Social media management for practices, without the HIPAA risk.
Social media rarely books appointments directly. What it does is make a practice look established and current when a prospective patient checks you out after seeing your listing. That is a real job, and it is also where practices most easily create a privacy breach, usually with good intentions and a photograph.
Key takeaways
- Treat social as a trust and recruitment channel. Judging it on direct bookings will always disappoint.
- Any recognisable patient requires written authorisation before posting. Verbal consent in the room is not enough.
- Comments and DMs are the highest-risk surface. Staff must never discuss a specific case in a public thread.
- Consistency beats volume. Two useful posts a week sustained for a year outperforms daily posting for a month.
What to actually post
The content that works for practices is unglamorous and repeatable. Practical information, hours changes, new providers, which plans you now accept, seasonal services, performs because it answers real questions. Staff and facility content builds familiarity, which matters when someone is deciding whether to walk into an unfamiliar building. Educational content tied to conditions you treat establishes expertise, provided it stays general and never becomes individual medical advice.
Recruitment is the underrated use. Clinical hiring is difficult in most markets, and candidates check social presence before applying. A feed that shows a functioning, pleasant workplace does measurable work in filling roles, which in turn protects capacity and collections.
| Platform | Audience | Realistic job | Cadence |
|---|---|---|---|
| Local, older skew, community groups | Practice news, hours, community presence; still the default for local trust | 2–3 / week | |
| Younger, visual, aesthetics-driven | Facility and team familiarity; strongest for dental, derm, aesthetics, wellness | 2–3 / week | |
| Referring providers, candidates, payers | Recruitment and referral relationships, often the highest-value channel for specialists | 1 / week | |
| YouTube | Search-driven, high intent | Procedure explainers that answer "what happens during…" and double as SEO assets | 1–2 / month |
| TikTok | Young, broad reach | High reach, low local relevance; worth it only with a provider who genuinely wants to do it | Optional |
Write one saved reply and give it to every staff member with account access: "Thanks for reaching out. We're not able to discuss any patient matter here, please call us at [number] or use our patient portal so we can help you securely." That single sentence, used reflexively, prevents the overwhelming majority of social-media privacy incidents in medical practices.
The consent workflow
Any content featuring a recognisable patient, a photograph, a video, a story with identifying detail, even a before-and-after image with no face visible, requires a signed authorisation that specifically covers marketing use on social media. A general consent-to-treat form does not cover it. The authorisation should name the platforms, state that the post may be public and may be shared beyond your control, and explain that the patient can withdraw consent going forward though previously distributed copies cannot be recalled.
We keep authorisations on file, tag every asset with its consent record, and will not schedule patient-featuring content without one. Where a patient withdraws consent, the post comes down and the asset is retired from the library. Staff photos need consent too, and departing employees are a common reason to audit and remove old content.
Do and don't
- Keep a written authorisation on file for every recognisable patient, naming the platforms.
- Move every clinical question to a private, secure channel immediately.
- Check backgrounds before posting, screens, whiteboards, charts and sign-in sheets leak information.
- Keep a documented list of who has account access and remove leavers the same day.
- Post consistently at a cadence you can sustain indefinitely.
- Don't respond to a complaint by explaining what happened in the visit, however unfair the claim.
- Don't post a patient image because they verbally agreed in the room.
- Don't give individual medical advice in comments or DMs.
- Don't repost a patient's own public post about their care without written authorisation.
- Don't let a personal account post on behalf of the practice.
Want your accounts audited for privacy risk?
We will review your existing posts, comment history and account access for disclosure risk, and set up a consent workflow you can actually follow.
Frequently asked questions
Does social media actually bring in patients?
Indirectly, and that is worth being honest about. Very few patients see a post and book. Many, however, check your Facebook or Instagram after finding you through search or a referral, and an abandoned or empty account undermines the confidence your listing just built. Measure it as a trust and retention channel, and as a recruitment channel, not as a booking source.
Can we share a patient's positive review on social?
Not without written authorisation. Resharing a review confirms the person is your patient, which is a disclosure even though they posted it publicly first. You can share the review text with the name and identifying detail removed, or ask the patient to sign an authorisation covering the specific use. Many patients happily agree when asked.
Who should have access to the accounts?
As few people as practical, each with their own credentials via the platform's business tools rather than a shared password. Keep a documented list, review it quarterly, and remove access the day someone leaves. Shared logins are the most common reason a practice cannot regain control of an account after a staff departure.
What do we do about a negative comment?
Respond once, publicly, without confirming they are a patient, and invite them to a private channel. Do not delete it unless it breaches platform rules, deletion frequently escalates. Do not argue the facts in the thread even when you are right, because doing so necessarily discusses their care. Then follow up privately and resolve it there.
Do you write the content or do we?
We write and schedule it, working from a monthly calendar built around your service lines, seasonal patterns and anything you have coming up. You approve before anything publishes. Practices that want to contribute usually supply photos and the occasional provider comment; everything else, including the compliance check, sits with us.