AHPRA vs FDA vs NMC: Healthcare Advertising Compliance Compared 2026

By Rohit Gupta · Business & Growth Lead, Ichelon Consulting Group

LinkedIn

Updated 8 October 2026 to the National Medical Commission's Guidelines on Ethical Advertising and Public Communication by Hospitals/Medical Institutions and Registered Medical Practitioners (public notice No. R-13014/01/2024-Ethics, dated 6 October 2026, in force immediately). Paragraph numbers in this article refer to those guidelines. General information, not legal advice.

The regulatory landscape at a glance

Each of the three markets has a lead professional regulator for healthcare providers, a therapeutic goods regulator for products, an advertising standards body and a data-protection statute. The names differ. The obligations overlap in shape but not in strictness.

1. Testimonials — the sharpest divergence

Testimonials are where the three regimes disagree most visibly. A testimonial creative that is acceptable in the US, with disclosures, can trigger a professional-conduct notice in Australia, and since October 2026 it is barred in India too.

Australia — AHPRA

Section 133 of the Health Practitioner Regulation National Law prohibits advertising a regulated health service that uses testimonials. AHPRA has interpreted this expansively — reviews on Google Business Profile posted by third parties are treated differently from testimonials solicited or displayed by the practice on its own platforms. Practices are expected to actively manage third-party review platforms, not curate testimonials on their own website.

United States — state medical boards

No federal ban. State medical boards vary. California, New York and Texas hold the tightest standards, generally requiring that testimonials be truthful, non-misleading, representative of typical results and accompanied by appropriate disclosures. FTC endorsement guides apply across the country and require that any material connection between the reviewer and the practice be disclosed clearly.

India — NMC and ASCI

The NMC's Guidelines on Ethical Advertising and Public Communication of 6 October 2026, read with the 2002 Code of Ethics Regulations, close the door on testimonials in promotion. No doctor or institution may solicit, buy, procure or publish fake, paid or misleading reviews, ratings, testimonials or endorsements, and a doctor may not request or share patient testimonials for professional promotion on social media (para 3.2, Explanation V). Patient testimonials may not be used in promotion (para 8.1(xi)), and patient consent does not make a prohibited testimonial lawful (para 6.2). Hospitals may publish factual, verifiable information about themselves (para 8.3). ASCI's code adds its own requirements on substantiation and disclosure of material connections, and AYUSH-category testimonials face additional restrictions under the AYUSH ministry's advertising guidance.

2. Before-and-after imagery

Before-and-after imagery is the second most-litigated creative element in cross-border healthcare marketing. Australia and the US require substantiation, non-misleading representation and appropriate consent, and differ on what "appropriate" means. India now goes further and bars promotional use altogether.

Australia — AHPRA

AHPRA advertising guidelines require that before-and-after imagery not be misleading, include appropriate disclaimers about the possibility of different outcomes, contain no digital manipulation and be accompanied by procedure-specific risk information. In practice most Australian aesthetic practices treat before-and-after use as high-risk and default to procedural walkthrough content instead.

United States — FDA, FTC, state boards

FDA applies to the underlying device or drug where relevant (device-based aesthetic treatments, prescription cosmeceuticals). FTC applies to the advertising representation more generally. State medical boards apply where the imagery could constitute misleading professional conduct. Standard practice in the US is to include typicality language, consent documentation and photographic-conditions disclosure (lighting, positioning, procedure detail).

India — NMC and ASCI

Under the NMC guidelines, a doctor may not use promotional before-and-after photographs, success stories or celebrity patients, except for scientific or educational purposes with anonymised consent (para 8.1(v)). Consent does not make a prohibited before-and-after lawful (para 6.2), identifying features must be blurred or cropped where patient images are lawfully used (para 6.4), and AI-generated or manipulated outcome images are barred (para 7.2). ASCI Chapter I applies separately against misleading representation. For aesthetic, dermatology, hair restoration and cosmetic dental campaigns aimed at India, the practical position is no before-and-after creative at all. Dentists are regulated by the Dental Council of India rather than the NMC, but the same principles are the safe default.

3. Cost and pricing claims

Because most Indian procedures are paid out of pocket, factual price information is expected, and hospitals may publish their charges (NMC para 8.3). What India bars is using discounts, offers, coupons, cashback or free procedures as inducements (para 8.1(x)), a limb that binds hospitals as well as doctors. Australia and the US both permit pricing, with their own constraints.

4. Data protection — HIPAA vs Privacy Act vs DPDP

Data protection is the fastest-evolving dimension of healthcare advertising compliance and the one where enforcement is most visibly stepping up in all three markets.

United States — HIPAA plus state layer

HIPAA is a healthcare-specific federal framework covering "protected health information" collected, transmitted or stored by covered entities and business associates. State laws (CCPA in California, CDPA in Virginia, and a growing list of others) layer additional consumer-privacy obligations that apply whether or not the entity is covered by HIPAA. HHS-OCR enforces HIPAA with penalties up to USD 1.5 million per calendar year per violation category. State AGs enforce state laws independently.

Australia — Privacy Act 1988 and APPs

The Privacy Act 1988 governs the handling of personal information by APP entities. Health information receives additional sensitivity treatment under the Australian Privacy Principles. The Notifiable Data Breach scheme requires notification to the OAIC and affected individuals within stipulated timelines. Recent amendments have raised the maximum penalty for serious or repeated interference with privacy to the greater of AUD 50 million, three times the benefit obtained, or 30 percent of adjusted turnover.

