Most healthcare social media marketing never gets anyone in trouble. The campaigns are fine. The trouble starts in the replies.
A patient leaves a one-star review. Someone on staff, tired and defensive, answers it with what actually happened at the appointment. That reply is a disclosure of protected health information, made in public, under your organization’s name. Federal regulators have settled cases with providers over exactly this.
The short version: you can post freely about your services, your building and your staff, but you cannot confirm in public that anyone is a patient, and any post that features a patient needs their written authorization first.
This guide is for operators and communications leads in healthcare, senior living and long-term care who run social with a small team and a compliance officer down the hall. It covers where the law actually draws the line, a strategy that survives review, the content that performs without a patient in it, and how to measure the results without tracking anyone.
What Healthcare Social Media Marketing Is Actually For
Social media in healthcare is rarely one program. It is three, talking to three audiences, and each one sits on a different legal footing.
Families and Patients Choosing Care
The highest stakes and the audience closest to protected health information. Everything you post here is read by people who may already be your patients.
Recruits
Nurses, aides, therapists and support staff deciding where to work. This is the least constrained audience and, for many operators, the most urgent one.
Referral Sources and the Community
Physicians, discharge planners, funders, local press and legislators. They want proof that your organization is credible and worth backing.
Most teams try to serve all three in one feed, then wonder why every post takes a week to clear. Separate the audiences and two of the three get easier, because recruiting and community content rarely touches a patient at all.
Platform choice should follow the audience. Pew Research Center’s most recent survey, fielded between February and June 2025, found that 84% of U.S. adults use YouTube and 71% use Facebook, against 50% for Instagram and 37% for TikTok. Social media marketing for hospitals and senior living communities usually starts on the two platforms with the widest reach, then adds the others where a specific audience is known to be.
HIPAA and Social Media: Where the Line Actually Sits
HIPAA and social media meet in two places: marketing, and disclosure. Most teams worry about the first and get caught by the second.
The HIPAA Privacy Rule defines marketing as “a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.” Before protected health information is used for marketing, the covered entity needs the individual’s written authorization.
The Rule then carves out the communications most organizations send every day:
- Communications describing your own health-related products or services
- Communications for the individual’s treatment, such as refill reminders
- Communications for case management or care coordination
In practice, a post announcing your new memory care wing is describing your own services. It uses nobody’s health information and needs nobody’s authorization. A post featuring a named resident’s recovery is different: it uses that person’s health information to promote you, and it needs their written authorization first.
The definition of “health information” is wider than most marketers assume. A 2023 review in Missouri Medicine on avoiding risk when clinicians use social media notes that identifiable details include not just names but photos and distinguishing features such as tattoos. De-identifying a story means stripping every specific that could point back to the person, including family members and employer.
The Review Reply Trap
Some of the best-documented HIPAA violations on social media are not campaigns. They are replies.
In June 2023 the HHS Office for Civil Rights announced a $30,000 settlement with Manasa Health Center, a New Jersey psychiatric practice. According to the OCR announcement, the practice had answered negative online reviews with specific diagnostic and treatment details for at least four patients. The practice also agreed to two years of OCR monitoring.
OCR’s director was blunt about disclosures in review responses and on social media: “Simply put, this is not allowed.”
The rule that follows is simple enough to put on a sticky note: never confirm, in public, that the reviewer was a patient. A patient describing their own care online does not give you permission to add to it. A reply that works for almost any review looks like this:
“Thank you for taking the time to share this. We take every concern seriously, and we can’t discuss anyone’s care in a public forum. Please call our patient experience team at [number] so we can look into it with you directly.”
It acknowledges the reviewer, protects the organization, and moves the conversation somewhere private.
Staff Posts, Photos and What’s in the Background
The second source of trouble is your own people. A nurse posts a team selfie at the end of a double shift. Nobody in the photo is a patient, but a whiteboard with room numbers and names is on the wall behind them.
The American Nurses Association’s social media do’s and don’ts for nurses makes the same point, warning that even a fun workplace photo may capture “a patient, family member, or a visible chart in the background.” The ANA also advises nurses against posting patient stories at all, even with good intentions.
There is a second, quieter rule for staff who post about work on their personal accounts. The Federal Trade Commission’s guidance on endorsements says employees promoting their employer should disclose the relationship, and that listing the employer on a profile page is not enough. An aide raving about your community on TikTok is an endorsement, and it needs a disclosure.
