HIPAA Social Media Rules for Dental Offices: Reviews, Photos and Testimonials
A dental office may use social media and review sites. It may not disclose patient information there. HHS has acted after practices posted patient details in review replies, photos and testimonials. This page is general information, not legal advice.
This page was drafted with AI assistance and reviewed against the sources cited.
Paste a draft reply into the free PlainReply checker. This page covers reviews, photos and testimonials together. For Google review replies specifically, see Is responding to a Google review a HIPAA violation? and safer Google review response templates.
The short answer: a dental office may use social media; it may not disclose patient information there
HIPAA does not ban a practice from having a Facebook page, an Instagram account, a website or a listing on a review site. The Privacy Rule limits when a covered entity may use or disclose protected health information. A public post or a public reply is a disclosure. (45 CFR 164.502(a); HHS, Summary of the HIPAA Privacy Rule)
What counts as PHI on a post or a reply
Protected health information is individually identifiable health information that a covered entity or its business associate holds in any form, including electronic. Health information includes information about a person's past, present or future physical or mental health, the provision of health care, or payment for health care. (45 CFR 160.103; HHS, Summary of the HIPAA Privacy Rule)
On a social media post or a review reply, that can include a name, a full-face photograph, treatment, visit or insurance details, and wording that confirms someone is or was a patient. The ADA warns that a reply can raise a problem if it "merely confirms that a patient was indeed at your practice," and that "Just because a patient identifies themself in a review, they have NOT waived their right to privacy!" The ADA also notes that lines such as "Thank you for coming in," "We appreciate our patients" or "We love treating your kids" can violate HIPAA. (ADA: Managing dental practice online reviews)
The Privacy Rule's minimum necessary standard requires a covered entity to make reasonable efforts to limit uses and disclosures of protected health information to the minimum necessary to accomplish the purpose. A public social media page is not a private conversation with that person. (HHS; 45 CFR 164.502(b))
Replies to reviews on social media and review sites
Replying is allowed. Disclosing patient information in the reply is not. Two dental cases below involved Yelp. For the full sourced list, including a North Carolina $50,000 civil money penalty after a practice disclosed a patient's information "on a webpage in response to a negative online review," see Dentists fined for replying to online reviews. (HHS; ADA News)
2019: Elite Dental Associates, Dallas, $10,000
Elite Dental Associates, a Dallas dental practice, agreed to pay $10,000 and adopt a two-year corrective action plan. An HHS press release dated October 2, 2019, says a patient complained on June 5, 2016, that Elite had responded to a social media review by disclosing the patient's last name and details of the patient's health condition. OCR found that Elite had impermissibly disclosed the protected health information of multiple patients in response to patient reviews on the Elite Yelp review page, and that Elite "did not have a policy and procedure regarding disclosures of PHI to ensure that its social media interactions protect the PHI of its patients."
OCR Director Roger Severino said: "Social media is not the place for providers to discuss a patient's care. Doctors and dentists must think carefully about patient privacy before responding to online reviews." (HHS press release; the live page returned 403, so this was also checked against the archive.org copy; also the HHS case page, content last reviewed October 2, 2019)
2022: New Vision Dental, California, $23,000
B. Brandon Au, DDS, Inc., doing business as New Vision Dental, a general dental practice in South Pasadena and Glendora, California, paid $23,000 and agreed to a two-year corrective action plan. The HHS case page says: "The violation involves the provider's inappropriate use of social media to respond to patient reviews, disclosing protected health information. This practice is illegal under HIPAA." A December 14, 2022 press release says that in November 2017 OCR received a complaint that the practice disclosed protected health information, "including patient names, treatment, and insurance information, in response to patients' online reviews."
The resolution agreement says the complaint, received November 29, 2017, alleged disclosures "on its Yelp business page," and that replies sometimes gave "full names where only Yelp monikers were used" and "detailed information about patient visits and insurance."
OCR Director Melanie Fontes Rainer said: "This latest enforcement action demonstrates the importance of following the law even when you are using social media. Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO." (HHS press release; HHS case page, content last reviewed December 14, 2022; Resolution Agreement and Corrective Action Plan)
Not just dentists: Manasa Health Center, a psychiatric practice, $30,000
Manasa Health Center, LLC, is not a dental practice. It is a New Jersey provider of adult and child psychiatric services. It appears here only as an example that HHS has acted on review-reply disclosures outside dentistry. Manasa paid $30,000 after replies to negative online reviews. The case page opened for this article does not name the platform. (HHS, content last reviewed June 5, 2023)
For whether a Google review reply itself is banned, and for safer wording templates, see Is responding to a Google review a HIPAA violation? and HIPAA-compliant Google review responses.
