Don't Build Your Practice on Rented Land

A med spa reached out to us last spring in a full panic. Their Instagram was the business. Eighteen thousand followers, a booking link in the bio, DMs full of questions, the whole thing built over four years of daily posts. One Monday they could not log in. The email on the account had been changed, the posts were gone, and the page was firing off crypto scam links to their own patients. They did everything the help pages said. The only thing that ever answered was a bot. Weeks later, they were still locked out, starting a new page from zero.

Nothing about that story is rare anymore. And it points at a truth most practice owners never think about until it is too late: you do not own your followers. You rent them. The platform owns the audience, the inbox, and the off switch, and in 2026 that off switch got pulled a lot more often.

The 2026 wake up call

This is not a hypothetical. In June 2026, Meta confirmed that attackers had exploited a single bug in its AI assisted recovery tool, the very feature meant to help people get back into locked accounts, to take over 20,225 Instagram accounts. One flaw, twenty thousand businesses and creators locked out in a wave.

Zoom out and the pattern is steady. Security researchers who track account takeovers find that Instagram and Facebook lead every other platform for hacks, with roughly 31% of social account compromises hitting Instagram and 27% hitting Facebook. When it happens, most victims are locked out completely, and most report the hacker then turned around and messaged their followers while pretending to be them. For a medical practice, that means scam links going out to your patients under your name. Back in 2024, a coalition of state attorneys general even wrote to Meta over a reported surge in hijacked accounts and how hard they were to recover.

You can also lose the account by doing nothing wrong

Here is the part that surprises people most. You do not need to get hacked to lose everything. Meta's automated systems disable accounts on their own, and they get it wrong on a regular basis. Through 2026, news outlets kept documenting business owners whose pages were shut off with little explanation, including accounts with tens of thousands of followers wiped out overnight. The common thread in nearly every story is the same one the med spa hit: when you try to appeal, the help you reach is a chatbot, and the final answer often arrives with no sign a human ever looked.

Think about what that means for a practice. Years of patient reviews, testimonials, before and after posts, and direct messages can be frozen or erased by an algorithm that made a mistake, and there is no front desk at Meta you can call to fix it. You are a tenant, and the landlord can change the locks without telling you why.

Why this hits healthcare harder

Plenty of businesses lean on social media, but a medical practice has a few extra things riding on it. Patients use your page as a trust check before they book, so a dead or hijacked account reads as a red flag about the whole practice. A lot of practices route their only booking link through the bio and take new patient questions through DMs, which means the day the account goes down, so does your front door. And the reviews and recommendations sitting on a Facebook page are not something you can pack up and move. If it all lives in one rented room, one bad morning takes out your reputation, your inbox, and your booking at the same time.

We see this especially with med spas, dermatology, aesthetics, and dental practices, the ones whose marketing is naturally visual and who built real followings on Instagram. That audience is genuinely valuable. The problem is never that they used social. The problem is that social became the only thing holding the practice up.

To be fair, social media is still worth it

Let's be honest, because the scary version of this is easy to oversell. Meta has tightened things up, and the company says new account hacks across Facebook and Instagram fell by more than 30% in the year to December 2025. Most practices will never get hacked. Social media is still one of the best and cheapest ways to reach new patients, show your team's personality, and stay top of mind in your town. We help practices run it every day, and we think they should.

So this is not a "delete your Instagram" argument. It is a "stop standing on one leg" argument. Use the rented platform for what it is great at, getting attention, and then move that attention somewhere you actually own. The practices that get burned are the ones who skipped that second step for years.

What you actually own

Here is the useful way to split it. Some of your presence is rented, and some of it is owned. Rented means a company grants you access and can take it away: your Instagram followers, your Facebook page, your TikTok. Owned means it keeps working no matter what any platform decides. Four assets fall firmly on the owned side, and every practice should be building them.

• Your website, on your own domain. Nobody can disable your site over a moderation flag. It is the one address that is always yours, which is exactly why it should hold your booking, your services, and your proof. We dug into this more in whether you actually own your practice website, because a surprising number of owners do not.
• Your email and text list. If Instagram vanished tonight, could you still reach your patients tomorrow? With an email and SMS list, yes. It is the single most durable audience you can build, and you can start collecting it at the front desk and on your site this week. Here is how to build that list.
• Your Google Business Profile. It is still run by a platform, so it is not fully yours, but it is tied to a verified physical business, far more stable than a social page, and it is where most "doctor near me" searches actually land.
• Your patient records and CRM. The list of everyone who ever booked, with contact details and history, is pure gold and completely yours. It is also the cheapest source of future visits you have.

One more thing worth saying plainly: make sure you, the owner, hold the top level access to all of it. A shocking number of practices do not even control their own ad or profile accounts, which we covered in who really owns your marketing accounts. If an ex employee or an old agency holds the keys, you are renting from them too.

The move: let social feed what you own

The practices that do this well treat social media as the top of the funnel, not the whole funnel. A reel or a post earns the attention. From there, the goal of every piece of content is gently moving that person onto owned ground: tap through to a real website, join the email list for a seasonal offer, or book an appointment that lands in your own system. The follower is nice. The booked patient in your database is the asset.

This is the same logic behind a real patient acquisition system. When we build one, social and ads bring people in, but every lead flows into a website built to convert and a CRM that captures their contact details and follows up, so the relationship no longer depends on an app you do not control. Pair that with steady local SEO so patients can find you on Google without any middleman at all, and your growth stops being one hack or one wrongful ban away from zero.

Our honest take

Renting is not the mistake. Everyone rents a little, and social media earns its place in almost every practice's marketing. The mistake is building your whole house on someone else's lot and never buying any land of your own. The med spa that lost eighteen thousand followers did not do anything reckless. They just never built the owned side, so when the rented side disappeared, there was nothing left to stand on. Keep posting. Keep growing that following. Just make sure that behind it sits a website, a list, and a patient database that no company can ever switch off. That is the difference between a practice that can be evicted and one that cannot.