A family sends a lovely thank-you card. A caregiver snaps a photo of a client blowing out candles on her 90th birthday. Someone leaves a furious review at 11 p.m. and the owner wants to set the record straight. Every one of those moments is a chance to show what your agency is like, and every one of them can turn into a HIPAA complaint if it lands on social media the wrong way.

The short answer: a home health agency can use social media and testimonials, but anything that identifies a patient needs that patient’s signed HIPAA authorization first, review replies must never confirm someone is a client, staff need a written social media policy, and testimonials have to follow the FTC’s rules on honest, unbought reviews. Here is how I would set each piece up.

Why social media is a HIPAA issue at all

If your agency bills Medicare or Medicaid electronically, it is almost certainly a covered entity under HIPAA. The Privacy Rule’s general rule, in 45 CFR 164.508, is that a covered entity may not use or disclose protected health information without a valid authorization unless the rule specifically permits it. Posting a client’s story to Facebook is a disclosure, and usually a marketing one.

Two details catch agencies off guard. First, the fact that someone is your patient is itself protected information. Second, a face is an identifier: the de-identification standard in 45 CFR 164.514 lists “full face photographic images and any comparable images” among the identifiers that must be removed. A smiling photo of a client in her living room, posted by a home health agency, tells the world she receives home health care.

Patient photos and stories: get a real authorization

What the marketing provision says

Section 164.508(a)(3) says a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing. HIPAA defines marketing in 45 CFR 164.501 as a communication about a product or service that encourages recipients to purchase or use it. A testimonial post that says, in effect, “this family chose us and you should too” fits that description. The only two exceptions in the marketing provision are face-to-face communications and promotional gifts of nominal value, and neither covers a post on Instagram.

Marketing or not, the answer is the same: get a signed authorization before you post.

What a valid authorization must contain

A consent checkbox on an intake form or a verbal “sure, go ahead” is not enough. Under 164.508(c), a valid authorization must be in plain language and include at least:

  • A specific description of the information, such as “one photo taken at my home and my first name.”
  • Who is authorized to make the disclosure (your agency) and to whom it may be made (for social media, effectively the public).
  • A description of each purpose, such as posting on the agency’s Facebook, Instagram and website.
  • An expiration date or expiration event.
  • The signature of the individual and the date. If a personal representative signs, a description of their authority to act for the patient.
  • Statements that the patient can revoke the authorization in writing, that treatment can’t be conditioned on signing, and that information disclosed may be redisclosed by others and no longer protected.

The rule also requires you to give the patient a copy of the signed form and, through 45 CFR 164.530(j), to keep it for six years from when it was created or last in effect, whichever is later.

How I’d run it in practice

  • Ask after the fact, never at admission. A photo release buried in intake paperwork feels like a condition of care, and the rule says it can’t be one.
  • One authorization per story. Describe the specific photo, video or quote.
  • Show them the post first. Let the family see the exact photo and caption before it goes live. It catches details you missed, like a medication bottle or a house number in the background.
  • Plan for revocation. If someone revokes, take the post down from every account and your website, and note the date.
  • Watch for cognitive decline. Many home health clients can’t meaningfully consent. If the patient lacks capacity, only their legal personal representative can sign, and I’d be cautious even then.

Lessons from filming cases

HHS’s Office for Civil Rights has penalized large providers over cameras, not just captions. In September 2018, OCR announced settlements with three Boston hospitals totaling $999,000 for letting a television crew film patients without first obtaining authorization. In 2017, Houston’s Memorial Hermann Health System agreed to pay $2.4 million after its press release named a patient.

Replying to reviews and comments

I covered the reply wording in detail in my post on local SEO for home health agencies in Texas, so I won’t repeat it here. The short version: never confirm, in public, that the reviewer or their family member is or was your client, and never mention dates, caregivers, diagnoses or visit details, even to correct a false claim.

OCR has enforced this repeatedly. Elite Dental Associates in Dallas paid $10,000 in 2019 over replies to Yelp reviews. New Vision Dental in California paid $23,000 in a settlement OCR announced in December 2022, over disclosures made in response to online reviews. In June 2023, Manasa Health Center, a New Jersey psychiatric practice, paid $30,000 after responding to a patient’s negative online review, and OCR also cited it for failing to have policies and procedures for protected health information.

The same rule applies to Facebook comments and replies to tagged posts. If a daughter comments “Thank you for taking such good care of Mom after her stroke,” don’t add detail or confirm the relationship. “Thank you for your kind words” is enough.

Caregiver and staff posts: write the policy down

The riskiest posts at a home health agency are usually not made by the marketing person. They are made by a caregiver who loves her client and wants to share a sweet moment, or a nurse venting about a hard day. Under 164.530, the agency must train its workforce on its privacy policies.

Here is what I’d put in a one-page social media policy for field staff:

  • No client photos, videos or audio on personal phones or accounts. Not even with permission. Photos for the agency go through the office and the authorization process.
  • No identifying details, ever. No names, initials, street names, neighborhoods, house photos, diagnoses or “my 2 p.m. client” stories.
  • No friending or following clients or their families from personal accounts while providing care.
  • Don’t answer reviews or comments about the agency. Send them to the designated person instead.
  • Disclose your job when you praise or review the agency.
  • Report mistakes quickly. If something gets posted by accident, tell the privacy officer right away so it can be removed and assessed.

