HIPAA-Compliant Patient Photos: The Marketing Mistake Multi-Location Groups Keep Making
A before-and-after smile transformation is one of the most effective pieces of content a dental practice can post. It’s also one of the easiest ways to end up on the wrong side of HIPAA, because the general consent-to-treat form patients sign at intake almost never covers marketing use of their photos.
Under HIPAA, using patient photos or identifiable information for marketing purposes requires a separate, specific, written authorization — not implied consent, not a verbal okay from the front desk, and not coverage under a broader HIPAA acknowledgment form.
Where Practices Get This Wrong
The mistake is rarely intentional. A patient is thrilled with their new smile, offers to let the office post it, and a team member snaps a photo for the practice’s Instagram before there’s ever a form involved. Multiply that across a marketing team running social accounts for several locations, and it’s easy for a photo release process to exist on paper but not actually get followed consistently at every site.
What a Proper Authorization Needs
A valid marketing authorization should specify exactly what will be used (photos, video, testimonial quotes), where it may appear (website, specific social platforms, in-office displays, print materials), and for how long the authorization is valid. It should be revocable, and revocation should actually be honored — which means someone needs to know where a given photo has been posted if a patient later asks for it to come down.
For a multi-location group with a centralized marketing function, this is a documentation and workflow problem more than a legal one: every photo needs a signed authorization on file before it ever reaches a marketing calendar, and that authorization needs to be retrievable years later if a patient asks a question or files a complaint.
Building the Habit Across Every Location
The practices that get this right treat photo authorization the same way they treat any other clinical documentation — captured at the point of care, filed immediately, and tied to the specific patient and use case, not handled after the fact by whoever manages social media.
Effex’s Document Control module keeps signed authorizations, consent forms, and their expiration or revocation status in one searchable place across every location, so marketing never has to guess whether a photo is actually cleared to use.
This article is for informational purposes and isn’t legal advice. Talk to your healthcare attorney or compliance counsel about your organization’s marketing consent practices.
