The short answer
Yes. Using an identifiable patient photo in marketing requires a separate written authorization meeting the core elements of 45 CFR 164.508, and HIPAA treats marketing uses specially under 164.508(a)(3). A treatment consent does not cover it, cropping the eyes does not reliably de-identify, and the FTC Endorsement Guides at 16 CFR Part 255 also apply to the results you show.
Why isn't a treatment consent enough?
Because they authorize different things. A treatment consent documents that the patient understood and agreed to a procedure. A HIPAA authorization is permission to disclose protected health information for a purpose that treatment, payment and health care operations do not cover — and marketing is exactly such a purpose. HIPAA addresses marketing uses specifically at 45 CFR 164.508(a)(3), which requires a valid authorization before a covered entity uses or discloses PHI for marketing.
A photograph of a patient's face, taken in the course of treatment, held in the chart, and posted to advertise the service they received, is a marketing disclosure of PHI. It needs its own signature.
What makes the authorization valid?
Section 164.508(c) sets out core elements and required statements. An authorization missing any of them is defective, and every use made under it is an unauthorized disclosure. In practice the form must include:
| Required content | What it looks like in a photo release |
|---|---|
| Specific description of the information | "Photographic and video images of my face and neck taken on [dates]" |
| Who may disclose it | The practice, by legal name |
| Who may receive it | The practice's marketing channels, named agencies, named platforms |
| Purpose | "Advertising and promotion of the practice's services" |
| Expiration date or event | A date, or a stated event — not blank |
| Right to revoke, and how | Written revocation, with the limit that prior uses stand |
| Statement on conditioning treatment | Treatment may not be conditioned on signing |
| Redisclosure warning | Recipient may not be bound by HIPAA once published |
| Signature and date | Patient or personal representative, with authority described |
Two extras matter for aesthetics. If a manufacturer, distributor or third party pays or compensates the practice to feature results, 164.508(a)(3) requires the authorization to state that remuneration is involved. And if you want to name specific platforms — Instagram, TikTok, your website, paid ads, conference decks — list them, because "promotional purposes" is weaker than an enumerated list when a patient later objects.
Does cropping or blurring solve it?
Usually not. HIPAA's de-identification standard at 45 CFR 164.514 lists full-face photographic images and comparable images among the eighteen identifiers that must be removed under the safe harbor method, and also requires that no other information could reasonably identify the individual. A cropped mid-face shot with a distinctive tattoo, jewelry, scar or lip shape, posted alongside a treatment date and your location, can still identify someone. A black bar over the eyes is not de-identification.
There is also a right-of-publicity claim entirely separate from HIPAA. Most states recognize a cause of action for commercial use of a person's likeness without consent, and it does not care whether HIPAA applied.
What do advertising rules add?
The FTC Endorsement Guides at 16 CFR Part 255 treat before-and-after imagery as a performance claim. If the results shown are not what consumers generally can expect, you must clearly and conspicuously disclose the generally expected results — and the FTC has been explicit that "results not typical" or "individual results may vary" is not sufficient on its own. Beyond that: no altered lighting, angle, makeup or filters between the two frames, no stock images presented as your patients, and disclosure of any material connection where a patient was compensated.
What this means for your paperwork
Keep the photo authorization as a standalone signed document, never a checkbox inside the treatment consent, and store it with the images it covers so you can prove permission for any specific frame months or years later. Log the date signed, the expiration, the platforms authorized, and any revocation.
Build a revocation workflow that actually works: a named person responsible, a defined turnaround, a checklist of every place images live — website, ad accounts, scheduled posts, printed collateral, third-party agency assets — and a record of what was taken down and when. Under 164.508(c)(2)(i) revocation does not undo uses already made, but continuing to run an ad after revocation is a fresh violation.
Retain authorizations at least six years under 45 CFR 164.530(j)(2), and put a business associate agreement in place with any marketing agency or photo storage vendor that touches patient images.
Related questions
This answer is educational and is not legal or medical advice. Requirements vary by state and change over time — verify with your own legal and clinical advisors before applying anything here in practice.