What can you say
Are before-and-after photos HIPAA compliant?
A face is an identifier, and the authorization is the whole job.
Usually not, unless you hold the patient's written authorization. A before-and-after a viewer can recognize is protected health information, tying an identifiable person to care you provided. Removing the name does not fix it: a full face image is a HIPAA identifier you must strip. The pairing implies a typical result the FTC wants substantiated.
HIPAA protects individually identifiable health information, meaning anything a covered entity holds about a person's care or payment that could reasonably identify them. A before-and-after links a recognizable face to treatment you provided, announcing that the person was your patient. The definition sits in 45 CFR 160.103, and it applies whether or not a name appears, because a recognizable face alone identifies someone. Publishing that pairing is a disclosure by a covered entity or business associate, allowed only with a permitting rule or the patient's authorization.
Individually identifiable health information relates to a person's care or payment for it and either identifies the individual or gives a reasonable basis to identify them.
Advertising with a patient's image is marketing, not treatment or operations, so it needs written authorization under 45 CFR 164.508. If a third party pays to feature the image, the authorization must say so. A copyright model release is not this document: a HIPAA authorization has required elements, a description of the use, who may use it, an expiration, and the right to revoke. Consent for one campaign does not cover the next, and an enthusiastic patient has not necessarily signed a valid one.
A covered entity may not use or disclose protected health information without a valid authorization; marketing uses require authorization, which must note any financial remuneration involved.
HIPAA offers two ways to de-identify, and a recognizable before-and-after clears neither. The Safe Harbor method at 45 CFR 164.514(b)(2) lists eighteen identifiers you must remove, and full face photographic images and any comparable images are on it, at (b)(2)(i)(Q); a photo whose whole value is that you can see the patient is not stripped of that identifier. Expert determination under 164.514(b)(1) asks a qualified expert to certify the re-identification risk is very small, and a clear facial image fails that test too. Blur or crop it unrecognizable and you fall outside PHI but lose what made the photo persuasive. No version is both recognizable and de-identified.
Under the Safe Harbor method, full face photographic images and any comparable images are identifiers that must be removed to de-identify protected health information.
Suppose you clear HIPAA with a signed authorization. You still carry the typicality problem that any dramatic result creates. A before-and-after implies that the pictured change is what a patient can expect, so under 16 CFR 255.2(b) you need substantiation that the outcome is representative, or a clear and conspicuous disclosure of the result patients generally see. The consent form answers the privacy question; it does nothing for the advertising one.
An ad implying that a depicted result is typical must hold substantiation for the generally expected performance, or clearly disclose that performance.
The scanner cannot see your consent folder, so it reads the caption for the two claims a before-and-after makes: this is a real patient, and this is what you will get.
Swipe to see a patient's before-and-after: 40 pounds gone in six weeks.
An identified before-and-after implies a typical result and, for a covered entity, can disclose a patient relationship without authorization.
A general illustration of the treatment area, with typical-results language and no identified patient.
Shows the service without an identified patient or an implied guaranteed outcome.
Sources
Pre-Trip is a rigorous screen, not legal advice. Counsel decides; we help you arrive prepared.