A PR program for healthcare executives and physician practices has five elements: a clean public record, expert commentary, a patient-story protocol, review handling and crisis readiness. The main rule is that patient stories, photos and testimonials need written authorization before use, according to HHS guidance summarized by compliance publishers. A 90 day plan builds the foundation first, then visibility.
By Ronn Torossian. Last updated: November 14, 2026. This is communications guidance, not legal advice, and a healthcare attorney should review every patient-facing program. Rules differ by state and by organization. Compliance details come from the publishers named below. The plan and examples are hypothetical.
How is PR for healthcare executives different from other PR?
PR for healthcare executives is different because patient privacy limits what can be shown or said, and health claims must be supported by evidence. A software founder can post a customer story with permission. A physician cannot discuss a patient's case, share a photo or quote a patient without a signed authorization that meets privacy rules.
That limit shapes the whole program. Visibility has to come from the executive's expertise, the organization's outcomes in aggregate and the public record around the person, such as biography, credentials and reviews. The guide to healthcare PR covers the wider field, and the healthcare public relations page covers services.
What do HIPAA marketing rules mean for a PR program?
HIPAA marketing rules mean a practice generally needs written patient authorization before using patient information in marketing, with some exceptions. A Prospyr guide summarizes it this way: HHS generally requires the patient's authorization before their information is used in marketing, and FTC rules ban fake testimonials and rewards that depend on a review being positive.
Compliance publishers describe what a valid authorization includes. Compliancy Group lists the name of the practice and its contact information, how the likeness or testimonial will be used and an expiration date or event. LuxSci adds that an authorization cannot be open-ended, and that social media use must be described. If an organization is paid to send a promotional message, the rules get stricter, according to Accountable.
What has gone wrong when a practice got this wrong?
A documented case involves a physical therapy practice that posted patient testimonials with full names and no authorization. AAPC reports that the Office for Civil Rights received a complaint in August 2012 alleging that Complete P.T. posted testimonials with patients' full names, and GovInfoSecurity reported a $25,000 penalty against a physical therapy provider for using patient information without permission.
The lesson is not about physical therapy. It is that a friendly testimonial on a website can become a federal complaint. A program that never posts a patient's name, image or story without a signed, specific authorization avoids that risk.
What can a healthcare executive say publicly?
A healthcare executive can speak about conditions, trends, evidence and the organization's approach, but not about an identifiable patient. The table separates what is generally safe from what needs authorization and what to avoid. It is a planning aid, and counsel should confirm it for your state.
| Topic | Generally fine | Needs written authorization | Avoid |
|---|---|---|---|
| Expertise and trends | Commentary on a condition, a guideline or a study | None | Unsupported health claims |
| Outcomes | Aggregate figures with a stated source and method | None for aggregate data without identifiers | Guarantees or superlatives |
| Patient stories | Composite or hypothetical examples labeled as such | Any real story, photo, video or quote | Names, locations or details that identify someone |
| Reviews | Thanking reviewers without confirming they are patients | Reusing a review in an advertisement, per Prospyr's guide | Paying for positive reviews |
| Media filming | Staged interviews with consenting staff | Any patient who appears or is audible | Relying on blurring after the fact |
That last row comes from HHS guidance on film crews, as Accountable summarizes it: blurring a patient's identity after filming does not replace authorization once media has had access to the information.
What does a PR program for a physician practice include?
A PR program for a physician practice includes five elements: a clean public record, expert commentary, an approved patient-story process, review handling and a crisis plan. Each can be built without exposing patient data.
- A clean public record. Accurate biographies, credentials and listings that match everywhere, so patients and reporters find the same facts.
- Expert commentary. Short, sourced comments for local and trade reporters on seasonal topics, new guidelines or research.
- A patient-story protocol. One authorization form, one approver and a rule that nothing runs without a signed copy.
- Review handling. A policy for responding to online reviews that never confirms a person is a patient.
- Crisis readiness. A holding statement and an escalation path, since a privacy complaint can become news. See the crisis communications hub.
How should an executive handle a media interview?
An executive should prepare three points about the topic, avoid any patient detail and decline cases politely. A reporter may ask about a specific patient or incident. The answer is that the organization does not discuss individual patients, followed by a point about the general issue.
Illustrative example: a hospital chief medical officer is asked about a local flu surge. She gives the organization's aggregate numbers with their source, explains what families should watch for and declines to describe any patient. The reporter gets a quotable explanation, and no patient is identified. The guide to executive reputation risk covers how to prepare for harder questions.
Who on the team needs privacy training?
Everyone who creates or approves public content needs privacy training, including communications and social media staff. Accountable notes that hospital marketing and communications staff handle protected health information when they create patient stories, photograph events or coordinate publicity, so they are part of the workforce subject to privacy rules. Medsafe likewise advises including communications staff in HIPAA training, not only clinical employees.
Build the training into onboarding, and refresh it each year. A one-page checklist that every post, photo and release must pass before publishing is simple and effective.
What does a 90 day plan look like?
A 90 day plan builds the foundation first, then visibility. The plan below is hypothetical, for a fictional physician group with a medical director who wants to be seen as a local expert.
| Days | Work | Output |
|---|---|---|
| 1 to 30 | Audit public profiles; write a patient-story protocol and one authorization form; train staff | Accurate profiles, signed-off protocol, trained team |
| 31 to 60 | Prepare three commentary topics; brief two local reporters; publish one educational article under the director's name | First quotes and a published article |
| 61 to 90 | Pitch a trade publication; set up review handling; run a crisis drill | One trade pitch, a review policy and a tested holding statement |
For help with byline placement, see the guide to executive bylines and contributed articles, and for building a personal profile see the founder personal brand plan.
How do you choose and price a healthcare PR firm?
Choose a healthcare PR firm that can explain privacy and claims rules in plain language, and compare prices by scope. A firm that treats HIPAA as an afterthought is a risk. The guide to choosing a healthcare PR agency gives a checklist, healthcare PR pricing covers what a six month retainer costs, and the guide to choosing a PR firm covers the general decision.
What claims rules apply beyond HIPAA?
Claims about outcomes need evidence, and some states restrict specific wording. Accountable notes that health efficacy statements must be supported by solid evidence, and that some jurisdictions prohibit guarantees, superlatives and unverifiable claims, require disclaimers or add telehealth disclosures. Treat every "best," "safest" or "guaranteed" as a claim that needs support, and ask counsel to review the final copy.
Frequently asked questions
Can a physician practice post patient testimonials?
Only with a signed written authorization from each patient that describes how the testimonial will be used. Without it, a testimonial can become a complaint, as the Complete P.T. case shows.
Can an executive talk to reporters about a patient?
No, not about an identifiable patient. Speak about the condition, the evidence and the organization's approach in general terms, and decline individual cases.
Does blurring a patient's face in a video solve the problem?
Not by itself. HHS guidance, as Accountable summarizes it, says blurring after filming does not replace authorization once media has had access to the information.
Do communications staff need HIPAA training?
Yes. Staff who create patient stories, run events or manage social accounts handle protected information and should be trained like clinical staff.
Where should a practice start?
With a patient-story protocol and one authorization form that counsel has reviewed. Everything else in the program depends on it.
Write the one-page protocol this week: who approves a story, which form patients sign and what is never posted. That page protects the practice before any publicity begins.