HIPAA compliant marketing for plastic and cosmetic surgeons
Updated October 16, 2026
Plastic surgery marketing runs on before-and-after photos, consultation forms, reviews and financing offers. Practices that bill insurance electronically for any procedure are HIPAA covered entities, and the FTC's rules on reviews and health data apply either way.
Where the risk shows up
- Before-and-after photos and patient stories posted without written authorization
- Consultation and quote forms that pass procedure interest to ad platforms
- Retargeting pixels on procedure, pricing and booking pages
- Review replies that confirm someone is a patient or mention their procedure
- Photo libraries kept in marketing tools, shared drives or staff phones
What the record shows
HIPAA applies to covered entities, which include health care providers that conduct certain transactions electronically, such as billing health plans (HHS).
In 2023, hackers stole patient records and nude before-and-after photos from a Las Vegas plastic surgery practice, posted them online and sent them to patients’ family and friends. About a dozen patients sued the practice (Malwarebytes).
In October 2024, Plastic Surgery Associates of South Dakota agreed to pay $500,000 to the Department of Health and Human Services Office for Civil Rights after a ransomware attack exposed the records of 10,229 patients (Saul Ewing).
The Federal Trade Commission’s consumer reviews and testimonials rule, effective October 21, 2024, allows penalties of up to $51,744 per violation for fake testimonials, paid positive reviews and undisclosed insider reviews (Morgan Lewis).
How Rook helps
Rook reviews your practice’s marketing from the outside, then installs the safeguards and systems your team runs. Start with a free Marketing Risk Report, or see programs and pricing.
Make cash-pay care easier to say yes to.
Most cosmetic procedures are paid out of pocket, which makes price the last objection between a consultation and a surgery date.
In one survey, 76% of prospective cosmetic patients didn’t know financing was available, and almost two-thirds said they’d be more likely to book if they knew (Practical Dermatology).
RepeatMD + Affirm gives your patients flexible financing with a soft credit check, plus memberships and rewards in your own branded app. RepeatMD reports approval rates above 80%.
Explore RepeatMDOpens RepeatMD’s site in a new tab. Rook Consulting is a RepeatMD referral partner and may be compensated when practices sign up through this link.
This page is general information about published regulations, enforcement actions and studies. It is not legal advice. Approval rates as reported by RepeatMD.