Manufacturer before-and-after images need written permission, not patient consent

What the source requires

A before-and-after image on a practice site is one of two different things, and they need different instruments. If the practice took it, it needs a HIPAA marketing authorization under §164.508 — a specific, revocable document, not a general consent form. If a device manufacturer supplied it, the practice instead needs the manufacturer's written permission naming the practice, and their warranty that they hold the subject's authorization.

Why this is hard to satisfy

Practices cannot tell the two apart, because device reps supply clinical assets that look exactly like the practice's own photography. Found on a real engagement: nine images assumed to need nine patient conversations turned out to carry manufacturer and investigator credits printed in the artwork, and needed three emails to reps instead. Guessing wrong in the other direction is worse — it means publishing a patient photograph with no authorization on file.

What we do about it

Detect before-and-after imagery and ask which bucket each belongs to, then hold the answer in the rights ledger. A "results may vary" caption is not a remedy for either bucket — the FTC has tested those disclaimers — and adding one creates a second problem under 16 CFR §255.2(b).

In build · phase one