How to market your clinic with AI within the rules

TLDR: Clinic marketing in the United States runs on two separate rulebooks: HIPAA governs what you may say about patients, and the FTC governs what you may claim about results. Inside them there is plenty to do, and the pieces that work are the boring ones. The reply to a bad review is where good clinics break the law, because posting first does not waive anything. Jasper drafts the pages in one voice, Gamma builds the decks, and a named person clears everything before it goes out.

The two-star review you should not answer

A review went up overnight. Two stars, and the patient says nobody called her back about her imaging results. You have a reply already typed: the images were read on Tuesday, the front desk called twice, and there is a voicemail. Every word of it is true and none of it can be posted. Confirming that she is a patient at all, and naming what was imaged, discloses protected health information, and the fact that she brought it up in public first changes nothing about your obligations.

This is not a hypothetical. In December 2022 the Office for Civil Rights settled with a dental practice over exactly this, PHI disclosed in responses to online reviews, and the official summary of the practice is one sentence long: “This practice is illegal under HIPAA.”

So the useful version of this guide is not a list of content ideas. It is the set of lines you cannot see until someone shows you where they are.

1. What HIPAA restricts, and the part it does not

Most clinics get this backwards in both directions. They believe HIPAA stops them from describing their own services, which it does not, and they believe a public reply is fair game once the patient goes public, which it is not.

The general rule is at 45 CFR 164.502(a): a covered entity “may not use or disclose protected health information, except as permitted or required” by the Privacy Rule. Everything else follows from that.

Where it gets useful is the definition of marketing at 45 CFR 164.501. Marketing means “to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”, and it expressly does not include a communication made “to describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication”. Read that twice, because it is the sentence that unblocks the work. Your service pages, your fee page and your new-provider announcement are not HIPAA marketing. They describe what you offer, and they use no patient information to do it.

What does trigger the rule is using patient information to promote something. Then 45 CFR 164.508(a)(3) requires a written authorization from the individual before any use or disclosure of PHI for marketing, with narrow carve-outs for face-to-face communication and promotional gifts of nominal value. A mailing list built from your diagnosis codes is the clearest example of the thing that needs paperwork first.

2. Build the local base: the website and the listing that answer

New patients arrive by searching nearby and they decide on clarity, not on slogans. The base that wins that decision is a website answering what someone wants to know before calling, which means who practices there and with what credentials and state license, what conditions you treat, what a visit costs or how pricing works, which insurance you are in network with, hours, parking and how to book. The Google Business Profile then carries the same facts, real photographs and hours that are actually current.

Jasper drafts those pages from your own material, from $59 a month with a free trial. What earns the fee in a regulated setting is not drafting speed, it is that fifteen service pages hold one voice and one limit, and a consistent voice is what makes a compliance review possible at all. Reviewing fifteen pages written in fifteen registers is a different and much worse job.

Insurance is where most clinic sites go vague and it costs them appointments. Say which plans you are in network with and say plainly when you are out of network. If you cannot publish a price because it depends on the plan, publish the range and what determines it. Booking mechanics belong with scheduling, and the site should hand off to it rather than explain it twice.

3. Publish useful content without crossing the advice line

The border gets written into the procedure: informing about the clinic and its work, yes. Telling a reader what to do about their symptoms, never. Inside the line sits what each service is and what a first visit involves, the team and their training, clinic news, and genuinely useful administrative content about insurance, referrals and what to bring.

Outside it sits symptoms and their causes, the five-tips-for-your-back-pain post, and anything a reader could act on as diagnosis. That line protects you twice, because content that reads as clinical advice also invites the other rulebook. The FTC’s health products compliance guidance sets the standard for health benefit claims, and it is not a low bar: claims “about the health benefits or safety of foods, dietary supplements, drugs, and other health-related products require substantiation in the form of competent and reliable scientific evidence”. A blog post promising an outcome is an advertising claim you now have to substantiate.

Social and video have their own rules on top of these, and they belong to the health social media guide rather than here. Gamma handles the deck-shaped work, referral presentations for physician groups and employer or payer meetings, from the same approved material. It starts free and paid plans begin at $10 a month.

4. Reply to reviews without confirming anyone is a patient

Reviews decide more new patients than any page you will write, so the reply template matters more than the content calendar. A reply that works says thank you, states the clinic’s general standard, and gives a way to reach a named person offline. It does not confirm the reviewer is a patient, does not mention any service, date or condition, and never corrects the factual record in public even when the record is wrong. That restraint is the whole skill, and it is why the template gets written once, in advance, when nobody is angry.

