Testimonial release form template for healthcare practices

A testimonial release form is a legal document that authorizes a healthcare practice to use a patient’s name, likeness, and treatment experience in marketing.

Get it signed before you publish any patient testimonial, whether it goes on your website, your social feeds, or printed material. A valid form names the content it covers and the channels you may publish in. It also sets how long consent lasts and how the patient withdraws it.

This guide covers the HIPAA and FTC rules behind the form, plus the five elements a valid one has to carry. It also shows where signature collection belongs in your patient workflow. Practice management software like Pabau collects the signature through its digital intake forms. The signed release then sits in the patient record, next to the treatment history it refers to.

Key takeaways

A testimonial release form is a signed agreement letting a practice use a patient’s name and treatment story in marketing.

HIPAA, the FTC endorsement rules, and state privacy laws all require written authorization before a testimonial is published.

A valid form names the content covered, the permitted channels, the duration, and the patient’s route to withdrawing consent.

Collect photo permission separately from written permission, so a patient can approve one and decline the other.

File the signed release on the patient record, so you can check the scope before publishing and act fast on a withdrawal.

What is a testimonial release form?

A testimonial release form is a written agreement between your practice and a patient. It grants permission to use their name, likeness, and treatment experience in marketing. The patient consents to publishing their opinion and their visible results, never their clinical details.

In healthcare the form does three jobs at once. It records the patient’s authorization under HIPAA, it secures your right to publish the testimonial, and it fixes the scope of that use. Scope means the specific channels: your website only, or social media and print as well.

Publish a patient’s name and testimonial without a signed release and you carry two exposures. The patient can claim compensation for unauthorized use of their likeness, and a regulator can treat the disclosure as a HIPAA violation. Both start with a complaint you then have to answer in writing.

Why practices need written consent before publishing

Three regulatory frameworks require written consent before a patient testimonial goes out:

• HIPAA Privacy Rule (45 CFR 164.508): Written authorization is required before patient information is used in marketing, a generalized testimonial included. The release form is what documents that authorization.
• FTC Endorsement Guides (16 CFR Part 255): Any material connection behind an endorsement has to be disclosed, and a patient relationship counts as one. A signed release evidences valid consent and supports your disclosure wording.
• State privacy laws (California CCPA, New York, and others): Several states require opt-in consent before personal information is used in marketing. Practices in the UK and the EU face equivalent rules under GDPR.

Regulation is not the only reason to bother. Complaints usually start with something small, like a patient’s first name published without consent, or treatment details attached to a quote. Tracking which patient authorized which use is one of the jobs HIPAA compliance software does. A signed release is then the record an auditor asks for first.

What a valid release form must contain

Five elements make a testimonial release enforceable, and the downloadable template already carries all five.

• Patient identification: Full name, date of birth, and signature. This ties the consent to the right individual. It also confirms the patient is 18 or older, or that a parent or guardian is signing for a minor.
• Scope of the testimonial: Name exactly what is covered. Written testimonial only, photo and written testimonial, video testimonial, or before-and-after photos with a written review. A blanket “any content” clause is ambiguous and may not hold up.
• Permitted channels of use: Name the platforms and media you may publish in. Website homepage, Facebook, Instagram, TikTok, email campaigns, print brochures. A patient cannot object to a use they explicitly approved.
• Duration and revocation: State how long consent runs, either permanently or for a fixed term such as 12 months from signature. Add a withdrawal clause naming the practice email address. Treat a withdrawal as effective within 30 days and pull the content inside that window.
• Signature and date: Take the patient’s handwritten or electronic signature and the date. An e-signature platform is fine where the vendor has signed a business associate agreement. Without a signature the form is unenforceable.

Read the five as one permission that narrows at every step, from who is consenting down to what you may actually publish.

Present the form as a standard step rather than a special request. Explain each section in plain language, take the signature, and file the signed copy in the patient record. Keep clinical detail out of the testimonial itself, so no diagnosis, no treatment specifics, and no medication names.

Testimonial and photo release: When you need both

Collecting a written testimonial and a photograph means collecting two consents. Permission to publish a written statement does not extend to a person’s image, and permission for an image does not cover their words. A patient may be happy with a written review on your website and still refuse to appear in a photo.

A combined form handles both in one document, as long as it keeps them separate:

• “I consent to publication of my written testimonial.” [Checkbox]
• “I consent to publication of my photographs alongside my testimonial.” [Checkbox]
• “I consent to use of my before-and-after images on social media.” [Checkbox]

Separate checkboxes give the patient granular control, so they can approve the text and decline the photo. That matters in aesthetics and med spa work, where some patients want their results shown and others want anonymity. Honoring the difference also gives your front desk something concrete to say when a patient hesitates.

HIPAA considerations for patient testimonials

The HIPAA Privacy Rule (45 CFR 164.508) separates using patient information for treatment from using it for marketing. A testimonial is marketing, so it needs written authorization of its own. The routine treatment consent the patient already signed does not cover it.

The rule also limits what a signed release can cover. Your form should state plainly that protected health information stays out of the testimonial unless a separate, specific HIPAA authorization covers it. That means diagnoses, medication names, treatment dates, and clinical measurements. Compliance management software records who authorized testimonial use and what scope they agreed to, which is what stops a publication going past the consent.

Two examples make the boundary concrete. A compliant testimonial reads: “I struggled with acne for years. After treatment my skin is clearer and I feel confident again.” A non-compliant one reads: “I was diagnosed with rosacea in 2024 and prescribed doxycycline before switching to IPL therapy here.” The second names a diagnosis and a medication, so it needs a specific HIPAA release before it goes anywhere.

FTC endorsement guidelines and testimonials

The Federal Trade Commission’s endorsement and testimonial guides apply to healthcare advertising. Two rules do most of the work:

• Material connections have to be disclosed. A testimonial from someone who paid you for treatment carries a material connection, and the endorsement has to make that clear. Wording such as “as a patient of [Practice Name], I received treatment for…” does the job.
• Endorsements have to reflect typical results. A single exceptional outcome presented as the norm misleads readers. Frame it honestly instead, as in “one patient reported…” rather than wording that implies every patient gets that result.

Put both disclosures in the form itself. One line has the patient acknowledge they are a patient of the practice. A second has them confirm the testimonial will be published as written, and may disclose that relationship. Your FTC position is then documented at the point of signature rather than argued afterward.

Where signature collection fits in your patient workflow

Collection rates depend almost entirely on timing. These five steps are the sequence that works:

1. Timing: Hand the form over straight after treatment, while the patient is still pleased with the result. Approval rates fall sharply once a few weeks pass.
2. Presentation: Explain it in plain language. Try “we would love to share your experience with people considering this treatment.” Then add that the form records their permission and sets out how you would use it.
3. Collection: Take a physical or electronic signature, then file the signed copy in the patient record. Digital forms remove both the paper handling and the scanning step.
4. Storage: Keep signed releases encrypted, either in your practice management system’s document store or in HIPAA-compliant cloud storage. