Patient Testimonials for GLP-1 and Hormone Clinics: What’s Actually HIPAA-Compliant

Patient testimonials are marketing gold for GLP-1 and hormone clinics. A client saying “I lost 28 lbs and feel like myself again” converts better than any ad copy you can write. But publish the wrong testimonial and you’ve violated HIPAA, exposing your clinic to complaints, fines, and reputational damage. Here’s what’s actually legal and what’s a liability.

HIPAA 101: what counts as protected health information (PHI)

HIPAA protects “protected health information” — any medical data tied to a patient’s identity. That includes names, medical record numbers, dates of service, diagnoses, lab results, and photos. The rule: if you can identify someone by a combination of name + medical detail + photo, HIPAA applies.

Here’s the key: HIPAA doesn’t prohibit sharing patient testimonials or results. It prohibits sharing identifiable medical information without authorization. You can publish “Patient lost 25 lbs on GLP-1,” but you cannot publish “Sarah Chen, 34, lost 25 lbs on GLP-1” without written consent.

This is general informational guidance, not legal advice. Healthcare privacy law is state-specific and nuanced. Consult a healthcare attorney about your state’s requirements before publishing testimonials or before-and-after results.

How to get consent: the form you need

Before publishing any patient testimonial, use a separate written authorization. Do not assume consent from the fact that someone is your patient or that they mentioned results in a review.

Your authorization form should cover:

• What data is being shared: “Your first name, weight loss amount, and timeline (e.g., ‘Sarah M., lost 22 lbs in 12 weeks’)”
• Where it will be used: “Our website, Google Ads, Instagram, and email marketing”
• How long: “For one year, or until I revoke this consent in writing”
• Right to revoke: “I can ask for this testimonial to be removed at any time by emailing [clinic email]”
• Patient signature and date

A simple one-page form works. Example language:

“I authorize [Clinic Name] to use my first name/initial, weight loss results, and timeline in marketing materials. I understand my full name and detailed medical history will not be shared without additional consent.”

Have the patient sign (digital signature is fine) and keep a copy in a compliance folder, separate from medical records.

Safe testimonial structures (what you can publish)

Structure 1: First name only + result
“Sarah lost 24 lbs in 14 weeks.”
Low risk. Use this for social media and ads. No explicit medical detail, low identification risk.

Structure 2: First name + age + result
“Sarah, 34, completed our GLP-1 program and lost 24 lbs in 14 weeks.”
Moderate risk. Get written consent. Age + first name is more identifying. Works on testimonial pages and email.

Structure 3: Initials + photo + specific result
“S.M., 28-year-old professional, lost 26 lbs and regained confidence in her appearance.”
Moderate-to-high risk. If using a photo, that’s identifying. Get explicit consent, and specify “photo consent” separately. Better for case studies or detailed testimonials.

Structure 4: Anonymous + specific results
“Patient, 31F, experienced 22 lb weight loss over 16 weeks and reported improved energy and mood.”
Low risk, high trust. Specific results without naming. This is your safest detailed testimonial.

Structure 5: Video testimonial
Face on camera is highly identifying. Get separate video consent, even if they’ve consented to text testimonials. Specify exactly how the video will be edited, cropped, and distributed. Offer audio-only (no face) as an alternative.

Real-world scenarios: what’s compliant and what’s not

Scenario: A patient reviews your clinic on Google
Compliant: Screenshot the review with consent from the patient (email or form) and republish on your website.
Not compliant: Scraping Google reviews and republishing without asking.
Gray area: Tagging a patient on a public Google review — they posted publicly, but that’s not marketing consent. Get separate permission.

Scenario: A patient posts results on Instagram
Compliant: Patient tags your clinic, you ask permission to repost, they say yes (via email or form).
Not compliant: Reposting without asking.
Safe alternative: Reshare their post without caption or keep the caption generic (“Love seeing our patients thrive!”).

Scenario: You want to feature a client in before-and-after photos
Compliant: Written consent for the specific photos, where they’ll appear, and how long. E.g., “I consent to use of my before-and-after photos on the clinic website and Instagram for 12 months.”
Not compliant: Assuming that being a patient means consent.
Safe option: Use initials/first name only, no identifying landmarks in background, and don’t combine with other medical details (age, specific condition, result) without additional consent.

Managing consent and revocation

Once a patient consents, keep a log of:

• Patient name and ID (medical record number)
• Date of consent
• What was authorized (e.g., “first name + weight loss result on website and Instagram”)
• Copy of signed authorization
• Expiration date (annual renewal recommended)

When a patient revokes consent (via email or request), remove the testimonial from your website and social channels within 48 hours. Document the revocation date. You don’t need to scrub it from historical backups, but it should be off live channels.

