Social Media for Healthcare: Marketing and Management Guide for Practices (2026)

Social media for healthcare has two jobs, and most practices only plan for one of them. The first is obvious: give prospective patients a reason to trust you before they book, with posts that answer the questions your front desk hears every day. The second is the one that ends up in an enforcement notice: a process that stops the wrong photo, the wrong reply or the wrong claim from going public. A dental office, a physiotherapy clinic and a hospital marketing team all need both.

This guide is written for the person who actually runs it: the practice manager, the marketing coordinator at a multi-site dental group, the health system social lead. It covers what to post and where, the HIPAA, FTC and ad-platform rules with the real cases behind them, and how to manage healthcare social media day to day so a coordinator can draft, a clinician can review, and nothing identifiable slips out at 7pm on a Friday.

One caveat up front. This is practical guidance, not legal advice. Where a rule matters, we link the official source so you can take it to your compliance officer or counsel.

Part of our guides by industry. If you work in another regulated field, the law firm guide covers the same review problem under bar advertising rules, and the guide for financial advisors covers it under FINRA, SEC and FCA rules.

Why Social Media for Healthcare Is Worth the Effort#

Patients look you up before they call. They check whether the dentist seems kind, whether the clinic is the kind of place that explains things, whether the physio has ever treated a running injury like theirs.

Your profiles answer those questions whether you post or not. A page last updated in 2022 answers them badly.

The audience is already there. Pew Research Center's 2025 survey found 71% of US adults use Facebook and 84% use YouTube. The age split is where it gets useful for a practice: Facebook reaches 80% of adults aged 30 to 49 (the people booking appointments for themselves, their kids and often their parents) and 74% of those aged 50 to 64.

Instagram reaches 80% of adults under 30 but only 19% of those over 65. That one table tells a pediatric dental office and a cardiology group to put their effort in different places.

(Our roundup of social media statistics has the wider platform picture.)

There is also a quieter payoff that has nothing to do with new patients. Every post that answers "Do you take my insurance?", "What happens at a first physio session?" or "Can I eat before a cleaning?" is one fewer phone call.

Practices that treat social media as patient education at scale, rather than advertising, tend to keep doing it, because the benefit shows up at the front desk within weeks.

What social media will not do is replace your Google Business Profile, your website or your referral relationships. It sits alongside them. A patient who sees three helpful posts from your hygienist and then finds 200 solid Google reviews books.

A patient who sees great posts and a two-star profile with angry, unanswered reviews does not.

HIPAA and Social Media: The Rules That Actually Bite#

If you are a covered entity (most practices that bill insurance electronically are), HIPAA's Privacy Rule governs any protected health information (PHI) you use in marketing. On social media, PHI is anything that ties a person to their health or care at your practice. A name is enough.

So is a face in a waiting room, a first name and a procedure in a caption, or a reply that confirms someone was in your chair.

The rule that matters most for marketing is short. Under 45 CFR 164.508, using PHI for marketing requires the patient's written authorization, with narrow exceptions (a face-to-face conversation, a promotional gift of nominal value). A verbal "sure, post it" does not count. Neither does a patient tagging themselves in your post.

What a valid patient authorization has to include#

The regulation spells out the core elements. Your form for testimonials and before-and-after photos should cover:

• A specific description of what will be shared (for example, "two photos of my teeth before and after treatment, and my first name")
• Who is disclosing it and who will receive it (your practice; the public via named platforms)
• The purpose ("marketing on the practice's Facebook, Instagram and website")
• An expiration date or event
• The patient's signature and the date
• Statements that the patient can revoke in writing, that treatment is not conditioned on signing, and that once information is public it can be redisclosed and is no longer protected

It must be in plain language, and the patient gets a copy. Keep the signed forms somewhere your marketing person can check before publishing, because that is the moment it matters.

If you use a template form, have your compliance officer confirm it before anyone relies on it. State privacy laws can add requirements on top of HIPAA.

