In most industries, a customer testimonial is a marketing asset with a light legal review. In addiction treatment, the fact that someone was a patient is itself protected health information, and the story they tell on camera is an advertising claim the FTC expects you to back up.
That’s why testimonial ads are the highest-trust and highest-risk creative a treatment center can run. A real alumni story can do what no clinician explainer can. It can also expose the facility to HIPAA, 42 CFR Part 2, FTC, and platform policy problems in a single 30-second spot.
This playbook covers the rules that apply, who can appear in testimonial ads and on what terms, the authorization packet to collect before anyone is recorded, how to keep the claims defensible, and the review workflow our ad creative team for treatment centers uses before a testimonial goes live.
It builds on our ultimate guide to ad creative strategy and our guide to video ad creative that passes compliance. This isn’t legal advice; have healthcare counsel review your authorization forms and your first testimonial campaign.
Key Takeaways
- Using a patient’s story or likeness in marketing requires written HIPAA authorization, and HHS says authorization is required for virtually all marketing uses of protected health information.
- Substance use disorder programs covered by 42 CFR Part 2 also need Part 2-compliant consent, which has its own required elements, including how the patient can revoke it.
- The FTC treats a testimonial as a claim that the speaker’s experience is typical. If it isn’t, the ad has to clearly disclose what people can generally expect, and testimonials can’t substantiate health claims on their own.
- Any payment, free or discounted treatment, or other material connection between the speaker and the facility has to be disclosed.
- The FTC’s fake reviews rule, in effect since October 2024, bans fake testimonials, bought reviews, and undisclosed insider testimonials, with civil penalties for knowing violations.
- Build the authorization packet, claims review, platform check, and revocation process before recording anything. Retrofitting consent after production is a common source of trouble.
Why testimonials carry more risk in addiction treatment
A testimonial for a gym or a software product reveals that someone bought something. A testimonial for a treatment center reveals that someone received treatment for a substance use disorder or mental health condition, which is exactly the kind of information health privacy law protects.
HHS’s enforcement record shows how seriously it takes even small disclosures. It settled with Elite Dental Associates after the practice disclosed patient information while responding to Yelp reviews, and reached an agreement with Manasa Health Center over PHI disclosed in response to negative online reviews.
HHS and FTC enforcement on reviews and testimonials
$10,000
Elite Dental settlement for PHI in Yelp replies (HHS, 2019)
$30,000
Manasa Health Center settlement for PHI in review replies (HHS, 2023)
Oct 21, 2024
FTC fake reviews rule takes effect
If replying to a review can be a HIPAA violation, putting a former patient in a paid ad without the right paperwork certainly can be. The good news is that the rules are knowable, and a facility that follows them can run testimonial creative with confidence.
DEFINITION
Testimonial ad. Any ad in which a real or portrayed person describes their own experience with the facility, including alumni stories, family member accounts, quoted reviews, and dramatizations presented as real experiences. Clinician and staff explainers are not testimonials unless the speaker describes being treated.
The definition matters because each type triggers different rules. An alumnus on camera needs HIPAA authorization and possibly Part 2 consent. An actor portraying a patient needs an FTC disclosure. A quoted online review needs both permission and a PHI review.
The four rule sets every testimonial has to clear
1. HIPAA marketing authorization. HHS’s marketing guidance says a covered entity needs an individual’s written authorization before using or disclosing their protected health information for marketing, with narrow exceptions such as face-to-face communications and promotional gifts of nominal value. Neither exception covers an ad.
The authorization has to meet the requirements in 45 CFR 164.508, including a description of the information, who may use it and for what purpose, an expiration date or event, the patient’s signature and date, and statements about the right to revoke.
2. 42 CFR Part 2 consent. Programs covered by Part 2 face an additional layer.
Part 2’s consent requirements in 42 CFR 2.31 require a written consent that names the patient, identifies who may disclose and to whom, describes what will be disclosed and why, explains how to revoke, carries an expiration, and is signed and dated. Our 42 CFR Part 2 guide for treatment center marketing covers how the rule applies to marketing.
