Can Your Practice Get in Trouble for Posting on Social Media?

We hear this one almost every week. A doctor wants to grow, knows patients live on their phones now, and still will not let anyone post. Not because they are lazy and not because they do not get it. They are scared. One slip and it is a privacy violation, or the medical board takes an interest, or a patient's attorney screenshots something. So the account sits empty, the competitor keeps posting, and the fear wins by default.

Here is the honest version. The fear is pointing at something real. People in healthcare do get in trouble for what they put online. But when you look at what actually causes it, the list is short, it is specific, and none of it is caused by posting itself. It is caused by posting carelessly. Learn the three real risks and you can post with confidence for years and never come close to a line.

Risk one: putting patient information in public

This is the big one, and it is also the easiest to trip over because it does not feel like a disclosure in the moment. The rule under HIPAA is simple and strict: you cannot share protected health information without the patient's written authorization. Protected health information is not just a chart. It includes the fact that someone is your patient at all, their name, their condition, their treatment, even their payment details.

The classic way this blows up is not a post. It is a reply to a review. A patient leaves an unfair one star rating, you feel the urge to set the record straight, and you type something like, we saw you twice for that and your balance is still unpaid. You just disclosed that they are a patient and detailed their care and billing to the entire internet. That is the exact mistake a Dallas practice, Elite Dental Associates, made. In 2019 it paid a $10,000 settlement to the federal Office for Civil Rights after revealing a patient's name and treatment details in a Yelp reply, and the investigation found it was not a one time thing.

The fix costs nothing. Never confirm that a person is your patient online. Never discuss any detail of anyone's care in public. When a review needs a response, keep it warm and generic, thank them, and invite them to call the office so the specifics stay private. We wrote the full playbook on this in how to reply to reviews without violating HIPAA. The same caution applies to photos, testimonials and that heartwarming patient story you want to share. If it identifies a real patient, you need their written consent first, which is covered in getting patient testimonials without breaking HIPAA.

Risk two: giving real medical advice to strangers

Education is encouraged. A dermatologist explaining what a suspicious mole looks like, a physical therapist demonstrating a stretch, a dentist busting a myth about charcoal toothpaste, all of that is great and completely safe. The line gets crossed when general education turns into individual treatment advice for a specific person you have never examined.

Someone comments, I have this exact rash on my arm with a photo, what should I take? If you answer with a diagnosis or a prescription suggestion, you may have created a doctor patient relationship in the eyes of the law, along with the liability that comes with it. The Federation of State Medical Boards, which guides state boards across the country, advises physicians to keep online interactions general and to avoid using social media to treat people who are not established patients.

This is not a hypothetical worry either. A national survey of state medical boards published in JAMA found that the overwhelming majority of boards had received reports of physicians' online professionalism violations, and most had opened investigations, with outcomes that ranged from a formal reprimand all the way to license suspension. The safe pattern is easy to hold onto: teach the room, never the individual. Answer common questions in general terms, and when a specific person has a specific problem, tell them the honest truth, that it needs a real visit, and point them to book one.

Risk three: claims you cannot back up

The third one is less about privacy and more about honesty. Advertising rules from the Federal Trade Commission apply to you the same as any business. If you promise a result, you need evidence for it. Guaranteeing that a treatment will cure a condition, posting a dramatic before and after without context, or running a paid testimonial that reads like a typical outcome when it is not, all of that can land a practice in hot water, and med spas get the most scrutiny here.

Keep claims truthful and specific. Say what a treatment does, who it is for, and what a realistic outcome looks like. Disclose when a post is an ad or when someone was compensated. Honesty is not just the legal path, it is the one that actually builds trust with a patient who is already skeptical of marketing. If you want the related question of whether you can even repost the nice things patients say, we covered it in can you share patient reviews on social media.

The risk nobody warns you about

Now the part that gets lost in all the worrying. Staying silent is not the safe choice. It just hides the cost. Every week you are not showing up, patients are choosing someone who is.

In a 2025 survey of more than 1,000 patients reported by Medical Economics, 35 percent said they had chosen a provider based on that provider's social media presence. A third of your future patients are deciding partly on something you refuse to do. They open Instagram, see a doctor down the road who looks human, warm and real, and book with that person. Your empty profile reads like a practice that is either not around anymore or has something to hide. That is the actual risk, and it never arrives as a letter from any agency. It just shows up as a slow month you cannot explain.

If your posting has not turned into patients yet, that is usually a strategy problem, not a reason to quit, and we broke down the why in why social media is not getting you patients.

What is actually safe to post, all day long

Once the three lines are clear, the amount of great, safe material you have is enormous. None of this comes close to a privacy or advertising issue:

• Education in general terms. What a condition is, how a treatment works, what to expect at a first visit, myths you are tired of hearing. Talk about the topic, never a specific patient.
• Behind the scenes and team. A short clip of your office, an introduction to a new hygienist, how you keep rooms clean. People book humans they have seen, not logos.
• Common questions answered. Do you take my insurance, how long is a visit, is it going to hurt. Answer the questions every patient already asks, in plain words.
• Community and seasonal. A local event you sponsored, holiday hours, a flu season reminder. Useful, friendly, and zero risk.

Notice that the safest content is also the content patients actually want. The rules do not shrink your options. They just point you at the posts that build trust anyway.

How EtherealMinds keeps you out of trouble and in front of patients

We work only with healthcare practices across the United States, so this is not a side skill for us, it is the whole job. The fear that keeps you off social media is exactly the problem our social media management for healthcare is built to remove. Every post runs through a process designed around these risks: nothing that identifies a patient without documented consent, advice that stays general by default, claims that are truthful and provable, and a review step before anything goes live. You get the consistent, human presence that wins patients, without lying awake wondering whether a caption crossed a line.

And because social media is only the discovery half of the story, we wire it into a full patient acquisition system, so the people who find you on Instagram land on a fast website and a booking flow that actually turns them into appointments. The point was never to post for the sake of posting. It is to show up where patients are choosing, safely, and give them an easy way to say yes.