Patient Testimonials: The Most Powerful Healthcare Marketing

A practice that posts a patient's name and photo on its website without a signed authorization has made a regulated disclosure, and in 2016 one California physical therapy practice paid $25,000 for exactly that. Healthcare patient testimonial marketing is still worth doing. It just has two sets of rules attached, one from HIPAA and one from the FTC, and most of the work is in following both from the first request onward.

This guide covers why testimonials earn their place, what has to be signed before you publish one, and how to ask patients so that you actually get them.

Why patient testimonials carry so much weight

Patients check reviews before they choose. In a 2025 survey of more than 1,000 US patients, run by the reputation management company rater8 and reported by Medical Economics, 84% said they read online reviews before picking a new provider, and 61% put reviews ahead of recommendations from friends and family.

Keep the sponsor in mind. rater8 sells reputation management, so the survey is a vendor's number, not a neutral census. The direction is still hard to argue with.

The more useful finding is the gap between what patients read and what they write. 57% of respondents rarely or never review their own providers, and the report puts that down to satisfied patients telling the practice directly instead of posting online. Unhappy patients are more likely to post, which means your public rating can understate how patients feel.

That gap is the opening for testimonial marketing. The stories your happy patients already tell you in the waiting room are worth far more once they're written down, authorized and published.

Does healthcare patient testimonial marketing need HIPAA authorization?

Yes, whenever the testimonial uses a patient's protected health information and the practice is the one publishing it. Federal rules require a covered entity to get a signed authorization before using health information for marketing, and a testimonial on your website, in an email or on your social accounts is marketing.

The regulation itself, 45 CFR 164.508, allows only two exceptions to the marketing rule: a face-to-face conversation with the patient and a promotional gift of nominal value. A video testimonial fits neither.

The enforcement case that made this concrete involved Complete P.T., Pool & Land Physical Therapy. According to Patient Safety & Quality Healthcare's report on the settlement, the practice ran a video testimonial campaign on its website with patients' full names and full-face photographs, and had no HIPAA-compliant authorization for them. The Office for Civil Rights found the practice had disclosed health information without permission and had no effective policy for obtaining it. The result was a $25,000 payment and a corrective action plan with a year of reporting.

Note what the finding was about. The penalty wasn't for the testimonials being flattering or even for a patient complaining about their content. It was for the missing paperwork and the missing process behind it.

What the authorization has to contain

A valid authorization is a specific document, and a general consent form the patient signed at intake doesn't do the job. Under 164.508, it must include:

• a description of the information to be used or disclosed
• who is authorized to disclose it and who may receive it
• each purpose of the use
• an expiration date or expiration event
• the patient's signature and the date, plus a description of the representative's authority if someone signs on the patient's behalf

For a testimonial, that translates into plain choices. List the exact material (the quote, the first name, the photo, the video), name the channels (website, newsletter, social media) and set an end date. A form that says "any marketing, any time" is the form that fails.

Revocation and the no-conditions rule

Patients can change their minds. The regulation says an individual may revoke an authorization at any time, though the revocation has to be in writing and doesn't undo anything the practice has already done in reliance on it. Build a way to take a testimonial down quickly, and tell the patient how to ask.

You also can't make care depend on a yes. A covered entity may not condition treatment on a patient signing an authorization, with narrow exceptions such as research-related treatment. Present the form as a favor the patient can decline without consequence, because legally that's what it is.

Our guide to HIPAA-compliant marketing goes through the wider set of channels where the same authorization logic applies.

What the FTC rule on reviews means for your practice

The FTC's consumer reviews and testimonials rule has been in effect since October 21, 2024, and it applies to a clinic as it does to any other business. It bans fake reviews, undisclosed insider reviews, review suppression and incentives tied to a particular sentiment, according to the FTC's own questions and answers on the rule.

Several parts of that guidance land directly on healthcare marketing habits:

• Incentives are allowed, with a condition. You can thank patients for a review, but the reward can't depend on the review being positive or negative.
• Staff reviews need disclosure. A review from an employee or other insider must clearly disclose the relationship. A front-desk team posting five-star reviews undisclosed is the textbook violation.
• Don't intimidate reviewers. Making false accusations about a reviewer or unfounded legal threats to get a review taken down counts as suppression.
• Featuring a review in an ad turns it into a testimonial. The FTC says the exemption for hosting reviews on your own site doesn't cover reviews you pull into advertising.