3. FTC endorsement rules and the fake reviews rule. The FTC’s Endorsement Guides govern how testimonials can be used, and the FTC’s consumer reviews and testimonials rule bans fake testimonials, buying reviews, and undisclosed insider testimonials. For substance use disorder treatment, the Opioid Addiction Recovery Fraud Prevention Act adds civil penalty authority for deceptive practices.
4. Platform policies. Meta requires LegitScript certification and written permission for US addiction treatment advertisers, and its personal attributes policy bars ad text that implies the viewer has a health condition. Google requires US addiction services advertisers to be certified by LegitScript and by Google under its healthcare and medicines policy.
Who can appear, and on what terms
Each type of speaker comes with its own requirements.
Alumni. The strongest testimonial and the most regulated. Before recording, get written HIPAA authorization and, if your program is covered by Part 2, Part 2 consent. Record only after the person has completed treatment and has had time to consider the decision without pressure from staff who treated them.
Family members. A parent or spouse describing their own experience of the family program is less sensitive than describing the patient’s treatment. As soon as they discuss the patient, the patient’s information is involved, so get the patient’s authorization too, or keep the story strictly to the family member’s own experience.
Clinicians and staff. Staff explaining the program aren’t testimonials, but a staff member describing their own recovery at the facility is. Under the FTC’s rules, their connection to the facility has to be disclosed clearly, and the fake reviews rule specifically targets undisclosed insider testimonials.
Actors and dramatizations. The FTC’s endorsement rules require that ads presenting “actual patients” use actual patients, or clearly disclose that the people shown are actors. A dramatization can work well, as long as viewers aren’t led to believe it’s a real patient’s story.
Quoted online reviews. Reusing a review in an ad needs the reviewer’s permission, and the facility’s own words around it can’t add information about the reviewer’s treatment. The HHS review-response settlements show how easily a reply or repost becomes a disclosure.
COMMON MISTAKE
Recording first, consenting later. A team films an alumni event, gets great footage, and then tries to collect authorizations from everyone on camera. Some people say no, some can’t be reached, and the footage either sits unused or runs with people who never agreed.
Collect authorization and consent before recording, and keep anyone without paperwork out of frame entirely.
Testimonial formats and how the rules apply to each
The same rules apply across formats, but each format creates its own practical risks.
Video testimonials. The most persuasive format and the one with the most to check. Everything in frame counts: other people, name badges, charts on a desk, a recognizable room in a small town. Review the background as carefully as the script, and put disclosures on screen long enough to read.
Static quote ads. A quote with a first name and a photo is simple to produce, which makes it easy to cut corners. The quote is still an endorsement, the photo is still a likeness, and both need authorization. If the photo isn’t the speaker, the ad has to say so.
Carousel and story sequences. Multi-card formats often split a story across frames, and the disclosure ends up on a card most people never reach. Put material connection and typicality disclosures on the first card, or on every card that carries a claim.
Creator-style and UGC-style ads. Ads made to look like organic posts raise the FTC’s concern about viewers not realizing they’re watching an ad. If a creator is paid, the connection has to be disclosed in the content itself, not only through a platform’s branded content tag. Upcoming guidance in this series covers UGC-style creative in depth.
Family story ads. These are often the most effective for reaching the family members who make first calls, and they carry a specific trap: the family member’s story usually includes the patient’s. Either keep the story strictly to the family member’s own experience of the program, or get the patient’s authorization as well.
Keeping the record
Every testimonial ad should come with a file that someone outside the marketing team could audit. At minimum, it holds:
- The signed authorization packet for each person shown or quoted.
- The brief, the script, and the final approved cut.
- The claims review notes, including how any outcome or typicality language was handled.
- The speaker’s approval of the final cut and the date.
- Every placement where the ad ran, with launch and end dates.
- Any revocation request and the actions taken.
Keep the file for at least as long as your authorization and record retention policies require, and longer if the ad is still running anywhere. When a platform, payer, regulator, or former patient asks how a testimonial was handled, this file is the answer.
