Compliance

Testimonials, before-and-afters and star ratings on a practice website

What the revised FTC Endorsement Guides mean for the social proof on a practice website, and how to keep it persuasive without making claims you cannot support.

By Mariya Di Luzio, Founder and Creative Strategist · Published · 6 min read

The short answer

A patient testimonial on your website is treated as your own claim. Under the FTC Endorsement Guides, revised in 2023, you need evidence for anything a testimonial implies, and if a result is not typical you must say what patients generally achieve.1 Staff and family endorsements need a clear disclosure, and HIPAA-covered practices need written authorization first.4

Key takeaways

  • “Results not typical” is not enough. Say what patients generally experience instead.2
  • A testimonial cannot claim what you could not prove if you said it yourself.5
  • Reviews from employees, relatives or anyone given a perk need a disclosure next to the review.1
  • Showing only five-star reviews, or ordering them to hide the rest, can mislead.2

Why is a patient’s testimonial treated as my claim?

Because you chose to publish it. The Endorsement Guides say an ad using consumer endorsements about a product’s performance will be read as saying the product is effective for that purpose, so the advertiser needs the same substantiation it would need to say it directly.1 The same section adds that consumer endorsements are not themselves competent and reliable scientific evidence.1

The FTC’s Health Products Compliance Guidance puts it more bluntly: advertisers should not make claims through testimonials that would be deceptive or could not be substantiated if the advertiser made them directly, and they need evidence that the product will work for buyers as it did for the endorser.5 The guides speak of “products,” but the FTC Act they interpret covers the advertising of services too.

So a chiropractor who could not write “we fix sciatica” cannot publish a patient saying “Dr. Lee fixed my sciatica” and treat it as someone else’s opinion. For the wording side of this, see health claims on practice websites.

What changed in 2023?

The FTC finalized revised Endorsement Guides in June 2023, the first revision since 2009.3 The changes most relevant to practices:

  • A new principle against procuring, suppressing, boosting, organizing or editing reviews in ways that distort what customers think.3
  • Explicit treatment of incentivized reviews and reviews written by employees.3
  • A definition of “clear and conspicuous,” and a warning that a platform’s built-in disclosure tool might not be enough.3

The Guides are guidance, not a statute. They describe what the FTC considers deceptive under the FTC Act, which is the law it enforces.3 Separately, the FTC’s Consumer Review Rule covers fake and bought reviews; the FTC Consumer Review Rule article covers asking for reviews under that rule.

Can I still show dramatic results?

Yes, with the typical result next to them. Under section 255.2, a testimonial about a key attribute will likely be read as what patients generally achieve. If you cannot show that it is representative, you must clearly and conspicuously disclose the generally expected performance, and that disclosure must change the overall impression of the page.1

The FTC’s question-and-answer guide is direct about the old workaround: noting that results are not typical is not sufficient on its own.2 You have to say what is typical, which means you need to know it.

For a practice, this is a data question before it is a design question. If you track outcomes for a program, you can publish a before-and-after with an accurate line underneath about what most patients experienced over the same period. If you do not track outcomes, you are not in a position to publish the outlier.

Which testimonials need a disclosure?

Any where the reader would not expect the connection. Section 255.5 says material connections can include business, family or personal relationships, payment, free or discounted services, and the chance of winning a prize, and they must be disclosed clearly and conspicuously when the audience would not expect them.1

Common practice testimonials and what they need
SituationDisclosure needed?What to do
Patient paid full price, no incentiveNoPublish as written, with consent
Patient got a discount for the reviewYesState the discount beside the review
Front desk staff member reviews youYesSay they work at the practice
Spouse or relative of the ownerYesSay who they are
Outlier result, e.g. 40 lbs in 3 monthsYesAdd what patients generally achieve

The Q&A guide adds that employees should disclose their connection even if their workplace is listed on their profile, because readers of a single post will not see it.2 It also says the closer the disclosure is to the endorsement, the better, and that a disclosure buried on another page is easy to miss.2

Can I edit or shorten a testimonial?

