Before and After Photos, the Consent and Compliance Rules Clinics Keep Breaking

Before and after photos are one of the most persuasive assets a clinic can publish, and one of the most frequently mishandled. This is not a legal opinion, and nothing here replaces advice from a lawyer familiar with your specific jurisdiction and specialty, but the pattern of mistakes we see repeated across clinic marketing is consistent enough to be worth setting out plainly.

Consent is a specific document, not an assumption

A patient agreeing verbally to have their photo taken during a procedure is not the same as consenting to that photo being used in marketing, published on social media, or kept indefinitely in a public facing gallery. Guidance from the American Med Spa Association is specific on this point, that clinics need clearly written consent spelling out the practice’s rights, the patient’s rights, and exactly what uses are permitted, rather than treating a photo taken for clinical record purposes as automatically available for marketing.

Clinical photos and marketing photos are legally different things

A photo taken purely for the clinical record, tracking a patient’s progress for treatment purposes, sits under different handling rules than the same photo repurposed for a website gallery or an Instagram post. Treating every photo in your camera roll as fair game for marketing the moment a procedure looks successful is exactly the mistake that turns a routine clinical photo into a genuine compliance problem the moment it appears somewhere public without the separate marketing consent that use actually requires.

Photos containing identifiable features are protected health information

Any photo showing a patient’s face or another uniquely identifiable feature counts as protected health information under most health privacy frameworks, which means it cannot be used for marketing, education or social media without specific written authorisation covering that exact use. This applies even to photos a patient seems enthusiastic about sharing themselves, since their enthusiasm in the moment does not substitute for the documented consent your own practice needs on file.

What a proper consent form actually needs to state

A consent form built to hold up needs to clearly outline what information and images are being used, the specific purpose, whether that purpose includes website, social media, print or all three, an expiration date or review point, and an explicit statement of the patient’s right to revoke consent later. A form that simply says “I agree to have my photo used” without any of that detail is far weaker than one that spells out exactly what the patient is agreeing to.

Storage and who else touches the images

Every step a photo passes through after it is taken, a cloud storage folder, an editing app, a social media scheduling tool, a photographer, needs to be covered by an appropriate agreement if any of it touches protected health information. A vendor with access to identifiable patient photos and no formal agreement in place is a real gap, not a technicality, and it is one of the more commonly overlooked links in the chain between taking a photo and posting it.

Where a testimonial quietly becomes a claim

A patient saying “I’m thrilled with my results” is a testimonial. A patient saying “this treatment eliminated my condition completely” describes a specific medical outcome, and pairing that statement with a before and after photo can shift the whole post from patient testimony into something closer to a medical claim about typical results, which carries a different, higher bar of substantiation in most advertising frameworks. Reviewing the actual wording attached to every photo, not just the image itself, is worth building into your publishing process as a standing step.

Minors and additional consent requirements

Photos involving a patient under the age of majority in your jurisdiction carry an additional layer of requirement, parental or guardian consent alongside, not instead of, the standard consent form, and the same rules around marketing use apply just as strictly regardless of how proud a parent might seem about a child’s treatment outcome in the moment. Treat any paediatric before and after content with extra caution and, where in doubt, legal review before it is ever published.

What happens when consent is later revoked

A proper consent form states a patient’s right to revoke consent, and a clinic needs an actual process ready for when that happens, not just the words on the form. Have a clear, quick route to remove a specific image from every place it has been published, website gallery, social platforms, printed materials still in circulation, and honour a revocation request promptly rather than treating it as a low priority task, since a delayed removal after a patient has explicitly withdrawn consent is a meaningfully worse position than never having had the consent complexity at all.

Editing and retouching photos changes the compliance picture too

Before and after photos are generally expected to represent genuine, unedited results, and retouching a result photo to look more dramatic than reality crosses from a compliance grey area into straightforwardly misleading advertising in most frameworks. Lighting, angle and background consistency between the before and after shot are legitimate presentation choices. Altering the actual visible outcome is not, regardless of how commonly it might be practised elsewhere.

Building the consent conversation into the visit itself

The clinics that handle this best treat the consent conversation as a normal, unhurried part of the visit rather than a form thrust at a patient on their way out the door. Explaining clearly what the photo is for, clinical record only, or potentially marketing too, at the point the photo is taken, gives a patient genuine time to consider the request rather than signing quickly under mild social pressure, which is both the more ethical approach and the one that produces consent likely to actually hold up if it is ever questioned.

A quick internal audit worth running this month

Pull every before and after photo currently live on your website and social channels and check each one against a consent record you can actually locate. Any photo without a traceable, specific consent record behind it is worth removing until that record is found or a fresh consent conversation is had, regardless of how long the image has already been live, since a photo’s age does not retroactively create the consent it was missing from the start.

Where responsibility actually sits

Compliance here is not solely the marketing team’s job, even where an agency or a social media manager handles publishing. The clinical staff taking the original photo, the front desk collecting the consent form, and whoever ultimately posts the image all share responsibility for the chain holding together, and a breakdown at any single point in that chain is where most real compliance problems actually originate.

Platform rules add a second layer on top of legal ones

Beyond the legal and consent questions, individual platforms carry their own content policies around medical and cosmetic before and after content, and a post that is fully compliant on the consent side can still be removed or restricted for violating a platform’s own advertising standards. Checking current platform policy before a campaign, not after a post is already flagged, is worth the ten minutes it takes, and our guide to Instagram for clinics covers the platform specific detail this article does not.

Building this into a repeatable process

The clinics that avoid these mistakes consistently are not the ones with the most legal caution, they are the ones with a repeatable process, a standard consent form used every time, a defined storage location, a review step before anything goes public. Building that once, properly, is far less work over a year than handling each photo as a one off decision made in the moment. Our companion article on healthcare advertising rules for clinics sets out the wider regulatory picture this piece sits inside, and our content creation service builds consent and compliance into the production process itself rather than treating it as a final check bolted on at the end.