Hand this out at onboarding and have every new hire sign it. If you are automating your hiring funnel, as I describe in caregiver recruitment automation, the policy acknowledgment is an easy step to build into it.

The FTC side: honest testimonials and reviews

HIPAA governs privacy. The FTC governs whether your testimonials are honest.

The Endorsement Guides

The FTC updated its Guides Concerning the Use of Endorsements and Testimonials in Advertising in July 2023. A few points apply directly to agencies:

  • Testimonials are your claims. Under 16 CFR 255.2, if a family says “their therapy got Dad walking again,” you need the same support for that claim as if you said it yourself. Testimonials are not scientific evidence.
  • Typical results. If a testimonial describes an outcome most clients won’t get, the ad should clearly disclose what people can generally expect.
  • Disclose material connections. Under 255.5, a family, business or employment relationship, payment, or free or discounted services must be clearly disclosed when the audience wouldn’t expect it.

The 2024 rule on fake reviews and testimonials

On August 14, 2024, the FTC announced a final rule banning fake reviews and testimonials. The Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, was published on August 22, 2024 and took effect on October 21, 2024. Unlike the Guides, it is a rule, which lets the FTC seek civil penalties against knowing violators. For an agency, the parts that matter most:

  • No fake or invented testimonials. You can’t write, create or buy a review or testimonial from someone who doesn’t exist or didn’t use your services, or that misrepresents their experience. That includes AI-written “client stories.”
  • No paying for positive reviews. You can’t offer compensation or incentives conditioned on a review expressing a particular sentiment.
  • Insider reviews need disclosure. Officers and managers who write a review or testimonial about the agency must clearly disclose their relationship. Managers also can’t ask employees or relatives for reviews without making sure that relationship is disclosed.
  • No review suppression. No groundless legal threats or intimidation to get a review removed, and if you display reviews on your own site, you can’t hide the negative ones while implying you show them all.
  • No fake followers or likes. Buying fake indicators of social media influence that you know are fake is prohibited.

The FTC rule and HIPAA push in the same direction: real families, real words, their permission, and no tricks.

What is safe to post

Your feed doesn’t have to be empty. Most good agency content involves no patient information at all:

  • Your team. Staff spotlights, new hires, certifications and anniversaries, with the staff member’s permission and no clients in frame.
  • Education. Fall prevention tips, what home health covers, how to prepare for a hospital discharge, caregiver burnout resources.
  • Your agency. Community events, hiring announcements, awards.
  • Authorized stories. Client stories with a signed authorization on file, reviewed by the family before posting.
  • Stock or staged photos, clearly not presented as real clients.

Your website and your feed should follow the same rules. My guide to HIPAA and your home health website covers the forms, pixels and chat side.

A checklist for your agency

  1. Name one person who approves every post and answers every review and comment.
  2. Adopt a written HIPAA authorization form for photos, videos and stories, reviewed by your compliance lead, with every element 164.508(c) requires.
  3. Store signed authorizations for at least six years, linked to the post each one covers.
  4. Train staff on a written social media policy and collect signed acknowledgments.
  5. Adopt a review reply script that never confirms a relationship, and use it on every platform.
  6. Ask every client family for reviews the same way, with no incentives and no screening for happy clients first.
  7. Require disclosure whenever staff, owners or their relatives post reviews or testimonials.
  8. Check testimonials for outcome claims you can’t support.
  9. Audit your accounts twice a year: old posts, tagged photos and posts whose authorization expired or was revoked.
  10. Have a takedown plan for accidental posts, including who decides whether it is a reportable breach.

Referral sources look you up too, which I cover in my home health referral marketing plan.

Frequently asked questions

Can a home health agency post patient photos on social media?

Only with a valid, signed HIPAA authorization from the patient or their legal personal representative. A face is an identifier, and showing someone as your client discloses that they receive care. The authorization must meet 164.508(c), and you must keep it for six years.

Is verbal permission enough to share a client’s story?

No. HIPAA requires a written, signed and dated authorization with specific required elements, including the purpose, an expiration date and the right to revoke. Verbal permission or a checkbox buried in admission paperwork does not meet that standard.

Can I reply to a negative review if the reviewer is lying?

You can reply, but you can’t confirm they were a client or share any details of their care, even to correct the record. OCR has settled several cases over review replies, including a $30,000 settlement with Manasa Health Center in 2023. Invite them to call the office instead.

Can we offer families a gift card for leaving a review?

The FTC rule prohibits incentives conditioned on a review expressing a particular sentiment, and Google’s review policies prohibit incentives for reviews entirely. The safest approach is to ask every family the same way and offer nothing in exchange.

Want help setting this up?

I’m a Solutions Architect at Lonestar Home Healthcare, I built the Lonestar and Epic Home Healthcare websites and an AI receptionist for a home healthcare agency, and I’m building Nuraflow, software for home care, home health and hospice agencies. If you want a second pair of eyes on your social accounts, testimonial pages or review process, get in touch.