Are Patient Testimonials a HIPAA Problem?
When it comes to growing a business, patient testimonials are extremely powerful. However, they can quickly become a HIPAA problem if not handled with care.
Obtaining a patient's consent to use their testimonial (e.g., written, video, picture) must go well beyond a single sentence or a verbal agreement. True "consent" must be informative and comprehensive.
Elements of testimonial consent
A good patient testimonial consent form should include information a patient would need in order to make an informed decision. At a minimum, be sure to include the following sections.
- The proposed uses of their testimonial information, such as:
- Print advertising and marketing
- Social media, e.g., Facebook, Twitter, Constant Contact, Instagram, etc.
- Verbal conversation with clients and prospective clients
- Describe the purpose of consent and the patient's right to revoke.
- By signing this form, you are hereby consenting to allow [Practice Name] to use and disclose...
- You have the right to revoke this Release at any time by providing your revocation...
- Actual "consent to release" language, which is the typical legalese you find in most agreements.
- I hereby authorize [Practice Name] to use my testimonial...
- I understand the information I provide in my testimonial...
- By signing below I agree and acknowledge...
- Provide how the patient would like to be identified. Examples include:
- First name and first initial of my last name (e.g., Jeff B., Michelle H.)
- First initial of my first name and first initial of my last name (e.g., J.B., M.H.)
- Use only my written testimonial, I would like to remain "anonymous"
To avoid a HIPAA problem, it is time to match the powerful patient testimonials you receive with a powerful consent form! Here's a sample Patient Testimonial form.
by Dr. Jeff Brown
Jeff Brown, DC, is CEO at HIPAAMATE and dedicated to making HIPAA compliance comfortable for small- and medium-sized healthcare practices and business associates. Dr. Brown’s career spans private practice, compliance consulting, and software product management for three healthcare technology companies.
DISCLAIMER: Because of the generality of this article, the information provided herein may not be applicable in every situation and should not be acted upon without specific legal advice based on particular situations.