Medical practices and clinics: the numbers, the rules, the AI picture.

• HIPAA Privacy Rule: marketing and authorization, 45 CFR 164.501 and 164.508(a)(3)

  A covered entity needs a valid written authorization before using or disclosing protected health information for marketing. The rule defines marketing as a communication about a product or service that encourages people to buy or use it, and excludes treatment communications and descriptions of the entity's own health services unless a third party pays for them. Exceptions cover a face-to-face communication and a promotional gift of nominal value. If a third party pays, the authorization must say so. OCR also enforces this on replies to online reviews: it settled with New Vision Dental for $23,000 in December 2022 after replies to Yelp reviews named patients and gave visit and insurance details, and with Manasa Health Center for $30,000 in June 2023 after a reply to a Google review disclosed a diagnosis. OCR's director said providers cannot disclose protected health information when responding to negative online reviews.

  What it means: Get a signed authorization before you publish a patient name, photo, voice, story or review that shows they were your patient. Telling your own patients about your own services is generally not marketing, but a paid third-party promotion or a testimonial is. Keep authorizations on file and specific to each use. Never confirm that a reviewer is a patient, never mention care or insurance, and reply with a generic message that invites a call. A reviewer posting their own details does not allow you to answer with yours.

  [10] law.cornell.edu

• HIPAA and website tracking technologies (OCR bulletin and the 2024 court ruling)

  OCR issued guidance on pixels and other trackers on health websites. On June 20, 2024, a federal court in American Hospital Association v. Becerra vacated the part of the revised bulletin that treated an IP address plus a visit to a public page about a condition or provider as protected health information. The rest of the bulletin was not vacated, and the guidance on authenticated pages such as patient portals stands.

  What it means: Do not place ad pixels, session recorders or chat widgets on patient portals, booking confirmation pages or any logged-in area without a business associate agreement and a legal review. Class actions over trackers continue, so audit every tag on appointment, symptom and insurance pages. Never send names, conditions or appointment details to ad platforms.

  [11] hklaw.com

• FTC Health Products Compliance Guidance, Endorsement Guides and the 2024 fake reviews rule

  The FTC requires competent and reliable scientific evidence for health claims, judges ads by the net impression they create and says a results not typical disclaimer does not cure dramatic results. Material connections with an endorser must be disclosed clearly (16 CFR 255.5). The FTC announced a final rule on August 14, 2024 banning fake and AI-generated reviews, paid reviews conditioned on sentiment, undisclosed insider reviews and review suppression through unfounded legal threats.

  What it means: Do not offer a discount, free visit or gift in return for a review, and do not write reviews yourself or ask staff and family to post. Substantiate every treatment claim with evidence you can produce. Disclose paid influencers and affiliate relationships. Never threaten a patient with legal action to remove a review.

  [12] ftc.gov

• California Business and Professions Code section 651

  Applies to licensed health professionals. It bars false, fraudulent, misleading or deceptive public communications, including statements that create false or unjustified expectations of favourable results, claims of professional superiority not supported by objective scientific evidence, and testimonials that mislead by omission. A physician may say board certified only for an ABMS-member board, an approved equivalent board or one with an ACGME-approved program, and must give the full board name with comparable prominence. Before and after images must name the procedures, be comparable and say results may vary. Price ads must be exact. Physicians who knowingly violate it can face fines of up to $10,000 per event.

  What it means: In California, remove superiority and guarantee language, caption every before and after image with the procedure and a results disclaimer, label model photos, show the full board name next to board certified and avoid price phrases such as as low as. Confirm the current text on the legislature site before publishing.

  [13] california.public.law

• Texas Medical Board rules 164.3 and 164.4, and New York 8 NYCRR 29.1

  Rule 164.3 lets physicians advertise their practice, credentials and qualifications but deems certain wording false, deceptive or misleading: board eligible or board qualified, a permanent cure for an incurable disease, testimonials without a credentials disclaimer and disclosure of compensation, models or actors not identified as such, deceptive cost claims, unsubstantiated unique skill claims and undisclosed paid-for content. Rule 164.4 limits board certified to boards that are ABMS, AOA Bureau of Osteopathic Specialists or American Board of Oral and Maxillofacial Surgery members, or approved by the board. In New York, Board of Regents rule 29.1(b)(12) covers professions licensed under Education Law Title VIII: false or unsubstantiated advertising and guarantees are unprofessional conduct, the licensee carries the burden of proof, testimonials need the patient's written authorization, fictional testimonials are barred and ads must be kept for one year.

  What it means: In Texas, delete board eligible, identify every actor and model, disclose any payment behind a testimonial and use board certified only with a qualifying board. The Texas Occupations Code also restricts testimonials, and the Texas Medical Board has proposed reorganising Chapter 164, so check the current text before you publish. In New York, collect written authorization for each testimonial and archive every ad. Physician discipline there runs through a separate process, so ask counsel how section 29.1 applies to your licence type.

  [14] law.cornell.edu

• Google Ads healthcare and medicines policy, personalized advertising policy and Business Profile guidelines

  Google restricts or bans ads for unapproved substances, speculative or experimental treatments and prescription opioids, and requires certification for services such as addiction treatment and prescription drug services. Telemedicine is generally allowed with limits and often requires LegitScript certification. Health is a sensitive interest category, so advertiser-curated audiences such as Customer Match cannot be used. For Business Profiles, a practitioner gets a profile only if public-facing at a verified location, an organization at a multi-practitioner site has its own, and names must match real-world signage with no keywords or taglines.

  What it means: Check certification before you run behavioural health or telehealth ads, do not build remarketing lists from patient data and name each profile exactly as the sign reads. Do not create several profiles for one clinician across specialties. Google also bans paid, incentivised and gated reviews.

  [15] support.google.com

• Self-pay clinics: the No Surprises Act good faith estimate

  Providers generally must give uninsured and self-pay patients a good faith estimate of expected charges when they schedule care at least 3 business days ahead or ask for one. If the final bill is at least $400 more than the estimate, the patient may be able to dispute it through a federal process. The notice of availability must also be posted.

  What it means: Cash-pay, concierge and direct primary care clinics should publish a clear self-pay price page and a good faith estimate process, and train the front desk to give the estimate in writing. A fee page without a path to an estimate leaves a compliance gap.

  [16] cms.gov

• United Kingdom and Canada: GMC, ASA and CAP, and the provincial colleges

  In the United Kingdom, the General Medical Council expects information about services to be factual and verifiable, to avoid exploiting patients' vulnerability and to avoid guaranteeing results, and the ASA enforces the CAP Code on clinic ads, which bars guarantees of cure. In Ontario, the College of Physicians and Surgeons of Ontario policy on advertising (updated December 2020) prohibits physicians from using testimonials in advertising and bars linking to third-party reviews or directing patients to post them, and it restricts specialist titles.

  What it means: UK and Canadian rules are stricter than most US states on testimonials and review prompting. A clinic serving patients there must follow the local regulator, not US practice, and should read the current text of each rulebook. The Care Quality Commission also publishes expectations for registered providers, which this page has not reviewed.

  [17] cpso.on.ca

This is general information, not legal advice. Medical advertising, privacy and board rules differ by state, province and country, and they change. Check your own medical or professional board, your regulator and a qualified healthcare attorney before you publish.