India — DPDP Act 2023

The DPDP Act 2023 is a horizontal data-protection statute applying to all digital personal data. It defines data-fiduciary and data-processor roles, requires purpose-specific consent, mandates breach reporting to the Data Protection Board, and carries penalties up to Rs 250 crore per instance. Healthcare data falls within the general framework — there is no separate healthcare-specific carve-out.

5. Ad platform-level constraints

Beyond the country regulators, the ad platforms themselves impose healthcare-specific restrictions that apply per country. Meta, Google and LinkedIn each maintain healthcare advertising policies that vary by market.

6. Enforcement teeth — how each regulator actually acts

Regulatory strictness on paper is not the same as enforcement in practice. All three regulators are stepping up healthcare advertising enforcement, but at different speeds.

Australia — AHPRA

AHPRA publishes advertising compliance guidance and pursues both practitioner-level and practice-level action. Advertising complaints are actioned through the notifications framework and can result in caution, conditions on registration, or referral to the tribunal. The 2020-2023 aesthetic advertising enforcement wave in Australia set an active baseline.

United States — HHS-OCR, FTC, state boards

HHS-OCR publishes HIPAA enforcement results annually. FTC actions on health-claim advertising are public and frequently referenced by state AGs. State medical board discipline is jurisdiction-specific and public — a practice operating in five states may face five different disciplinary regimes.

India — ASCI, NMC, DPDP Board

ASCI publishes complaint outcomes monthly. The NMC issued its Guidelines on Ethical Advertising and Public Communication on 6 October 2026, in force immediately. For doctors, State Medical Councils may contemplate graded action, from a warning with mandatory ethics training for a first violation to suspension and, for repeated violations, removal from the register for 1-3 years (para 10.1), after a show-cause notice and a reasoned order (paras 10.2-10.3). Hospitals are dealt with under the Clinical Establishments Act or the relevant State Act. The DPDP Board is progressively activating enforcement functions through 2026 and 2027, with early enforcement expected to focus on high-volume data-fiduciary categories where healthcare marketing operations sit.

7. Reviewer overhead — the hours it actually takes

Compliance is not free. Every healthcare campaign in every market carries reviewer-hour overhead. Ichelon Consulting US tracks the median reviewer hours per campaign per month across all three markets.

Reviewer hours are a per-country line item, not a shared function across countries. A cross-country healthcare programme needs a reviewer for each country regulator on the operating rhythm.

The Ichelon Consulting US compliance operating model

Ichelon Consulting US scopes healthcare marketing compliance the same way across all three markets. A named reviewer per country regulator. A documented reviewer-hour budget per campaign per month. A campaign-boundary checklist run pre-launch and again on every creative refresh. A quarterly regulatory horizon-scan for enforcement patterns. The scope of the reviewer function is disclosed in the SOW, not hidden inside the retainer.

Cite this report

Frequently asked questions

Which regulator has the strictest testimonial rules?

AHPRA in Australia is the strictest single national framework on testimonials for regulated health services. India is now comparably strict: under the NMC guidelines of 6 October 2026, doctors and hospitals may not use patient testimonials in promotion, a doctor may not request or share testimonials for promotion on social media (para 3.2, Explanation V; para 8.1(xi)), and patient consent does not make a prohibited testimonial lawful (para 6.2). US state medical boards vary, with California, New York and Texas among the tightest.

Can before-and-after imagery be used in healthcare advertising?

AHPRA advertising guidelines require significant caveats and typically discourage before-and-after use for regulated services. FDA and FTC in the US expect substantiation and non-misleading representation. In India, the NMC guidelines bar promotional before-and-after photographs, allowing them only for scientific or educational purposes with anonymised consent (para 8.1(v)); consent does not legitimise a prohibited before-and-after (para 6.2), and identifying features must be blurred or cropped (para 6.4).

What is the biggest data-protection difference between HIPAA and DPDP?

HIPAA is a healthcare-specific US federal framework covering protected health information with a defined covered-entity structure. DPDP is a horizontal Indian data protection law applying to all personal data with narrower carve-outs. Australia relies on the Privacy Act 1988, which is again horizontal rather than healthcare-specific.

Can healthcare providers use paid Google ads that mention specific procedures?

Yes in all three markets, subject to platform-level healthcare advertising categorisation, licensing verification requirements and country-specific claim rules. Some categories (fertility, unproven experimental treatments, prescription products to consumers) face additional platform restrictions in each market. In India, ads for a hospital or clinic should carry factual, verifiable information (NMC para 8.3) with no superiority claims or offers used as inducements (paras 8.1(ix) and 8.1(x)).

Which regulator carries the largest financial penalties for a serious advertising breach?

HHS-OCR HIPAA penalties in the US can reach USD 1.5 million per calendar year per violation category. DPDP in India can reach Rs 250 crore per instance for a major breach. AHPRA can impose fines up to AUD 60,000 per offence for advertising breaches by regulated practitioners with additional consequences under the National Law. For Indian doctors, the NMC guidelines set out graded action a State Medical Council may contemplate, from a warning to suspension or removal from the register (para 10.1).

How does Ichelon Consulting US scope compliance across the three markets?

Named reviewer per country regulator, documented reviewer-hour budget per campaign per month, campaign-boundary checklist run pre-launch and again on every creative refresh, and quarterly regulatory horizon-scan for enforcement patterns.

Related reading

• US vs India vs Australia Healthcare Marketing Benchmark 2026
• Multi-country healthcare marketing agency buyers guide
• Global healthcare search behaviour report
• How to run multi-country healthcare marketing
• US healthcare marketing agency
• Australia healthcare marketing agency
• International medical advertising compliance for Indian healthcare brands