Patient photos and videos on dental social media: consent and privacy
A dental practice should only post a patient's face, voice, name, radiograph or story with the patient's explicit, written consent for that specific use — a HIPAA authorization in the US, explicit consent under UK GDPR in the UK — which the patient can withdraw. Treatment consent does not cover social media, and even confirming someone is a patient can breach confidentiality.
Updated 5 min readGeneral information, not legal advice.
By the DentVideo editorial team, Bulsu Labs · Last reviewed
Why this deserves its own checklist
A before-and-after smile, a patient's thank-you video or an X-ray with a name in the corner looks harmless. But it combines three sensitive things: health information, a person's image, and advertising. A mistake in any of them can lead to a privacy complaint, a regulator's inquiry or a damaged relationship with a patient.
What the law expects
In outline; always check the current rules where you practise:
- United States: patient images and stories are protected health information under HIPAA; marketing use generally requires a signed authorization that states what will be used, for what, and how to revoke it.
- United Kingdom: health information is special category data under UK GDPR, and the duty of confidentiality applies online. Explicit, informed consent is the usual basis for publishing; the GDC's guidance on social media points the same way.
- European Union: Article 9 of the GDPR treats health data as a special category; national data-protection authorities enforce it.
- Everywhere: advertising rules still apply on top. Consent does not make a misleading before-and-after acceptable; see dental social media advertising rules.
What a good consent form says
- Separate from treatment consent: agreeing to treatment is not agreeing to appear on Instagram.
- Specific: what will be used (intraoral photo, full face, voice, first name), where (Instagram, website, waiting room) and for how long.
- Freely given: treatment must not depend on it, and no discount should be offered in exchange.
- Written and signed, and stored with the patient record.
- Revocable: how to withdraw, and what you will do (remove posts you control within a reasonable time).
- For children: signed by a parent or guardian, with the child's own view taken into account.
How to ask without making it awkward
Do not ask in the chair or in a hurry. Ask at the end of treatment, calmly and in writing. Explain in one sentence why (“it helps us show other patients what this treatment involves”), show the exact image you would use, and make clear that saying no changes nothing about their care. If they hesitate, treat it as a no.
Offer smaller options: an intraoral photo only, no name, website only rather than social media. Many patients are comfortable with a limited version even when they would not want to appear on camera.
Before you film in the clinic
Most problems come from the background, not the patient you are featuring. Before recording, check for monitors showing records, the appointment book, radiographs with names, and other patients in the waiting room or the next surgery. Turn off location tagging if you do not need it, and never tag a patient unless they asked you to.
Your team has image rights too. Get written consent from staff who appear in videos, and agree in advance what happens to those videos if they leave.
Replying to online reviews
Replying to a review is where many practices slip. Confirming that the reviewer is a patient, mentioning their treatment or correcting their account with details from the record can all disclose health information. In 2019 the US Department of Health and Human Services settled with a Dallas dental practice for exactly this: its replies to Yelp reviews had disclosed a patient's last name, treatment plan and insurance details. A safe reply thanks the person, says you take feedback seriously, and invites them to contact the practice directly — nothing more.
Alternatives that need no patient data
Most useful content does not need real patients at all: the dentist explaining to camera, models and typodonts, diagrams, animation and narrated videos. They are easier to produce, never have to be taken down when consent is withdrawn and raise no advertising questions. Ideas in dental social media post ideas.
DentVideo makes exactly this kind of video: narrated, captioned education in your colours, or clips cut from your own recording, with every script checked for promises and testimonials. You approve everything. See your own videos before you pay.
A week of patient-education videos, checked before you see them
DentVideo writes, narrates and captions five short videos a week in your language and colours, checks each one for clinical accuracy and advertising rules, and waits for your approval. See a live preview with your own logo and colours before you pay.
Questions
Can I post a patient's before-and-after photos?
Only with their explicit, written consent or HIPAA authorization for that specific use, and without misleading about typical results. Advertising rules in your country may add restrictions.
Do staff need to sign consent forms to appear in videos?
Yes, it is good practice everywhere and often required. Agree in writing how the videos will be used and what happens to them if the person leaves the practice.
Can I repost a patient's own post that tags the practice?
Be careful: resharing it in your marketing turns their post into your testimonial and confirms they are your patient. Ask for written consent first, and check your advertising rules on testimonials.
Does treatment consent cover social media?
No. Publishing is a different purpose and needs separate, specific, written consent that the patient can withdraw.
What if a patient withdraws consent?
Stop using the image and remove posts you control within a reasonable time. Explain this process when you ask for consent.
Can I post an X-ray with the name removed?
If nothing reasonably identifies the patient, the risk is much lower. Still check file names, metadata and context before posting.
Is this legal advice?
No. It is general information. Ask your data-protection officer, privacy officer, indemnity provider or a lawyer about specific cases.
Sources and official texts
- U.S. Department of Health and Human Services — HIPAA for professionals
- California Dental Association — Dental practice settles HHS complaint over patient information disclosed in review replies (2019)
- Information Commissioner's Office — UK GDPR and health data
- General Dental Council — Guidance on using social media (in effect since 27 June 2016)
- FTC Endorsement Guides, 16 CFR Part 255 (revised 2023) — eCFR
Rules change. Check the current text with your regulator or professional body before you rely on it.