The photo release in your chart is almost certainly a consent form. The rule asks for an authorization. Under 45 CFR § 164.508(a)(3)(i), a covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing,” and the regulation allows exactly two exceptions: a face-to-face communication made to the individual, and a promotional gift of nominal value. An Instagram post is neither one.
That distinction is not a technicality about titles. An authorization has required elements, an expiration, and a right of revocation. A one-line release saying the patient agrees to photography has none of them, and it is the document most clinics are relying on.
Two separate problems, and clinics usually solve only the first
| The question | The rule | What failure looks like | |
|---|---|---|---|
| Permission | May you use this patient’s image at all? | 45 CFR § 164.508 authorization | A consent form with no expiration or revocation right |
| The claim | Does the image promise a result you can support? | 16 CFR Part 255 | A genuine, authorized photo that still misleads |
Getting permission right and the claim wrong still leaves you with a deceptive advertisement. They are independent failures.
What the authorization has to carry
Work from the regulation rather than from a template someone emailed you.
- It is an authorization, not a consent. The marketing use of protected health information is the trigger, and § 164.508(a)(3)(i) is explicit that the authorization is required.
- If money is involved, say so. Section 164.508(a)(3)(ii): if the marketing involves financial remuneration to the covered entity from a third party, “the authorization must state that such remuneration is involved.” A manufacturer paying for a campaign that features your patients is exactly this.
- Revocation is real. Patients may revoke. Build a way to find and pull an image after the fact, because a revocation you cannot execute is worse than none.
- Name the channels. Authorizations that say “marketing” without naming social platforms, paid advertising and third-party sites tend to be read narrowly later.
- Date it and expire it. An open-ended authorization invites the argument that the patient never agreed to a use five years on.
De-identification is a higher bar than people think
The honest route around the authorization is that the image is not identifiable. That bar is not cleared by cropping the eyes. Tattoos, scars, jewelry, nail work, background details and the caption itself have all been enough to identify someone. A face-adjacent photo with a treatment date and a location tag is not de-identified in any meaningful sense.
Assume identifiability unless someone competent has actually assessed it, and keep the authorization anyway. It costs a signature. How we handle protected health information is set out in our privacy practices.
The photo can be honest and the ad still deceptive
This is the part that surprises operators. The Federal Trade Commission’s endorsement guides say that where the advertiser lacks substantiation that the endorser’s experience is representative of what consumers will generally achieve, the advertisement “should clearly and conspicuously disclose the generally expected performance in the depicted circumstances,” and the advertiser “must possess and rely on adequate substantiation for that representation.” The guides add that to be effective, the disclosure “must alter the net impression of the advertisement so that it is not misleading.”
Read that last clause carefully. A disclaimer in gray six-point type under the image does not alter a net impression. If your best case is your only case, showing it as though it were typical is the violation, and the fact that the result really happened is not a defense.
Practical consequences for an aesthetics feed:
- Your best result is not your average result. If you cannot substantiate the average, disclose it in a way a viewer actually absorbs.
- Matched conditions matter. Same lighting, same angle, same distance, no makeup change between frames. Altered conditions turn a true photo into a false claim.
- Say what produced the result. Number of sessions, product, time elapsed. A twelve-week result presented with no timeline implies a speed you cannot support.
- Concurrent treatments. If the patient also had something else, the image attributes the result to one intervention that did not produce all of it.
Our companion piece on endorsements and paid posts is at FTC rules for testimonials and influencers.
Staff phones are the leak nobody documents
The authorization governs the clinic’s use. It does not make the photo safe on an injector’s personal camera roll, and it does not survive that person leaving. Every clinic we look at has images on personal devices, and almost none has a written rule about it.
Three rules that cost nothing: clinical photos are taken on a clinic device only, they move to the record and off the device the same day, and the policy is in the employment agreement rather than in a manager’s memory. What lives in the chart is governed by your retention schedule and your documentation standards.
A five-step sequence before a photo goes out
- Is there a signed authorization that names marketing, names the channels, and is not expired?
- Has the patient revoked, and can you prove you checked?
- Is the result representative, and if not, what disclosure alters the net impression?
- Are the two frames matched, and is the timeline stated?
- Was the image captured and stored on clinic-controlled equipment?
Clinics running this well tend to have it written down rather than understood, which is the same pattern as the rest of our clinical standards.
What this means for you
Replace the photo release with an authorization drafted to § 164.508 and re-paper the patients whose images are already running. Build a revocation path you can actually execute, which means knowing where every published image lives. Then treat the caption as advertising copy rather than an afterthought, because the claim is where the second exposure sits and it is the one a regulator can see from outside without ever asking for your chart. The images on your feed today were posted under whatever rules you had at the time, and they are still publishing.
Related reading
Frequently asked questions
Do I need a signed release to post before-and-after photos?
You need more than a release. 45 CFR § 164.508(a)(3)(i) requires an authorization for any use of protected health information for marketing, with only two exceptions, a face-to-face communication and a promotional gift of nominal value. A social post is neither, and a generic photography consent is not an authorization.
Can I post a photo if I crop out the face?
Only if the image is genuinely not identifiable, which is a higher bar than cropping. Tattoos, jewelry, scars, background details and the caption can all identify a person. Treat the image as identifiable unless someone has actually assessed it, and keep the authorization.
Does a patient have to be paid for a photo to count as marketing?
No. Payment is not what makes it marketing. But if the marketing involves financial remuneration to you from a third party, § 164.508(a)(3)(ii) requires the authorization to state that remuneration is involved.
Can a patient take back permission for a photo already posted?
Yes, authorizations are revocable. That is why the practical requirement is knowing where every published image lives, across platforms, agencies and any third party who reposted it, so a revocation can actually be executed.
Is a disclaimer enough to run an unusually good result?
Only if it works. The FTC’s endorsement guides require disclosure of generally expected performance where the result is not representative, and say the disclosure must alter the net impression of the advertisement. Small type under an image generally does not.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.