Patient testimonials build credibility because they let a prospective patient hear from someone in their position. To use one in your marketing, a healthcare provider needs three things in place: a signed HIPAA authorization from the patient, a testimonial that reflects results patients can generally expect (or a clear statement of what they can expect), and a check against your state medical or dental board's advertising rules.
Get those right and testimonials belong on your service pages, next to the booking button, where a nervous patient decides whether to call. Get them wrong and a single quote can create a HIPAA disclosure, an FTC deception problem and a board complaint at once.
Why testimonials work for practices
Patients cannot judge clinical skill before a visit. They judge what they can see: how other patients describe being treated. BrightLocal's 2026 survey of 1,002 US consumers found 97% read online reviews for local businesses (BrightLocal). A testimonial on your own site does the same job at the moment of decision, on the page about the exact service the patient is considering.
Testimonials also help where reviews cannot. A Google review is short and unstructured. A testimonial can follow a patient's story from first worry to follow-up, in their words, on a page you control.
Rule 1: get a HIPAA authorization
Under the HIPAA Privacy Rule, marketing means a communication that encourages people to purchase or use a product or service. Publishing a patient's name, photo or story to promote your practice uses their protected health information for marketing, and 45 CFR 164.508(a)(3) requires a written authorization for that.
A valid authorization must contain, at minimum, these core elements (164.508(c)):
- A specific description of the information to be used (for example, "my name, photograph, and a description of my knee replacement and recovery")
- Who may use or disclose it (your practice)
- Who will receive it (the public, through your website, social media and print materials)
- The purpose (marketing and advertising)
- An expiration date or event
- The patient's signature and date
It must also tell the patient they can revoke it in writing, whether treatment depends on signing (it cannot for marketing), and that information may be redisclosed once published. It must be in plain language. HHS's marketing guidance explains how these rules apply.
A Google or Yelp review the patient posted themselves is their own disclosure. Copying it onto your website and attributing it by name is your use. Get the authorization or present it without identifying details. This guide describes what the rules say; your privacy officer or attorney should approve your form.
Rule 2: follow the FTC Endorsement Guides
The FTC's Guides Concerning the Use of Endorsements and Testimonials in Advertising were revised in June 2023. Four provisions matter most for healthcare.
| Provision | What it says | What it means for a practice |
|---|---|---|
| Typical results, 16 CFR 255.2(b) | A testimonial about a key attribute is read as representing what consumers will generally achieve | If a patient lost 60 pounds and most patients lose 15, either show typical results or clearly disclose what patients can generally expect |
| Substantiation, 255.2(a) | Testimonials are not scientific evidence; the advertiser must substantiate the claims a testimonial makes | A patient saying "this cured my migraines" is your claim, and you need evidence for it |
| Actual consumers, 255.2(c) | Ads that present "actual consumers" must use real ones or disclose that they are actors | No stock-photo patients presented as real patients |
| Material connections, 255.5 | Payment, free or discounted care, or a personal or business relationship must be disclosed clearly | A staff member's spouse or a patient who received a discount for filming needs a disclosure |
The FTC's Health Products Compliance Guidance, issued in December 2022, is direct about disclaimers: a "results not typical" line does not cure a misleading testimonial. Testimonials with atypical results need a clear disclosure of what a typical patient can actually expect, and health claims need competent and reliable scientific evidence behind them.
Two more FTC points to know. The 2023 Guides add that you should not procure, suppress, boost or edit reviews in ways that distort what patients think (255.2(d)). And the FTC's 2024 rule on fake reviews and testimonials makes fake or AI-written testimonials, and testimonials that misstate the writer's experience, a violation with civil penalties.
Rule 3: check your state board's advertising rules
Physicians, dentists, therapists and chiropractors are licensed by state boards, and each board sets its own advertising rules. Those rules can be stricter than federal law, and they differ from state to state and profession to profession. Find your board through the Federation of State Medical Boards' state board directory (dentists: your state dental board) and read its advertising regulations before publishing.
Professional ethics point the same way. The AMA's Code of Medical Ethics Opinion 9.6.1 says patient testimonials about a physician's skill or quality of service tend to be deceptive when they do not reflect the results patients with comparable conditions generally receive, and that claims of an exclusive or unique skill are usually deceptive.
