← All articles
Article

Patient stories and testimonials, with consent

Daniel Luna
Daniel Luna
Founder, DPC Bookkeeper · November 2026 · 2 min read

A real member describing what changed for them persuades more than anything you can write. It also involves their health information. Before you use any patient story, quote or photo, get written permission, and keep it on file.

Get written permission first

If your practice is covered by HIPAA, using a patient's story, name, photo or quote in marketing requires their written authorization. Ask your attorney or compliance advisor for the right form. Don't rely on a verbal yes or a text.

What the form should cover

Keep stories about experience

The best testimonials are about access and how care felt: "I texted at 8 PM and was seen the next morning." Avoid specific diagnoses and treatments even with permission. They aren't needed and raise the stakes.

Reviews are different

Reviews a member posts on their own are their words, on their account. Sharing or quoting them in your own marketing can still need care. Replying to reviews safely.

Never make them up

Don't write testimonials yourself or combine several people into one. Use real words from real members, with permission.

Keep records

Store signed forms with a list of where each story is used. If someone withdraws permission, remove it everywhere.

What I'd do this week

Common questions

Can I use first names only?
Even first names and photos can identify someone. Get written permission anyway.

Can staff share their own experience as members?
Yes, with their written permission, and without pressure.

What about employer testimonials?
A quote from an employer about the contract is a business reference. Get their written OK.

Want marketing results you can measure?

We reconcile every account every month and send your P&L and Balance Sheet by the 15th, so you can see what each new member is worth and what it cost to get them. If that's what you need, apply to work with us.