What compliant actually means here
Most social media advice is written for retail and hospitality, and it doesn't transfer cleanly to a dental or medical practice. The core rule that changes everything: consent to treat a patient is not consent to use their information, image, or story for marketing. Those are two separate permissions, and a practice needs the second one, in writing, before any patient content goes on a social account — full stop, regardless of how enthusiastic the patient was in the chair.
This matters more on social media than on a website because social posts get shared, screenshotted, and surfaced in ways a static webpage doesn't. A testimonial buried on a website's reviews page is one thing; the same testimonial as a public Instagram post with a patient's face and full name attached is a materially bigger disclosure, and it needs its own explicit sign-off. This is one reason a clinic's digital presence needs a slightly different process than a typical local business's — the upside of social proof is real, but the process to get there has an extra, non-optional step.
Build a simple, reusable consent form specifically for marketing use of a patient's photo, story, or testimonial. Have it ready at checkout for any patient who volunteers positive feedback, rather than scrambling for consent after you've already posted something.
Before-after photos, done properly
Before-and-after photos are some of the highest-performing content a dental practice can post — cosmetic and orthodontic results are visual and persuasive in a way text testimonials aren't. But they carry the most risk if handled loosely. The safe approach: explicit written consent for marketing use, specific to that image, obtained separately from any general treatment consent; cropping or blurring identifying features (eyes, distinguishing marks) unless the patient has separately agreed to be fully identifiable; and avoiding captions that name a specific diagnosis or condition unless the patient has explicitly agreed that detail can be public too. A "smile transformation" caption works; "treated for severe periodontal disease" without consent for that specific disclosure does not.
Content that works without the risk
Four categories consistently perform well for dental and clinic accounts without touching patient-specific clinical detail. Staff spotlights — introducing the hygienist, the front-desk team, the associate dentist — humanize a visit that's often anxiety-inducing for patients before they even arrive. Plain-language procedure explainers (what actually happens during a root canal, why a crown takes two visits) reduce the fear that comes from not knowing what to expect, and they double as genuinely useful search content. Comfort- and culture-focused content — the sedation options available, the noise-cancelling headphones at the chair, the fish tank in the waiting room — speaks directly to anxious patients, who are a meaningfully large share of anyone avoiding a dental visit. And community events — a free screening day, a sponsorship of a youth sports team, participation in a local health fair — build the same neighbor-not-vendor trust that works for any local business, without any patient-specific content at all.
What to avoid in comments and captions
The single most common compliance mistake we see clinics make isn't in their planned content — it's in the comments. A patient asks "does this hurt if I have a similar issue?" in the comments of a post, and someone on staff, trying to be helpful, replies with specific advice. That reply can read as medical guidance given without an exam, and depending on how the question was phrased, it can expose details about that patient's situation to everyone else reading the thread. The safe, consistent response to any specific medical question in a public comment is a short redirect: thank them, and ask them to call the office or book a consultation to discuss their specific case. No exceptions, even when the answer feels obvious.
The same logic applies to anything resembling PHI — protected health information — in a caption or comment: no patient names paired with condition details, no photos that could identify a patient without documented consent for that exact use, and no discussion of a specific patient's treatment plan anywhere public, even in response to a glowing message from that patient.
Who should actually run the account
The person posting for a dental or medical practice doesn't need clinical training, but they do need to understand the consent rules well enough to catch a problem before it's posted, not after. In practices we work with, the strongest setup pairs someone comfortable with content and scheduling with a designated staff member — often the office manager or a clinician — who signs off on anything involving a patient's image, story, or specific case before it goes live. That second set of eyes is the single biggest safeguard against an innocent mistake, like a well-meaning team member posting a thank-you message that names a patient and their procedure together without realizing that combination needed separate consent.
Practices that skip this second review step tend to be fine for months, right up until they aren't — a single posted testimonial or photo without proper consent can require a public correction and an uncomfortable conversation with the patient involved. A five-minute sign-off step before publishing is cheap insurance against that outcome, and it's a habit worth building into the practice's digital presence workflow from day one rather than retrofitting after something goes wrong.
It's also worth writing this process down, even briefly — a one-page checklist covering who can post, who signs off on patient content, and what the redirect response to a public medical question looks like. New hires and rotating front-desk staff change more often than most practices' social accounts get audited, and a written checklist survives staff turnover in a way that "everyone just knows the rules" doesn't.