What are clinicians' responsibilities for their own social media posts?

The HIPAA Privacy Rule does not stop at the practice's official pages. A physician, nurse, therapist or front-desk employee who posts protected health information on a personal account can create a breach for the practice. Protected information is broader than a name. A photo of a waiting room with a visible schedule, a description of an unusual case in a small town, or a reply that confirms someone is a patient can all identify a person.

The safe rules are simple to state:

• No patient photos, videos or case details without a signed HIPAA authorization that covers social media use.
• No "guess who I saw today" posts, even when the clinician thinks the details are vague.
• No replies to reviews or comments that confirm a person was treated, even to correct a false claim.
• No clinical photos taken on personal phones unless the practice policy allows it and the images are stored securely.

Our guide on HIPAA for healthcare marketing teams covers authorizations and photo handling in more detail.

The FTC's Endorsement Guides apply to clinicians who talk about products, devices, supplements, apps or services. If a clinician receives money, free products, equity, travel or any other benefit from a company, a post that mentions that company needs a clear and conspicuous disclosure. A hashtag buried among others, or a line in a profile bio, is generally not enough. The disclosure should sit in the post itself, in plain words such as "paid partnership" or "I received this device free from the manufacturer."

Clinicians should also avoid:

• Recommending prescription drugs or devices for uses the FDA has not approved in a way that reads as promotion.
• Posting fake or paid reviews of their own practice, or asking staff to post reviews.
• Sharing patient testimonials that imply typical results when results vary.

Practices in aesthetics see these issues often. Our FTC endorsement guide for aesthetic practices shows compliant disclosure wording.

Because the practice carries much of the risk, it should not leave social media to individual judgment. A one-page policy, signed by every clinician and staff member, should cover:

• What counts as patient information, with examples from your own specialty.
• Who may post on practice accounts, and who reviews posts before they go live.
• How to handle patient comments, reviews and direct messages.
• Disclosure rules for any paid or sponsored relationship.
• What happens after a mistake: who to tell, how fast, and how the post is removed and assessed as a possible breach.

Give staff a simple way to ask before posting, such as a named contact in the compliance or marketing team, so questions get answered quickly instead of guessed at. Refresh the training at least once a year and when a new platform or feature becomes popular with your team. Our social media marketing guide for physicians covers how to build a compliant posting routine. This page is general information, not legal advice; confirm details with your compliance officer or counsel.