Healthcare Social Media Marketing: The Part You Don’t Control

A patient leaves a comment under one of your posts. She names the procedure she had, thanks the surgeon by name, and says she has never felt better. It is a lovely comment. Whoever runs the account replies within the hour, warmly, using her first name, saying how glad everyone is to hear it. That reply took nine seconds and confirmed, in public and in writing, that a specific named person is a patient of your practice. Nobody did anything malicious. The staffer behaved exactly the way any business behaves on social media, which is the problem, because a medical practice is not any business and social media is the one channel where that difference becomes operational rather than theoretical.

Almost everything written about healthcare social media marketing concerns what a practice should post. That is the easy half. Your own posts are reviewable, editable, schedulable, and entirely within your control — if something is wrong with them, you find out before they publish. The half that actually carries risk is everything that appears underneath them, arrives in the inbox attached to them, or gets tagged to your account without anyone asking. That layer is written by patients, visible to the public, frequently permanent, and it lives inside a venue your practice owns but does not govern.

No other channel works this way. Email is one to one, and nobody else sees it. A website has no comment section unless you build one. A paid ad has a reply thread you can switch off. A brochure does not answer back. Social media is structurally unlike all of them, and the practices that get into trouble are rarely the ones with reckless copy. They are the ones who never thought about the reply. Healthcare social media marketing is really two disciplines wearing one name: producing the visible half, and governing the half you did not write.

The second place practices create real exposure is deliberate rather than accidental, and it is the content everyone wants most. Patient stories, transformations, and before-and-after imagery are simultaneously what the platforms reward and what a practice is least free to publish. Using a patient’s words, face, likeness, or results in marketing requires written authorization that names the specific use — which channel, which format, how long it may run. The Department of Health and Human Services publishes its guidance on marketing under the Privacy Rule plainly enough that any practice manager can read it in ten minutes, and the short version is that authorization is required, with narrow exceptions that do not cover a social post. A consent signed for treatment does not cover it. An enthusiastic yes in an exam room, however genuine, is not authorization.

There is a second regulator with an interest here that healthcare practices tend to forget entirely. The Federal Trade Commission’s guidance on endorsements, influencers and reviews applies to medical practices the same way it applies to anyone advertising a service. If something was given in exchange for a review, that relationship has to be disclosed. If a person featured in a testimonial has any connection to the practice, that matters. Practices that would never dream of a HIPAA violation cheerfully run review contests and offer small incentives for feedback, which is a different rulebook entirely and one they have usually never opened.

All of which points at a substitution that most practices arrive at eventually and would save themselves considerable trouble by adopting first. Content in which the practice is the subject rather than the patient carries none of this exposure and converts nearly as well. The clinicians. The space. What a first visit actually involves. What a procedure feels like from the chair. Who answers the phone. Why the practice does something a particular way. A prospective patient scrolling your account is not evaluating other people’s results in any rigorous sense; she is deciding whether these seem like competent people she would be comfortable with. That question is answered better by watching a clinician explain something clearly than by a gallery she has no way to verify.

Clinicians posting under their own names inherit a further set of obligations that practice owners should understand before encouraging anyone onto camera. The American Medical Association’s ethics opinion on physicians’ use of social media is direct about it: personal and professional identities cannot be cleanly separated online, patient privacy standards apply to personal accounts, and financial interests behind any promoted content must be publicly disclosed. A physician who posts enthusiastically about a device or product without saying what the relationship is has a professional problem in addition to a regulatory one. This is worth raising gently and early, because the alternative is raising it after something is already published.

The platforms themselves add a third layer that has nothing to do with the practice’s conduct. Health conditions are a restricted targeting category almost everywhere, which eliminates the interest-based audience building that works in every other industry — you cannot build an advertising audience out of people who appear to have a condition, and attempting it through a customer list is the same problem wearing a different hat. Several categories restrict before-and-after imagery outright regardless of what authorization you hold. None of this is negotiable, and none of it is worth discovering after an account is restricted. Every paid element of healthcare social media marketing sits inside these constraints regardless of budget.

Which brings the whole thing to governance, the part nobody writes about because it is unglamorous and every practice needs it. The reply that causes the problem is almost never a decision. It is a reflex, made in seconds, by whoever happens to have the password. So the first control is simply naming who is permitted to respond and making sure that list is short and trained. The second is agreeing what a safe reply sounds like before anyone needs one — warm, generic, confirming nothing, and moving anything specific to a private channel. Something close to thanking the person for taking the time and inviting them to reach the office directly does the entire job without acknowledging that they are a patient at all.

The third control is the one that has to be taught explicitly, because it runs against every instinct a marketing-minded person has: not replying is frequently correct. Silence on a comment that discloses clinical information is not rudeness and it is not neglect. It is the only response that does not compound the disclosure. Staff will not arrive at that conclusion on their own, because everything they know about social media says engagement is good and ignoring people is bad. Write it down, explain why, and the problem largely disappears.

