What specific elements must be included in a HIPAA Marketing Authorization form for video testimonials?

Under the HIPAA Privacy Rule (45 CFR § 164.508), a standard permission slip or generic photo release will not legally protect your practice. To use a patient’s video testimonial for marketing, you must obtain a standalone, signed HIPAA Marketing Authorization Form.

If any required element is missing, the authorization is considered defective, making the video’s publication an unlawful disclosure of Protected Health Information (PHI).

The Core Required Elements

Your authorization form must contain all of the following specific components:

1. Specific Description of Content

A clear, detailed description of what is being disclosed.

• Example: “Patient’s full name, visual image, voice, diagnosis, treatment experience, and spoken statements contained within the video recording made on [Date].”

2. Designated Recipients & Publishing Channels

Explicitly state who is authorized to make the disclosure (your practice) and where the video will be distributed.

• Example: “Authorized to publish on [Practice Name]’s official website, YouTube channel, social media accounts (including Instagram, Facebook, LinkedIn, TikTok), and digital advertising campaigns.”

3. Purpose of Disclosure

HIPAA requires stating the purpose. For video testimonials, state clearly that it is for marketing, promotional, or educational purposes.

4. Patient Right to Revoke (With Mechanics)

A plain-language statement explaining that the patient has the right to revoke their consent at any time, alongside instructions on how to revoke it (e.g., “by submitting a written request to our Privacy Officer at [Email Address]”).

• Exception Note: Explain that revocation will not affect any actions or publications already carried out prior to receiving the written notice.

5. Expiration Date or Event

The authorization must have a specific end date or event (e.g., “Valid for 3 years from the date of signature” or “Expires when the practice ceases operations”).

6. Treatment Refusal Protection (No Conditioning)

A clear statement that treatment, payment, enrollment, or eligibility for benefits cannot be conditioned on signing the form.

• In short: The patient must know their medical care will remain 100% the same whether they sign or decline.

7. Remuneration & FTC Disclosure

• HIPAA Rule: If the practice receives any direct or indirect payment or financial benefit from a third party for using the video, this must be disclosed.
• FTC Rule: If the patient is receiving any compensation or free service in exchange for the video, that financial incentive must be explicitly stated.

8. Potential for Re-disclosure

A mandatory warning letting the patient know that once the video is published publicly online, it is no longer protected by HIPAA and can be viewed, shared, or copied by third parties.

9. Signature & Date

Must be signed and dated by the patient or their legally authorized Personal Representative (if a minor or under legal guardianship, accompanied by a description of the representative’s authority).

Best Practice Tip: Always provide a copy of the signed authorization form to the patient after signature, and keep the original signed copy in your administrative records (separate from the clinical record) for at least 6 years to comply with HIPAA record retention rules.