Illinois Medical Practice Act advertising rules — a marketing guide for physicians and practices

What Illinois calls "advertising" — and the deceptive-practice standard

Illinois takes an expansive view of what constitutes advertising for medical-board purposes. It includes paid media in any channel — print, broadcast, out-of-home, digital display, paid search, paid social, sponsored content — and also unpaid content published by or on behalf of the licensee: a practice website, a Google Business Profile, a physician's professional social-media account, review-platform responses, patient-education videos, downloadable guides, webinars, and podcast appearances in a promotional context.

The deceptive-practice standard at 225 ILCS 60/22(A)(3) covers three related failure modes. First, a material misrepresentation: an affirmative statement that is false in a way that a reasonable patient would find important. Second, a material omission: leaving out a fact that a reasonable patient would need to interpret the advertisement correctly. Third, a false expectation: language, imagery or juxtaposition that leaves a reasonable patient with a mistaken impression about what the treatment can deliver, even if every individual statement is technically true.

IDFPR reads the "overall impression" prong seriously. A page that pairs a photograph of a slim, athletic patient with the text "our weight-management programme" implies an outcome even without saying anything false — and IDFPR has treated that construction as deceptive under the false-expectation prong. The safer construction is to keep imagery non-idealised, or to use the imagery only under a testimonial disclosure with a stated "results not typical" line.

Credentials, specialties and titles

Illinois takes titling and credentialing claims seriously because they go directly to a reasonable patient's decision about who to see. The general standard is that any credential or specialty claim must be accurate, current, and referable to a recognised certifying body. Three specific tripwires recur.

• Board certification. The phrase "board-certified" is only safe when the certifying board is a member of the American Board of Medical Specialties (ABMS), the American Osteopathic Association Bureau of Osteopathic Specialists (AOA-BOS), or another body recognised by IDFPR. Certifications from private organisations that award them for a fee, without a defensible examination and training standard, cannot be shortened to "board-certified" — they must be identified by the full name of the certifying entity.
• Fellowship claims. "Fellowship-trained" implies a formal, accredited fellowship in the named specialty. A brief observership, a weekend course, or a non-accredited preceptorship does not qualify and cannot be advertised as a fellowship.
• "Specialist" and "specialising in". These phrases are permissible where the physician has substantial training and practice concentration in the area, but IDFPR has cautioned that they should not be used to imply a certification that does not exist. The safer construction is to describe the training and the practice concentration directly — "trained in reconstructive surgery, with 60% of the practice concentrated in that field" rather than "specialist in reconstructive surgery" alone.

Physician-supervised versus physician-performed

Illinois distinguishes between a service performed by a physician and a service performed by a non-physician under physician supervision. An ad that says "administered by our physicians" when the injection is in fact administered by a licensed practical nurse under supervision is deceptive under 225 ILCS 60/22(A)(3). The safer construction identifies the licensed provider category and the supervising physician by name.

Digital advertising — SEO, ads, social, review platforms

Every rule above applies identically to digital surfaces. Four digital-specific patterns deserve separate calibration.

SEO and AI Overview content

Ranked or generative-AI-cited content that touches Illinois patients is subject to the same false-and-misleading standard as a print advert. Landing pages, condition explainers, and long-form guides need the same substantiation, currency, and typicality controls as paid media. AI Overview citations are particularly exposed because a fragment lifted out of context can become the ad in a search-result reading. Author every long-form healthcare page with a byline, a "medically reviewed by" line, a review date, and a link to sources — not because those signals ensure ranking, but because they preserve the substantiation trail an IDFPR reviewer will look for.

Paid search and paid social

Paid-search ad copy and paid-social creative are subject to two overlays in addition to Illinois: the ad platform's own healthcare policy (which varies by vertical and geography), and — for pixel-based tracking — the federal HIPAA rules on disclosure of PHI to third-party trackers. The Illinois-specific point is that the physician remains responsible for every claim in the ad copy, even when the ad platform inserts a dynamic-keyword-insertion phrase. Practices must build a review workflow that inspects every rendered ad, not just the templates.

Google Business Profile and directory listings

Directory content is advertising for Illinois purposes. Practice descriptions, service categories, opening hours, and photographs on Google Business Profile, health-directory profiles, insurance directories and physician-listing sites need the same currency and substantiation controls. A stale profile that lists a physician who has left, a service that is no longer offered, or an outdated credential is deceptive by omission under the false-expectation prong.

Review platforms and responses

The practice's own response to a patient review is advertising by the practice. Two failure modes recur. The first is confirming a patient's presence in a review response — that is a HIPAA disclosure regardless of what the reviewer said, and it exposes the practice to both federal HIPAA enforcement and Illinois deceptive-practice review. The second is publishing a rebuttal that names or characterises the specific care rendered — again a PHI disclosure. The safe response pattern is a de-identified, standard-form reply that thanks the reviewer, invites offline discussion, and does not confirm or deny the reviewer's status as a patient.

Federal overlay — HIPAA, FTC, TCPA, ADA

Illinois advertising rules do not preempt or relax federal requirements. Every campaign that runs in Illinois must clear all of them.

• HIPAA Privacy Rule (45 CFR 164). Any advertising that uses PHI requires prior written authorisation. Any third-party tracker on a page that combines an IP address with a condition URL is a disclosure of PHI under the 2022/2024 OCR bulletins.
• FTC Act Section 5. Deceptive or unfair advertising is a federal violation independent of Illinois rules. The FTC endorsement guides at 16 CFR 255 are the operative standard for testimonials nationwide.
• TCPA (47 USC 227). Marketing texts and pre-recorded calls to patients require prior express written consent. Statutory damages are USD 500 to USD 1,500 per unlawful message and can aggregate in class actions.
• ADA Title III. Practice websites are places of public accommodation under most federal appellate readings. WCAG 2.2 AA is the operative reference standard, and Illinois inspectors have increasingly cited accessibility failures alongside deceptive-practice complaints.