The enforcement cases are about reviews, not hackers#

Most of the cases worth knowing involve ordinary practices doing something human. The Office for Civil Rights (OCR) at HHS has settled several:

• Elite Dental Associates, Dallas (2019): paid $10,000 after replies to Yelp reviews disclosed patients' information. The practice was answering criticism.
• New Vision Dental, California (2022): paid $23,000 over review responses that OCR found disclosed patients' protected health information.
• Manasa Health Center, New Jersey (2023): a psychiatric practice that paid $30,000 after disclosing four patients' information in replies to negative Google reviews.
• Cadia Healthcare Facilities, Delaware (2025): paid $182,000 over a "success story" marketing program that published patients' names, photos and recovery details without written authorization. In announcing it, OCR said a valid written authorization is generally needed before PHI goes into a website testimonial or a social media campaign.

Notice the pattern. Three of the four started with a practice defending itself against a bad review. Nobody at those offices thought "let's breach HIPAA today". They thought "that's not what happened, and I'm going to set the record straight".

Replying to reviews and comments without confirming a patient#

The safe reply never confirms that the person is a patient, never mentions a visit, a treatment, a date or a bill, and moves the conversation offline. Even if the reviewer has posted their own diagnosis, do not repeat it or add to it.

A reply that works for almost any complaint: "We take every concern seriously and would like to talk this through. Please call our practice manager on (your number) so we can help."

That reads as calm and accountable to the prospective patient scrolling past, which is who you are really writing for. Write two or three approved versions, keep them where the team can find them, and make "use the template" the rule for anyone replying under the practice name.

Comments on your own posts follow the same rule: "Great to see you last week, glad the extraction healed well!" is a disclosure, however friendly.

The everyday leaks#

Most HIPAA problems on social media are not testimonials. They are background details:

• A team photo with the schedule screen or a sign-in sheet visible behind it
• A "busy Monday!" Story filmed in the waiting room with patients in shot
• A birthday cake for "our favorite patient, Maria"
• Location tags or check-ins that place a recognizable person at a specialty clinic
• A celebratory post about "the first patient on our new laser", with a date

The fix is a habit, not a policy document: before anything is filmed on the clinical floor, someone checks the frame. Before anything is posted, a second person reviews it. More on building that review step below.

Put a review step between drafting and publishing. With PostEverywhere's review queue for team posts, a team member's post waits for an owner or admin to approve it or send it back with a note.

Nothing a member drafts goes live on a timer while it is still in review. Start a 7-day free trial.

FTC Rules: Health Claims, Testimonials and Reviews#

HIPAA protects patients' information. The FTC protects patients from being misled, and it applies whether or not you are a covered entity. Three rules come up constantly for practices.

Health claims need evidence. The FTC's Health Products Compliance Guidance expects health-related claims to be backed by "competent and reliable scientific evidence", which for health benefit claims generally means well-designed human clinical trials. "Our laser therapy reverses gum disease" is a claim. So is "pain-free dentistry".

If you cannot point to the evidence, rewrite it as what you actually do: "We use local anesthetic and check in with you throughout."

Testimonials must reflect typical results. The same guidance is blunt: testimonials that show results more dramatic than people can generally expect are likely deceptive, and "results not typical" does not fix it.

Your best Invisalign case is fine to share (with authorization), but if most patients finish in 12 to 18 months and this one took 6, say so.

Reviews and endorsements have their own rules. The FTC's Endorsement Guides FAQ says employees who post about their employer need to disclose that connection in the post itself, and that asking only happy patients for reviews can be deceptive if it skews the overall picture.

Since October 21, 2024, the FTC's rule on consumer reviews and testimonials lets it seek civil penalties for fake reviews, undisclosed insider reviews and incentives that are conditional on a positive (or negative) review. "Leave us 5 stars and get a free whitening" is exactly what it targets. Asking every patient for honest feedback is fine.

If staff or paid partners post about the practice, run their captions through our disclosure checker first.

Health Ads on Meta, Google and TikTok#

Organic posts and paid ads run under different rulebooks. Before a practice spends money, someone should read the current policy for each platform, because they change often. The points below were checked in October 2026.

Meta (Facebook and Instagram). Meta's personal attributes policy bans ads that imply knowledge of someone's medical condition. Its own non-compliant examples include "Do you have diabetes?" and "Depression getting you down?

Get help now." Describe the service, not the person: "Our nutrition clinic now offers evening appointments for diabetes care" is the safer shape, though Meta's reviewers make the final call.

Meta's health and wellness standards require cosmetic procedure ads, including injectables, laser treatments and before-and-after transformations, to target people 18 and over.

