Healthcare Marketing and Patient Testimonial Compliance Review Program

By Thomas G. Goddard, JD, PhD, founder of Integral Healthcare Solutions and former Chief Operating Officer and General Counsel of URAC

Last updated: November 2026

A healthcare marketing and patient testimonial compliance review program is a written workflow that checks each advertisement, endorsement and online review a practice or health company publishes against the FTC's two texts on the subject: the Endorsement Guides (16 CFR Part 255) and the Consumer Reviews and Testimonials Rule (16 CFR Part 465). It is for practices and health companies that show patient testimonials, ratings or clinician endorsements without a written step before something goes live. Integral Healthcare Solutions (IHS) has three practice lines (Accreditation Consulting, Compliance Services and Program Development), and this program sits in Compliance Services. IHS drafts the policy, log and audit steps; your compliance lead and counsel decide what stays on your site.

What do the FTC endorsement and review rules say?

Two federal texts apply, and they differ in force: Part 255 is guidance, and Part 465 is a rule. The text below comes from the current eCFR (Part 255, Part 465; opened 2026-11-05).

Part 255: the Endorsement Guides

• Section 255.0(a) calls the Guides "administrative interpretations" of FTC-enforced law "for the guidance of the public". Practices inconsistent with them "may result in corrective action" if, after investigation, the Commission has reason to believe they are unlawful (88 FR 48102, July 26, 2023).
• Section 255.1(d): "Advertisers are subject to liability for misleading or unsubstantiated statements made through endorsements or for failing to disclose unexpected material connections between themselves and their endorsers." An advertiser may be liable even when the endorser is not. Advertisers should guide and monitor endorsers and remedy non-compliance, which is "not a safe harbor".
• Section 255.1(f): agencies, review brokers and reputation management companies may be liable for their roles in endorsements with representations they know or should know are deceptive, and for endorsements that fail to disclose unexpected material connections.
• Section 255.2: claims made through consumer endorsements need adequate substantiation, and "Consumer endorsements themselves are not competent and reliable scientific evidence." Example 11: inviting only very positive respondents to post may be deceptive if posted reviews end up substantially more positive than they otherwise would.
• Section 255.5(a): a connection that might materially affect the weight or credibility of the endorsement, and that the audience does not reasonably expect, "must be disclosed clearly and conspicuously".

Part 465: the consumer reviews rule

• Effective October 21, 2024 (89 FR 68034, opened 2026-11-05).
• Section 465.4 reaches compensation or other incentives given "in exchange for, or conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment, whether positive or negative".
• Section 465.2 covers writing or selling a review or testimonial that materially misrepresents that the reviewer exists, used the service or had the experience described; buying such a review or disseminating such a testimonial that the business knew or should have known did so; and procuring one from officers, managers, employees, agents or their immediate relatives for a third-party site, on the same knowledge standard. Paragraph (d) exempts generalized solicitations to purchasers and mere review hosting from paragraphs (b) and (c) only, not from section 465.4.
• Section 465.5 requires a clear and conspicuous disclosure of an officer's or manager's relationship in reviews they write (for a testimonial, unless otherwise clear to the audience), and in staff or agent testimonials the business disseminates when the relationship is not otherwise clear and it knew or should have known of it.
• Section 465.7(a) bars unfounded legal threats, physical threats, intimidation and knowingly or recklessly false public accusations made to stop or remove a review. Section 465.7(b) applies when a business materially misrepresents that the reviews in its own review section show "most or all" submitted reviews while suppressing reviews based on rating or negative sentiment. Withholding under criteria applied equally to all reviews, such as defamatory or clearly false content, is not suppression on that basis.

What is the exposure?

For knowing violations of a rule other than an interpretive rule, 15 U.S.C. 45(m)(1)(A) lets the FTC seek a civil penalty (statute, 2023 edition, opened 2026-11-05). IHS reads Part 465 as such a rule; counsel confirms. The 16 CFR 1.98(d) text lists a maximum of 53,088 dollars for each violation under section 5(m)(1)(A), for penalties assessed after January 17, 2025. Counsel checks the current amount.

The HIPAA marketing authorization

Under 45 CFR 164.508(a)(3)(i) (opened 2026-11-05), a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, unless the communication is a face-to-face communication by the covered entity to the individual or a promotional gift of nominal value. Section 164.501 defines marketing as a communication about a product or service that encourages recipients to purchase or use it, with exclusions.

Who needs a written review program and what triggers it?

Any practice or health company that publishes testimonials, ratings or endorsements needs a written step that decides what goes live, because section 255.1(d) puts liability on the advertiser. Usual starting points: testimonials with no approval owner; asking patients for reviews or offering anything in return; staff or family posting; an agency collecting reviews.

How does IHS help?

IHS organizes the program around four questions: who is speaking, what is claimed, what connection exists, and how reviews are asked for, shown and removed. That grouping is IHS's design.

What IHS drafts

• A written advertising and review-handling policy and disclosure standard.
• A testimonial intake log: speaker, relationship, incentive, substantiation, date.
• A solicitation script that goes to all recent patients and does not depend on sentiment.
• Written criteria for withholding reviews, applied equally, with a removal log.
• A vendor-oversight checklist and a quarterly spot-check.

