Before and after photo consent for marketing requires a written authorization that meets 45 CFR 164.508, because promoting your practice with a patient's image is marketing under HIPAA. Clinical photographs taken to document a condition, plan, or result are part of treatment and need no separate HIPAA authorization to capture and store. The two uses are different, they need different paperwork, and combining them into one signature line is itself a rule violation.
Patient Intake Forms Pack
A comprehensive aesthetics-grade intake and medical history, photo/media release with separate marketing opt-ins, and a financial & cancellation policy — the front-desk trio.
See what's inside — $23Treatment photos and marketing photos are two different documents
A photograph taken during a consultation to plan filler placement, to document baseline asymmetry, or to compare results at follow-up is created for treatment. Treatment, payment, and health care operations uses are permitted without authorization under the Privacy Rule, so you do not need a marketing release to take or keep that image. It is part of the medical record and follows the chart's retention schedule under your state's rules.
The moment that image moves to Instagram, your website, a printed brochure, a conference deck, a manufacturer's case study, or a paid ad, its purpose changes. It is no longer documenting care; it is encouraging people to buy a service. That is a different legal category with a different requirement.
Keep the two physically separate. Clinical images live in the EMR under the patient's chart. Marketing-approved images live in a separate, access-controlled library that only exists after a signed authorization is on file. If your only copy of an approved marketing image is a file in the chart, someone will eventually pull the wrong one.
Why a before and after photo counts as marketing
45 CFR 164.501 defines marketing as a communication about a product or service that encourages recipients to purchase or use it. A before and after gallery does exactly that.
45 CFR 164.508(a)(3)(i) then requires a covered entity to obtain an authorization for any use or disclosure of protected health information for marketing, with two narrow exceptions: a face-to-face communication made by the covered entity to the individual, and a promotional gift of nominal value. Showing a prospective patient a photo album during an in-person consultation may fall inside the face-to-face exception; posting the same images publicly does not.
If a manufacturer or device company is paying you in connection with the communication, 164.508(a)(3)(ii) adds a requirement: the authorization must state that financial remuneration is involved.
Practices that are not HIPAA covered entities, which includes many strictly cash-pay med spas that never transmit a standard electronic transaction, are not bound by 164.508 as a matter of federal law. They are still bound by state medical privacy statutes, consumer health data laws, right of publicity law, and board advertising rules, all of which converge on the same answer. Get it in writing.
The required elements of a valid photo authorization
45 CFR 164.508(c) lists what must appear. An authorization missing any of these is defective under 164.508(b)(2) and provides no protection.
| Element in 164.508(c) | What it means on a photo release | Where it lives in your paperwork |
|---|---|---|
| (c)(1)(i) Specific description of the information | Identify the images by date, treatment area, and session, not "any photos" | Photo authorization form, item 1 |
| (c)(1)(ii) Who may disclose | Your practice's legal name | Form header |
| (c)(1)(iii) Who may receive | Named channels and any agency or platform, listed specifically | Form, item 2 |
| (c)(1)(iv) Purpose | "Marketing and advertising of the practice," stated plainly | Form, item 3 |
| (c)(1)(v) Expiration date or event | A real date or defined event, such as three years or until revoked in writing | Form, item 4 |
| (c)(1)(vi) Signature and date | Patient, or personal representative with authority described | Signature block |
| (c)(2)(i) Right to revoke | How to revoke, in writing, and the exceptions to revocation | Form, standard statements |
| (c)(2)(ii) No conditioning | Statement that treatment is not conditioned on signing | Form, standard statements |
| (c)(2)(iii) Redisclosure warning | Statement that information may be redisclosed and no longer protected | Form, standard statements |
| (a)(3)(ii) Remuneration | Disclosure if a third party pays you in connection with the marketing | Form, only when applicable |
| (c)(3) and (c)(4) Plain language, copy to patient | Written so a patient understands it, with a signed copy given to them | Workflow, plus retention file |
Three details deserve emphasis because they are where otherwise careful practices fail.
Specificity is not optional. "I consent to the use of my photographs" is too vague to satisfy 164.508(c)(1)(i). Name the session, the area, and the channels. A patient who agreed to a website gallery has not agreed to a paid social ad with a spend behind it.
The form must stand alone. 164.508(b)(3) prohibits combining an authorization with any other document to create a compound authorization outside narrow research and psychotherapy exceptions. Stapling the photo release to the treatment consent, or making it a checkbox on the intake packet, creates exactly the compound document the rule forbids.
Signing cannot be a condition of care. 164.508(b)(4) restricts conditioning treatment on an authorization, and the form must say so under 164.508(c)(2)(ii).
Keep the signed authorization for six years from creation or from the date it was last in effect, whichever is later, under 45 CFR 164.530(j)(2). The photos may be published for three years, but the paperwork outlives them.
