HIPAA for healthcare creators: what physicians can and cannot say in videos, posts, and DMs

A physician can teach a million people online without ever breaking HIPAA. A physician can also break it in one sentence, in a video that never mentions a name. The difference is not caution or confidence. It is knowing what the law actually covers, and most clinicians were taught HIPAA as a compliance module about fax machines, not as a rule about what they say on camera.

This post is HIPAA for healthcare creators: physicians, nurses, PAs, NPs, dentists, pharmacists, and med spa owners who post, film, and reply. It is education, not legal advice; your employer’s privacy officer and a healthcare attorney are the people who rule on your specific situation. The point here is to make the rules legible enough that you stop guessing.

What HIPAA actually covers

HIPAA’s Privacy Rule governs protected health information: any information about a person’s health, care, or payment for care that identifies them, or could reasonably be used to identify them, when it is held by a covered entity (a provider, plan, or clearinghouse) or their business associates. If you treat patients and bill insurance, you are a covered entity. If you work for one, its obligations run through you.

Three things follow that creators miss.

Identification is broader than a name. HIPAA lists eighteen identifiers, and the list is only the start. Dates (of a visit, a surgery, a birth), locations smaller than a state, ages over 89, photos, voices, device serial numbers, and “any other unique identifying characteristic” all count. A rare diagnosis plus a city plus “last Tuesday” identifies someone to everyone who knows them.

The law applies to information you learned as a clinician, in any form. A story told at a party, in a tweet, in a video, in a DM, in a reply to a review. The channel does not matter.

Even where HIPAA does not technically apply, state privacy laws, your licensing board’s standards, your employer’s policy, and ordinary privacy torts do. A nurse at a non-covered wellness business who posts about a client has a problem; it is just not a HIPAA problem. Treat the rules below as the floor everywhere.

What you can say

Most of what makes a good healthcare creator is entirely safe.

• General medical education. What a condition is, how a treatment works, what the evidence says, what questions to ask, what a guideline changed. No patient is involved.
• Your own experience and opinions as a clinician, without a patient attached: what you see in practice in general terms, what frustrates you about the system, what you have changed your mind about.
• Composite or hypothetical cases, clearly labeled as such, built so that no real person is recognizable. “Imagine a patient in their forties who...” is fine when it is genuinely invented. A real case with the name removed is not a hypothetical.
• Public health information and commentary on news, studies, and public figures’ publicly disclosed health, with ordinary care.
• Patient stories with written HIPAA authorization, specific to the use (this video, this platform, this period), signed before anything is filmed, revocable, and kept on file. Verbal consent on camera is not an authorization.
• Your own health. You can say anything you like about yourself.

What you cannot say or show

• Any real patient detail that could identify them, with or without a name: the unusual presentation, the timeline, the town, the age, the occupation, the photo, the X-ray with a date on it, the room number in the background.
• The “anonymized” story that is still recognizable. The test is not whether strangers could identify the person. It is whether the patient, their family, or their coworkers could. If a patient would recognize themselves, it is identifiable.
• Anything from the chart, screens, labs, imaging, or schedules, including blurred or glimpsed in a background.
• Before-and-after photos without written authorization. A face is an identifier. So is a distinctive tattoo, a scar, or a body shape in a small community. Med spas live on this content and it is the single most common violation in the category.
• Confirmation that someone is a patient. Replying to a review with “we are sorry your visit went that way” confirms they were seen. Replying to a comment with “great to see you in clinic last week” does the same. The correct reply never confirms care: “We take feedback seriously; please contact our office directly.”
• Patient questions answered in public with their details. If someone comments or DMs their symptoms and history, do not restate those details in your answer. Move them to the office and answer the general version publicly, if at all.
• Filming in clinical spaces without control of the frame. Waiting rooms, hallways, whiteboards, name tags, voices behind a curtain. Staff “day in the life” videos are a frequent source of breaches.
• Colleagues’ patients. Information about a patient you did not treat is still protected if you learned it at work.
• “Content” from deceased patients. HIPAA protects information for fifty years after death.