Google. Health is a sensitive interest category for personalized advertising, and Google's health in personalized advertising policy rules out advertiser-curated audiences, such as customer lists and remarketing, for health products and services.

Google's broader healthcare and medicines policy requires certification for things like online pharmacies, telemedicine and addiction services. A general dental or physio search campaign is usually straightforward. A remarketing campaign to people who visited your "anxiety treatment" page is not.

TikTok. Healthcare ad rules on TikTok differ by market, so read the healthcare and pharmaceuticals policy for every country you target. One recent change matters for aesthetics clinics: since March 2026, TikTok allows cosmetic surgery and aesthetic procedure ads in the US and Canada, on conditions.

Ads must disclose risks and recovery times, must not use before-and-after imagery that exaggerates results, must be age-targeted, and need approval through a TikTok sales representative.

Tracking pixels on booking pages. This is where ad measurement and HIPAA collide. OCR issued guidance on online tracking technologies, and in June 2024 a federal court vacated part of it covering unauthenticated public web pages.

What the ruling did not change: data from patient portals and booking flows that reveal a person's care can still be PHI. If an ad platform's pixel sits on your appointment form, get your compliance officer to look at it before you scale spend.

When you do set a budget, the ad budget calculator helps you size it against the bookings you need.

Which Platforms a Healthcare Practice Should Use#

Pick two platforms you can keep up with, not six you abandon in March. Here is how we would choose.

Facebook is the default for nearly every practice. It reaches the 30 to 64 age bands that make most healthcare decisions, and it handles the practical posts (holiday hours, flu clinic dates, a new associate) better than anything else. Scheduling Facebook Page posts ahead keeps a steady run of these going without someone remembering to log in.

Instagram earns its place when results are visual or when your patients skew younger: dental and orthodontics, dermatology and aesthetics, physio, sports medicine, pediatrics. Short Reels showing the room, the team and the equipment do more than polished graphics. Queue them on Instagram in advance so a Reel filmed on Tuesday does not sit in someone's camera roll for a month.

YouTube is where patients search for "what happens during a root canal" or "ACL surgery recovery week by week". One good explainer keeps working for years. If your clinicians are licensed doctors, nurses, psychologists, marriage and family therapists or clinical social workers, and the channel meets YouTube's thresholds (more than 1,500 public watch hours in 12 months, or 1.5 million Shorts views in 90 days), you can apply for YouTube's health source features, which label videos as coming from a licensed professional. Dentists and physios are not on that list today.

You can schedule YouTube videos and Shorts in the same place as everything else.

Google Business Profile is not a social network, but for "dentist near me" and "urgent care open now" searches it matters more than any of them. Keep hours, photos and services current and answer every review with the safe template above. Manage it directly in Google.

TikTok works for clinicians who are comfortable on camera and want to reach under-30s. Pew found 63% of 18 to 29 year olds use it. Myth-busting ("Does whitening damage enamel?") travels well.

Skip it if nobody on the team wants to be the face of it.

LinkedIn is not for patients. It is for recruiting hygienists, nurses and associates, and for referral relationships with GPs, specialists and employers. Scheduling LinkedIn posts keeps a hiring post a week going without much effort.

Mental health practices deserve a special note. The Manasa case above was a psychiatric practice, and the bar for anything that could identify a patient is higher still. Lean on general education, clinician introductions and practical information (fees, how to book, what a first session is like), and limit or turn off comments, where the platform allows it, on posts where people might disclose too much.

What Healthcare Practices Should Post#

The practices that keep posting for years publish roughly the same handful of things, built once and refreshed each season. The difference between a good post and a risky one is usually what it needs before it goes out.

A few notes on doing these well.

Answer the questions you already hear. Ask the front desk for the ten questions they get most often. That is your first two months of content, and it comes with a built-in audience. "How long does a crown appointment take?" will outperform anything you invent.

Write the way you talk in the hallway. "Composite resin bonding" means nothing to someone scrolling Instagram. "A tooth-colored filling that blends right in" does. If your least medically minded patient would need to search a word, rewrite it.

Show the people. Provider and team introductions are some of the most useful posts a practice publishes, because patients choose the person they feel comfortable with. A hygienist explaining why she went into dentistry does more for an anxious patient than any offer.

