# What Consent Do You Need to Use Patient Before-and-After Photos in Ads?

Reviewed October 8, 2026 · By Michael Borgia, MedScale Health

## Short answer

As of October 2026, a HIPAA covered clinic should get the patient's signed HIPAA authorization before a treatment photo appears in any ad, with every core element 45 CFR 164.508 lists, a revocation route and an expiry. The ad must then pass the FTC's testimonial rules and each platform's before-and-after policy. MedScale Health, a paid acquisition agency for telehealth brands and clinics, does not run before-and-after ads; this page covers what a clinic needs if it does.

## What this means for you

- Treat treatment photos as protected health information. They are health information recorded in a medium, and HIPAA lists full face photographs among the identifiers that must be removed before data counts as de-identified.
- Using PHI for marketing needs the patient's written authorization under 45 CFR 164.508(a)(3). It is its own document, not a line in the treatment consent.
- The authorization needs its core elements: what is used, by whom, to whom, for what purpose, an expiry, and a signature and date, plus statements on revocation, conditioning and redisclosure.
- The ad must show typical results or say what people generally achieve. The FTC says "Results not typical" is not enough.
- Since July 22, 2026, Meta allows cosmetic before-and-after in ads targeted to adults. Microsoft bans exaggerated, unrealistic or manipulated before-and-after.

MedScale Health, a paid acquisition agency for telehealth brands and clinics, writes ad creative for aesthetic, weight care and other clinics, and as a house rule it does not make before-and-after ads. Clinics still ask what they would need to run their own, so this page sets out the consent and the advertising rules from the regulations and platform policies themselves. This page is marketing guidance, not medical or legal advice. Platform policies change, so check the sources listed at the end before acting on a specific rule.

## Why a patient photo is PHI

Under 45 CFR 160.103, health information is any information, whether oral or recorded in any form or medium, created or received by a health care provider that relates to an individual's health or the provision of health care to them. It becomes individually identifiable when it identifies the person or could reasonably be used to, and protected health information when a covered entity holds or transmits it. A photo taken at a treatment visit records the care given. HIPAA's de-identification standard in 164.514(b) lists "full face photographic images and any comparable images" among the identifiers to remove. A clinic should handle every before-and-after pair as PHI, cropped or not.

## Marketing use needs an authorization

Section 164.508(a)(1) says a covered entity may not use or disclose PHI without a valid authorization except as the Privacy Rule otherwise permits, and 164.508(a)(3) requires an authorization for any use or disclosure of PHI for marketing. Section 164.501 defines marketing as a communication about a product or service that encourages recipients to buy or use it, which describes an ad built on a patient's result. HHS's marketing guidance puts it simply: with limited exceptions, the Rule requires written authorization before PHI is used or disclosed for marketing. Get the authorization before the photo appears in any ad, and have counsel approve the form.

The form has its own rules. Under 164.508(b)(3) an authorization may not be combined with other documents, with narrow exceptions, so it should not be folded into the treatment consent. Under 164.508(b)(4) the clinic may not make treatment depend on the patient signing. It must be in plain language, the patient gets a signed copy, and if a third party pays the clinic for the marketing, the authorization must say so.

## What the authorization must contain

- A specific description of the information: which photos, of which area, from which visits.
- Who may use or disclose it, and to whom. For an ad, the recipients include everyone who sees it on the platforms named.
- Each purpose, such as paid advertising on named platforms and the clinic's own website.
- An expiration date or an expiration event.
- The patient's signature and the date, with the representative's authority if someone signs for them.
- Statements on the right to revoke in writing and how, on the clinic not conditioning treatment on signing, and on the risk that recipients redisclose the information beyond HIPAA's protection.

## When a patient revokes

Under 164.508(b)(5) a patient may revoke an authorization at any time, in writing, except to the extent the clinic has already acted in reliance on it, and 164.508(b)(2) makes an authorization invalid once the clinic knows it was revoked or once it has expired. Whether impressions already served count as reliance is a question for counsel. What needs no lawyer is the operating step: keep a register of every ad and asset that uses each patient's images, pause all of them the day a revocation arrives, remove the files from the ad accounts' libraries and record the date. Retire ads before the authorization's expiry for the same reason.

## The FTC rules on results and testimonials

The FTC's Endorsement Guides, 16 CFR 255.2, say an advertiser needs the same substantiation for claims made through consumer endorsements as for claims made directly. An endorsement about a key result is likely to be read as what consumers will generally achieve, so the advertiser should either substantiate that or clearly disclose the generally expected performance. The Guides record that disclaimers such as "Results not typical" did not adequately change that impression in the Commission's testing.