Policies can overreach in the other direction too. The Missouri Medicine authors caution that employer social media policies must not infringe on employees’ rights to discuss their working conditions. Write the policy with counsel, not from a template.
A Healthcare Social Media Strategy That Survives Review
A healthcare social media strategy usually fails review for the same reason most healthcare campaigns do. Legal sees it after it is built. The fix is sequencing, not caution. Social media sits inside the healthcare marketing strategy that survives HIPAA review, the layer above any healthcare social media strategy, so start there if the demand problems are not yet settled.
Choose Content by Consent Chain
Sort every idea by one question: whose consent does this post need, and can it be withdrawn later? Three tiers fall out of it.
- Facility, community and education content. Your building, your events, your services, general health information. No one’s consent is needed beyond your own. This is where volume should live.
- Staff and caregiver stories. One signature deep, and the signature belongs to the person in the story. They consent for themselves and disclose nothing about anyone else.
- Patient and resident stories. The most persuasive and the most fragile. They need a specific written authorization that the person can revoke, which is a real problem once a post has been shared. Treat each one as a project, not a post.
A calendar built mostly on tiers one and two will ship. One that depends on tier three will stall in review.
Write the Posting Policy before the Calendar
A one-page policy does more for healthcare social media than any content calendar. It should cover:
- Who can post on official accounts, and who approves what
- A photo checklist before anything goes up: faces, wristbands, whiteboards, screens, charts and name badges in the frame
- The reply rule: never confirm or deny that anyone is a patient, and never add clinical detail to a public thread
- Personal accounts: what staff may share about work, and how to disclose the employment relationship
- Escalation: who gets called when a post goes wrong, and how fast it comes down
Set a Comment and Review Playbook
Most social media teams in healthcare write their posts carefully and their replies in a hurry. Flip that. Write three or four approved replies for the situations you see every week: a complaint about care, a billing complaint, a compliment that names a staff member, and a question that should go to a clinician.
Every reply moves the conversation to a private channel. None of them confirms a relationship. When the playbook covers the routine cases, staff only need judgment for the unusual ones.
Medical Social Media Marketing People Actually Watch: Film the Caregiver
Most medical social media marketing is announcements, awareness days and stock photography. The feed does not reward it, and the people you most want to reach scroll past it.
What travels is people. And the people with the cleanest consent chain in your building are the ones delivering the care. If you cannot film the patient, film the caregiver.
That is the premise behind People Worth Caring About, the Strategic Pete docuseries about long-term care workers. The program has produced 28+ episodes, interviewed 200+ people on camera and filmed in 50+ cities. The Nebraska season, funded by the nonprofit arm of the Nebraska Health Care Association, captured 21 unscripted stories across 7 communities.
Across every season, those caregiver stories drew social numbers closer to entertainment than to healthcare content:
- 7.9M+ TikTok views, with 558K+ likes and 40K shares
- A top clip with 535K likes, 38.8K shares and a 9.16% engagement rate
- Engagement across clips ranging from 5.54% to 21.62%
- 475K YouTube highlight views
The association itself recorded 80,000+ views in six months, and the wider series reports 32.1 million in social media reach. That is a social figure, not television viewership. The series also streams on Roku, Apple TV, Samsung TV and Amazon Fire, which is a separate distribution channel with its own audience.
One detail is worth sitting with. The TikTok audience skewed roughly 60% male and mostly 25 to 44. That is not the audience most senior living marketers picture, and it is a reminder to read your own analytics rather than your assumptions.
The clips also did work no awareness post does. Reels were geofenced around Capitol debates, QR-code handouts went to state senators, and according to the Nebraska long-term care docuseries case study, senators began quoting scenes from the film during discussions about funding and workforce shortages. Tracy Lichti, President and CEO of New Cassel Retirement Center, described the effect: “This docuseries has been a game-changer for our association… we raised our highest amount of money ever!”
A Smaller Version: One Community, One Specialist
Social media marketing for healthcare does not need a docuseries to use the same idea. Glass Peaks, a faith-based senior living community in Toledo, Ohio, could not recruit memory care specialists through conventional channels. The answer was one 17-minute episode following Lavida, a memory care specialist, plus a 30 to 60 second cut-down for social.
The cut-down ran on the community’s own accounts and as paid Facebook and LinkedIn campaigns targeting certified caregivers and healthcare professionals, with press outreach alongside. Outcome figures for the project have not been published, so treat the Glass Peaks memory care recruitment film as a format to copy rather than a result to expect.
