SOVE7GN
HIPAA social media rules: what med spas and dental practices get fined for
Updated 25 October 2026 · Written by Reyansh Juneja and Naman Dhiman, the co-founders of SOVE7GN, who run the campaigns and review the clips
HIPAA lets a covered practice post on social media, but not to reveal anything that identifies a patient and relates to their care unless that patient signed an authorization. The cases HHS has actually brought are mostly not about marketing posts: they are about replies to online reviews, where a practice defended itself and named the patient's treatment.
Short answer: never confirm in a reply, comment, tag or caption that someone is your patient. HHS settled with or fined four practices from 2019 to 2023 for disclosing patient information in online review replies or on social media, for $10,000 to $50,000 each. Film only empty rooms or patients who signed first; blurring later does not fix it. Train staff on personal accounts and enforce it. Checked 25 October 2026. General information, not legal advice.
This page is about behavior: replies, tags, filming and staff posts. For the release a patient signs before appearing in a clip, see our patient photo consent form, which also covers whether HIPAA applies to a cash-pay clinic.
Which practices has HHS fined over social media and online reviews?
| Practice | What happened | Outcome | HHS source |
|---|---|---|---|
| Elite Dental Associates, Dallas, Texas (general, implant and cosmetic dentistry) | Social media disclosures of patients' protected health information | Paid $10,000 and adopted a corrective action plan (2019) | HHS resolution agreement page |
| Dr. U. Phillip Igbinadolor, D.M.D. & Associates, Charlotte and Monroe, North Carolina | Disclosed a patient's information on a webpage in response to a negative online review, then did not answer OCR's data request or subpoena | $50,000 civil money penalty | HHS enforcement page |
| New Vision Dental, California | Disclosed patient names, treatment and insurance information in responses to online reviews | Paid $23,000 and a corrective action plan monitored for two years (December 2022) | HHS press release |
| Manasa Health Center, New Jersey (psychiatric care) | Disclosed patient information when it posted a response to a patient's negative online review | Paid $30,000 and a corrective action plan (2023) | HHS resolution agreement page |
Three of the four are dental practices, which is why our dentist Instagram bio guide says never to tag or repost a patient without a signed authorization. When it announced the New Vision case, OCR's director put it plainly: "Providers cannot disclose protected health information of their patients when responding to negative online reviews."
Why is a review reply a disclosure?
Protected health information includes anything that relates to "the provision of health care to an individual" and identifies that person (45 CFR 160.103). A reply such as "We're sorry your crown felt loose, but you missed your follow-up" confirms that the reviewer is a patient, what treatment they had and what happened. The reviewer posting first does not give you permission to add to it.
A reply that stays safe says nothing about the person or their care:
"Thank you for the feedback. Privacy rules stop us from discussing anyone's care online. Please call our practice manager on [number] so we can talk it through."
Use the same reply, or no reply, for good reviews too. "So glad you love your new veneers, Sarah!" confirms a patient and a treatment just as much.
Can you film in the treatment room?
HHS says a provider may not let film crews into treatment areas where patient information can be seen or heard without prior written authorization from every patient who is or will be there, and that asking the crew to blur faces, pixelate or alter voices afterwards is not enough (HHS film and media FAQ). That FAQ is written about media crews. Our cautious reading: your own marketing shoot is held to the same standard, because using patient information for marketing needs a written authorization in any case (45 CFR 164.508(a)(3)).
Before any shoot in a clinic, check the frame for:
- Patients in the chair, the waiting room, a doorway or a mirror.
- Screens with charts, X-rays, schedules or the practice software.
- Paper on the counter, a whiteboard with names, labeled trays or prescription bags.
- Voices: a patient's name called out in the background is a disclosure too.
What about tags, comments, likes and reposts?
| Habit | Why it is a problem | Do this instead |
|---|---|---|
| Tagging a patient in a result post | Links a named account to your practice and the treatment | Tag only with a signed authorization that names the platform and the tag |
| Replying "see you at your next cleaning!" to a comment | Confirms a patient relationship and a treatment | Reply with general information, or not at all |
| Resharing a patient's story about their visit | Your repost adds that they are your patient | Ask for a signed authorization before you reshare (our rule) |
| Posting a birthday or "patient of the month" shout-out | Identifies a patient by name | Celebrate staff, not patients, unless signed |
| Answering a medical question in a DM thread on a public post | The thread is visible | Move it to a private, secure channel |
What about staff posting on their own accounts?
A covered practice must train every member of its workforce on its patient privacy policies (45 CFR 164.530(b)) and must have and apply sanctions against workforce members who break them (164.530(e)). The workforce includes employees, volunteers and trainees under the practice's control (160.103). So a written social media policy, training on day one and a stated consequence are what the rule asks for.
The posts that slip through are rarely malicious: a selfie with the day's schedule on a screen behind it, "guess which celebrity was in today", a funny story about "a patient this morning" with enough detail to identify them, or a before and after from the practice's files shared to a personal account. Your policy should name each of these.
How we handle this when we clip for a practice
We cut clips only from footage with no patients in frame, or where every patient shown has signed an authorization that covers social media. We do not reply to reviews, comments or DMs; your team keeps that, with the reply above. You approve 2 example clips before anything goes live, and we go live within 48 hours. See med spa video marketing, plastic surgeon social media, the dental reel ideas clip map, or our founders page, and book a 30-minute call when you are ready.
Questions people ask
Is it a HIPAA violation to confirm someone is a patient?
For a covered practice, confirming publicly that a named person is your patient discloses information about their health care, so treat it as one unless they signed an authorization. That is why safe review replies never confirm the relationship.
Can a dentist respond to a negative Google review?
Yes, with a reply that says nothing about the person or their care and invites them to call. HHS has settled with or fined three dental practices whose replies or posts disclosed patient information.
Does blurring a patient's face make a video HIPAA compliant?
No. HHS says masking techniques such as blurring, pixelation or voice changes do not replace an authorization that was never obtained.
Can employees post pictures at work?
Only under the practice's social media policy, and never with a patient, a screen or a patient document in shot. The practice must train staff on its privacy policies and apply sanctions when they are broken.
Want a straight answer for your videos?
Book a 30-minute call. Send us a link first and we'll tell you which plan fits and how many clips we can make.
Book a call See plans and pricing- Patient photo consent form for social mediaThe clauses a patient photo and video release needs in the US, UK and Canada.
- Med spa before and after rulesWhat a before and after reel must show, say and keep on file, with example captions.
- Dental reel ideasOne smile reveal and consult session, about 20 reels, and hooks that promise nothing.