A before-and-after pair is not merely documentation. In marketing, it is a claim: this change happened, this treatment contributed to it, and a viewer may reasonably expect something about their own result.
A signed patient form answers only part of that claim. It may authorize a use of information. It does not make the photographs comparable, the edit truthful, the result typical, or the presentation compliant with state and platform rules.
This article reflects federal sources reviewed on September 6, 2026. It is general information, not legal advice. Medical-board, facility, privacy, recording, publicity-right, telehealth, advertising, and platform rules vary by jurisdiction and specialty. Counsel and an appropriately qualified clinical reviewer should approve the program and high-risk images before publication.
Privacy permission and advertising truth are separate
An identifiable image connected to a person’s care, condition, or treatment may be PHI when held or disclosed by a HIPAA-regulated entity. Marketing use may require a valid authorization under 45 CFR § 164.508. That authorization needs to match the information, purpose, recipients, term, and intended use.
Consent to take a clinical photograph is not automatically authorization to publish it. A general media release is not automatically a HIPAA authorization. Conversely, a valid authorization does not prove the advertisement is non-deceptive.
The practice may use one counsel-approved workflow to address multiple permissions, but it should preserve the legal distinctions. The same is true for the broader testimonial consent and claims workflow. Patients also need a realistic explanation of public distribution, screenshots, resharing, facial recognition, comments, and the limits of later removal.
The comparison begins at capture
Lighting, camera position, lens, distance, pose, expression, grooming, clothing, background, timing, and patient effort can change what the viewer sees. A brighter “after,” a closer crop, or a different posture may amplify a result even if no pixels are retouched.
Standardized capture is a Decabrand risk-control recommendation, not a single nationwide photography law. Define protocols by body area and procedure with clinical input. Use fixed room markers and camera settings where practical, record treatment and capture dates, and preserve the original files and metadata.
The time interval should be visible when it materially affects interpretation. An “after” taken during temporary swelling, immediately after an injectable treatment, or before a result has stabilized may imply something different from a later image.
Editing has no universal safe list
Rules such as “cropping is allowed” or “color correction is safe” are too broad. Cropping can hide a scar, remove a reference point, or make body proportions look different. Color changes can alter redness, pigmentation, bruising, tooth shade, or skin texture. Background cleanup can remove an identifying mark or an unfavorable contour.
The question is whether the process changes the factual comparison or net impression. Preserve originals; log every adjustment; apply symmetrical, technically necessary corrections where appropriate; and require approval of the final pair. Avoid retouching, smoothing, reshaping, generative fill, beauty filters, expression changes, or other processing that could enhance the apparent outcome. The governing advertising question is the one used throughout FTC and FDA claim review: what will a reasonable viewer take away from the finished piece?
If an edit is necessary for privacy, ask whether the image remains useful and whether the remaining details still identify the patient. A blur is not a de-identification method by itself.
Selection can mislead without editing
A gallery composed only of exceptional responders may imply that exceptional outcomes are normal. The FTC’s endorsement guidance states that specific results are generally interpreted as what others can expect. “Results not typical” or “individual results may vary” usually does not change that impression.
The advertiser needs adequate support that the depicted performance is typical or must clearly and conspicuously disclose generally expected performance in the circumstances shown. That disclosure requires evidence. It cannot be invented from staff impressions or copied from a manufacturer’s unrelated study.
For many procedures, the practice may not have a sound estimate of generally expected visual performance. In that case, do not assume a broader disclaimer solves the problem. Narrow the claim, provide decision-useful context, change how the gallery is presented, or omit exceptional result-led creative.
A worked review: a dramatic resurfacing result
A dermatology practice selects a strong resurfacing result. The “before” was taken under overhead light; the “after” under diffuse frontal light with makeup removed differently. The practice crops the images tightly, smooths a distracting background, and adds “One treatment. A decade younger.”
Patient authorization does not resolve the advertising problems. The conditions are not comparable, the edit history is incomplete, and “a decade younger” creates an objective result claim with no defined measure. The strongest case may also imply generally expected performance.
The defensible response is not a tiny “results vary” line. Re-capture comparable images if possible, remove the age claim, document the treatment and interval, assess typicality and evidence, and have clinical and legal reviewers decide whether the pair should run at all.
Context should help a patient interpret, not sell harder
Useful context can include the procedure, number of sessions, elapsed time, material adjunctive care, and whether the image shows a particular patient rather than a guaranteed outcome. Include only facts the authorization permits and the record supports.
Disclosures should be adjacent, readable, and understandable in the format. If the image appears in video, the disclosure needs sufficient duration and prominence. A disclosure on a gallery home page may not travel with an image opened, shared, or used in an ad.
Do not imply that the subject is an ordinary patient if the person is an employee, model, creator, or recipient of free or discounted treatment. Material connections may need clear disclosure.
State rules and platform policies must be checked at release
State medical, dental, nursing, and other professional boards may impose additional advertising standards, required disclosures, record-retention rules, or restrictions on testimonials and claims. Publicity and recording law can also affect the workflow.
Platforms may restrict medical imagery, cosmetic-procedure ads, body-focused creative, targeting based on health interests, or certain treatments. Platform approval does not establish legal compliance, and legal compliance does not guarantee platform acceptance. A practice still needs the channel-level social media governance that covers the final caption, crop, comments, and distribution.
Create a jurisdiction and channel checklist for the actual locations where the content will appear. Do not publish a generic “all 50 states” conclusion without current state-by-state legal research.
Build an image ledger
For every published pair, preserve:
- patient identifier in the protected system and linked authorization status;
- original files, metadata, capture protocol, treatment date, and photo dates;
- every edit, crop, caption, and version;
- express and implied claim review plus supporting evidence;
- typicality analysis and the basis for any generally expected result;
- material connections and disclosures;
- state, professional, platform, clinical, privacy, and legal approvals; and
- each publication location, expiration, revocation, and removal action.
HIPAA revocation is generally prospective and does not undo action already taken in reliance on a valid authorization. Decabrand recommends prompt removal from controlled digital properties where feasible after a valid revocation, while counsel decides what is required for paid, printed, syndicated, or archived uses. There is no universal 30-day removal rule.
A truthful image can still be the wrong image
The strongest before-and-after program is not the largest gallery. It is the one where every pair has a clear permission trail, comparable capture, restrained presentation, and evidence that supports what the viewer is likely to believe.
If the team would be uncomfortable showing the originals, edit log, outcome data, and authorization to a patient, board, regulator, or judge, the image is not ready for marketing.
Primary sources
Questions this article answers
Is patient permission enough to publish before-and-after photos?
No. A HIPAA-regulated practice may need a valid authorization, and the final presentation still must not create an unsupported or misleading outcome claim. State and platform rules may add requirements.
Can a practice edit before-and-after photos?
There is no universal list of edits that are always permissible. Any change in lighting, crop, color, posture, expression, background, retouching, or generative processing must be assessed for whether it changes the comparison or net impression.
Is 'individual results may vary' an adequate disclosure?
Usually not when the visual communicates that the depicted result is generally expected. FTC guidance calls for support that the result is typical or a clear disclosure of generally expected performance in the circumstances shown.
Part of the Healthcare Marketing Trust & Compliance collection
Practical guidance for persuasive marketing that respects privacy, evidence, consent, platform rules, and patient trust.
Explore the topic hub