Revocation, expiration, and posts already published
Under 164.508(b)(5) a patient may revoke an authorization in writing at any time, except to the extent the covered entity has already taken action in reliance on it. In practice that means you must stop future use promptly and take the images down from anything you control, while a brochure already printed and distributed, or a magazine already in circulation, falls within the reliance exception.
What the reliance exception does not do is undo the internet. Once an image is on a public feed it can be screenshotted, reposted, and scraped, and you cannot retrieve it. Say that in the form, in plain language, before the patient signs. It makes the consent genuinely informed.
Build a takedown workflow that works: a named owner, an inventory of every place each image was published, and a turnaround measured in days. A publication log listing image ID, authorization date, channels used, and post URLs turns a panicked search into a checklist. Log the revocation and the removal date alongside the original authorization.
For minors, a parent or guardian signs, and the authorization should carry an expiration that prompts a fresh decision rather than running indefinitely.
De-identification does not work the way people think
The common shortcut is to crop the face and assume HIPAA no longer applies. It is not that simple. Under the Safe Harbor method at 45 CFR 164.514(b)(2), information is de-identified only when all eighteen listed identifiers are removed, and 164.514(b)(2)(i)(Q) lists full face photographic images and any comparable images among them. Cropping addresses one identifier, not the set.
164.514(b)(2)(ii) adds a second condition that is easy to miss: the covered entity must have no actual knowledge that the remaining information could be used, alone or in combination with other information, to identify the individual. A cropped lip photo with a distinctive tattoo, an unusual piercing, a recognizable ring, or a caption saying "yesterday's lip filler with our Thursday injector" fails that test. So does a photo posted the same day the patient tagged your location.
Two operational hazards travel with digital images. Photo files carry metadata including timestamps and often GPS coordinates, so strip EXIF before publishing. And phones sync automatically, so a clinical photo taken on a personal device lands in a personal cloud account with no business associate agreement behind it. Use a practice-owned device and an application that keeps images out of the general camera roll.
What HIPAA does not cover
A HIPAA-compliant authorization is necessary and not sufficient. Three other regimes apply to the same photo.
Federal advertising law reaches the results claim. The FTC's Endorsement Guides at 16 CFR Part 255 require substantiation for performance claims conveyed by endorsements, and where the depicted result is not what consumers generally achieve, the ad must clearly and conspicuously disclose the generally expected performance, which must itself be substantiated. The FTC has been explicit that a "results not typical" disclaimer does not cure an ad that still conveys typical results. The Rule on the Use of Consumer Reviews and Testimonials at 16 CFR Part 465 separately prohibits fake or misleading reviews and undisclosed insider endorsements. If you gave free or discounted treatment in exchange for photo rights, that is a material connection and must be disclosed in the post itself.
State right of publicity law governs commercial use of a person's likeness and is separate from HIPAA. A model release addressing media, territory, duration, and compensation belongs alongside the HIPAA authorization, and for a practice that is not a covered entity it may be the primary legal instrument.
State boards regulate before and after advertising directly. Several require that images be of actual patients rather than stock or manufacturer models, that any use of models be disclosed, and that photos be unretouched and taken under comparable lighting and angle. Filters and mismatched lighting between the two frames are a fast route to a board complaint, and they are trivially detectable.
The bottom line
Treatment photos need no HIPAA authorization; marketing photos always do, and 45 CFR 164.508(a)(3) is the controlling provision. The authorization must be a standalone document with every element from 164.508(c), including a specific description of the images, named channels, an expiration, revocation language, and a statement that care is not conditioned on signing. Cropping does not reliably de-identify an image, and metadata, captions, and distinctive features can identify a patient just as effectively as a face. Layer the FTC's substantiation and disclosure rules, a right of publicity release, and your state board's advertising rules on top, then keep the signed authorization for six years.
Frequently asked questions
Do I need written consent to post a patient's before and after photos?
Yes. Using a patient photo to promote your practice is marketing under 45 CFR 164.501, and 45 CFR 164.508(a)(3) requires a written authorization for any use or disclosure of protected health information for marketing. Clinical photos taken purely to document treatment do not need a separate authorization, but posting them does.
Can the photo release be part of my treatment consent form?
No. 45 CFR 164.508(b)(3) prohibits combining an authorization with any other document to create a compound authorization, outside narrow research and psychotherapy exceptions. The marketing authorization has to be a standalone document the patient can decline without affecting their treatment.
Does cropping out the face make a photo safe to post?
Not automatically. Full face photographic images and any comparable images are one of the eighteen Safe Harbor identifiers at 45 CFR 164.514(b)(2)(i)(Q), and Safe Harbor also requires that you have no actual knowledge the remaining information could identify the person. A cropped image with a distinctive tattoo, scar, or jewelry, or one posted alongside a caption naming the treatment date, can still identify the patient.
Related templates
Free template for your practice
Get a ready-to-edit version of the document this guide describes, plus new templates as we publish them. One useful email now and then, no spam.
This guide is educational and is not legal or medical advice. Verify requirements with your own advisors and your state board before applying them in your practice.