What you supply

Your advertisements, testimonial inventory, review platform accounts, vendor contracts, patient authorization forms and the names of the people who approve copy.

The real limit

IHS is a consulting firm, not a law firm, and gives no legal advice. Counsel decides whether a claim is deceptive and whether a testimonial is HIPAA marketing. State advertising rules are outside this page. IHS does not contact the FTC or any other regulator.

What should you have ready?

Each item ties to the section named.

1. Every live ad, page and post showing a testimonial, rating or endorsement (255.1(d)).
2. The substantiation file behind each health claim (255.2).
3. Credentials for each clinician described as an expert (255.3(a)).
4. Every connection to anyone who speaks for you: payment, free service, employment, family (255.5(a); 465.5).
5. Every way you ask for reviews today, and who receives each request (255.2 Example 11; 465.2(d)).
6. Anything given to a patient around a review: discounts, gift cards, drawings (465.4).
7. Platform access, your rules for withholding reviews and any removal record (465.7(b)).
8. Agency and reputation-vendor contracts (255.1(f)).
9. The patient authorization form for testimonials that include protected health information (164.508(c)).

A free introductory call is the place to walk through this list and agree what IHS drafts first.

How do the three texts compare?

For the wider program, see Compliance Services and compliance program development.

What does it cost?

The sections cited set no fee, so the costs are consulting and your own staff time. IHS scopes each engagement after a free introductory call. Scope moves with the number of sites and platforms, how many testimonials are live, whether an agency collects reviews, and what the first inventory finds. Your team builds the inventory and runs the spot-check; IHS publishes no hour estimate.

What is this not?

• It is not legal advice; counsel decides what is deceptive and what is HIPAA marketing.
• It is not an FTC filing, approval or safe harbor; no IHS document is submitted to a regulator.
• It is not review collection or reputation management; your people or vendor run what IHS drafts.

Frequently asked questions

What does the FTC say about patient testimonials on a practice website?

Part 255 treats a patient testimonial as an endorsement. Section 255.2(a) requires adequate substantiation for the claims it conveys; consumer endorsements themselves are not competent and reliable scientific evidence. Under section 255.2(b), a result on a key attribute will likely be read as typical; without substantiation of that, the advertisement should disclose generally expected performance.

Can we offer a discount or gift card for a review?

Not if the incentive depends on what the review says. Section 465.4 makes it a violation to provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, reviews expressing a particular sentiment, positive or negative. Section 255.5(a) adds a disclosure question for free or discounted products. Counsel approves any incentive.

Do the rules apply to reviews on Google, Healthgrades and other sites we do not control?

Your own conduct is covered wherever the review appears: sections 465.2(c), 465.4 and 465.5 are written about what the business does. Section 465.7(b) is limited to a review section on the business's own website or platform. Counsel confirms how a given third-party platform is treated.

What must we disclose when a physician or staff member endorses our service?

Section 255.5(a) requires a clear and conspicuous disclosure of a connection that might materially affect the endorsement's weight or credibility and that the audience does not reasonably expect. Section 465.5 adds disclosure of an officer's, manager's, employee's or agent's relationship when not otherwise clear to the audience. Section 255.3(a) requires an expert's qualifications to match the expertise represented.

Can we remove or hide negative reviews?

Not on the basis of sentiment. Section 465.7(b) applies when a business materially misrepresents that the reviews in its own review section show most or all submitted reviews while suppressing them based on rating or negative sentiment. Withholding under criteria applied equally to all reviews, such as defamatory or clearly false content, is not suppression on that basis. Section 465.7(a) bars unfounded legal threats and intimidation to remove a review.

What is the difference between the Endorsement Guides and the consumer reviews rule?

Part 255 is a set of guides, with corrective action possible after investigation. Part 465 is a rule whose sections each state that a practice is an unfair or deceptive act or practice and a violation of the part, effective October 21, 2024.

When does a patient testimonial also trigger HIPAA authorization?

Under 45 CFR 164.508(a)(3)(i), a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, unless the communication is a face-to-face communication by the covered entity to the individual or a promotional gift of nominal value. Counsel decides whether a testimonial is marketing under section 164.501; the log flags every testimonial that identifies a patient or describes care.

Who is responsible when our marketing agency collects the reviews?

You remain responsible as the advertiser: section 255.1(d) says an advertiser may be liable even when the endorser is not. Under section 255.1(f), agencies, review brokers and reputation management companies may also be liable for their roles for endorsements with representations they know or should know are deceptive, or that omit a needed disclosure. IHS drafts a vendor-oversight checklist.

What should a written review-handling policy contain?

IHS drafts it to cover who approves copy; how each testimonial is logged; how material connections are disclosed; how reviews are asked for, including from all recent patients; equal written criteria for withholding a review; what staff may post; and how patient information is handled.

How often should we audit our testimonials?

The opened text sets no audit cadence; section 255.1(d) says advertisers should monitor endorsers' compliance. IHS drafts a quarterly spot-check as its own working design.