HIPAA-safe patient education content for clinics
Patient education content is HIPAA-safe when it teaches about conditions, patterns, points, and approaches without ever using an identifiable patient’s details. Write about the condition, not the case. Publish testimonials only with a signed, revocable consent on file. Keep all outcome language educational, never promissory. Every post gets a two-minute compliance read before it goes out.
Key takeaways
- Education about a condition is safe; a story about a patient is protected health information unless that patient signed a release.
- Consent for testimonials must be written, specific to the use, and revocable — a thank-you text is not consent.
- Owner replies to reviews and comments must never confirm that someone is a patient.
What is the line between patient education and patient information?
HIPAA governs protected health information: anything that identifies a patient and relates to their health, treatment, or payment. A post explaining why a clinic treats plantar fasciitis with a combination of local and distal points contains no PHI. A post saying “a 42-year-old runner came in last Tuesday with plantar fasciitis and left pain-free” contains PHI even without a name — age, timing, occupation, and outcome can identify someone in a small community. The rule is simple: write about the condition, the pattern, the method, and the research. Never write about the visit.
Composite or “typical presentation” framing is fine when it is truly composite and labeled that way. “A patient like this often presents with…” describes a pattern, not a person.
Which content formats are safe by design?
- Condition explainers — what the condition is, how Chinese medicine frames it, what a course of care typically involves.
- Point and channel education — one point, its classical indications, how it is used today.
- Seasonal medicine — the solar term, foods, habits; nothing patient-specific.
- Research translated — a published finding, one sentence of context, one honest caveat.
- What a visit looks like — the space, the intake process, the practitioner speaking to camera. No patient faces, no charts on screen, no whiteboard schedules in the background.
- Practitioner voice — why you practice the way you do, what you studied, what you are reading.
Every Lu Social post is built from these formats, drawn from classical texts and current research, so the clinic never has to reach for a case to fill the calendar.
When can a clinic use a patient’s photo, story, or review?
Only with a written authorization that names the patient, describes exactly what will be used (photo, quote, first name, condition), lists where it will appear (Instagram, website, Google Business Profile), and states that the patient can revoke it at any time. A verbal “sure, post it” or a text message does not meet that bar. Keep the signed form with the patient’s record, and take the content down promptly if consent is withdrawn.
Reviews a patient posts publicly on Google are the patient’s own disclosure; reposting them as marketing still calls for permission, and your reply must never confirm treatment details or even that they were seen at the clinic. “Thank you for taking the time to share this” is a complete reply.
How should a clinic talk about outcomes?
Educationally and in the aggregate: what the research literature reports, what the classical texts describe, what a course of care is designed to address. Avoid promissory language about any individual result, avoid before-and-after framing, and avoid superlatives you cannot substantiate. The FTC and state acupuncture boards read marketing claims as strictly as HIPAA reads disclosure; California practitioners should assume Business and Professions Code § 4937 applies to every caption. Lu Social produces marketing copy and does not make clinical claims; clinical decisions are between you and your patient.
What does a pre-publish compliance check look like?
Two minutes per piece, every piece:
- Does this identify any patient, directly or by combination of details? If yes, is signed consent on file for this exact use?
- Does any sentence promise an outcome, a fix, or a result? Rewrite it as education.
- Are images free of faces, charts, schedules, and screens?
- Does the call to action point to the website, not a phone number?
- Would I be comfortable if this post were read aloud at a board hearing?
Lu Social runs a deterministic compliance scan on every caption, blog, and reel script before it reaches your review queue, and you authorize each piece before it publishes.
Frequently Asked Questions
Can I post about a condition I treated this week?
Yes, as long as the post is about the condition, not the patient. Drop the timing, the demographic, and the outcome; keep the medicine.
Is a first name and a photo enough to require consent?
Yes. A face is identifying on its own, and a first name in a small community usually is too. Written, use-specific, revocable consent is required for both.
Do HIPAA rules apply to comments and DMs?
They apply to what the clinic writes. Never confirm someone is a patient, never discuss their care in a public reply, and move anything clinical to a private, secure channel through the website.
Does Lu Social ever see patient data?
No. The clinic owns its accounts and content; Lu Social publishes through Metricool and has zero access to patient records or clinic systems.
What about herbal content?
Herbal education posts carry a DSHEA-style statement that the content is not intended to diagnose, treat, or prevent disease, and stay educational rather than prescriptive.