Can Orthodontists Post Patient Photos on Social Media? HIPAA Basics

Last updated: November 5, 2026

Yes, you can post patient photos on social media, as long as you have the patient’s written HIPAA authorization before the photo goes up. Debond-day smiles, before and after results and team moments with patients are some of the best content an orthodontic practice has. The photo is rarely the problem. Posting it without a signed authorization is.

Patient stories are one of the strongest assets in orthodontic marketing, so it pays to get the compliance side right once and then use that content for years.

The rule is clear, and the fix is mostly paperwork and habits. Here’s what HIPAA says, where practices get caught, and the system we recommend.

Not legal advice: this post explains the federal HIPAA Privacy Rule in plain language. State privacy laws and dental board rules can add requirements, so confirm your forms and policies with your attorney or compliance advisor.

Is it a HIPAA violation to post pictures of patients?

It is a violation if the photo identifies a patient and you don’t have a valid written authorization to use it. HIPAA protects health information that can be tied to a person, and a social post from your practice account tells the world that the person in the picture is your patient.

HHS spells this out in its HIPAA marketing guidance: “With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing.” A promotional post on your practice’s Instagram, featuring a patient’s result, is the kind of use that guidance is written for.

The American Dental Association makes the same point for dental offices. Its patient privacy and social media guidance warns that photos and messages posted to the practice’s website or social pages, “or the personal pages of team members, may violate privacy laws if the post identifies a patient,” and adds that “Releases should always be obtained in writing.”

What counts as an identifiable patient photo?

Any photo where a reasonable person could tell who the patient is counts. The obvious case is a face, but captions, tags, first names, school mascots and a location check-in can identify someone just as fast.

HHS’s de-identification guidance lists the 18 identifiers that must be removed before health information is considered de-identified under the Safe Harbor method. One of them is “Full-face photographs and any comparable images.” Names and dates are on that list too, and they sneak in through captions.

Cropped intraoral shots are a gray zone. Alone they may not identify anyone, but add a caption like “Congrats to our senior soccer captain!” and a small town knows exactly who it is. Our view: if you’re asking whether a photo is identifiable, get the authorization anyway.

What does a valid HIPAA authorization for photos need to include?

A valid authorization must contain the core elements and statements listed in 45 CFR 164.508, the federal regulation on authorizations. The same section says a covered entity “must obtain an authorization for any use or disclosure of protected health information for marketing,” with narrow exceptions for face-to-face communications and promotional gifts of nominal value.

Here is a plain-language checklist of what 164.508 requires. Use it to review the form you have now with your attorney:

1. What you’ll use. A specific description of the information, such as “intraoral and extraoral photos, before and after images, and video taken during treatment.”
2. Who is sharing it and who receives it. Your practice, plus the people or class of people it goes to. For social media, that means the public.
3. Each purpose. Say it plainly: the practice website, social media accounts and advertising, if you plan to use all three.
4. An expiration date or event. The rule requires one. Pick something that matches how long you’ll realistically use the content.
5. Signature and date. If a parent or guardian signs for a minor as the personal representative, the form must describe that person’s authority to act for the patient.
6. The right to revoke in writing, and how to do it.
7. A statement about conditioning. In general, you can’t make treatment depend on signing a marketing authorization, and the form has to say so.
8. A note that information shared may be redisclosed by the recipient and may no longer be protected.
9. Plain language, plus a copy of the signed form for the patient.

Two practical notes. Don’t bury the authorization inside new-patient paperwork; the rule limits “compound” authorizations combined with other documents. And keep a simple log of who signed and what you posted, so a revocation is easy to honor.

Has HHS actually fined anyone for posting patient photos?

Yes. In 2016, OCR announced a settlement with Complete P.T., Pool & Land Physical Therapy, a Los Angeles-area practice, over patient testimonials posted to its website. According to the HHS resolution summary, the practice posted “patient testimonials, including full names and full face photographic images,” without valid HIPAA-compliant authorizations. It agreed to pay $25,000 and adopt a corrective action plan.

The OCR Director’s statement in that summary is worth reading twice. Covered entities, she said, “must ensure that they have adequate policies and procedures to obtain an individual’s authorization for such purposes, including for posting on a website and/or social media pages, and a valid authorization form.”