How to collect testimonials, step by step
- Choose the moment. Ask after a good outcome is clear: at the final follow-up, after a successful course of therapy, or when a patient thanks you unprompted. Never ask during treatment, when a patient may feel unable to say no.
- Ask in person, then follow up in writing. A clinician or practice manager asks; the written request repeats that saying no changes nothing about their care.
- Sign the authorization before you record. Use a form that covers the specific content (quote, photo, video), the channels and an expiration date.
- Interview, do not script. Ask open questions: "What were you worried about before your first visit?" "What surprised you?" "What would you tell someone in your position?" Script nothing; the FTC requires an endorsement to reflect the endorser's honest opinion.
- Edit lightly and show them the final. Trim for length, keep their words and meaning, and get approval of the final version.
- Record the context. File the authorization, the raw recording, the approved version, and any connection to disclose (staff relative, discounted care).
- Honor revocation fast. If a patient revokes, take the testimonial down from every channel you control and log the date.
How to present testimonials
| Format | Best for | Watch out for |
|---|---|---|
| Short written quote with first name | Service pages, near the booking button | Surname or photo needs authorization; outcome claims need typical-results context |
| Long patient story | Procedures with a long decision process (joint replacement, bariatric, IVF) | Specific outcomes; dates and locations that identify the patient |
| Video testimonial | Building trust in the team and the visit itself | Full-face images are identifiers under HIPAA; captions for accessibility |
| Before and after photos | Dental, dermatology, plastic surgery | Show typical results; tattoos, jewelry and backgrounds can identify someone |
| Embedded Google reviews | Social proof that updates itself | Do not filter to five stars only |
Place testimonials on the page for the service they describe, close to the call to action. Our guide to healthcare conversion rate optimization covers where trust signals earn their place on a page.
A note on search: you can mark up testimonials on your own site, but Google will not show review stars in search results for reviews a business publishes about itself. Google calls these self-serving reviews and stopped showing them for LocalBusiness and Organization markup in 2019. Your Google Business Profile reviews are what earn stars in local results; our healthcare reputation management guide covers growing them.
Testimonial compliance checklist
| Check | Done |
|---|---|
| Signed HIPAA authorization covering this content and these channels | |
| Authorization has an expiration date and explains revocation | |
| Patient approved the final edited version | |
| Outcome claims reflect typical results, or typical results are clearly disclosed | |
| Any material connection (staff relative, free or discounted care) is disclosed | |
| No unique-skill or guaranteed-outcome claims | |
| State board advertising rules checked | |
| No identifying details beyond what the patient authorized (photos, tattoos, dates, location) | |
| Date published and review date recorded |
FAQ
Do I need patient consent to use a testimonial?
If the testimonial identifies the patient, yes. HIPAA treats using a patient's information to promote your practice as marketing, which requires a signed written authorization with specific elements. A verbal OK or a checkbox in intake paperwork is not enough.
Can I share a patient's Google review on our website or social media?
The patient posted it publicly, but republishing it with their name to promote your practice is your own use of their information. The cautious approach is to get an authorization or to show the review without the name. Showing a representative mix of reviews also keeps you in line with the FTC's guidance against distorting what patients think.
Can I pay patients or give them a discount for a testimonial?
You can compensate a patient for their time, but the payment is a material connection that the FTC requires you to disclose clearly next to the testimonial. Offering anything in exchange for a positive testimonial or review is banned under the FTC's 2024 rule. Your state board may have stricter limits.
Do "results not typical" disclaimers protect me?
No. The FTC's Endorsement Guides and its Health Products Compliance Guidance both say a disclaimer like that does not cure a testimonial that implies unusual results are typical. Disclose what patients can generally expect, and have evidence for it.
Are video testimonials treated differently under HIPAA?
The same authorization rule applies, and video carries more identifying information. Full-face images are one of the 18 identifiers HIPAA lists in its de-identification standard, so the authorization should name video specifically and the channels where it will run. Check the background for anything else that identifies the patient or other patients.
Can therapists and mental health providers use testimonials?
Rules vary by profession and state, and the relationship between therapist and client makes freely given consent harder to be sure of. Check your licensing board's rules and your professional association's ethics code before using them. Our guide to mental health treatment SEO covers trust-building options that do not rely on client stories.
