Can You Share Patient Reviews on Social Media?

A med spa owner called us on a Tuesday, half thrilled and half nervous. A patient had left a review that read like a love letter: named her injector, described her results, thanked the team by name. The owner wanted to blow it up into a graphic and post it everywhere. Then she paused and asked the question every careful practice owner eventually asks. Am I even allowed to do this?

It is a fair worry, and a common one. Reviews are the single most persuasive thing patients read about you, so of course you want them where people scroll. But you work in healthcare, where a stray detail about someone's care can cross a legal line. The good news is that sharing reviews is absolutely doable. You just have to know where the line sits.

The short answer: yes, with a few real rules

You can share patient reviews on social media. The patient already chose to post their words in public, so the review itself is out in the world. The risk is not the patient's words. The risk is what your practice adds to them.

Here is the core idea. HIPAA protects information your practice holds about a patient. When you take a review and pair it with the person's full name, their photo, a before and after, or a detail about their diagnosis or treatment, you may be confirming that a specific person is your patient and revealing their health information. That is a disclosure, and disclosures for marketing generally need written authorization. The HHS Office for Civil Rights, which enforces HIPAA, has settled cases with practices that revealed patient information in their responses to online reviews. The lesson is simple: the patient can say anything about their own care, but the moment your practice adds identifying or clinical detail, you own that risk.

What is safe, and what gets practices in trouble

Most of the panic around this topic disappears once you separate the two situations. One is low risk and you can do it today. The other needs a signed form first.

Low risk, go ahead: a text review turned into a clean graphic with the star rating and the quote, using a first name and last initial or no name at all, and no health detail. You are simply amplifying words the patient already made public, without confirming anything private about them. This is the bread and butter of good healthcare social media management, and it is one of the highest converting posts you can make.

Needs written consent first: anything with the patient's face, a before and after photo, their full name tied to a treatment, or a story about the care they received. For that, you want a signed HIPAA authorization and a photo or media release on file. We walk through the whole process in how to get patient testimonials without breaking HIPAA. It is not hard. It is one short form, and most happy patients are glad to sign it.

Why this is worth the small effort

Some owners read all this and decide it is easier to just not bother. That is the real mistake. A five star review is the most trusted thing a stranger will read about you, because you did not write it. When a nervous new patient sees a real person saying the front desk was kind and the doctor did not rush, that does more than any ad you will ever run. We made this case in full in whether online reviews matter as much as word of mouth, and the answer keeps getting stronger.

The problem is that most reviews die where they were born. They sit on your Google profile, seen by the handful of people who scroll that far, and never reach the hundreds who follow you on Instagram or drive past your Facebook page. Sharing them fixes that leak. You already earned the proof. Social media just puts it in front of the people deciding whether to book.

A simple, safe playbook for sharing reviews

You do not need a legal team to do this well. You need a routine. Here is the one we set up for the practices we work with:

• Default to no last name and no health detail. A first name and last initial is plenty. Skip the diagnosis, the procedure, and anything that ties a face to a treatment unless you have written consent. When you strip the private detail, you strip the risk.
• Make it a branded graphic, not a raw screenshot. Put the stars and the quote on a clean template in your colors. It looks intentional, it reinforces your brand, and it lets you control exactly what shows. A screenshot can accidentally include a name or profile photo you did not mean to share.
• Get a signed release for anything with a face or a story. Video testimonials, before and afters, and named patient stories are gold, and they all belong behind a signed HIPAA authorization and media release. One form, kept on file, and you can use it across your website, ads, and social.
• Do not tag or reveal the patient. Never tag the person, never confirm in a comment that they are a patient, and never reply with private detail. Even a friendly "so glad your back is better" can disclose more than you intend.
• Keep the reviews coming. You cannot share what you do not have. A steady flow of fresh reviews gives you a constant supply of content and keeps your reputation strong. Here is how to get more Google reviews without being pushy about it.

Our honest take

Do not let the HIPAA worry scare you into silence. The practices that grow are the ones that put their proof to work, and reviews are the best proof you have. The whole risk lives in one place: the detail your practice adds. Keep the patient's private information private, get a signed form before you use a face or a story, never fake a word, and you are free to share as much genuine praise as you can collect.

The bigger point is to stop treating reviews as something that happens to you and start treating them as content you own. Every real review is a small, honest ad written by someone with no reason to lie. Leaving it buried on Google is the same as printing a great testimonial and locking it in a drawer.

Where EtherealMinds fits

This is exactly the kind of thing we handle for practices so owners do not have to think about it. We help you earn a steady stream of real reviews, turn the best ones into clean, compliant posts, and keep them flowing across your social media and your website. It all sits inside one patient acquisition system built for healthcare, where the reputation side and the growth side finally pull in the same direction.

Want a quick gut check? Open your Instagram and scroll back a few weeks. Count how many of your posts are a real patient saying something real about you. For most practices the answer is zero, and that is the easiest fix in your whole marketing.