A patient leaves a sweet comment on your practice's Facebook post: "Best dentist in Houston!" Your front desk wants to reply with something warm, like "So glad your new crown is holding up, see you at your cleaning in March!" It feels friendly. It's also the kind of reply that can land a practice in trouble with federal privacy rules.
Dental and medical practices can use social media well, but any post, reply or message that identifies a patient or their care can fall under HIPAA. Get a patient's written authorization before sharing their photo or story, never confirm in a public reply that someone is your patient, and move any question about care to a private, approved channel.
This article is general information in plain words, not legal advice. Your compliance advisor should have the final say on your policies. But knowing the basics will keep you out of the most common traps.
HIPAA in plain words
HIPAA's Privacy Rule applies to "covered entities," which includes most health care providers, like dental and medical practices. According to the HHS summary of the Privacy Rule, it protects "individually identifiable health information" in any form, whether electronic, paper or spoken. HHS calls this protected health information, or PHI for short.
In everyday terms, PHI is anything about a person's health, their care or paying for their care that points back to them. HHS notes it includes common identifiers like a name, address or birth date. On social media, that means a patient's name next to "your root canal," a smiling before and after photo, or even "great seeing you Tuesday" can all count.
The simple test I'd give your team: if a stranger could read it and learn that a specific person got care from you, don't post it without permission in writing.
Patient photos, stories and testimonials need it in writing
Patient smiles and success stories are great content. They're also the area where practices most often slip.
HHS explains in its guidance on marketing that, with limited exceptions, the Privacy Rule requires a person's written authorization before their protected health information is used or disclosed for marketing. A patient testimonial or before and after on your page is promotion built on someone's health information. Treat it as needing a signed authorization every time.
A verbal "sure, go ahead" in the chair isn't enough. Neither is a patient tagging you in their own post. That's their choice to share. Resharing it to your page is your choice, and it's a different thing.
Ask your compliance advisor for an authorization form that fits your practice, and keep the signed copies somewhere you can find them. When a patient changes their mind, take the post down.
Replying to comments and reviews: a Texas lesson
This one isn't theoretical. In 2019, HHS announced that Elite Dental Associates in Dallas agreed to pay $10,000 and adopt a corrective action plan to settle potential HIPAA violations tied to social media. As HIPAA Journal reported, the practice had responded to a patient's Yelp review with the patient's last name and details about her health condition, treatment plan, insurance and cost.
The practice was probably just trying to tell its side of the story. That's the trap. Any reply that confirms someone is your patient shares information about them.
So even a nice reply should stay general. Here's a safe pattern for a negative review:
"Thank you for sharing this. We take every concern seriously. Privacy rules keep us from discussing anyone's care online, but we'd welcome a call to our office manager at [office number] so we can talk."
And for a positive one: "Thank you so much for the kind words. Our team loves hearing this." Notice neither reply says "your visit," "your treatment" or "we remember you."
Direct messages are a front door, not an exam room
Patients will message your page with real questions. "Is this swelling normal?" "Can you check if my insurance covers this?" It's tempting to answer right there.
I'd set a clear rule instead. Reply warmly, answer general questions like hours and whether you accept new patients, and move anything about a person's own care to a phone call or whatever private channel your compliance advisor has approved. Don't ask people to send symptoms, birth dates or insurance ID numbers through social messages.
A saved reply makes this easy: "Thanks for reaching out. So we can protect your privacy, please call us at [office number] and our team will help you right away."
What you can post with confidence
None of this means your page has to be boring. Plenty of great content involves no patient information at all:
- Meet the team posts, with your staff's okay
- Short educational tips, like how often to replace a toothbrush
- Office news, new equipment and new services
- Behind the scenes of sterilization or setup, with screens and charts out of frame
- Your team at Houston community events and school health fairs
- Answers to common questions, written in general terms
This is exactly the kind of content we plan in our social strategy and content calendars and produce through our content creation work.
A privacy checklist for your practice's social media
- Write a short social media policy and have your compliance advisor review it
- Decide who is allowed to reply to comments, reviews and messages
- Keep signed patient authorizations on file before any patient content goes up
- Save approved reply templates for positive reviews, negative reviews and care questions
- Check every photo and video for screens, charts, schedules and faces in the background
- Train new staff on the "never confirm a patient" rule on day one
- Review your page every month for anything that slipped through
Again, this is general information, not legal advice. Rules and your obligations can depend on your situation, so check with your compliance advisor before you change how your practice handles social media.
Want a second set of eyes on yours?
If you'd like someone to look at your practice's social presence with fresh eyes, we'll do it for free. Our Social Check looks at your profiles and posting rhythm, whether your page actually looks like you, how comments and reviews are being handled, whether any ads are aimed at the right people and whether social visits show up as calls and forms. You get a short written summary. If the answer is "not much needs to change," we'll tell you that. Request your free Social Check.