The traps that catch careful people

The viral case. A fascinating presentation is exactly the one someone will recognize. The rarer the case, the fewer details it takes to identify the patient. Rare cases should be taught as true hypotheticals or not at all.

The DM inbox. A follower sends their history and asks for advice. Every detail they volunteered is now information you hold about a person who may become, or already be, your patient. Do not forward it, screenshot it, or quote it. Reply with a general answer and an invitation to book. See our guide to the business side of doctors on social media.

Live video and Q&A. Live formats are where unscripted details slip out. If you go live, decide in advance that no real cases will be discussed, and say so at the top.

The team. Your front desk, your medical assistant, your videographer. A practice without a written social media policy will eventually have a staff post that breaches; the template is in social media policy template for medical practices. The practice-specific rules for med spas are in HIPAA and social media for med spas and private practices.

The employer. Many employers restrict what employed physicians may post about work at all, beyond HIPAA. Read the agreement; the clauses are explained in social media agreements between a physician and their employer.

What happens when it goes wrong

A HIPAA complaint goes to the Office for Civil Rights, which can investigate and fine the covered entity; employers routinely terminate clinicians over social media breaches; licensing boards discipline for unprofessional conduct independently of HIPAA; and the patient can sue under state law. The reputational damage is the part that follows a physician creator longest, because the breach is public by definition.

The checklist before anything goes live

1. Is any real patient involved, directly or in the background? If yes, is there a signed, specific, written authorization on file?
2. Could the patient, their family, or their coworkers recognize them from any combination of details, images, or timing?
3. Is every case I describe genuinely hypothetical, and labeled as such?
4. Is the frame clean: no screens, charts, schedules, name tags, voices, or faces I did not clear?
5. Does my reply to this comment, review, or DM confirm that someone is a patient, or repeat details they shared?
6. Would my privacy officer, my employer, and my board be comfortable seeing this?
7. Is any sponsorship disclosed? (A separate law, covered in FTC disclosure rules for physician influencers.)

If any answer gives you pause, the post waits.

The business side of staying compliant

Compliance is not a reason to post less. The clinicians with the largest, most durable audiences teach general medicine brilliantly and never need a real patient to do it. What they do need is a system: a content review step before publishing, a reply script for comments and reviews, a DM policy, authorization forms for the rare patient story, a clean filming setup, and a written policy for anyone on the team who posts. That is operational work, and it is exactly the kind of work a clinician should not be improvising between patients.

Why Studio Germina

HIPAA sets the floor for everything a healthcare creator publishes, and we build the review, the reply scripts, the authorization forms, and the team policy into every content system we run, so the content you make teaches freely and never puts a patient, a license, or a reputation at risk. You are the medical expert. We are the marketing and business experts, and keeping your publishing compliant is part of that job.

You are the medical expert. We are the marketing and business experts. That is the whole arrangement, and it is a partnership rather than a vendor relationship. You keep doing the part only you can do: the clinical work, the answers, the teaching, the content people trust. We take the part you never wanted: positioning, marketing, the deals, the contracts, the pricing, the follow-up, and the reporting that proves it worked.

The hours you already spend online answering questions and posting useful content are real work. You would happily do it for free, and most clinicians do. We make sure that time gets paid for, and paid properly, without turning you into a salesperson.

We select the opportunities we bring you, and we turn down the ones that do not fit. Every deal, campaign, and partnership has to line up with your brand, your ethics, your morals, and your vision for the work. If it does not, we say no on your behalf, and we explain why.

You get the thinking, not a black box. Every recommendation comes with the reasoning, the tradeoffs, and what success looks like, so you become a better decision-maker through the relationship rather than dependent on it. And you work directly with the founder, whose career runs from creator and brand partnerships before healthcare to brand, PR, and growth leadership inside it. Engagements are deliberately small and senior.

That is why clinicians who have tried the alternatives come here, and why we are the better choice for a physician or healthcare creator who wants the business side handled by people who understand both the business and the medicine. Book a consultation, or take the Fit Quiz if you are not sure what kind of support makes sense. The representation and partnerships page describes how we handle the commercial side directly.