Use the calendar that already exists. The ADA runs National Children's Dental Health Month every February with free materials, and the federal Office of Disease Prevention and Health Promotion publishes a monthly round-up of national health observances.

Pick the three or four that fit your specialty, plan them a quarter ahead on a content calendar, and you will never face a blank week.

Keep promotions to roughly one post in five. "New patient exam $99" belongs in the mix. A feed that is nothing but offers trains people to scroll past.

For more starting points, our content calendar templates give you a month's structure to fill in, and a free planner for your content themes helps you settle the four or five themes you will rotate.

Misinformation, Crisis Moments and Sensitive Posts#

Health content is held to a higher standard by the platforms themselves. YouTube's medical misinformation policy removes content that contradicts local health authority guidance on prevention, treatment and specific substances. Meta and TikTok have their own versions.

A practice is unlikely to break these rules on purpose, but a clinician sharing a strongly held view on vaccines or supplements from the practice account can. The practice account should say what the evidence and your clinicians agree on. Link the source when you make a claim.

Plan for the days when you should not post at all:

• A local emergency or tragedy. Pause scheduled posts the moment it happens. A cheerful "Smile Saturday!" landing during a community crisis is the kind of thing people screenshot.
• A data incident or system outage at the practice. Your communications should come from one approved statement, not a queue of hygiene tips running underneath it.
• A public health event. Share the official guidance from your health department or the CDC, not your own interpretation.

The practical requirement is that one person can stop everything in the queue within minutes, without hunting for passwords. Decide who that is now, and make sure they know where every scheduled post lives on the content calendar.

Provider Personal Accounts vs the Practice Account#

Clinicians on social media are a real asset. A dentist answering questions on TikTok can bring in more patients than anything the practice account posts. It also blurs lines that need to be clear.

The AMA's ethics guidance on professionalism in the use of social media asks physicians to keep patient information off their posts entirely, to maintain professional boundaries if they interact with patients online, and to consider separating personal and professional content.

Your licensing board or professional body may publish its own guidance, so check that too.

In practice, set these rules in writing:

• Patients are never discussed on personal accounts, even anonymously ("had a tough case today" with a recognizable detail is enough).
• Clinical advice is not given in DMs or comments. "Please call the office so we can help properly" is the reply.
• Staff who promote the practice from their own accounts disclose that they work there, in the post, as the FTC expects.
• Decide who owns the account before it grows. If an associate builds a following under the practice's name and leaves, who keeps the handle? Agree it on day one, not at the exit interview.
• The practice account is never a personal account. Holiday photos and political opinions belong elsewhere.

You can draft a staff policy in a few minutes as a starting point to adapt and run past your compliance officer.

Healthcare Social Media Management, Week to Week#

Strategy is the easy part. Healthcare social media management is the weekly routine that makes the strategy happen while patients are being seen. Here is the setup that holds up in a busy practice.

Decide who can post, and who can only draft#

The single most useful control a practice has is separating the people who write posts from the people who can publish them. The coordinator, front desk lead or marketing assistant drafts. A practice owner, office manager or clinical lead approves.

In PostEverywhere this maps to who can publish and who can only draft: owners and admins publish and approve, and once approvals are switched on, members submit their drafts for approval instead of publishing.

Nobody shares a Facebook password, and when someone leaves, you remove one login instead of changing six.

Build in compliance review before anything posts#

A review step only works if it is fast enough that people do not route around it. Keep it to three checks:

1. Is anyone identifiable? Faces, names, screens, paperwork, location tags. If yes, is the signed authorization on file?
2. Is every claim one we can back up? No cures, no guarantees, typical results stated for any outcome shown.
3. Is it right for this week? Dates, hours and offers correct, and nothing tone-deaf given local news.

With approvals switched on, a team member's post shows "Submit for approval" instead of "Publish now". It waits under "Waiting for approval" until an owner or admin clicks "Approve" or "Request changes" with a note the author sees. Approvals are on every plan except Lite.

Treatment result posts can sit in drafts until the paperwork is confirmed, then move into the calendar. Our roundup of approval workflow tools compares the options if you are evaluating more than one.

Run multiple locations and providers without cross-posting mistakes#

A group with three clinics has a specific failure: the post with the Elm Street phone number goes out on the Oak Avenue page. The fix is structural. Keep each location's accounts in its own workspace, with its own drafts and calendar, and share a template across locations while changing the address, phone number and offer per site.

