What Should a Cosmetic Surgery Practice Review Before Marketing Goes Live?

Start with the proposed disclosure, not with the assumption that a signed clinical form covers marketing. The patient-media authorization issue deserves its own review because a HIPAA regulated practice may need a valid authorization before using or disclosing identifiable patient information for marketing, subject to the rules and any applicable exception.

What the team should document:

• The exact photographs, video, quotation, procedure information, or other patient material proposed for publication.
• The marketing purpose, the channels where the material may appear, and the parties expected to receive or display it.
• The signed authorization language that supports the intended use, including the required description of the information, permitted disclosure, expiration terms, signature, and notices concerning the patient's rights.
• The relationship between the approved asset and the final crop, caption, headline, gallery entry, social creative, or advertisement.

Why this becomes a search issue: Image galleries, procedure pages, surgeon profiles, social previews, paid landing pages, and image-search assets may reuse the same patient material in different contexts. A marketing team that treats the asset library as unrestricted can separate the final use from the authorization that originally supported it.

Correction: Keep clinical consent and marketing authorization as distinct records. Route a new or materially changed use back through the responsible privacy or legal reviewer. Do not broaden the patient's permission through a caption, page template, syndication workflow, or agency handoff that was never part of the approved disclosure.

Owner: Privacy or legal review should define the authorization standard. The practice should retain the signed record. Marketing should map each public asset to the supporting authorization. Clinical reviewers should confirm that procedure descriptions and result language remain medically appropriate.

Verification: Compare the live asset with the approved version before publication and after redesigns. Check visible identifiers, metadata, captions, distinctive markings, surrounding text, and reuse across other channels. If the final creative changes the information disclosed or the audience receiving it, stop publication until the responsible reviewer confirms that the authorization still supports the use.

In 2022, HHS OCR issued guidance focused on HIPAA obligations when regulated entities use online tracking technologies. Current implementation requires a fact-specific review because later litigation narrowed part of the government's position concerning certain unauthenticated public webpages. The durable question is whether the practice is a HIPAA regulated entity and whether the information collected or disclosed through the tracking setup is PHI in the actual context.

Evidence to collect before deciding:

• A page inventory showing where analytics tags, advertising pixels, session tools, chat products, call measurement, and conversion scripts execute.
• A data map for booking, registration, patient portal, contact, intake, financing, and other flows where a visitor may submit identifying or health-related information.
• Network-request evidence showing the event names, page data, identifiers, parameters, form values, and destination systems transmitted from each sensitive flow.
• The vendor's role, contract terms, retention practices, subprocessors, permitted uses, and whether the vendor is performing a function on behalf of the practice that involves PHI.

Consequence: A tag can behave differently depending on placement. A general informational page may present a different privacy analysis from a logged-in portal, appointment workflow, or form that connects an identifiable person with health care. Treating the entire site as one tracking category can hide the pages where the material disclosure occurs.

Correction: Remove unnecessary tags from sensitive flows, minimize transmitted values, prevent form contents or sensitive parameters from entering marketing systems, and use technical controls that match the approved data map. If a tracking vendor is acting as a business associate, route the relationship through the required agreement and security process rather than relying on a cookie notice or privacy-policy statement alone.

Owner: Privacy and security teams should define permitted disclosures. Engineering or tag-management owners should implement the controls. Marketing analytics should document the measurement purpose and accept a less granular event when the more detailed implementation would create unnecessary data exposure.

Verification: Test the production site with browser developer tools or another approved inspection method. Observe what is actually transmitted after a visitor opens a page, makes a selection, submits a form, books an appointment, or enters an authenticated area. Repeat that verification after tag-manager changes, vendor migrations, form redesigns, and campaign launches.

Patient endorsements can trigger privacy and advertising questions at the same time, but those questions should be reviewed separately. A patient authorization addresses whether identifiable patient information may be used or disclosed. FTC endorsement principles address whether the endorsement is truthful, whether claims conveyed through it are substantiated, whether a material connection needs disclosure, and whether the overall presentation could mislead a prospective patient.

Evidence to collect:

• The patient's original statement, the edited version, and the context in which the practice plans to display it.
• Any payment, discount, complimentary service, gift, employment relationship, referral arrangement, or other connection that could affect how an audience weighs the endorsement.
• The evidence supporting objective claims communicated by the words, photographs, captions, headlines, labels, or surrounding page copy.
• The authorization record supporting any use of identifiable patient information.

Consequence: A testimonial can become misleading when editing removes qualifications, when an exceptional result is presented in a way that creates an unsupported expectation, or when a material connection is hidden. Separately, a truthful endorsement can still create a privacy problem if the practice lacks authority to disclose the patient's information.

Correction: Review the complete advertisement rather than the quotation in isolation. Preserve the patient's actual experience, avoid strengthening the endorsement through editing, disclose material connections clearly when required, and evaluate what information about generally expected performance is necessary when the presentation would otherwise imply a result that the practice cannot substantiate.

Owner: Marketing should preserve source material and edits. Clinical review should assess medical accuracy. Legal or advertising review should assess substantiation and endorsement disclosure. Privacy review should address the patient's identifiable information and authorization.

