Patient Testimonials: HIPAA-Safe Patient Testimonial Videos and Examples
A patient testimonial is worth more than any ad a practice can buy, and it is also the marketing asset most likely to draw a HIPAA complaint. The difference between the two outcomes is a written authorization you can produce on demand.
In short
A patient testimonial is a statement from a patient about their experience with a provider, and publishing one is a disclosure of protected health information, because it identifies the person as your patient. Under the HIPAA Privacy Rule a covered entity needs a valid written authorization from the patient before using their information for marketing, and a testimonial on your website is marketing. Regulators enforce this. In February 2016 a Los Angeles physical therapy practice paid $25,000 to the HHS Office for Civil Rights after posting patient testimonials with names and photos on its site without authorization, and on September 30, 2025 Cadia Healthcare agreed to pay $182,000 and adopt a two-year corrective action plan after posting patient success stories, including names, photographs, and details of condition and recovery, for 150 patients without written authorization. Testimonials is built so the authorization is captured in the same step as the testimonial. You send one link, the patient records video or types their story in the browser with no login, they read and accept your consent language before submitting, and the record of that acceptance is stored with the testimonial. Nothing publishes until your team approves it, so a compliance review sits between the patient and your website. Then you embed the approved testimonials as a slider or wall on your practice site. This page is practical guidance, not legal advice; have your privacy officer or counsel approve your authorization language.
Last updated July 2026
What you get
Patient testimonials that founders, agencies, and SaaS teams can put live in minutes
Consent captured with the testimonial
The patient accepts your authorization language in the same flow they record in, so approval and consent live in one record instead of a separate signed PDF nobody can find.
Approval before anything is public
Every submission waits for your review. A privacy officer can hold, edit, or reject before a word reaches the site.
Video without a production day
Patients record on their own phone from a link. No studio, no crew in the waiting room, no app for the patient to install.
One flat price for the whole practice
Unlimited testimonials, locations, and staff seats on one plan, so a multi-location group is not metered per office.
How it works
From one request link to embedded proof in four steps
Set your authorization language
Have your privacy officer approve the consent text that patients read before they submit.
Send one link at discharge
Text or email the request when the patient is happiest, right after the result they came for.
Review before publishing
Nothing goes live until your team approves it, so clinical detail and identifiers get checked first.
Embed on the practice site
Paste one line to place approved video and text testimonials on your service pages.
Every plan mixes video testimonials and written quotes in one Wall of Love, and you embed it anywhere with a lightweight testimonial widget.
A sample Wall of Love
This is the kind of proof you embed on your site
❝One link later we had twelve video testimonials on our pricing page and trial-to-paid jumped noticeably.
❝The embed loads instantly and looks like part of our site. No heavy widget dragging the page down.
❝Unlimited brands on one flat plan means every client gets a Wall of Love without a billing headache.
❝Sending one link instead of chasing people by email tripled how many testimonials I actually collected.
❝Native-feeling review widgets that protect our Core Web Vitals. Proof that converts without the bloat.
❝We map video and text to specific pricing tiers. The objection is answered right where people hesitate.
Sample content · illustrative demo wall
In depth
Patient testimonials and HIPAA: what practices get wrong
Why a testimonial is protected health information
Practices often assume the rule only covers charts and lab results. It does not. The Privacy Rule protects individually identifiable health information held by a covered entity, and a testimonial that names a person and says they were treated at your clinic identifies them as your patient. That is the disclosure. It applies to the glowing five star review a patient wrote about their knee replacement just as much as to a record, which is why the safe move is to obtain a written authorization that specifically covers marketing use before you republish anything a patient said.
What a compliant authorization actually contains
HIPAA specifies what a valid authorization must include: a specific description of the information being used, who is disclosing it and who receives it, the purpose, an expiration date or event, a statement of the patient right to revoke it and how, and the patient signature and date. Marketing authorizations must also disclose if the provider receives payment in connection with the use. A one line checkbox that says I agree does not meet that bar. Write the language with your privacy officer, keep it in plain English, and store the acceptance with the testimonial so you can produce it if a complaint arrives years later.
Responding to reviews is where practices slip
The most common HIPAA marketing violation is not a testimonial at all, it is a reply. A patient posts an unfair review, the office manager responds with the visit date, what was prescribed, or that the patient missed appointments, and the practice has just disclosed PHI to the public. OCR has settled cases on exactly this. The rule of thumb: never confirm in public that a reviewer is a patient. Reply with a generic invitation to contact the office privately, and move the conversation off the platform.
Results claims, before and after, and the FTC
Consent is one layer. The other is truthfulness. The Federal Trade Commission rule on consumer reviews and testimonials bars compensation conditioned on positive sentiment, and long-standing FTC guidance requires that a testimonial describing results reflects what patients generally achieve, or that you clearly disclose the generally expected outcome. That matters most in aesthetics, weight management, and elective care, where a single dramatic outcome is not typical. State medical, dental, and chiropractic boards add their own rules, several of which restrict testimonials about the quality of care or require specific disclaimers, so check your board before you publish results language.
Where patient testimonials belong on a practice site
Not all on one testimonials page. Put the knee replacement story on the orthopedics service page, the implant story on the implants page, and a short Wall of Love on the home page and the contact page where people decide to call. Prospective patients read proof about the procedure they are considering, not proof in general. If you also collect Google reviews, show them in the same section with the Google reviews widget rather than adding a second script to the page.
Frequently asked
patient testimonials: the questions people actually ask
Are patient testimonials a HIPAA violation?
Not by themselves. A patient testimonial becomes a violation when you publish it without a valid written HIPAA authorization, because naming someone as your patient discloses protected health information for marketing. With a signed authorization that meets the Privacy Rule requirements, publishing is permitted. Without one, you are exposed even if the patient posted the words publicly first.
Do I need written consent to use a patient testimonial?
Yes. A covered entity needs a valid HIPAA authorization before using protected health information for marketing, and a testimonial on your website or social account is marketing. The authorization must describe what is being used, who receives it, the purpose, an expiration, and the right to revoke, and it must be signed and dated by the patient or their representative.
Can a patient revoke a testimonial after it is published?
Yes. HIPAA gives patients the right to revoke an authorization in writing at any time, and the revocation applies going forward. In practice that means you take the testimonial down promptly when asked, keep the revocation on file, and check anywhere else it was reused, such as social posts, printed material, and paid ads. Build the takedown step into your process before you need it.
Can I respond to a negative patient review online?
Only in a way that discloses nothing. Do not confirm the person is a patient, do not mention their visit, treatment, billing, or attendance, and do not correct their version of events with clinical facts. A short public reply that gives a phone number and invites a private conversation is the safe pattern. OCR has fined practices that answered reviews with patient details.
What is the difference between a patient testimonial and a patient review?
A review is written on a third-party platform such as Google or Healthgrades, unprompted and outside your control. A testimonial is something the patient gives you directly, usually in response to a request, that you publish on your own site. The practical difference is consent: you need authorization to republish either one on your marketing, and you control only the testimonial flow.
How do dental and med spa practices collect video testimonials?
By asking at discharge, when the patient is happiest, and making recording take under two minutes. Send one link by text that opens the camera in the browser, with no app to install and no account to create, and give them two or three specific prompts rather than a blank page. Keep your authorization language on the same screen so consent and recording happen together.
Social proof that converts, collected, not chased
Send one link, your customers record a video or text testimonial, and you embed a beautiful wall of proof on your site in minutes. Text and video, unlimited, at one flat price.