Asking for reviews is the other half. The natural moment is after discharge in the thank-you message from the patient communication circuit, and the ask has to go to everyone in that step rather than to the patients you expect to say something nice, which is both more honest and less fragile.

Patient testimonials in your own advertising are a separate decision with a second rulebook. Under HIPAA they need that written authorization, and under the FTC’s endorsement guides at 16 CFR 255.2 an endorsement about a key attribute is read as representative of what patients generally get, so you need substantiation that it is. Worth knowing before you build a testimonial page: the FTC’s own testing found that stamping “results not typical” on it does not fix the problem, because neither that disclosure nor a stronger one “adequately reduced the communication that the experiences depicted are generally representative”.

Before anything publishes

The four exceptions that always show up

The reviewer who names their own condition. They have posted their diagnosis, their surgery date and your surgeon’s name, so it feels settled. Their disclosure is theirs, and yours would be a separate one made by a covered entity. The reply stays generic no matter how much detail is already public.

The five-star review you want to repost. Positive reviews feel safe and they are the more common trap, because moving one onto your own website turns it into advertising you control. Now it needs the endorsement analysis, and if it describes a clinical outcome it needs substantiation too. Link to the platform instead of lifting the text.

The provider who leaves. Their bio, photograph and name in service pages and directory listings all have to come down, and your state board may have its own requirement about announcing a departure. Put offboarding in the same checklist as keys and system access, because a bio left up for eight months is the most common stale thing on clinic websites.

The vendor who asks for your patient list. A marketing agency offers a recall campaign and asks for an export. That is a disclosure of PHI to a third party, it needs a business associate agreement in place before anything moves, and if the campaign promotes a service it may need patient authorization too. The answer is not no, it is not yet.

What to count to know it is working

Three numbers you can count yourself, before and after, without buying an analytics product:

Calls that came from someone who read the site first. Ask at intake, one question, and write it down. It is the only honest attribution a small clinic gets, and it separates the site working from the site existing.

Days between a review appearing and your reply. Track the gap. Under a week is a clinic that is paying attention, and the number moves faster than any ranking you might chase.

How many published pages a named person actually cleared. If it is not all of them, the gate is decorative. This is the metric that predicts the incident.

The approval boundary

AI drafts. A person clears. In a regulated vertical that sentence has to survive a busy Friday, which is why the gate is a written list rather than an instinct.

The model may write service pages, administrative FAQs, review-reply drafts from the fixed template and deck outlines. It may not decide whether a claim is substantiated, whether a testimonial has authorization on file, or whether a reply discloses PHI. Those three carry a regulator, and they need a named person, usually your privacy officer for the HIPAA questions and a clinician for anything touching scope of practice. Keep the paper trail per piece: the draft, who cleared it and the date.

What patients think of the operation as a whole belongs to the patient surveys circuit, where a problem caught privately never becomes a public review, and the review and referral trend lines belong in the monthly clinic reports. The rest of the back office lives in AI for health and wellness.

Frequently asked questions

Can I use patient testimonials?

Yes, with work. HIPAA requires written authorization before you use their information, and the FTC treats the testimonial as an advertising claim you have to back up. Your state board may add rules on top. The practical answer for most small clinics is to let reviews live on the platforms where patients wrote them and skip the testimonial page.

Can AI write patient-facing educational content?

It can draft it, and this guide recommends you do not publish health advice as clinic marketing. Crossing that line moves you into claims you have to substantiate. Patient education signed by a clinician is a different project with clinical review attached.

When is this not worth doing?

When you are booked out six weeks and referrals all come from two physician groups. Then your problem is not visibility but capacity, and content makes the schedule worse and the reviews worse with it. The other case is a single-provider practice with no one to be the second pair of eyes, because the gate in this guide needs two people to be real.

What if the bad review is factually false?

You still cannot answer it in public with the facts, and this is the hardest rule to follow. You can reply generically, invite them to a named person offline, and separately use the platform’s own process for reviews that violate its policies. If it is defamatory, that is a conversation with your attorney rather than a comment thread.

How much budget does this need?

Mostly hours, and the two pieces that decide the most cost nothing, which are a current Google Business Profile and replies that go out within the week. In tools, Jasper starts at $59 a month with a free trial and Gamma starts free with paid plans from $10 a month.