Shorten, yes. Change the meaning, no. The Guides say an endorsement may not be presented out of context or reworded so as to distort the endorser’s opinion or experience, and that quotation marks represent the endorser’s exact words.1 The endorser must also have been a real user of the service when they gave it.1

The safest workflow: keep the original review or form submission, publish a faithful excerpt, and record the date and the patient’s consent.

What about star ratings and “as seen in” logos?

Star ratings are endorsements shown in aggregate. The Q&A guide warns that organizing reviews so the five-star ones dominate can create a misleading impression.2 If you show an average, show the real average, from a named source, with the review count.

“As seen in” logos tell a patient a publication vouched for you. Use a logo only when that outlet actually featured you, and link to the piece. A paid placement or a press release republished on a news site is not the same thing, and presenting it as editorial coverage misleads.

Where does HIPAA come in?

If your practice is a HIPAA covered entity, a patient’s name, photo or story in your marketing is protected health information. The Privacy Rule says a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, with narrow exceptions such as face-to-face communication.4 A signed, specific authorization before publishing is the minimum; a verbal “sure, go ahead” is not.

Health coaches and other non-covered businesses are outside HIPAA, but the FTC rules above still apply. This article is not legal advice; have counsel review your authorization form.

The free check looks at the testimonials, ratings and badges on your site and flags anything missing a disclosure.

Questions practice owners ask

Is results not typical still an acceptable disclaimer?

Not on its own. The revised Endorsement Guides say that if you cannot show a testimonial is representative, you must clearly disclose what patients generally achieve. The FTC question-and-answer guide confirms that simply saying results are not typical is not sufficient.

Can my staff leave reviews for the practice?

They can share their view, but they must disclose that they work for the practice, close to the review itself. The FTC says employees should disclose the relationship even when their employer is visible on their profile, because readers of a single post will not see that background.

Can I offer a discount in exchange for a testimonial?

A discount or free service is a material connection under 16 CFR 255.5, so any resulting testimonial needs a clear disclosure. Conditioning the incentive on a positive review is a separate problem covered by the FTC Consumer Review Rule. Offering nothing is the simplest path.

Do I need written permission to post a patient testimonial?

If your practice is a HIPAA covered entity, yes: using protected health information for marketing requires the patient’s authorization under 45 CFR 164.508. Even outside HIPAA, written consent protects you and the patient and shows the testimonial is genuine.

Can I show before-and-after photos?

Yes, if they are real, unaltered, from consenting patients, and paired with an accurate statement of the results patients generally achieve. If you do not track typical outcomes for that service, you do not have the information needed to publish an exceptional result responsibly.


Sources, and how much weight each one carries

  1. Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR Part 255 (sections 255.1, 255.2 and 255.5, revised 2023), via the Electronic Code of Federal Regulations.
    Federal regulation text (FTC guides). Primary source.
  2. Federal Trade Commission, "FTC’s Endorsement Guides: What People Are Asking".
    Official regulatory guidance in question-and-answer form.
  3. Federal Trade Commission press release, "Federal Trade Commission Announces Updated Advertising Guides to Combat Deceptive Reviews and Endorsements", June 2023.
    Official agency announcement.
  4. HIPAA Privacy Rule, 45 CFR 164.508(a)(3), "Authorization required: Marketing", via the Electronic Code of Federal Regulations.
    Federal regulation text. Primary source.
  5. Federal Trade Commission, "Health Products Compliance Guidance".
    Official regulatory guidance.

This article is about marketing, website and compliance practice. It is not medical or legal advice, and nothing in it is intended to diagnose, treat, cure or prevent any disease. For a decision about your own practice, speak with a qualified attorney or the relevant regulator.

Is your social proof working for you, or against you?

The free check reviews the testimonials, ratings and badges on your site and flags what needs a disclosure or a rewrite.

Run the free check

Free check · findings by email within one working day

What does AI say about your practice?

  1. 1 Tell me what a patient would search for, and where.
  2. 2 An AI assistant searches the live web and answers, as a patient would see it.
  3. 3 I read the result and email you the findings, with what they mean.

The search it will run

Your name, email and practice go to the studio so the findings can be sent. Nothing else, never sold, never used for advertising. How data is handled.

This is one question. The full check asks a fixed list of 25, across four assistants, and records every answer word for word. We go through it on the call.

More insights