◈ Field notes / Compliance

MedGrid

Marketing a medical practice without getting in trouble

MedGrid · · 6 min read

Medical marketing answers to several regulators at once. The Federal Trade Commission polices deceptive ads, endorsements and reviews. FDA polices drug promotion, including compounded drugs. Your state board polices you as a licensee. Platforms add their own rules, and HIPAA applies whenever patient information shows up in marketing. Here is how to stay on the right side of each.

Health claims need evidence before you publish them

The FTC's Health Products Compliance Guidance (December 2022) covers health-related products generally, not just supplements:

  • Health claims need "competent and reliable scientific evidence." For health benefit claims, that generally means randomized, controlled human clinical trials.
  • You are responsible for implied claims as well as stated ones, judged by the net impression of the whole ad, including images.
  • A disclaimer does not fix a misleading claim.
  • Testimonials are not substantiation. If a patient's story implies the treatment works, you need evidence that it works for others too.

Average-results claims need the same support. In 2025, the FTC settled charges against a telehealth weight-loss company that included an allegedly unsubstantiated claim about members' average weight loss. The final order requires competent and reliable evidence for claims about average or typical results.

Testimonials, endorsements and influencers

The FTC updated its Endorsement Guides in June 2023. For a practice, the key points are:

  • Endorsements must be real. They must reflect the honest opinions and actual experience of real people.
  • Atypical results need context. If you can't show that a featured result is typical, clearly disclose the results people can generally expect.
  • Disclose connections. Employees, patients given free or discounted treatment, affiliates and paid influencers must clearly and conspicuously disclose the relationship.
  • You own what others say for you. Train endorsers, monitor what they post and fix problems.

Reviews: the FTC's 2024 rule

The FTC's Rule on the Use of Consumer Reviews and Testimonials took effect October 21, 2024. It prohibits:

  • Fake reviews and testimonials, including AI-generated ones and reviews from people who never used the service.
  • Incentives conditioned on a review expressing a particular sentiment, positive or negative.
  • Reviews by officers, managers, employees or agents that don't clearly disclose the connection.
  • Presenting a website you control as an independent review site.
  • Suppressing reviews through unfounded legal threats, intimidation or false accusations.
  • Buying or selling fake followers, views or other social media indicators.

Courts can impose civil penalties for knowing violations. In December 2025, FTC staff sent warning letters to 10 companies, citing penalties of up to $53,088 per violation.

The rule does not ban asking only happy patients for reviews, a practice known as "review gating." But the FTC says the practice could still violate the FTC Act, and its guidance says not to do it. Invite every patient to leave an honest review.

The 2025 telehealth case shows what to avoid. The FTC alleged that the company posted fake reviews, used before-and-after photos of people who were not its clients, gave gift cards to get negative reviews changed or removed, and conditioned refunds on removing them.

When you reply to a review, don't confirm that the reviewer is a patient or discuss their care. HHS's Office for Civil Rights (OCR) settled with a New Jersey provider in 2023 over patient information disclosed in responses to negative reviews.

Before-and-after photos

Before-and-after photos are testimonials in picture form. They must show real results without overstating what is typical. California's Business and Professions Code section 651 treats the following as false or misleading advertising:

  • A photo that does not accurately depict the results, or that has been altered in any way from the image of the actual subject.
  • A photo of a model that is not prominently labeled as a model.
  • Before-and-after photos of a patient that do not prominently state which procedures were performed.

HIPAA adds a separate requirement. In a September 2025 settlement over patient "success stories" posted online, OCR's director said a valid, written HIPAA authorization is generally needed before a patient's information appears in a website testimonial or social media campaign. The providers in that case paid $182,000 over posts about 150 patients. Get a signed authorization that covers marketing use before any photo or story is published.

Advertising compounded medications

FDA does not approve compounded drugs or review their safety, effectiveness or quality before they are sold. Under section 502(bb) of the Food, Drug, and Cosmetic Act, a compounded drug is misbranded if its advertising or promotion is false or misleading in any particular. FDA sent warning letters to 30 telehealth companies in March 2026 and sent more in June 2026. Its guidance page for telehealth companies, updated in June 2026, says not to:

  • Use branding that implies you are the compounder.
  • Call a compounded drug a generic version of, or the same as, an FDA-approved drug.
  • Say or imply that it is FDA-approved or has been evaluated for safety and effectiveness.
  • Claim that it is clinically proven to produce the same result as the approved drug.
  • Say that it comes from an "FDA-approved" or "FDA-licensed" pharmacy or outsourcing facility.

Warning letters have also flagged claims that a compounded product has "the same active ingredient" as a branded drug. FDA's guidance targets telehealth companies, but section 502(bb) covers the promotion of compounded drugs generally, so use the list as your baseline.

Brand names bring a second risk. Brand manufacturers have sued med spas, weight-loss clinics and compounding pharmacies, alleging trademark infringement and false advertising over compounded versions of their drugs. Don't use brand names or logos to sell a compounded product.

State board advertising rules

Your license carries its own advertising rules. California's section 651 also covers statements or images likely to create "false or unjustified expectations of favorable results" and testimonials that mislead by leaving out material facts. Florida lists "false, deceptive, or misleading advertising" as grounds for physician discipline. The same list includes promoting or advertising the use, sale or dispensing of any controlled substance. Testosterone is a controlled substance in Florida, so hormone clinics there should review their ads with counsel. Telehealth practices should check each licensing state's rules.

Platform policies and LegitScript

  • Google allows U.S. online pharmacies accredited by LegitScript or the National Association of Boards of Pharmacy. Telemedicine providers promoting prescription drug services need LegitScript certification. Advertisers also need Google's own certification.
  • Meta requires online pharmacies and telehealth providers to hold active LegitScript certification to promote prescription drugs. Those ads may target only people 18 or older in eligible countries.

LegitScript certifies pharmacies, telemedicine providers, medical spas and digital health platforms. Its review covers licensure, legal compliance, past discipline, affiliates, privacy (including HIPAA where it applies), prescribing practices and advertising. Build review time into any launch that depends on paid ads.

A pre-publication checklist

  1. Can you substantiate every express and implied health claim, including averages?
  2. Are testimonials real and typical, or paired with the results people can generally expect, with any connections disclosed?
  3. Do before-and-after photos show unaltered results, name the procedures and have a signed HIPAA authorization?
  4. Does compounded-drug copy avoid brand names and claims of FDA approval, generic status or sameness?
  5. Does the ad meet your state board's rules and the platform's policies?

This article is general information, not legal advice. Rules vary by state; confirm specifics with your counsel and your state boards.

Sources

Put this to work on MedGrid.

Verified vendors, wholesale pricing and the regulations research behind every post. Free to join with your NPI.

Join as a DoctorSell on MedGrid
Related

Keep reading.

Field notes

Every field note

Protocols, outcomes and product notes from clinicians, vendors and MedGrid.

A physician, an operations lead and a rep reviewing a report together
State by state

Regulations research

The FDA rules for each product category, and what your state adds on top, with sources.

The entrance of a small independent medical clinic in morning light
Share yours

Pitch a field note

A protocol, an outcome series, a handling note: reviewed and de-identified before it goes live, under your name.

A physician working on a laptop in a private-practice office