Should your medical practice turn off social media comments?

A med spa owner messaged us on a Saturday, clearly rattled. A past client had commented under a Botox post, by full name, thanking the injector and mentioning the dose and the area treated. The owner froze. Was that a HIPAA problem? Should she delete it? Should she just turn comments off on everything so it never happened again? Her social media person had already drafted the settings change.

We told her to breathe, and to leave the comments on. The thing she was afraid of was real, but the fix she reached for was the wrong one. Turning comments off does not solve the HIPAA question at all, and it hands away one of the few things social media actually does for a practice. Let us walk through it the way we did with her.

Why owners want to switch comments off

The instinct is understandable. When you run a healthcare page, the comment section can feel like a liability waiting to happen. Owners usually point to four fears:

• A patient says too much. Someone names their condition, their procedure, or their provider in public, and you panic that you are now responsible for it.
• Trolls and spam. Ads in particular pull in rude strangers, bots selling things, and the occasional person with a grudge.
• Medical misinformation. A commenter gives flat out wrong health advice under your post, and you worry it looks like your practice endorses it.
• Nobody is watching after hours. A comment sits unanswered all weekend and you would rather it never existed.

Every one of those is a real concern. None of them is actually fixed by disabling comments. They are fixed by managing them, which is a very different thing.

The HIPAA part, because this is where the real teeth are

Here is the piece most owners have backwards. A patient sharing their own health information in a public comment is not a HIPAA problem. People are allowed to say whatever they want about their own care. HIPAA governs you, the covered entity, not your patients.

The risk lives entirely in your reply. The moment your practice responds in a way that confirms the person is a patient, or mentions anything about their condition or treatment, you can cross into an impermissible disclosure. And this is not theoretical.

In 2019 the Department of Health and Human Services Office for Civil Rights settled with a Dallas dental practice, Elite Dental Associates, for 10,000 dollars after it responded to a patient's negative online review by posting the patient's name along with details of her health condition, treatment, and insurance. The patient had posted first. The violation was not her comment. It was the practice answering with protected information in public. That one reply triggered a federal settlement and a corrective action plan.

So the honest takeaway is this: turning comments off does nothing to protect you here, because the exposure was never in the comment box. It was in the keyboard of whoever runs your page. The fix is a simple rule everyone with access follows, which we will get to below. This is the same discipline that applies when you respond to reviews without violating HIPAA.

What you give up when you turn comments off

Now the cost side, which owners almost never weigh. Disabling comments is not a neutral safety setting. It takes three things away from you.

1. It shrinks your reach

Comments are one of the loudest signals the Facebook and Instagram systems use to decide who sees a post. A lively comment thread tells the platform the content is worth pushing to more people. Switch comments off and you strip out that signal, so the same post reaches fewer people organically, and your paid ads work harder for the same result. You are paying more to be seen while trying to feel safer.

2. It makes you look like you are hiding

Patients notice a locked comment section. In a field built entirely on trust, a page that will not let anyone speak reads as a practice with something to manage. The open, answered comment section does the opposite. It shows a real office that stands behind its work and talks to people like humans.

3. It buries real patient questions

This is the one that actually costs you money. A huge share of the comments under a practice post are not trolls. They are questions. Do you take my insurance. Are you accepting new patients. How much is that treatment. Do you have anything next week. Those are people with a wallet out, asking to be sold to. Turn comments off and they cannot ask, so they scroll on and book with whoever let them. A comment left unanswered is barely better, which is why response speed matters just as much here as it does when you answer social media messages and DMs.

And patients expect a quick answer. In Sprout Social's ongoing research on social behavior, most consumers say they expect a business to respond on social media within 24 hours, and a sizable group wants a reply even faster than that. A buried question is a lost patient on a clock.

The smarter middle path

You do not have to choose between a wide open free for all and a silent, locked page. The platforms give you real tools for exactly this. Here is what we set up for the practices we manage.

• Turn on comment filters. Both Instagram and Facebook let you auto hide comments that contain specific words you choose. Load in profanity, common spam phrases, and competitor names, and most of the junk never appears in public at all.
• Hide, do not delete, by default. Hiding a comment keeps it from everyone else while the person who wrote it still sees their own words, so it rarely sets them off. Save deleting for spam, harassment, or anything that exposes protected health information.
• Answer the real complaints in public, then take it private. A calm reply that says you are sorry to hear this and you would love to make it right, please call or message the office, looks far better to the next reader than a comment that vanished. The reply is for the hundred people reading, not just the one who complained.
• Have one clear HIPAA rule for everyone with the login. Never confirm someone is a patient and never mention any care detail in public. Ever. If a thread needs specifics, move it to a private message or a phone call.

What a patient naming their care actually calls for

Back to the med spa owner. The right move with that comment was not to delete it and not to panic. It was to reply warmly without touching a single clinical detail. Something like, thank you so much for the kind words, we are so glad you had a great experience, and we cannot wait to see you again. No confirmation of what was done, no dose, no area, nothing that turns a happy patient into a disclosure. The client feels seen, the next reader sees a real five star moment, and your practice never says anything it should not. That is the whole game.

Where EtherealMinds comes in

We work only with healthcare practices in the United States, and the comment section is one of the first things we lock down the right way when we take over a page. As part of our social media management, we set the keyword filters, write the reply playbook your front desk can actually follow, monitor comments and DMs so patient questions get answered fast instead of sitting over a weekend, and keep every public reply on the clean side of the HIPAA line. For the practices that live and die on comments, like a med spa running Botox and filler promotions, that difference shows up directly in booked appointments.

The point is simple. An open, well run comment section is not a liability to hide from. It is one of the few places online where a nervous new patient can watch how you treat people before they ever call. Handle it with a filter and a rule instead of a kill switch, and it becomes part of your patient acquisition system instead of a source of Saturday panic.