Before and after photos are a powerful marketing tool for elective medical practices, including plastic surgeons, dermatologists, med spas, aesthetic clinics, and wellness providers. These images can help potential patients visualize results and build trust in your services.
However, when it comes to the law, these photos are more than just marketing assets. They can be considered:
- Protected Health Information (“PHI”)
- Subject to Health Insurance Portability and Accountability Act (“HIPAA”) Rules
- Federal Trade Commission (“FTC”) Regulations
- State Privacy Laws
- State Licensing Board Requirements
Failure to follow any of these rules can result in steep penalties, damaged reputations, and even loss of licensure.
Understanding HIPAA Rules and Patient Privacy
When using patient before and after photos in marketing, privacy is the first and most critical consideration. HIPAA sets clear rules on when these images qualify as PHI and outlines how they must be handled to safeguard patient confidentiality.
Are Before and After Photos Protected Health Information?
Under HIPAA, PHI includes any patient information that can identify an individual. This means that certain before and after photos, especially those showing full-face images, tattoos, scars, birthmarks, or other unique identifiers, can be considered PHI.
While de-identification can reduce compliance burdens, it is not foolproof. Even if a face is cropped out, distinctive features, background details, or metadata in the image can still link the photo to a specific patient.
Additionally, many states have their own version of HIPAA. These state privacy laws generally fall under broader categories of health care privacy and patient confidentiality. As such, practices must also be aware of how such state laws potentially apply.
Failing to treat these photos as PHI can lead to HIPAA or state privacy violations, triggering civil penalties, and serious reputational harm.
HIPAA and State Privacy Law Requirements for Using Patient Images
To use patient images for marketing or social media, HIPAA and state privacy laws require written patient authorization. Verbal consent is not enough, and a compliant authorization must clearly state:
- Who may use the images (your practice, a specific provider, marketing vendors).
- Where they will be used (website, social media, print ads, presentations).
- How they will be used (educational, promotional, internal training).
Even with written authorization in place, practices should take additional steps to safeguard patient privacy and remain compliant. Important considerations include:
- Any photos used must be stored securely, ideally in encrypted, access-controlled systems.
- All team members handling patient images should receive privacy training to avoid accidental disclosures.
- A release of before and after pictures for website use does not automatically permit social media posting.
These privacy practices work hand in hand with another key legal consideration, understanding who actually owns the before and after photos.
Who Owns Patient Before and After Photos?
Beyond privacy, understanding who owns the rights to patient photos is crucial to avoid disputes and misuse. Ownership affects how images can be used, especially when providers leave a practice or patients revoke their authorization.
Ownership of before and after photos often depends on who took the picture and the terms of employment. If a staff member takes the photo as part of their job, it’s typically a work-for-hire, making the employer the copyright holder. Photos are also considered part of the patient’s medical record, which the practice, not the provider, generally owns.
When a provider leaves a practice, disputes can arise over who can continue using those images. Patients also maintain rights over their likeness, meaning they can revoke authorization in certain situations, although prior authorized uses may be grandfathered in. As a result, if there is an expectation that a provider leaving a practice will be able to take and continue to use the before and after pictures, the patient must grant permission, and the practice must have allowed this through its contractual arrangement with the provider.
Advertising Rules and Regulations for Before and After Photos
Marketing with before and after photos requires more than just creativity; it must comply with strict federal and state advertising standards. Both the FTC and state licensing boards set rules to ensure these images are truthful, non-misleading, and properly disclosed.
FTC Truth-in-Advertising Rules
The FTC enforces strict truth-in-advertising standards for health care marketing. For before and after photos, this means:
- No misleading edits that enhance results through lighting, filters, or photo manipulation.
- You must include clear disclaimers if the results shown are not typical.
- Any express or implied claims must be substantiated with evidence.
- Only use real patient photos unless you clearly disclose that images are stock photography.
- If the patient received free or discounted treatment in exchange for their testimonial, that material connection must be disclosed.
In addition to federal guidelines, health care providers must also comply with state-specific advertising rules set by dental and medical licensing boards.
State Licensing Board Regulations
State medical and dental boards regulate advertising in health care. For example, in Georgia, disclaimers are required when photos depict atypical results. Whereas, California mandates specific consent documentation for patient images. In other states, you may encounter common prohibitions such as:
- Guarantees of results.
- Comparative claims without evidence.
Violations can lead to public reprimands, fines, or even suspension or revocation of a professional license. Every provider should review their state’s specific advertising rules before launching a campaign.
Compliance Guidelines for Before and After Photos in Medical Advertising
Compliance with HIPAA, FTC, state privacy laws, and state board regulations goes beyond avoiding penalties. If your practice uses, or is considering using, before and after photos in marketing, now is the time to ensure your processes align with those standards. Following these compliance guidelines helps provide a clear framework to reduce the risk of legal trouble:
- Use standardized photo consent and release forms that meet HIPAA, FTC, and state requirements.
- Provide regular staff training on patient privacy and marketing laws.
- Maintain clear policies on image ownership and usage rights.
- Store all photos in secure, encrypted systems with access controls.
- Establish a review process for all marketing content before publication.
- Conduct policy audits annually to address regulatory updates.
Navigate Before and After Picture Usage with ByrdAdatto
Our legal team can help you understand the legalities of posting patient before and after pictures. Contact ByrdAdatto to review your policies, consent forms, and marketing materials so you can confidently share patient results without putting your practice at risk.