Cherry-picking deserves its own warning. The FTC says that asking only the patients you expect to be happy isn't expressly banned by the rule but may still violate the FTC Act, and that selectively using non-representative positive reviews in marketing can be deceptive too. Ask everyone, and publish a fair spread.

The FTC page also states that its staff guidance isn't definitive and offers no safe harbor. For anything borderline, have a healthcare attorney read it.

How to collect patient testimonials without awkwardness

Ask, and ask soon. Of the patients in the rater8 survey, 74% said they'd be more inclined to leave a review if their provider asked, and 47% were most likely to do it within 24 hours of an appointment.

Email was the preferred way to be asked (46%), followed by text messages (29%). A short email the same day, sent to every patient rather than a hand-picked few, fits that pattern and also keeps you on the right side of the FTC point above.

Separate the two jobs, because they run on different rules. A public review on Google is the patient speaking on their own platform. A testimonial you quote on your site is you publishing, and that's the one that needs the authorization.

A workable sequence looks like this:

1. Send a same-day request to all patients asking for honest feedback and linking to your review profile.
2. When a patient gives you something worth featuring, ask whether you may quote it, and send the authorization form with the exact wording attached.
3. Record the form, the channels and the expiration date in one place, and set a reminder before it lapses.
4. Publish only what the form covers, and remove it promptly when a patient revokes.

Resist the urge to polish a patient's words into marketing copy. The FTC rule is aimed squarely at false testimonials, and an edited quote that no longer says what the patient said sits uncomfortably close to one.

Choosing the format: text, video or a star rating

Photo by cottonbro studio on Pexels

A short written quote is the easiest to authorize and the easiest to remove. It can carry a first name and a specific moment (the wait was short, the explanation was clear) without any treatment detail that points back to the patient.

Video persuades more but costs more to get right. Every face, name and condition mentioned in a clip is health information in the same sense as in the physical therapy case, so a video needs the fullest authorization and a clear plan for takedown if consent is withdrawn.

For most practices the sensible order is written quotes first, with video reserved for a few patients who are happy to be on camera and have signed the paperwork for it. Starting with the heaviest format is how a small practice ends up with a compliance project instead of a marketing campaign.

Where testimonials do the most work

Put them where a patient is deciding. Your Google profile is usually the first place that happens, so our walkthrough of the healthcare Google Business Profile shows how to keep that listing current and the review stream healthy.

On your own pages, place a testimonial next to the service it refers to, not on a single wall of praise. A quote about a first appointment belongs on the new-patient page, and a quote about a procedure belongs on that procedure's page.

Testimonials also give your content something real to work with. A practice that pairs patient stories with clear answers to common questions builds the trust we cover in our healthcare content marketing strategy article.

If you'd rather not build the request emails, the consent workflow and the display pages yourself, our digital marketing and growth team sets up review and testimonial systems for healthcare practices.

Frequently asked questions

Can a patient withdraw a testimonial after it's published?

Yes. A HIPAA authorization can be revoked at any time, in writing. The practice doesn't have to undo disclosures it already made in reliance on the authorization, but it should stop using the testimonial going forward.

Can I refuse treatment to a patient who won't sign a testimonial release?

No. HIPAA bars a covered entity from conditioning treatment on a patient signing an authorization, apart from narrow exceptions such as research-related treatment.

Can I give patients a gift card for a review?

The FTC allows incentives for reviews as long as they aren't conditioned on a positive or negative opinion. Offering the same thank-you to every patient who responds is the safer shape for it.

Can my staff post reviews of the practice?

Only with a clear disclosure of the relationship. The FTC rule requires reviews from employees and other insiders to disclose it clearly and conspicuously.

Should I only ask my happiest patients for testimonials?

No. The FTC says that approach isn't expressly banned by the rule but may violate the FTC Act. Send the request to every patient.

Cover photo by RDNE Stock project on Pexels