficial badges.

HIPAA. Republishing a patient's review in your ad tells everyone that this person is your patient, and that comes from you, not from them. Treat it like any other testimonial and get their signed authorization before you reuse it. Ask them privately, in the office or through your secure patient channel, not in a public reply that confirms they're a patient.

FTC. The FTC's Endorsement Guides (16 CFR Part 255, revised in 2023) say an endorsement must reflect the endorser's honest opinion or experience and "may not be presented out of context or reworded so as to distort" it. The FTC's rule on consumer reviews and testimonials (16 CFR Part 465) took effect October 21, 2024. In its questions and answers on that rule, the FTC says that when a business features reviews in its advertising, "consumer reviews become testimonials and the exemption for review hosting does not apply to them," and that "the use of non-representative consumer reviews in marketing could be deceptive."

So the safe default is simple: ask first, get it in writing, quote the review word for word, and choose quotes about the experience ("they explained every step and the cost up front") over quotes that rank the doctor.

Photos on your Google profile

Patients and visitors can add photos to your Google Business Profile. Being on your profile doesn't make them yours. The U.S. Copyright Office explains that copyright "protects original works of authorship as soon as an author fixes the work" in a tangible form, and that the person who takes an original photo is "the author and the owner." Google's Terms of Service say "Your content remains yours," and the license users give is to Google, for purposes like operating its services.

If you'd like to use one, ask the person who posted it for written permission. If a patient appears in it, you also need that patient's signed release.

Before-and-after photos: consistent and honest

Good before-and-after photos show a patient's real result in a way a future patient can trust. The work is in the setup: the same light, angle, distance and background both times, so the only thing that changes is the result. The shot standard on the printable sheet is the card I'd tape up where your team takes photos.

Editing: what's fine and what's never fine

Editing that treats both photos the same way keeps the comparison fair: the same crop, and the same exposure or color correction on the before and the after. Anything that changes teeth, gums, lips or skin changes the result itself, so no whitening, smoothing, reshaping, removing or swapping, on either photo. The FTC's Policy Statement on Deception says the Commission will find deception if there is "a representation, omission or practice that is likely to mislead the consumer" acting reasonably, and it looks at the net impression of the whole ad. Florida's 466.019(3)(a) bars a dental ad that "contains misrepresentations of fact." Keep the untouched original of every photo, labeled with a case code rather than a name, in your secure records system.

Honest captions

Fla. Stat. 466.019(3)(d) says a dental ad may not create "false, unjustified expectations of favorable results." A gallery of only your most dramatic cases, with no context, can do that even if every photo is real. Under the FTC's 16 CFR 255.2(b), an ad featuring a patient's experience may be read as showing what people will generally achieve; if you can't support that, the ad should "clearly and conspicuously disclose the generally expected performance" in the circumstances shown. A short "results vary" line is a good start, and it works best with real context:

• The treatment, and who provided it
• The time between the photos
• Your own patient, treated at your practice. Never stock photos or another practice's case presented as yours.
• A mix of cases that reflects your typical work, not only the best one

Clinical photos for the patient's chart are part of their care. Using the same photos to promote the practice is a separate use, and that's the one the release covers. Ad platforms also set their own rules for before-and-after images, so check the platform's ad policy before you run one as a paid ad.

Staff and actors in ads

Team members and paid actors make great ads. The FTC asks one thing: be clear about who they are. Under 16 CFR 255.5, when there's a connection between you and the person in the ad that the audience wouldn't expect, "such connection must be disclosed clearly and conspicuously." The Guides' examples say that if actors are used in place of real customers, that should be disclosed too. Part 465 adds rules for testimonials from officers, managers and employees (465.5); the FTC's Q&A notes a short disclosure can work.

• Staff: "Maria, our treatment coordinator, on her own smile."
• Actors: "Actor portrayal" or "Not actual patients," on screen and, in video, spoken too.
• Get written consent from staff and actors to use their likeness, and keep it with your releases.

Florida rules for dental and SLP practices

Once a quote or photo is in your marketing, it's your advertising. Fla. Stat. 466.019 defines a dental advertisement to include websites and social media. Subsection (3) says an ad may not contain "laudatory statements about the dentist or group of dentists," or a statement that "is intended or is likely to create false, unjustified expectations of favorable results." The statute doesn't use the word "testimonial," but a quote can still cross those lines, so pick quotes about the visit and the people, not promises about results.

