Patient photo and video consent form for social media: the clauses clinics need in the US, UK and Canada

Updated 24 October 2026 · Written by Reyansh Juneja and Naman Dhiman, the co-founders of SOVE7GN, who run the campaigns and review the clips

A patient photo consent form for social media must, for a US clinic covered by HIPAA, contain the authorization elements in 45 CFR 164.508: what will be shared, who shares it, who receives it, why, an expiration date or event, the patient's signature and date, and statements on revocation, conditioning and redisclosure. A good release then adds what HIPAA does not ask for: the platforms, whether the face is shown, whether you may boost the post as a paid ad, and what happens when the patient withdraws.

Does HIPAA apply to your clinic?

HIPAA covers a health care provider only if it transmits health information electronically in a transaction HHS has a standard for, such as billing insurance (HHS on covered entities). A cash-pay clinic that never bills insurance electronically may fall outside that test, but if you are not sure, plan as if you are covered.

For a covered clinic, using a patient's photo or story to promote your services is marketing, and marketing needs the patient's written authorization (45 CFR 164.508(a)(3)). If a third party pays you for the marketing, for example a product maker, the form must say so. HHS also says blurring or masking a patient afterwards does not replace a missing authorization, and that authorizations are needed before material is posted online (HHS film and media FAQ).

What must a HIPAA authorization include?

The form must be in plain language, the patient gets a copy, and you keep the signed original (164.508(b)(6) and (c)(3) to (c)(4)).

What should a social media release add beyond HIPAA?

HIPAA sets the minimum. These clauses answer the questions a patient will ask before signing:

• Platforms and formats. Name each platform and say whether that includes stories, reels, ads and your website.
• What identifies the patient. Face, voice, tattoos, jewelry, first name, and whether you may tag their account.
• Paid boosting. Say whether you may run the clip as a paid ad. Ontario physicians may not show before-and-after images where the public sees them unsolicited, and the CPSO counts sponsored posts to non-followers (CPSO advice).
• Editing and captions. Whether the patient sees the final cut and caption before it goes up. No retouching of the treated area.
• Withdrawal. How to withdraw, what you will take down, and a plain warning that copies others saved may stay online.
• Payment or discounts. If the patient gets anything for taking part, the post must disclose it in the US (16 CFR 255.5); see FTC disclosure for clips. In Ontario, physicians may not offer incentives at all.
• Results statement. California before-and-after ads must state that results may not occur for all patients (B&P 651); the CPSO requires a "not guaranteed, may vary" statement.

What changes in the UK?

Before-and-after images are treated like testimonials: hold signed and dated proof from the person shown that the images are genuine and not manipulated (ASA advice on before-and-after photos). The CAP guidance on cosmetic interventions also bars retouching beyond what the treatment achieves. Images of a toxin treatment are unlikely to be acceptable at all, because Botox cannot be advertised to the public (see can you advertise Botox on Instagram).

Under UK GDPR, data about a person's physical health is health data, a special category, and the ICO says you need an Article 9 condition to process it, including data you infer (ICO). A treatment photo can reveal health information, so ask your adviser which condition your form relies on.

What changes in Canada?

Private clinics fall under PIPEDA, and Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have their own health information laws (Office of the Privacy Commissioner). Ontario physicians must also follow the CPSO Advertising policy: express consent to the specific use, asked only after the treatment, with the final images shown, a dialogue about the use, the right to withdraw at any point, a warning that a social post may not be fully withdrawable, and no incentive. Patients must be de-identified unless they consented to being identified. Other provinces: check your college.

Clause checklist

1. Clinic legal name, patient name, date of birth and treatment.
2. Exactly what is recorded: photos, video, voice, dates.
3. Where it goes: each platform, website, paid ads yes or no.
4. Who handles it: your staff and any outside editor or agency.
5. Purpose: promoting the clinic's services.
6. Identification: face shown, name used, account tagged, each yes or no.
7. Review: patient sees the final images or clip first (required for Ontario physicians).
8. Expiration date or event.
9. Right to revoke in writing, how, and what you take down.
10. Treatment does not depend on signing.
11. Redisclosure warning: once public, others may share it.
12. Payment or incentive: none, or what it is and that it will be disclosed.
13. Signature and date, or a representative's signature and authority.
14. Copy given to the patient; original kept on file.

For cosmetic dentistry the same checklist works; ask your state board or the GDC about any extra wording, and see dental reel ideas for clips that need no patient at all. A signed form covers the post, not your replies: HIPAA social media rules covers review replies, tags and staff accounts. Once forms are signed, our med spa video marketing team only clips footage where every patient shown has signed, and our reel ideas show what to film with no patient in frame. Book a 30-minute call or read how we work with founder-led businesses.

Questions people ask