A unified platform built for multiple locations, programs, and audiences without feeling fragmented
- Reorganized multi-service site architecture
- ADA compliant responsive design system
- Future-ready CMS with modular templates
- Optimized for SEO and lead capture
The authorization packet
Put together one packet per speaker and keep it with the creative file. It should include:
- HIPAA marketing authorization meeting 45 CFR 164.508, covering the specific uses (paid social, video, website, print) and the specific information to be disclosed.
- Part 2 consent, where the program is covered, meeting 42 CFR 2.31.
- Likeness and media release covering the recording, editing, and distribution channels, with a clear term.
- Compensation disclosure: anything the speaker received, including payment, gift cards, free or discounted services, or travel, so the ad’s disclosure matches reality.
- Revocation instructions in plain language: how to withdraw permission and what the facility will do when they do.
- Final-cut acknowledgment: a record that the speaker reviewed the edited ad before it ran.
Authorizations must not be a condition of treatment. Keep the process separate from clinical care, and have someone other than the speaker’s treating clinician handle the conversation.
OPERATOR INSIGHT
The speakers who make the best testimonials are the ones who feel in control of their own story. Walking them through exactly where the ad will run, showing them the final cut, and making revocation easy tends to produce more willing participants, not fewer.
It also protects the facility. A speaker who understood and approved the final ad is far less likely to feel exposed when it runs.
Keeping the claims defensible
Once the paperwork is in place, the words still have to hold up.
Typicality. The FTC treats a testimonial as a claim that the speaker’s experience is what people can generally expect. If a speaker’s outcome isn’t typical, the ad must clearly disclose what people generally experience. The old “results not typical” line alone doesn’t satisfy that standard.
Substantiation. Testimonials don’t substantiate health claims. The FTC’s health products compliance guidance expects health claims to be backed by competent and reliable scientific evidence. If a speaker says “this place cured me,” the ad is making that claim, and the facility has to be able to support it.
Clear and conspicuous disclosures. Disclosures of material connections, dramatizations, or typical results have to be easy to notice and understand. In video, that means on screen long enough to read and, where the claim is spoken, stated in the audio too.
Safer ground. Keep testimonials focused on the experience of treatment: what admissions was like, how the staff treated them, what the family program involved, what the first week felt like. Those stories carry trust without making outcome claims the facility can’t back up.
DO
- Tell the story of the treatment experience.
- Disclose any compensation or connection on screen.
- Label dramatizations and actors clearly.
- Show the speaker the final cut before launch.
- Keep a dated file of every authorization and approval.
DON’T
- Promise sobriety, cures, or success rates through a speaker.
- Run footage of anyone without authorization on file.
- Pay for positive testimonials or reviews.
- Present staff or actors as ordinary patients.
- Let ad copy imply the viewer has a condition.
Platform checks before launch
Even a fully authorized, claims-clean testimonial can be rejected by the platform.
On Meta, the testimonial speaker can talk about their own experience, but the ad text, headline, and captions can’t assert or imply that the viewer has a health condition. “Hear how Maria’s family found help” works; “Struggling like Maria was?” implies something about the viewer.
On Google, confirm the account’s LegitScript and Google certifications are current and the landing page is covered by them, and keep outcome claims out of headlines and descriptions.
Our HIPAA-compliant Facebook ads guide covers the targeting and tracking side of running this creative, including why audiences can’t be built from patient or alumni lists.
The testimonial review workflow
Run every testimonial through the same sequence:
Brief
Define the story angle, speaker type, placements, and the claims the ad will and won’t make.
Authorization
Collect the full packet before scheduling a recording date.
Recording
Film only people with paperwork on file. Keep other patients, charts, and identifying details out of frame.
Edit and claims review
Check typicality, substantiation, and disclosures in the edited cut. Our storyboarding framework helps catch problems before the edit.
Speaker approval
Show the speaker the final cut and record their approval.
Compliance and platform review
Counsel or compliance signs off, and the ad is checked against Meta and Google policies.
