Social media for dentists: what you can show, and what HIPAA stops
Dental marketing runs on before and after photographs, which are also the single easiest way to breach a patient's privacy. What needs written authorization, what does not, and the posts that fill the gap.
Dental social media has one dominant format and one recurring problem, and they are the same thing. Before and after photographs are the most persuasive content a practice can publish, because the result is visible in a way that almost no other professional service can match. They are also protected health information, published under the name of a covered entity, which is a sentence worth sitting with before the next case goes up on a Friday afternoon.
Our articles are still written by humans!
Get human written articles in your Google feed.
None of that is an argument for posting nothing. It is an argument for getting the paperwork right once, and then spending most of your attention on the content that does not need paperwork at all, which turns out to be the content that brings in new patients anyway.
The photograph problem, precisely
The Privacy Rule defines marketing as a communication about a product or service that encourages recipients to purchase or use it, and requires an individual's written authorization before protected health information is used for it. HHS states the position in one line at the top of its guidance: with limited exceptions, the Rule requires an individual's written authorization before a use or disclosure of protected health information can be made for marketing.
The exceptions are about treatment and care coordination, not about promotion. A refill reminder is not marketing. A composite case posted to attract new implant patients is not covered by any of them, and there is no reading of the exceptions that gets you there.
| What you were going to post | Status | What makes it safe |
|---|---|---|
| Before and after of a completed case | Marketing use of health information | A signed marketing authorization, specific to this use |
| The same photo cropped to the teeth only | Still identifiable, and still a patient | The same authorization. Cropping changes nothing |
| A patient's video testimonial | Marketing, plus an endorsement under FTC rules | Written authorization, and disclosure if they are staff or family |
| A stock photo of a smile | Fine, if it is not presented as your work | Do not imply a stock image is a case you treated |
| The team, the practice, the equipment | No patient information involved at all | Nothing. This is most of what you should be posting |
Get the authorization once, properly
The failure we see most often is a practice that believes it has consent because a form was signed at registration. A general treatment consent is not a marketing authorization. The authorization needs to describe what will be used, where it will appear, and it needs to be revocable, which means somebody has to be able to ask for a post to come down later and be told yes.
- Make it a separate sheet, signed at the point the photograph is taken, not at registration.
- Name the surfaces. "Our Instagram, Facebook and website" is specific. "Promotional purposes" is not.
- Say whether the face is included. Patients answer this differently from how you assume.
- Write down how they withdraw it, and honour it fast when they do.
- Keep the signed form somewhere findable. An authorization nobody can produce is the same as no authorization.
What actually brings in new patients
Here is the uncomfortable finding for a category built on clinical photography. The person who has not been to a dentist in six years is not weighing your veneer work against another practice's. They are managing a fear, a cost and an embarrassment, in that order, and the content that reaches them addresses those directly.
- What happens in a first appointment, minute by minute. The single highest performing post type for a general practice, and it involves no patient at all.
- What it costs, or at least what the range depends on. Practices avoid this and it is the most searched thing about them.
- The nervous patient post. Say plainly what you do differently for somebody who is frightened. People screenshot this and send it to a partner.
- Meet the person who will be in the room. Not a corporate team page, one person and what they are like.
- The correction. Charcoal toothpaste, whitening strips, brushing straight after orange juice. These travel further than anything else you will post.
- The equipment, when it changes the experience rather than because it is expensive. Nobody cares about the model number. They care that the scan replaced the tray of putty.
That list is the general principle applied to one trade: the content already exists inside the ordinary working day. We have made the broader case in what a small business should actually post about, and the dental version is unusually clean because the questions are so consistent from patient to patient.
Reviews, and the two ways practices get this wrong
Reviews matter more in dentistry than in almost any category we work with, because the decision is local, high trust and hard to evaluate on any other basis. That makes the temptation to help them along strong, and there are two specific failures worth naming.
The first is incentives. Offering anything of value for a review, including entry into a draw or money off a hygiene appointment, changes the nature of what you are collecting and the FTC's guides are unambiguous about disclosure of material connections. The second is staff. A practice with fourteen glowing reviews, four of which are from people who work there, has a problem that is obvious to any reader who checks and is exactly the situation the FTC describes when it says an ad featuring an employee endorser is misleading unless the connection is made clear.
Reposting a review is also a use of a patient's information. A five star review someone left publicly is theirs to have written, and turning it into a graphic that says "our implant patient said" is you confirming that a named person is a patient. Ask first.
This is a local business, so be findable locally
A dental practice does not need reach. It needs to be the answer when somebody within four miles types a question, which is a different and much easier problem. That means the town or district belongs in your profile and in the words of your posts rather than only in a location tag, and it means the questions you answer should be the ones people type rather than the ones you would phrase.