Patient photos, before-and-afters, and testimonials need a valid written authorization
A covered entity must obtain the individual's written authorization for any use or disclosure of protected health information that the Privacy Rule does not otherwise permit or require. A valid authorization has core elements set out in the rule, including a description of the information, who may disclose and receive it, the purpose, an expiration, a signature and date, the right to revoke, and plain language. (45 CFR 164.508)
A Notice of Privacy Practices is not a substitute
HHS OCR FAQ 342, content last reviewed February 8, 2023, states that a Notice of Privacy Practices is not a substitute for a written authorization: "Covered entities are required to obtain the individual's written authorization for any use or disclosure of protected health information not permitted or required by the Privacy Rule. See 45 CFR 164.508." (HHS OCR FAQ 342)
Not dental: Cadia Healthcare Facilities, $182,000
Cadia Healthcare Facilities is not a dental practice. It is a group of five Delaware providers of rehabilitation, skilled nursing, and long-term care. It appears here because the settlement is about patient "success stories" on public sites, not because it is a dental office.
An HHS press release dated September 30, 2025, says Cadia agreed to pay $182,000 and adopt a two-year corrective action plan after "success story" posts of a patient's name, photograph, and information about conditions, treatment, and recovery, without a valid written authorization. OCR found protected health information of 150 patients posted to the facilities' websites.
OCR Director Paula M. Stannard said: "The internet and social media are important business development tools. But before disclosing PHI through social media or public-facing websites, covered entities and business associates should ensure that the HIPAA Privacy Rule permits the disclosure. Generally, a valid, written HIPAA authorization from an individual is necessary before a covered entity or business associate can post that individual's PHI in a website testimonial or through a social media campaign." (HHS press release)
Not dental: Complete P.T., $25,000
Complete P.T., Pool & Land Physical Therapy, Inc., is not a dental practice. It is a Los Angeles-area physical therapy practice. It appears here only as another non-dental example of testimonials posted without a valid authorization.
HHS says the practice paid $25,000 and agreed to a one-year corrective action plan after posting patient testimonials, "including full names and full face photographic images, to its website without obtaining valid, HIPAA-compliant authorizations." Then-OCR Director Jocelyn Samuels said covered entities "must ensure that they have adequate policies and procedures to obtain an individual's authorization for such purposes, including for posting on a website and/or social media pages, and a valid authorization form." (content last reviewed February 12, 2016) (HHS)
What a social media policy should cover
This is not a legal template, and it is not a substitute for advice from a privacy officer or attorney. It is a plain-English list based on what OCR required of New Vision Dental and on the Privacy Rule's administrative requirements, including workforce training and written policies and procedures with respect to protected health information. (New Vision Resolution Agreement and Corrective Action Plan; 45 CFR 164.530)
The New Vision agreement required, among other things, policies on the minimum necessary standard "in electronic format, including email, internet and social media sites"; a Notice of Privacy Practices that describes uses needing authorization, "e.g., posting on NVD's website, social media pages and/or other public platforms"; removal of social media postings with individually identifiable health information or protected health information since January 1, 2014; and breach notices plus a substitute notice on the Yelp page. OCR also found that the practice had "failed to implement policies and procedures with respect to PHI, including releasing PHI on social media/public platforms."
A dental office policy on this topic would typically need to say, at least:
- Who may post on the practice's website, social media pages and review-site listings.
- That public replies must not disclose protected health information, including names, treatment, visits, insurance, or confirmation that someone is a patient.
- When a valid written authorization is required before posting, including on the website, social media pages and other public platforms.
- How the workforce is trained on those rules.
- How to report a post that may have disclosed patient information, and how to take that post down.
A safer public-reply workflow
Keep a public reply generic: thank the person for the feedback, invite them to contact the office, and leave care details off the public page. PlainReply is a free, rule-based wording checker. It checks your draft for wording that can reveal patient information. It does not post for you, it does not store your text, and it is not a legal review.