Dental practices have also settled with OCR over social media disclosures, including the Elite Dental Associates case covered in the FAQ below. Review replies trip up even careful practices, so treat every public response as a potential disclosure.

Do HIPAA social media rules apply to your team’s personal accounts?

Yes, when a team member posts something that identifies a patient. The ADA guidance quoted above names “the personal pages of team members” directly. A chairside selfie or a “guess who came in today” story can identify a patient, even from a personal account.

This is where most practices are exposed, and it’s rarely malicious. Assistants love their patients and want to celebrate them. A short written policy and a few minutes of training fix most of it: patient content goes through the practice account, after the authorization is on file.

A workable policy covers:

• Who can post to the practice accounts, and who checks for a signed authorization first
• No patient photos, names or stories on personal accounts
• How to handle a patient who tags the practice in their own post (a like or a generic thank-you is very different from adding details)
• What to do if someone posts a mistake: take it down, tell the privacy officer, document it

If you’d rather hand the whole workflow to a team that does this every day, our social media consulting includes content planning and posting with consent checks built in.

Why patient photos are worth the paperwork

Prospective families want to picture themselves in your chair, which is why real patients beat stock photos.

The practices that do this well treat it as a system. One of our clients, Dr. MaryEvan Thacker Hellebusch of Thacker Orthodontics, put the payoff this way on our home page: “Every time we have an idea in our heads, you put it into digital form. It looks great, and it reaches our patients wonderfully.”

If you’re building a library of patient content from scratch, our guide to orthodontic practice photography covers what to shoot. Dr. Kyle’s older post on using photos in your practice shows how simple the camera side can be. And when you’re ready for a professional shoot, our video and photography services team handles the session for you.

A simple consent workflow for orthodontic practices

Ask at the right moment and make the signature routine. Here’s the workflow we suggest:

1. Ask at a high point. The debond appointment or the reveal of a great result is when families are proudest. Ask then, never as a condition of treatment.
2. Use one standalone form, reviewed by your attorney, that covers photos, video, website, social media and ads. For minors, the parent or guardian generally signs.
3. Log it. Patient name, date signed, expiration, and what you posted. A shared spreadsheet works.
4. Write captions without health details. Celebrate the smile, not the chart. Use a first name only if the authorization covers it, and never mention diagnoses or appointment details.
5. Turn off location tags and don’t tag the patient’s personal account unless they asked you to.
6. Honor revocations fast. Remove the posts and note the date in your log.

With authorizations on file, good results can go up the same week. For more ideas on what to do with that content, see our playbook for what orthodontic practices should post on social media, or see how patient stories fit into a broader content marketing plan.

Frequently Asked Questions

Can an orthodontist post a patient’s before and after photos?

Yes, with the patient’s signed HIPAA authorization, or a parent’s or guardian’s signature for a minor. Before and after photos that show a face, name or other identifying detail are protected health information. The authorization should name the photos, the purpose (website, social media, ads), an expiration date and the right to revoke. Have your attorney review the form before you use it.

What is considered a HIPAA violation on social media?

Posting anything that identifies a patient without written authorization. That includes photos with faces, names in captions, tagging a patient, sharing appointment details, and replying to reviews or comments with treatment or billing information. It applies to practice accounts and to team members’ personal accounts when they post about patients.

Can we repost a patient’s own photo when they tag our practice?

Be careful. When the practice reshares a patient’s post, the practice is the one publicly confirming that person is a patient. Our recommendation is to get a signed authorization before resharing, and to keep any reply generic, like “Thanks for the love!” without treatment details. Ask your compliance advisor how they want your team to handle tags.

What are examples of HIPAA violations in the dental field?

HHS has settled with dental practices over social media disclosures, including Elite Dental Associates in Dallas, which paid $10,000 in 2019, according to the HHS settlement summary. Other common problems include patient photos posted without authorization and review replies that mention treatment details.

Want help building patient content the right way?

If you want a social and photo strategy that puts real patients front and center, with consent built into the process, talk with our team. We’ll show you what a consent-first content plan looks like for your practice.