The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, defines a consumer testimonial to include depictions of a person's likeness, and bars testimonials that misrepresent that the person exists, used the service, or what their experience was. A retouched after photo, or a model presented as a patient, is the kind of misrepresentation the Rule addresses.

## What the platforms allow

- Meta: since July 22, 2026, ads targeted to people 18 and over may promote general cosmetic products, procedures and surgeries depicting before and after transformation. Statements of inferiority about appearance stay banned, weight loss ads may not show close-ups pinching fat, and prescription weight loss products follow Meta's drugs and pharmaceuticals policy.
- Microsoft: health ads and landing pages must not include before-and-after images that are exaggerated or unrealistic, weight loss ads may not use misleading or manipulated before-and-after imagery that projects unrealistic outcomes, and health advertising must target users 18 and over.

## What MedScale does

MedScale Health does not make before-and-after ads for any client; that is MedScale's rule, not a platform rule. Our creative shows the clinician, the visit, the process and the price instead, pre-checked against the rules above, and our landing pages make no outcome promises. MedScale tracks server-side under a BAA with neutral event names, and no names, emails, phone numbers, IP addresses or browser IDs go to any ad platform. If your clinic runs its own before-and-after, have counsel approve the authorization form. For the rest of the paid side, book the free growth audit at medscale.health/audit.

## FAQ

**Do I need a HIPAA authorization to use patient photos in social media ads?**

If your clinic is a HIPAA covered entity, plan on one. HIPAA requires written authorization to use or disclose PHI for marketing, and a treatment photo is health information about the patient. Have counsel approve the form before any photo runs.

**Can the photo release be part of the treatment consent form?**

Not as one combined document. 45 CFR 164.508(b)(3) bars combining an authorization with other documents, with narrow exceptions, and 164.508(b)(4) bars making treatment depend on the patient signing it.

**What happens to live ads if a patient revokes photo consent?**

The rule lets the patient revoke in writing at any time, except where the clinic already acted in reliance. Pause every ad that uses the images the same day, remove the files and record the date; ask counsel about anything already shown.

**Does Meta allow before-and-after photos in 2026?**

Yes, for cosmetic products, procedures and surgeries in ads targeted to people 18 and over, since Meta's July 22, 2026 update. Inferiority statements, pinched-fat close-ups and timed promises without qualifiers are still banned.

**Is a "results not typical" disclaimer enough?**

No. The FTC's Endorsement Guides say a testimonial about a key result is read as typical, and record that "Results not typical" did not change that in the Commission's testing. Show typical results or disclose what people generally achieve.

## Sources

- [45 CFR 164.508: uses and disclosures for which an authorization is required (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508) (checked October 8, 2026)
- [45 CFR 164.501: definition of marketing (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.501) (checked October 8, 2026)
- [45 CFR 160.103: definitions of health information, individually identifiable health information and PHI (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-A/section-160.103) (checked October 8, 2026)
- [45 CFR 164.514(b): identifiers removed for de-identification (eCFR)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.514) (checked October 8, 2026)
- [HHS OCR: Marketing (HIPAA Privacy Rule guidance)](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html) (checked October 8, 2026)
- [FTC Endorsement Guides, 16 CFR 255.2: consumer endorsements (eCFR)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-B/part-255/section-255.2) (checked October 8, 2026)
- [16 CFR Part 465: Rule on the Use of Consumer Reviews and Testimonials (eCFR)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-D/part-465) (checked October 8, 2026)
- [Meta Advertising Standards: Health and Wellness (change log Jul 22, 2026)](https://transparency.meta.com/policies/ad-standards/restricted-goods-services/health-wellness/) (checked October 8, 2026)
- [Microsoft Advertising policies: Healthcare and Pharmaceutical (updated Oct 5, 2026)](https://help.ads.microsoft.com/#apex/ads/en/60379/-1) (checked October 8, 2026)

## Related

- [Can You Use Before and After Photos in GLP-1 Ads?](https://medscale.health/answers/before-and-after-imagery-glp-1-ads)
- [What Are the Advertising Rules for Med Spas and Aesthetic Clinics on Meta and Google?](https://medscale.health/answers/aesthetic-clinic-advertising-rules)
- [Is Email and SMS Marketing HIPAA Compliant for a Clinic?](https://medscale.health/answers/hipaa-email-sms-for-clinics)

Canonical page: https://medscale.health/answers/patient-before-and-after-photo-consent-for-ads