Can Your Wellness Practice Use Client Testimonials? The Rules, and the Safe Way to Do It
A great client testimonial is the most persuasive marketing you own. People trust other people, so a story from someone who felt lost and then got better does more than any tagline you could write. Which is exactly why it is tempting to plaster them everywhere.
In wellness, testimonials and reviews are a legal minefield, and it catches careful, well-meaning practices all the time. Depending on what you do, up to three different sets of rules can apply to a single review, from the FTC, from HIPAA, and from your own professional ethics board. Get it wrong and you are looking at fines that run from a few thousand dollars into the tens of thousands.
You can absolutely build powerful social proof. You just have to do it the careful way, and most of your competitors do not know how.
This is general marketing guidance to help you spot risk. It is not legal advice. For your specific situation, run it by an attorney or your licensing board.
a testimonial is a claim (the FTC rules)
Start with the rule that applies to everyone (coaches and cash-pay practices included): the FTC treats a testimonial as a claim you are making yourself. So if a client review says "this fixed my chronic fatigue," the FTC reads that as you claiming you fix chronic fatigue, and you would need the same evidence to back it up as if you said it directly. A happy quote does not lower that bar. And an unusual result is not rescued by adding "results not typical" to it. You have to make clear what a typical client can expect.
On top of that, the FTC's Consumer Reviews and Testimonials Rule, which took effect in October 2024, added hard lines that carry civil penalties. Under it, you cannot:
Write, buy, or post fake reviews, including anything generated by AI.
Pay or reward people for reviews that lean a certain way, whether you say so outright or just imply it.
Have staff, family, or insiders leave reviews without disclosing the connection.
Suppress or bury negative reviews, including by threatening the reviewer.
This is not theoretical. The FTC began enforcing the rule at the end of 2025, and penalties can reach more than $50,000 per violation. So the fake five-star review, the "leave us a review and get $20 off" promo, and the buried one-star are all specific violations now.
patient words are protected (HIPAA)
If your practice is a HIPAA covered entity, and most medical, functional medicine, and insurance-billing therapy practices are, then a patient's words, face, and story are protected information, and using any of it in your marketing needs the patient's written, HIPAA-compliant authorization first.
This is where practices slip. A patient saying "of course, use my story" in the treatment room is not enough. You need signed authorization that spells out what you can use and where, before a single testimonial, before-and-after photo, or "meet a patient we helped" post goes live. HHS guidance is clear that marketing uses of protected information require authorization, and it gets enforced. One physical therapy practice paid $25,000 for posting patient testimonials with full names and faces without proper authorization.
the review-response trap
Replying to a review can break HIPAA, even a glowing one.
This template pack gives you ready-to-use, compliant replies for five common situations, positive, negative, fake, health-detail, and how to ask for reviews at all, plus the golden rule and what never to do.
Responding to an online review can itself break HIPAA, even to a glowing one, and even when the patient posted publicly and named themselves.
Under HIPAA, confirming that someone is your patient is itself a disclosure of protected information. So a warm "so glad we could help with your thyroid, Dana!" reply reveals that Dana is a patient and what they were treated for, which is exactly the kind of thing you need authorization to share. It does not matter that Dana named themselves first. The obligation is on you.
OCR, the office that enforces HIPAA, fined one dental practice $10,000 for revealing a patient's name and treatment details in a Yelp reply, and other practices have paid $23,000 and even $50,000 for the same mistake. Mental health practices have been fined too.
So how do you respond safely? Keep it generic and take it offline. Something like "thank you for the feedback, we take it seriously and would love to talk, please give the office a call" says you care without confirming anything about anyone. Never mention the person's care, and never confirm they are a client, no matter what their review said.
if you're a licensed therapist, there's a third layer
Therapists, counselors, and social workers have a rule on top of the other two that catches people off guard. Your professional ethics code likely bars you from soliciting testimonials from current clients at all. The APA's Ethics Code tells psychologists not to solicit testimonials from current therapy clients or from anyone who, because of their situation, is vulnerable to undue influence, and social work has a matching rule.
For a lot of licensed mental health providers, asking a current client for a testimonial is off the table, full stop, before HIPAA even enters the picture. This throws people who watch other businesses run on reviews. Your rules are stricter, and it is worth knowing exactly what yours say.
what to do instead (build trust without the risk)
None of this means you have to market without social proof. It means you get it the careful way.
For any testimonial you do use, get written, HIPAA-compliant authorization first, and keep it truthful and typical.
Let happy clients leave their own reviews on Google or elsewhere. An unsolicited review a client chooses to write is theirs. Just respond generically and never add protected details.
Lean on referral partners and colleagues. A referring physician or a fellow practitioner speaking well of you carries weight and sidesteps the patient-authorization problem entirely.
Show outcomes in aggregate and de-identified, along the lines of "most clients see X within Y," if you can back it up, rather than one dramatic personal story.
Demonstrate expertise instead of borrowing it. Content that shows you know your field builds trust the way a testimonial does, with none of the exposure.
The practice that handles reviews and privacy correctly is the one patients, and referral partners, trust with their name.
how can we help?
At Microdose, marketing wellness practices means knowing these rules cold: the FTC's, HIPAA's, and the ethics lines your license draws. We help you build social proof that is persuasive and compliant, set up your reviews the safe way, and flag anything gray so you can check it with your attorney before it becomes a problem. Want the compliant replies for every kind of review? Grab the free template
If you have testimonials you are not sure you are allowed to use, or a review situation you are not sure how to handle, let's talk.
