What Can Aurora Medical and Dental Practices Post on Social Media Without Breaking HIPAA?

Last updated: October 2026 · By Kelly Noble Mirabella, Fractional Social Media Director and Founder of Stellar Media Marketing (Aurora, CO)

Quick answer: Aurora practices can safely post education, team culture, office updates, and community content without patient information. Patient photos, stories, and testimonials need written HIPAA authorization first, and review replies must never confirm someone is a patient. HHS has settled with at least three practices, including New Vision Dental ($23,000), over review responses.

This is not legal advice. I'm a social media director, not a lawyer. Confirm your policy with your compliance officer.

Why does HIPAA matter so much for social media in Aurora?

Aurora has an unusually dense healthcare economy. The Colorado School of Public Health describes the CU Anschutz Medical Campus in Aurora as the largest academic health center in the Rocky Mountain region, home to University of Colorado Hospital and Children's Hospital Colorado, with the Rocky Mountain Regional VA Medical Center across the street.

Around that campus, and out through Southlands and Saddle Rock, independent dental offices, chiropractors, therapists, and med spas all market to the same neighbors. According to HHS's covered entities page, dentists, chiropractors, psychologists, and clinics are covered when they transmit health information electronically for standard transactions like insurance billing. Cash-only med spas may fall outside that definition, but confirm with your compliance officer before assuming it.

What can a medical or dental practice post without patient authorization?

Anything with no patient information in it is generally safe to post, and that's most of what works anyway.

Safe list (no patient in the frame, no patient in the caption):

• Education: "What happens at a first chiropractic visit," "3 signs you're grinding your teeth," "how Botox units are priced."
• Your team: staff introductions, certifications, birthdays, with each person's permission.
• Office updates: new hours, closures, new equipment.
• Community: sponsoring a youth team, a booth at a school health fair, a food drive.

In my last 20 free social media audits for Colorado businesses, 18 had a stale Google Business Profile, and nearly 60% had generic or ineffective content. Most practices post too little, not too much.

What should a practice never post?

Never post anything that identifies a patient or reveals someone received care without written authorization. HHS's de-identification guidance lists 18 identifiers, including names, dates such as admission dates, geographic areas smaller than a state, and "full-face photographs and any comparable images."

Unsafe list:

• Before-and-after photos without a signed authorization, even with eyes blurred.
• "Happy patient" selfies, even when the patient offered.
• Background leaks: a schedule on a monitor, a name on a chart, an X-ray on the light box.
• Tagging or thanking a patient by name, or reposting their story without authorization.
• Case stories detailed enough (age, neighborhood, procedure, date) that a neighbor could recognize the person.

What does written authorization for patient photos and testimonials look like?

Patient photos, videos, and testimonials need a signed HIPAA authorization before they go live. The HHS marketing guidance says "the Rule requires an individual's written authorization before a use or disclosure of his or her protected health information can be made for marketing."

A verbal yes is not enough. Consider Complete P.T., Pool & Land Physical Therapy, a Los Angeles-area practice that posted patient testimonials with full names and full-face photos on its website without valid authorizations. It paid $25,000, according to Healthcare IT News, which reported the settlement in February 2016.

My rule: the signed authorization goes in the file before the photo goes in the content folder. Your attorney supplies the form.

How do you reply to a review without confirming someone is a patient?

Reply to every review as if you have no idea who the reviewer is. Confirming a reviewer was your patient is itself a disclosure, and HHS has settled at least three such cases:

1. Elite Dental Associates, Dallas (October 2019): $10,000 over patient information disclosed in social media responses to reviews.
2. New Vision Dental, California (December 2022): $23,000 plus a two-year corrective action plan. HHS said the replies disclosed patient names, treatment details, and insurance information.
3. Manasa Health Center, New Jersey (June 2023): $30,000 after a psychiatric practice disclosed diagnosis and treatment details while responding to negative reviews.

OCR Director Melanie Fontes Rainer put it plainly in the New Vision announcement: "Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO."

Unsafe reply: "We're sorry, Jen, but your crown needed a second visit because you missed your follow-up."

Safe reply: "Thank you for the feedback. We can't discuss anyone's care online, but please call our office manager at [number] so we can talk directly."

Five-star replies too: "Glad your root canal went well!" is a disclosure.

"The review reply is where I see smart practices get into trouble, because the owner is hurt and wants to set the record straight. You can't. Write one warm, generic reply, take it offline, and let your pattern of good reviews do the arguing for you." Kelly Noble Mirabella, Fractional Social Media Director and Founder, Stellar Media Marketing

How should a practice handle comments and DMs?

Treat comments and DMs as a front door, not an exam room. When someone asks "Is my MRI back yet?" the safe move is the same every time:

• Don't confirm, diagnose, or discuss care, even if the person started the conversation.
• Redirect with a standard reply: "For your privacy, please call us at [number] or use the patient portal."
• Hide comments where patients overshare health details, per your written policy.
• Limit automation. A DM chatbot should handle hours, location, and booking only, and route anything clinical to a person.

What are the rules for staff content?

Staff content is safe when you control the background. Three guardrails: film in a break room or empty operatory, get each employee's written okay, and put "no patient content on personal accounts" in your social media policy. An assistant posting a patient moment on her own TikTok is still your problem.

What educational content works for each type of practice?

Education is the safest category and the most useful. Starting points:

• Medical: flu shot timing before Colorado's winter, urgent care vs. ER.
• Dental: what dry Colorado air does to your mouth, what a crown appointment feels like.
• Chiropractic: snow shoveling form, desk setup for remote workers.
• Med spa: sun protection at altitude, what a consultation covers.
• Therapy: what a first session looks like. Never client stories.

What should you check before every post goes live?

Run every post through this checklist before it publishes.

1. Is any patient visible, including in a reflection or background?
2. Are any screens, charts, schedules, X-rays, or whiteboards visible?
3. Does the caption name, tag, or hint at a specific patient or visit?
4. If a patient appears, is a signed HIPAA authorization on file for this use?
5. Could a neighbor recognize the person from the details?
6. If this is a review reply, does it avoid confirming the reviewer is a patient?
7. Would your compliance officer sign off if they saw it on Monday morning?

Want help building a HIPAA-conscious content plan for your Aurora practice?

I've spent 18 years in social media marketing and handle strategy, content, posting, and reporting myself. For healthcare clients, that means an education-first calendar and review replies from a template your compliance officer approves. Packages start at $1,200 a month.

See how I work with local businesses on my Aurora social media marketing page, book a video call to review what your practice posts now, or browse my services.

Related reading: How to Use Google Business Profile Posts to Get More Calls and What to Automate on Social Media With AI (and What Never to Automate).

Frequently asked questions

Can a dental office post before-and-after photos?

Yes, with a signed HIPAA authorization from the patient for that marketing use. Cropping to just the teeth doesn't guarantee anonymity, so get the authorization anyway.

Can we respond to a fake or unfair negative review?

Only with a generic reply that doesn't confirm or deny the person was a patient. If a review looks fake, report it through the platform instead of arguing in the replies.

Is it a HIPAA violation if the patient posts about us first?

A patient can share their own story, but your reply is a separate disclosure, so don't confirm treatment. Resharing their post to promote your practice is marketing and needs authorization.

Do med spas have to follow HIPAA?

It depends on whether the business meets HHS's definition of a covered entity, which usually turns on electronic insurance billing. Confirm with your compliance officer, and protect client privacy either way.

Can therapists use social media at all?

Yes. Education and explaining how therapy works are safe. Never reply to a review in a way that suggests the person is a client, which is what the Manasa Health Center settlement was about.

Changelog: October 2026, first published.