The mechanics of that are the same for every local business and we have written them up in social media SEO for small business. The one line version is that the searchable surface is smaller than people think and the name field on your profile is the most wasted forty characters in the category. The same consistency is what gets a practice named when somebody asks an assistant for a recommendation instead of a search engine, which is a related problem covered in how to get your business to show up in ChatGPT.
What this does not fix
Social media will not fill a schedule next week, and a practice with a three week gap should be calling its recall list rather than opening TikTok. The channel builds the pool of people who have heard of you before they need you, and recall builds this month.
It also cannot repair a reputation problem. If the reviews describe waiting times and rushed appointments, posting more will only make more people aware of the reviews. That is worth saying plainly because the marketing industry's usual answer to bad reviews is more content, and it is the wrong answer. If you are pricing up whether to run this in house at all, what social media management actually costs is the honest comparison.
The short version
- Write one marketing authorization form and use it every time, at the chair, not at registration.
- Assume a cropped photo is still identifiable, because the caption usually identifies it anyway.
- Lead with fear, cost and process. Save the clinical photography for the cases you have a signature for.
- Never pay for a review, and disclose it when the reviewer works for you.
- Put the town in your profile and in your words, not only in a tag.
- Ask before resharing a review. It confirms that a named person is your patient.
Frequently asked questions
Can dentists post before and after photos on social media?
Yes, with the patient's written authorization. A photograph used to promote the practice is a marketing use of protected health information, and HHS states that marketing generally requires written authorization under the Privacy Rule. A treatment consent signed at registration is not that authorization.
Does cropping a photo to the mouth avoid HIPAA?
Not reliably. The protected information is that this person is your patient and had this treatment, and a caption naming the procedure supplies most of that. Whether a bare intraoral image with no context is identifiable is arguable, which is exactly why getting a signature is the cheaper answer.
What should a marketing authorization form say?
What will be used, where it will appear by name rather than as promotional purposes, whether the face is included, and how the patient withdraws permission. It should be signed at the point the photograph is taken and stored somewhere you can produce it later.
What should a dental practice post if not before and after photos?
What happens in a first appointment minute by minute, what things cost or what the range depends on, what you do differently for nervous patients, the person who will be in the room, corrections of common myths, and equipment only where it changes the patient's experience. None of it needs paperwork and it is what new patients decide on.
Can I share a patient's Google review on Instagram?
Ask first. Turning a public review into a practice graphic confirms that a named person is your patient and links them to a treatment, which is information the practice is disclosing rather than the patient. The review being public does not transfer that decision to you.
Can dental staff leave reviews for the practice?
Only with the connection disclosed. The FTC's guides state that an ad featuring an endorser who is a relative or employee of the marketer is misleading unless the connection is made clear. A cluster of undisclosed staff reviews is also obvious to any reader who looks at the profiles.
Can I offer a discount in exchange for a review?
No. Incentivising reviews creates a material connection that has to be disclosed, and it changes what you are collecting from feedback into paid endorsement. In a category where trust is the entire product, it is a poor trade even where it is technically survivable.
Which platform works best for a dental practice?
Instagram and Facebook, because the decision is local and both are still where local recommendation happens. TikTok works well for practices willing to answer fear and myth questions on video. The platform matters less than being unmistakably located in one town.
How often should a dental practice post?
Once or twice a week, consistently, from a small set of repeatable formats. Practices burn out on daily posting inside a month because clinical days do not leave room for it, and a quiet feed reads worse to a new patient than a sparse but current one.
Can I use AI to write posts for my dental practice?
For drafting the words, yes. For deciding whether an image is publishable, no, and this is the sharp edge in this category. A tool cannot know whether a photograph has a signed authorization behind it, and the obligation stays with the practice, so a person checks every image before anything goes out.
How we researched this
- The HIPAA position described here is read from the Department of Health and Human Services' own marketing guidance, opened on 13 August 2026 and linked below, together with the regulation it cites at 45 CFR 164.508. It is a description of the federal floor. State privacy law can be stricter, your state dental board has its own advertising rule, and none of this is legal advice.
- We have kept two things apart on purpose. That marketing uses of protected health information generally require written authorization is what the regulation says. That a before and after photograph of a patient's mouth is such a use is our reading of it, and it is the reading that dental defence organisations and practice lawyers generally take. Where a question is genuinely arguable we have said so rather than printing the confident version.
- The content advice comes from what works for local businesses whose customers are chosen within a few miles of home, which is a category we have onboarded a lot of. Dentistry differs from the rest of it in one respect that shapes the whole article: the product is something most people are actively afraid of.
- We sell a tool that drafts posts. That interest is disclosed where it becomes relevant.
Sources