The Board of Dentistry's advertising rule, Rule 64B5-4.002, also applies and was amended effective September 24, 2026. The Board's records show a 2010 petition from a dentist asking whether a patient testimonial in an office brochure would violate that rule, which tells you it's a fair question to put to your attorney.

Speech-language pathologists are under a different board: the Board of Speech-Language Pathology and Audiology, under part I of chapter 468. Its discipline statute, Fla. Stat. 468.1295(1)(i), lists using "any advertising matter, promotional literature, testimonial, guarantee" that is misleading, deceiving or untruthful. The HIPAA and FTC rules above apply the same way.

[Your logo here]
**[Practice name]** | [Phone] | [Website]

# Patient permission and photos for marketing: when to ask, and the release

For the office manager. Before a patient's name, face, words or story goes in your marketing, get it in writing. Signing is always optional for the patient.

## When you need a signed release

| You want to use | Where | What to have first |
|---|---|---|
| A patient's photo, video, name, quote or story | Website, social posts, paid ads, email, print, billboards | Signed HIPAA marketing authorization, plus likeness consent |
| A patient's Google review, copied into your marketing | Anywhere outside the review itself | The same signed release. Google also asks you to get the reviewer's consent. |
| A photo someone posted to your Google profile | Anywhere outside Google | Written permission from the person who took it, plus a release if a patient appears |
| A staff member or paid actor | Any ad or post | Their written consent, and a clear note in the ad that they're staff or actors |

## Building it into your new patient paperwork

- **Its own page and signature.** HIPAA doesn't let an authorization be combined with other documents, like your consent to treat (45 CFR 164.508(b)(3)).
- **Optional, and it says so.** You can't make treatment or payment depend on signing (164.508(b)(4)). Keep a standalone copy for patients who decide later.
- **Give them a copy** (164.508(c)(4)), and keep the signed form six years (164.530(j)).

- **Revoked in writing, any time** (164.508(b)(5)). Mark it on the tracker that day and take the content down where you can.
- **Minors:** a parent or guardian signs. Florida's likeness law, 540.08, lets either parent or a guardian consent for a minor.
- **Check the box before you post:** is this use on the signed form, and has it expired?

**Florida:** a quote you publish becomes your ad. Dental ads can't be laudatory or create unjustified expectations of results (Fla. Stat. 466.019(3)). SLPs: chapter 468 applies. **Staff and actors:** say so in the ad, for example "Our team member, Maria" or "Actor portrayal" (16 CFR 255.5).

## Before-and-after shot standard (tape it up where you shoot)

Camera, lens, settings: ______________________
Light and position: ______________________
Background: ______________________
Distance or chair mark: ______________________

- [ ] Same camera, lens and manual settings
- [ ] Same light in the same spot; blinds closed
- [ ] Same plain background and distance
- [ ] Head level, looking straight ahead
- [ ] Same retractors, or none, in both sets
- [ ] Same views and expressions both times

- **OK:** the same crop and the same exposure or color fix on both photos
- **Never:** whitening, smoothing, reshaping, removing or swapping anything
- Keep every untouched original, labeled with a case code, not a name
- Caption: "[Treatment] by Dr. [Name], [DDS or DMD]. Photos taken [time] apart. Your results depend on your own case."

---

## Marketing release (template: have your attorney review)

**Authorization to use my photos, video and words in marketing.** Patient: ____________________ Date of birth: __________

**1. What may be used:** ☐ Photos of my face ☐ Photos of my teeth or smile ☐ Before-and-after photos ☐ Video ☐ My first name ☐ My full name ☐ My words, including reviews I've written ☐ A description of my treatment: [describe]

**2. Who may use and share it:** [Practice name] and the people who design and run its marketing for it.

**3. Who may receive it:** The public, through ☐ Website ☐ Social media posts ☐ Paid ads ☐ Email ☐ Print, mailers and billboards ☐ Other: [describe]

**4. Purpose:** To promote [Practice name]'s services. [If anyone pays the practice for this marketing, say so here.]

**5. This authorization expires on:** [date or event]

**6. Your rights:** Signing is your choice. [Practice name] will not condition your treatment or payment on whether you sign. You may revoke this in writing at any time by writing to [name and address]; that won't undo uses already made. Once shared publicly, this information may be shared again by others and may no longer be protected by federal privacy rules. You'll get a copy of this form. No payment or gift is given for signing.