PostEverywhere's Scale plan includes five separate workspaces, and you can add more for $2/month each. For a single practice with several provider pages, connecting every provider page once keeps them in one place.

Keep a weekly rhythm#

Two or three posts a week per platform is a pace most practices can hold. Here is a realistic week for a single dental practice on Facebook and Instagram:

Then a daily ten-minute slot for comments and reviews, using the approved reply templates. PostEverywhere publishes and schedules posts. It does not manage comments or review replies, so that slot happens in the platforms themselves.

For timing, our posting-time research gives sensible starting points, and the queue lets you set weekly openings that posts drop into automatically. Treat both as starting points and adjust once you see your own numbers.

Batching and Repurposing Healthcare Content#

The weekly rhythm only survives if the posts already exist before the week starts. Two habits make that happen.

Batch education content once a month#

Practice social media rarely dies from a shortage of ideas. It dies because the only person free to post is also running the front desk. Move the work into one block a month: ninety minutes to draft every education post, provider introduction and seasonal reminder, send them for review, and schedule the approved ones.

If you plan in a spreadsheet, you can import a CSV of up to 200 posts at once. Evergreen education posts (hygiene tips, post-op care, myth-busters) can be kept and rescheduled next year rather than rewritten.

Repurpose one explainer across every platform#

The most efficient thing a practice can do is film one clinician answering one common question well, then cut it for every platform. Take "Do I need a crown or a filling?":

• The full 3-minute answer goes to YouTube
• A 45-second cut becomes an Instagram Reel, a YouTube Short and a TikTok
• The three key points become an Instagram carousel
• A short text version with a link to the video goes to Facebook
• A note for referring dentists about when you recommend crowns goes to LinkedIn

That is six or seven posts from one twenty-minute filming session. You can write one post for every platform, use "Customise per platform" to adjust each caption, and schedule it everywhere at once.

Our guide to repurposing content for social media goes deeper on the cutting process.

Where PostEverywhere Fits in a Practice's Workflow#

PostEverywhere is a scheduling and publishing tool for all top platforms. For a healthcare practice, the parts that matter are the approval step, roles, separate workspaces for locations, the calendar and queue, and cross-posting. AI Studio can produce a first draft of a caption when you click "Write with AI", and a clinician should still read every one before it is approved, because generated copy has no idea what your licensing board allows you to claim.

You can also connect an AI assistant such as Claude or ChatGPT to draft a month of posts. If you do, ask it to save drafts, and remember that posts created through an agent or the API do not pass through the approval queue, so keep that connection with the person who approves.

What it is not: a HIPAA compliance product, a patient system, or a review inbox. It does not connect to your EHR or practice management software, and it should never hold patient information.

Treat every caption, image and file name you put into it, or into any social tool, as public the moment you type it.

On cost, approvals start on Starter ($19/month: 5 social accounts, 2 team members). Growth ($29/month: 10 accounts, 3 team members) suits a single practice where a coordinator drafts and a provider approves.

Scale ($39/month: 20 accounts, 5 team members, 5 workspaces) is the step up for a group. Extra team members are $5/month each. Every plan starts with a 7-day free trial, card required.

Run a practice's social media from one calendar. Draft a month of patient education in one sitting, hold every team member's post for approval, and publish to all top platforms with the social media scheduler. See plans and start a 7-day free trial.

Measuring Healthcare Social Media: Appointment Requests, Not Likes#

Likes tell you a post was pleasant. They do not tell you whether it filled a chair. Measure the things that pay for the effort:

• Appointment requests from social. Add UTM tags to every link you post, so your website analytics can separate Instagram bookings from Facebook ones. Our UTM tagging tool makes these in seconds. Never put anything about a patient or a condition in a UTM tag.
• Calls. A dedicated tracking number in your social bios shows how many calls those profiles generate.
• "How did you hear about us?" on the intake form, with social platforms listed as options. It is low-tech and it works.
• Recruiting results. If LinkedIn brought in your last two hygienist applicants, that is a return worth counting.
• Which formats earn attention. Compare education posts, team introductions and videos over a quarter in cross-platform analytics, and shift next quarter's calendar toward what works. A quick engagement check helps you compare posts fairly across accounts of different sizes.

