Nothing converts an aesthetics prospect like a before-and-after gallery — and few things on a practice website touch more regulatory frameworks at once. A single gallery has to satisfy the FTC (truth in advertising), HIPAA (patient privacy), and your state medical board (advertising conduct). Five rules cover nearly all of it.
The FTC treats images as claims. That means the before and after must be genuinely comparable: same lighting, same angle, same distance, no filters, no retouching. The classic violations are subtle — a ring light and better posture in the "after" is an altered result even though no pixel was edited. If a photo was enhanced in any way, it can't represent a treatment result.
Showcasing only your single best-ever outcome presents an atypical result as the expectation. The FTC's Endorsement Guides require that depicted results reflect what consumers can generally expect — or that you clearly disclose what's typical. The practical standard: your gallery should look like your average patient, and "Individual results vary" should appear with it — visibly, not in a footer.
HIPAA treats the marketing use of patient photos as requiring its own authorization. A clinical-intake photography clause doesn't cover your Instagram. Use a standalone, signed marketing-photo release that names the uses (website, social media, advertising), and keep it on file for as long as the image is published. A patient can revoke consent — have a process for taking images down.
Cropping the eyes out isn't de-identification if a tattoo, distinctive jewelry, or the caption's date and treatment details could identify the patient to people who know them. When in doubt, treat the image as identifiable and rely on written authorization rather than anonymization.
Boards and OCR investigations follow images upstream. Patient photos belong in a system covered by a Business Associate Agreement — an EHR or compliant gallery platform — not in a staff member's personal phone camera roll or a shared drive. The photo that was never authorized for marketing but leaked from a personal device is a privacy incident, not a marketing problem.
Open your own gallery and ask: Could I hand the source photos and signed releases for every image to an investigator today? Is "individual results vary" visible without scrolling? Would my average patient recognize these results as realistic? If any answer is no, that's the punch list.
This article is educational content about publicly available regulatory guidance. It is not legal advice; consult healthcare counsel for guidance specific to your practice.
Run a free AI compliance scan — your score and sample findings in about a minute.
Analyze My Website — Free