**7. Likeness:** I consent to the use of my name, photograph and likeness as checked above for advertising.

Signature: ____________________ Date: __________ If signed by a parent, guardian or representative: name ______________ and relationship or authority ______________

## Permission tracker

| Patient | What's approved | Where it can be used | Date signed | Expires | Revoked |
|---|---|---|---|---|---|
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |
|   |   |   |   |   |   |

---
Sources: 45 CFR 164.508, 164.514, 164.530(j); HHS marketing guidance; 16 CFR 255 and 465; FTC deception policy; Google Partner Marketing Hub; Fla. Stat. 466.019, 468.1295, 540.08. I'm not a lawyer or a doctor. This is what I've learned helping practices, shared to help you. It's general information for Florida practices as of October 2026, not legal or medical advice. Rules differ by state and change, so have your attorney review it before you use it. Template from Double Jaw Marketing, doublejawmarketing.com/resources.

Common questions

Do we need written permission to post a patient's photo on social media?

Yes. A patient's photo, name, quote or story in your marketing is a use of their health information to promote your practice, and HIPAA requires a signed authorization under 45 CFR 164.508. Florida's 540.08 also requires consent to use a person's likeness in advertising.

Can a marketing release be part of our new patient paperwork?

Yes, as its own page with its own signature. HIPAA doesn't allow an authorization to be combined with other documents like a consent to treat, and treatment can't be conditioned on signing it, so it has to be optional.

Can we copy a patient's Google review into an ad or onto our website?

Get the patient's written permission first. Google's brand guidance says you must get the reviewer's consent, the FTC treats reviews featured in ads as testimonials, and republishing confirms the person is your patient.

Can we use photos people posted to our Google Business Profile?

Ask the person who took the photo for written permission. The person who takes a photo generally owns it, and Google's terms say users keep ownership of their content. If a patient appears in it, get their signed release too.

How do you take consistent before-and-after photos?

Use the same camera, lens and manual settings, the same light in the same position, the same background, distance, patient position, retractors and expressions, and the same shot list both times. Apply any crop or color correction to both photos equally, and never retouch the result.

Is "results vary" enough on a before-and-after photo?

It helps, but the FTC's Endorsement Guides say that if you can't support that a result is typical, the ad should clearly disclose what patients can generally expect. Add the treatment, who provided it and the time between photos.

Do we have to say when people in our ads are staff or actors?

Yes. The FTC's Endorsement Guides say a connection the audience wouldn't expect must be disclosed clearly and conspicuously, and the Guides' examples call for disclosing when actors are used.

Claims and sources

Checked October 17, 2026. Rules and platform settings change, so check the source before you rely on it.

1. HIPAA authorization required; marketing; core elements; required statements; no conditioning; no compound authorizations; written revocation; copy to patient: eCFR 45 CFR 164.508
2. HIPAA definition of marketing: eCFR 45 CFR 164.501
3. Full face photographs are identifiers: eCFR 45 CFR 164.514(b)(2)(i)
4. Keep documentation six years: eCFR 45 CFR 164.530(j)
5. Marketing authorization and its exceptions: HHS: Marketing guidance
6. Deception standard; net impression of the whole ad: FTC Policy Statement on Deception (1983)
7. Endorsements reflect honest opinions, no distortion, generally expected results, material connections, actors (2023 revision): eCFR 16 CFR Part 255
8. Rule on consumer reviews and testimonials, insider testimonials: eCFR 16 CFR Part 465
9. Part 465 effective October 21, 2024; reviews in ads become testimonials; non-representative reviews could be deceptive: FTC: Consumer Reviews and Testimonials Rule, questions and answers
10. Reviews belong to the reviewer; get the reviewer's consent; Google logo: Google Partner Marketing Hub: Customer reviews
11. Users keep ownership of their content; license is to Google: Google Terms of Service
12. Copyright from fixation; the photographer is the author and owner: U.S. Copyright Office: What is copyright?
13. Florida likeness consent; parent or guardian for a minor: Fla. Stat. 540.08 (2026 Florida Statutes)
14. Florida dental ads: websites and social media; misrepresentations of fact; laudatory statements; unjustified expectations: Fla. Stat. 466.019 (2026 Florida Statutes)
15. Board of Dentistry advertising rule, amended effective September 24, 2026: Rule 64B5-4.002, Florida Administrative Code
16. 2010 petition on a patient testimonial in an office brochure: Florida Administrative Register notice 8472676
17. Board of Speech-Language Pathology and Audiology: Fla. Stat. 468.1135
18. SLP discipline for misleading advertising, testimonials or guarantees: Fla. Stat. 468.1295 (2026 Florida Statutes)