The frame around health advertising and patient data in the US and Europe. Informational, not legal advice: which rules apply depends on where you practice and where your patients are.
Before-and-after images#
Photos comparing a patient before and after treatment. They are among the elements that health advertising rules restrict most clearly.
In practiceIn the US they must not be altered or unrepresentative, and identifiable photos need the patient's written authorization. Several European countries restrict them, especially for cosmetic procedures. Consent alone is not always enough.
Business associate#
BAA
A vendor that creates, receives, stores or transmits protected health information on behalf of a covered entity. HIPAA requires a written business associate agreement (BAA) with such vendors.
In practiceForm builders, scheduling systems, chat widgets and some analytics or advertising tools can fall into this category. If a vendor will not sign an agreement, keep PHI out of that tool.
Cookie consent#
Permission asked of users before non-essential cookies are set. In the EU and the UK, cookies used only for analytics generally fall under this requirement too.
In practiceSites that avoid cookies and use server-side or cookieless measurement may not need a consent banner; check the rules in the countries you serve.
Data controller#
Under GDPR, the person or organization that decides why and how personal data is processed. The obligations fall on the controller.
In practiceEven if an agency runs the site, when the physician or the practice makes the decisions, the responsibility stays with them.
Endorsements and testimonials#
Patient testimonials
Patient reviews, stories, videos or quotes used to promote a practice. In the US they fall under FTC endorsement guidance and, where patient information is involved, HIPAA; many European professional codes restrict or prohibit them.
In practiceOne of the riskiest areas. A testimonial may not suggest that one patient's result is typical unless you can support that; fake or selectively gathered reviews are unlawful; and using protected health information needs written authorization. Get advice before you use them.
EU MDR#
EU Medical Device Regulation
The EU framework that governs medical devices, including CE marking. Among other things, it prohibits claims that mislead about a device's intended purpose, safety or performance.
In practiceIf your page names a device, keep the claims within its CE-marked intended purpose. The manufacturer's marketing text is not necessarily safe to copy.
Explicit consent#
Consent given through a clear, affirmative statement for a specific purpose, after the person has been informed. A pre-ticked box or a general agreement to terms does not count.
In practiceIt is one of the conditions that can allow health data to be processed under GDPR. Using a patient's story, photo or review in promotion needs its own consent, separate from consent to treatment.
FDA approved vs. cleared#
In the US, "approved" means the FDA reviewed evidence of safety and effectiveness, as it does for drugs and high-risk devices. "Cleared" means a device was shown to be substantially equivalent to one already on the market. "Registered" or "listed" says nothing about effectiveness.
In practiceMany devices used in office procedures are cleared, not approved, and writing "FDA approved" for a cleared device is a misleading claim. Check the exact status and the indication before you write it.
GDPR#
General Data Protection Regulation
The EU's data protection framework, which the UK applies in a similar form. It governs how personal data is collected and used and gives people rights over their data.
In practiceOn a practice website it shows up as a privacy notice, a lawful basis for every form, minimal data collection, cookie consent for non-essential cookies and care over where analytics data is sent.
HIPAA#
The US federal framework that protects health information held by covered entities, such as most healthcare providers, and by their business associates. It sets rules on privacy, security and breach notification.
In practiceOn a website, HIPAA questions come up mostly around contact and booking forms, patient portals and third-party tracking tools. A public article about a condition is not covered; a form in which a patient describes symptoms can be. See business associate.
Material connection#
Disclosure
Any relationship between an endorser and the business that could affect how people weigh the endorsement: payment, free or discounted treatment, employment, family ties. Under FTC guidance it must be disclosed clearly.
In practiceA review from a staff member, a patient who received a discount or a paid influencer needs a plain disclosure placed where people will see it, not hidden in a footer.
Medical disclaimer#
A standard statement that the content is for information only and does not replace diagnosis or treatment by a clinician.
In practicePlace it at the end of every clinical article. It tells readers and reviewers what the page is for; it does not make misleading content acceptable, and it does not replace a medical review line.
National physician advertising rules in Europe#
Professional codes
In most European countries, a national or regional medical chamber, council or order sets its own rules on how physicians may present themselves. Factual information is usually allowed; comparative, laudatory or misleading promotion usually is not.