What patients actually want to share (and why they’ll consent)

Here’s what’s encouraging: most patients who achieve results want to tell people. They’re excited. The issue isn’t resistance — it’s that clinics aren’t asking properly or aren’t building consent into their operations.

During the post-treatment follow-up call or email, introduce it: “We love sharing stories of transformation. Would you be open to being featured (with your first name and results) in our marketing? Here’s what that looks like.” Most will say yes.

Offer options:

• Named testimonial (first name + results)
• Anonymous detailed testimonial (all results, no name)
• Before-and-after photo (with initials only)
• Video testimonial (if they’re comfortable)

Patients appreciate the choice. And you get a library of compliant, high-converting content.

Red flags: testimonials that will get you in trouble

• Full name + specific medical diagnosis: “Jennifer Smith cured her hormone imbalance on TRT.” Even if true, too identifying and potentially actionable as a medical claim.
• Full name + photo + medical claim: “John Doe, hormone therapy patient, is finally off antidepressants.” Combines identification with a medical result — HIPAA violation and potentially a medical claim liability.
• Medical record excerpts: Never pull language from a patient’s chart or medical history and republish, even anonymously. Charts are PHI.
• Unsolicited testimonials from competitors’ patients: If someone posts about your clinic on a review site and mentions their full name + other medical conditions, don’t republish. Get permission first.
• Patient data from leaked lists or referrals: Never contact patients who haven’t explicitly opted in to testimonial requests. That’s both a HIPAA violation and potential telemarketing violation.

Building a testimonial system that scales

If you’re publishing testimonials regularly, build a process:

1. At 4-week follow-up: Send a simple email: “We’d love to share your journey with others. Interested?”
2. If yes: Send the consent form + options. Make it frictionless (digital signature link).
3. Once signed: Log it in a spreadsheet with patient name, what they consented to, and expiration date.
4. Publish: Use testimonials on the website, ads, email, and social — but never beyond what the form authorizes.
5. At expiration (yearly): Email the patient: “Your consent for your testimonial is expiring. Want to renew for another year?” This is also a retention touch-point.

Testimonials are a critical component of a HIPAA-compliant medspa website checklist. Make sure consent collection is baked into your standard workflows from day one. Also, understand the nuances of what to ask when collecting before-and-after photos — many clinics make consent mistakes at this stage because they don’t separate photo consent from medical detail consent.

Frequently asked questions

Can I use a patient’s name and photo together in a testimonial?

Only if they sign a specific HIPAA-compliant authorization. Never use name + photo + medical details without written consent. Safe approach: use first name + last initial + condition (e.g., “Sarah T. – GLP-1 patient”) with separate photo consent.

Does a patient’s social media post count as consent?

No. A public Instagram post is not a medical authorization. If a patient tags your clinic publicly, you need separate written consent to repost it on your site or ads. Get an email confirmation or signed form.

What can I share without specific consent?

Aggregate, de-identified data: “Our typical patient loses est. 15-20 lbs in 12 weeks.” No names, photos, or medical identifiers. You can also share testimonials where the patient explicitly signs a form allowing clinic marketing use.

How specific can I get about medical results?

Only if the patient consents to that level of detail. Safe examples: “I lost 18 lbs” (specific, patient-approved). Risky: “18 lbs, BMI drop from 31 to 28, testosterone increase to 650 ng/dL” (too much medical detail without explicit opt-in). Get consent for specificity.

Can I use a testimonial from a patient review site like Google or Yelp?

Only with written permission. A public review is not a marketing authorization. Contact the patient, show them exactly how you’ll use it, get email or signed consent. Never scrape and republish without asking.

What if a patient wants to share their results but stay anonymous?

That’s compliant and strong. Use: “Anonymous patient, 28F, GLP-1 program, 22 lbs lost in 16 weeks.” You can be specific on results without naming them. Just ensure they sign consent for the specific results you share.

Do video testimonials need different consent than written ones?

Yes. Video is more identifying. Get separate consent for video, specify how it will be used (website, ads, social media), and what portions can be edited. Audio-only video is slightly safer if face isn’t shown.

How long can I keep a patient testimonial up?

As long as consent is valid. Best practice: re-confirm consent annually or ask for renewal consent. If a patient revokes consent, remove the testimonial within 48 hours. Keep a log of who consented, when, and what they consented to.

Testimonials for hormone clinic marketing require extra diligence because hormone therapy results are more sensitive than cosmetic treatments. Invest in your consent infrastructure now.

Want a second set of eyes on this for your clinic? Book a free strategy call or call/text me at +91 97297 12388.