Verification: Inspect the final creative on the device and placement where it will appear. A disclosure that exists in a source file but is obscured, separated from the endorsement, or lost in a mobile layout may not communicate the intended information. Verify current FTC guidance at ftc.gov before relying on an older internal template.

Advertising-platform eligibility is a separate operational gate. Google treats health as a sensitive-interest category for personalized advertising and expressly includes invasive medical procedures such as cosmetic surgery. Meta also maintains health-related advertising standards and account controls. The exact restriction depends on the campaign, creative, audience method, destination, market, and current platform policy.

For Google, collect:

• The campaign type, proposed search terms or other targeting, audience source, landing page, geographic scope, and conversion setup.
• The current personalized-advertising and health-policy provisions that apply to the advertiser's proposed use.
• Any account notice, disapproval reason, targeting limitation, or certification request actually presented by the platform.

For Meta, collect:

• The exact creative, copy, destination, targeting configuration, audience source, lead form, and conversion event.
• The current policy language relevant to cosmetic procedures, health-related content, personal attributes, data use, and the specific ad format.
• Platform feedback from rejected or restricted assets so the team can correct the identified issue instead of guessing.

Consequence: A campaign may be legally reviewed yet remain ineligible under platform policy. The opposite also matters: approval by an advertising platform is not a legal opinion and should not be used as proof that HIPAA, FTC, professional, consent, or state requirements have been satisfied.

Correction: Include platform QA before launch, maintain alternate creative that preserves the approved claim while avoiding unnecessary policy friction, and use the platform's appeal process honestly when a decision appears incorrect. Do not use cloaking, misleading redirects, hidden creative changes, or audience workarounds to bypass a restriction.

Owner: Paid media should own policy monitoring and evidence from the ad account. Legal, privacy, medical, and regulatory reviewers remain responsible for their own domains. The account owner should retain approvals, disapprovals, appeals, and material policy changes so future campaigns are not built from memory.

Verification: Recheck eligibility when creative, targeting, audience source, landing-page content, conversion configuration, advertiser identity, or platform rules materially change. A prior approval is useful operating history, not a guarantee that a revised campaign will remain eligible.

Federal privacy and truth-in-advertising requirements do not replace state professional rules. A cosmetic surgery practice may also face medical-board requirements, professional-practice statutes, facility advertising rules, licensing restrictions, and other state-specific controls. The applicable rules depend on the physician, practice structure, location, targeted market, service, and claim.

Evidence to collect:

• The jurisdictions where the practice operates and where the campaign intentionally seeks prospective patients.
• The physician names, credentials, specialty statements, facility descriptions, prices, financing messages, photographs, testimonials, procedure claims, and outcome language used in the marketing.
• The current state source or legal interpretation that the responsible reviewer is using for approval.
• Any separate rules affecting non-physician services, medical-spa operations, delegated services, facility representation, or cross-border promotion in the practice's actual model.

Consequence: Copy approved for one market can become inaccurate or impermissible in another. Problems often arise when a national template automatically inserts a physician claim, specialty label, price statement, testimonial, or procedure description without routing the local variation through review.

Correction: Maintain a jurisdiction matrix that identifies which claims or fields require local approval and which team owns that decision. Create a dedicated location page only for a genuine practice location with useful location-specific information; do not manufacture pages for nominal service areas solely to imitate local presence.

Owner: Legal or regulatory reviewers should interpret applicable professional rules. Marketing operations should map each campaign to the jurisdictions it targets. Content managers should preserve approved local variants and prevent automated templates from overwriting required differences.

Verification: Reopen the review when the practice adds a location, physician, service, pricing promotion, advertising channel, target market, or material claim. Retain the source and approval record used for the public version so the practice can later determine why a particular wording or disclosure was selected.

Classify the relationship from the vendor's actual function and access, not from labels such as agency, software provider, analytics vendor, or hosting company. If a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity or business associate while performing a covered function or a qualifying service, the business-associate analysis belongs in the contracting process.

Evidence to collect:

• The systems, pages, dashboards, recordings, reports, forms, CRM records, scheduling data, and other resources the vendor can access.
• The information the service receives by design and any additional information exposed through integrations, debugging, support, logs, or account permissions.
• The vendor's subprocessors, retention controls, security documentation, contractual restrictions, breach responsibilities, and data-use terms.
• The precise service the practice is buying so public-content work can be distinguished from activity involving patient information.

Consequence: A practice can expose PHI through an unreviewed vendor relationship or, in the other direction, treat every marketing supplier as a business associate without examining whether the definition applies. Both outcomes signal that access and data flow were not mapped before contracting.

Correction: Complete the classification before granting production access. Minimize permissions, separate marketing systems from clinical workflows where practical, remove unnecessary patient data, and execute the required agreement when the role meets the business-associate criteria. A vendor's statement that staff do not normally inspect data does not by itself resolve what the system creates, receives, maintains, or transmits.

Owner: Privacy, security, procurement, and legal teams should approve the vendor classification and contract. Marketing should document the business need for access. System administrators should implement the approved permissions and remove access when the engagement ends.

Verification: Compare the approved access model with the live implementation. Review permissions, integrations, logs, exported reports, support workflows, and transmitted payloads after onboarding and after material changes. If the service begins receiving information outside the approved scope, stop unnecessary disclosure and reopen the review.