Review it once a month: how many bookings and calls came from social, which three posts did best, and what you will do more of next month. If you need a structure, our guide to measuring return on social walks through it.

Your First 30 Days#

If you are starting from nothing, or restarting after a long gap, this is the order that works.

1. Week one: policy and permissions. Write a one-page social media policy covering who drafts, who approves, what needs a signed authorization, how to reply to reviews, and what staff can post personally. Get your compliance officer to read it. Remove shared passwords.

2. Week one: fix your profiles. Update hours, phone numbers, booking links and photos on Google Business Profile, Facebook and Instagram. Answer every outstanding review with the approved template.

3. Week two: collect your questions. Ask the front desk and clinicians for the ten questions patients ask most. That is your content list.

4. Week three: one filming session. Film a clinician answering three of those questions. Cut each one for every platform you use.

5. Week four: batch, review and schedule. Draft the rest of the month's posts, send them for approval, and schedule the approved ones. Then put the next batch session in the diary.

For goals, audiences and channel choices beyond healthcare, see our planning framework for any industry.

Give your practice a review step before anything goes live. Coordinators draft, clinicians approve, and the calendar runs itself between batch sessions. Try PostEverywhere free for 7 days.

FAQ#

Can a practice post patient photos or testimonials on social media?#

Yes, but only with the patient's signed written authorization. HIPAA requires written authorization before protected health information is used for marketing, and a photo, a name or a story about someone's treatment counts.

The form should say exactly what will be shared, on which platforms, for what purpose, when the permission expires, and that the patient can revoke it in writing. A verbal yes or a patient tagging themselves is not enough.

Check your form with your compliance officer before relying on it.

How should a healthcare practice respond to a negative review?#

Reply briefly, calmly and without confirming the reviewer is a patient. Do not mention a visit, treatment, date or bill, even if the reviewer already has. Thank them, say you take concerns seriously and invite them to call the practice manager directly.

Several HIPAA settlements, including Elite Dental Associates, New Vision Dental and Manasa Health Center, began with practices disclosing patient details while defending themselves in review replies.

Can doctors and dentists have personal social media accounts?#

Yes. The AMA's ethics guidance suggests keeping personal and professional content separate, never posting identifiable patient information and keeping professional boundaries with patients online. Practices should put written rules in place: no patient discussions on personal accounts, no clinical advice in DMs, staff disclose their employment when promoting the practice, and an agreement on who owns any account built under the practice's name.

How often should a medical or dental practice post on social media?#

Two or three posts a week on each main platform is a pace most practices can keep up, especially when posts are drafted in one monthly batch. Consistency matters more than volume.

A steady run of education tips, team introductions and practice news does more than daily posting for a month followed by silence.

What is healthcare social media management?#

It is the ongoing work of planning, writing, reviewing, publishing and measuring a practice's or health system's social media posts. For healthcare it adds a compliance review step: one person drafts, an authorized person approves, and nothing that could identify a patient goes out without signed authorization.

A healthcare social media management tool puts that work on one calendar with roles and approvals, so nobody shares passwords.

Is PostEverywhere HIPAA compliant?#

PostEverywhere is a social media scheduling and publishing tool, not a HIPAA compliance product, and it is not designed to hold patient information. It does not connect to EHR or practice management systems.

Treat it like the social platforms themselves: never put protected health information into a caption, image or file name. Its approval step supports your own review process by holding team members' drafts until an owner or admin approves them.

Which PostEverywhere plan suits a dental or medical practice?#

Approvals start on Starter at $19 a month with 5 social accounts and 2 team members. Growth at $29 a month adds 10 accounts and 3 team members, which suits a single practice where a coordinator drafts and a provider approves.

Scale at $39 a month includes 20 accounts, 5 team members and 5 workspaces for multi-location groups. Every plan includes a 7-day free trial, and a card is required to start.

Can AI write social media posts for a healthcare practice?#

AI can produce a useful first draft of an education post, a seasonal reminder or a service announcement, which saves the person who usually stares at a blank caption. It cannot judge whether a claim is accurate for your patients or allowed by your licensing board, so a clinician should review every AI draft before it is approved.

Never paste patient details into any AI tool to generate a post.