Launch and monitoring
Track where the ad runs, and watch comments for anything that reveals more about the speaker.
The same workflow applies to AI-assisted edits. Our AI ad creative guardrails guide covers the extra checks for AI-generated or AI-edited material, including never generating synthetic “patients” presented as real.
When a speaker changes their mind
Revocation isn’t an edge case. People’s circumstances change, and a testimonial that felt empowering a year ago can feel exposing today.
Build a takedown process before the first ad runs:
- One contact point for revocation requests, named in the authorization.
- A list of every placement where the testimonial runs, including organic posts, website pages, and email.
- A target timeline for pausing paid placements and removing owned content once a request comes in.
- A record of the request and every action taken.
Paid ads can be paused quickly. Organic posts, reshares, and cached copies take longer, which is another reason to keep the distribution list tight from the start.
Putting it into practice
Start with the paperwork. Draft your HIPAA authorization and, if it applies, your Part 2 consent with counsel, and build the rest of the packet around them.
Then run one testimonial through the full workflow before scaling. The first one surfaces every gap in the process, and it’s far cheaper to find them on one ad than on ten.
Our upcoming video ad script templates include an authorized alumni story template built to these rules. For how testimonial creative fits the rest of your creative program, see our creative strategy guide and our behavioral health marketing guide.
If you want a second set of eyes on your testimonial process, book an intro meeting and we’ll walk through it with you.
Most in-house teams hit a wall not because they lack knowledge, but because they lack bandwidth.
When you are ready to hand it off, Webserv has spent 9 years executing exactly this for treatment centers nationwide.
Frequently Asked Questions
Can a treatment center use patient testimonials in ads at all?
Yes, with the right paperwork and claims discipline. HHS requires written HIPAA authorization for marketing uses of protected health information, and programs covered by 42 CFR Part 2 also need Part 2-compliant consent. With both in place, and with claims that meet FTC standards, alumni testimonials are lawful.
The authorization has to be specific about what information will be used, where, for how long, and how the patient can revoke it. It can’t be a condition of treatment.
Many facilities start with staff and clinician videos, which carry trust without the authorization process, and add alumni testimonials once the workflow is in place.
Do we need to disclose if we paid a speaker?
Yes. The FTC’s endorsement rules require disclosure of material connections between the speaker and the advertiser, which include payment, free or discounted services, and other incentives. The disclosure has to be clear and conspicuous in the ad itself.
The FTC’s fake reviews rule also bans buying testimonials or reviews that misrepresent the speaker’s experience, and bars undisclosed testimonials from company insiders.
Record what every speaker received in the authorization packet so the disclosure in the ad always matches.
Can we use actors to portray patients?
Yes, if the ad makes clear they’re actors. The FTC’s endorsement rules require that ads presenting people as actual patients use actual patients, or clearly disclose that they aren’t.
Dramatizations are a practical option when authorization isn’t possible, and they avoid the privacy issues of real patient stories entirely.
Keep the claims in a dramatization to the same standard as a real testimonial. Labeling it a dramatization doesn’t make an unsupported outcome claim acceptable.
Can we turn our Google reviews into ad creative?
Only with the reviewer’s permission, and with care about what the ad adds. The review itself was written by the patient, but the facility repurposing it in an ad is a marketing use, and any added context about the reviewer’s treatment can be a disclosure of protected health information.
HHS has settled with providers that disclosed patient information while responding to online reviews, which shows how easily a reply or repost crosses the line.
The safest approach is to get written permission and HIPAA authorization from the reviewer, quote only what they wrote, and add nothing that identifies their treatment.
What happens if a former patient wants their testimonial taken down?
Honor it promptly. HIPAA authorizations and Part 2 consents must explain how to revoke, and revocation stops future uses under that authorization.
Pause paid placements first, then remove the testimonial from your website, social profiles, and email, and record every action taken.
Build the takedown process before launch, with a single contact point and a list of every placement. It’s much easier to act quickly when you already know where the ad is running.
Keaton Nalle is the Director of Paid Admissions at Webserv, a digital marketing agency for treatment centers.