The logic is the one Strategic Pete’s healthcare work is built on: “Job ads compete on wages. Stories compete on meaning.” It is also the reason documentary video production for healthcare social media marketing starts with care routines and the people inside them.
See how our healthcare video production works, built around the people who deliver care.
Paid Social: Where Social Meets Tracking
Organic posting is publishing. Paid social is where social media marketing for healthcare meets the measurement layer: pixels, custom audiences, lookalikes and conversion tracking. That is where the regulatory risk changes shape.
The clearest warning came from outside HIPAA. In February 2023 the FTC announced a $1.5 million civil penalty against GoodRx, whose conduct included uploading contact details and advertising IDs of users who had bought particular medications to Facebook for targeting.
Nobody hacked anything. A growth team built an audience.
The full picture of what a healthcare site may measure and target, including the 2024 court ruling on tracking guidance, is in our guide to what healthcare digital marketing can and can’t track. The short version for social: boost content freely, and have counsel look at any audience built from your website visitors or patient lists before it is built.
Measuring Healthcare Social Media Marketing without Tracking Patients
The instinct to prove healthcare social media marketing with pixel data is exactly the instinct that creates risk. Measure against the demand problem instead, and most of the numbers you need come from places that carry no tracking at all.
- Recruiting: applications, and where applicants say they first saw you. Ask it on the application form. Referral quality counts as much as volume.
- Families and patients: tour requests, inquiry calls and the “how did you hear about us” question at intake.
- Community and advocacy: who shares your content, who cites it, and who invites you to speak or screen it.
Platform numbers are leading indicators. Shares matter more than likes, because a share is someone vouching for you to their own network. Watch time matters more than views on video.
Treat each audience as its own line in your healthcare marketing campaigns, with its own number agreed before anything is posted. If you cannot name the number, you cannot tell whether the program worked.
Frequently Asked Questions
What Is the Best Social Media Platform for Healthcare?
It depends on the audience. By reach, YouTube and Facebook lead: Pew’s 2025 survey puts them at 84% and 71% of U.S. adults. Families researching care are likely to be on both. Recruiting content often does well in short-form video, and referral and clinician audiences are usually easiest to reach through professional networks and trade press.
Can a Healthcare Provider Respond to Online Reviews?
Yes, as long as the reply does not confirm the reviewer was a patient or add any detail about their care. OCR’s $30,000 settlement with Manasa Health Center in 2023 was over replies to negative reviews that disclosed diagnostic and treatment information. Acknowledge, don’t disclose, and move the conversation to a private channel.
Can Staff Post about Work on Their Own Accounts?
Generally yes, within a clear policy. Staff should never post patients, patient stories or anything identifiable in the background of a photo. When they promote the organization, the FTC’s endorsement guidance says they should disclose that they work there. Have counsel review the policy so it does not restrict employees’ rights to discuss working conditions.
Do We Need Patient Consent to Post a Photo?
If the patient can be identified and the post promotes your organization, you need their written HIPAA authorization first. Identifiable includes faces, names, distinguishing features and details in the background. Truly de-identified content does not need it, but de-identifying a photo is harder than it looks.
What Are the 5 P’s of Healthcare Marketing?
Several versions circulate and no authoritative healthcare-specific set exists. The most common extends the classic marketing frameworks of product, price, place and promotion with people. For social, the more useful questions are which audience you are serving and whose consent the post depends on.
What Does Healthcare Video for Social Media Cost?
Strategic Pete publishes one figure for this work: short branded stories of four to seven minutes at $5,000 to $10,000 per episode. Social cut-downs are planned from the same footage. For association work, sponsors typically contribute to a segment or short feature, which can offset production costs.
Conclusion
Healthcare social media marketing looks like a content problem and turns out to be a consent problem. The posts that cause trouble are rarely the ones that went through review. They are the reply written in a hurry, the selfie with a whiteboard behind it, the testimonial nobody got in writing.
Solve for consent first and the content problem gets smaller. Most of what performs on social in this sector needs nobody’s authorization but the person on screen: the aide, the specialist, the admissions coordinator whose work is the actual product. They consent for themselves, and their stories travel further than anything a brand account could say about itself.
That is the underrated advantage. The rules that make patient stories hard make caregiver stories valuable, because your competitors are still posting awareness days.
Scale your healthcare brand with powerful stories. Let’s talk about what your organization can put on film.