Reviews sit in the same territory with more weight attached, since they persist and carry further. The mechanics that keep them clean are the same ones that keep comments clean: invitations go to every patient rather than the ones you expect to be pleased, nothing is offered in exchange, and public replies never confirm that a reviewer is a patient. Treated as a standing process rather than an occasional campaign, reputation management compounds quietly, and a measured reply to a critical review usually persuades future readers more than the favourable ones do. The instinct to defend is the instinct to lose.

Specialty changes the calculus more than most practices expect. Where a diagnosis carries stigma, the entire dynamic inverts — patients will not comment publicly, will not tag the practice, and would be actively harmed if the practice engaged with them where anyone could see it. Discretion becomes a structural requirement rather than a preference, which is why psychiatry marketing looks so different from aesthetics on the same platforms. At the other end, a practice built around elective, visible procedures has patients who genuinely want to be seen and tagged, which creates volume and consent questions rather than silence. Neither pattern is a template for the other, and the specialty-specific version of this — how it plays out in dentistry, for instance — is worth reading separately in dental social media marketing.

Something else has changed underneath all of this in the last couple of years. A prospective patient increasingly does not scroll a list of links at all — she asks a question in a full sentence and reads an assembled answer that names a few practices. What surfaces there is not a function of posting frequency. It is a function of whether the practice’s account, listings, site and content corroborate one clear and consistent picture of who it is and what it does. That is why generative engine optimization and a social presence are less separate than they look, and why the same discipline that makes medical SEO work — accurate categorisation, consistent information, content built around real questions — is what makes a social account legible to a system trying to summarise it.

Seeing where social actually sits in the sequence usually requires laying the whole thing out, which is what patient journey mapping is for. Done honestly, it tends to reveal that social is doing consideration work rather than acquisition work — she found the practice elsewhere, then came to the account to decide whether these were the right people. That reframes what the content is for. It is not a lead source to be optimised for volume. It is the place a decision either firms up or quietly falls apart, which makes the comment section part of the conversion path rather than a side channel.

It also settles the measurement question, which most practices get wrong in a predictable direction. Followers, reach and engagement are all real numbers that describe activity rather than outcome, and none of them appears anywhere in the practice’s finances. The number worth reporting is consultations booked, tracked properly — a distinct booking link per campaign, so the scheduling system records which one produced which appointment. That is entirely trackable and it survives scrutiny in a way an engagement rate does not. It also tends to reveal that a modest account doing careful work outperforms a large one doing volume, which is the opposite of what the platform dashboards encourage. Judged that way, healthcare social media marketing stops competing with the rest of the budget for credit it cannot prove.

Social also does not have to carry the relationship alone once someone has made contact. The channel is rented — reach can contract without notice and an account can be restricted for reasons nobody explains — whereas healthcare email marketing runs on infrastructure the practice actually owns. The sensible arrangement uses social to be found and evaluated, then moves the ongoing relationship somewhere that cannot be switched off by a policy change. A.L.I. 360 by Target Patients MD, a proprietary AI-powered patient-acquisition system for medical and dental practices — the name stands for Attract, Learn, and Influence — was built around that division, with the visible channels feeding a pipeline that lives where the practice’s own obligations already attach.

None of this argues for staying off social media. It argues for going in with the reply layer understood rather than discovered. Decide who may respond, agree what a safe response sounds like, get authorization in writing before anything featuring a patient goes anywhere near a feed, and accept that the most valuable thing a practice can post is usually itself. The practices that do this are not being cautious at the expense of results. They are the ones still posting in two years, with an account that reads as competent rather than abandoned, and a comment section that has never once created a problem anybody had to explain. Done in that order, healthcare social media marketing becomes an asset the practice controls rather than a liability it hosts.

Here are direct answers to the questions practices ask most often.

Can a practice reply to a patient who comments publicly? Not in any way that confirms a treatment relationship — even when the person has already disclosed it themselves. A safe reply thanks them for taking the time and invites them to contact the office directly, without naming them, referencing any detail, or acknowledging that they are a patient. Where a comment discloses clinical information, not replying at all is frequently the correct answer.

Do patient testimonials and photos require written authorization? Yes, and the authorization has to name the specific use — the channel, the format, and how long it may run. A consent signed for treatment does not cover marketing, and verbal agreement is not authorization. Obtain it before the material is produced rather than after, and keep it somewhere it can be found two years later.

What should a healthcare practice actually post? Content where the practice is the subject rather than the patient: the clinicians, the space, what a first visit involves, how a procedure works, who answers the phone. It carries none of the authorization exposure and answers the question a prospective patient is really asking, which is whether these seem like the right people.

Who on staff should be allowed to respond? A short, named, trained group working from a written standard. The reply that causes a problem is almost always a reflex rather than a decision, made quickly by whoever had access. Narrowing who can respond and agreeing in advance what a response sounds like removes most of the risk.

How should a practice measure social media? By consultations booked, not followers or engagement. Give each campaign its own booking link so the scheduling system records which one produced which appointment. Activity metrics describe effort; the booking number describes whether any of it worked.