In practiceThere is no single European rule: the same page can be acceptable in one country and not in another. If you practice or advertise across borders, check the code of each country involved.
Off-label promotion#
Promoting a drug or device for a use, dose or patient group that the regulator has not approved or cleared. Physicians may generally use products off label in their clinical judgment; promoting that use is restricted, most strictly for manufacturers.
In practiceOn a practice site, describe an off-label treatment accurately as such, do not suggest regulatory approval, and do not present it as established when the evidence is limited.
Outcome guarantee#
A promise of a specific result: "guaranteed", "100% success", "no risk", "permanent cure". Medicine rarely allows that certainty, so such claims are treated as misleading in most jurisdictions.
In practiceDescribe results in terms of what is typical and what the evidence shows, and name the risks.
Prescription medicine advertising#
In the EU, advertising prescription-only medicines to the general public is prohibited. In the US, manufacturers may advertise prescription drugs directly to consumers under FDA rules.
In practiceIn a treatment article for a European audience, use generic names and neutral wording; a brand-name drug praised on a practice page can read as advertising.
Privacy notice#
Privacy policy
The text explaining what personal data is collected, for what purpose, how long it is kept and who receives it, provided when the data is collected. US covered entities also provide a Notice of Privacy Practices under HIPAA.
In practiceThe minimum document every practice website with a contact form needs.
Promotion limit#
Information vs. advertising
The line at which informational health content turns into advertising. In the US, physician advertising must be truthful and backed by evidence under FTC standards and state medical board rules; in most European countries, professional codes allow factual information and restrict promotion more tightly. What pushes a page over the line: superiority claims, an outcome guarantee, before-and-after images, discounts and price pushes, and repeated calls to book.
In practiceThe test for a practice page is not "does it sell well" but "does it stay informational". One plain line on how to make an appointment is enough in an informational article, and the same topic, without the claim language, can almost always be written as information. For the rules that bind you, check with your state medical board or your national medical chamber.
Protected health information#
PHI
Individually identifiable health information held by a covered entity or a business associate: anything that links a person to a condition, a treatment or payment for care, including names, photos, dates and contact details connected with care.
In practiceConfirming that someone is your patient, for example in a reply to an online review, can itself disclose PHI. Using a patient's photo or story in marketing generally requires the patient's written authorization.
Special category data#
Personal data that GDPR protects more strictly, including data concerning health. Processing it is prohibited unless a specific condition applies, such as explicit consent or the provision of healthcare.
In practiceA contact form in which a patient describes symptoms collects health data. Ask only for what you need, and do not route that data into analytics or advertising tools.
State medical board#
The body that licenses and disciplines physicians in a US state. Many state boards treat false or misleading advertising as grounds for discipline and set rules on how specialty and certification may be stated.
In practiceRules differ from state to state. Many boards limit the phrase "board certified" to certification by a recognized specialty board, and some require specific disclosures in advertising. Read your own board's advertising rules before launching a site or a campaign.
Substantiation#
The evidence an advertiser must have before making a claim. For health claims, US regulators generally expect competent and reliable scientific evidence.
In practice"Proven", "clinically shown", "painless" and "permanent results" each need evidence you can point to. If you cannot cite it, soften the claim or remove it.
Superiority claims#
Words that rank you above others: "best", "leading", "number one", "the only", "most experienced". Unless they can be objectively verified, they are treated as misleading.
In practiceThey also weaken patients' trust. Replace them with facts that can be checked: training, board certification, years in practice, the procedures you perform.
Truth in advertising#
FTC standard
The US Federal Trade Commission principle that advertising must be truthful, must not mislead and must be backed by evidence. It applies to health services and to the online content that promotes them.
In practiceA practice website, social post or video that promotes a service is advertising in this sense. What counts is the overall impression on a reasonable patient, not whether each sentence is technically true.
YMYL#
Your Money or Your Life
Topics such as health, law and finance, where wrong information can cause real harm. Google's quality guidelines hold them to a noticeably higher standard.
In practiceAll clinical content falls here. A text that is fine on a cooking blog can be judged inadequate on a health site.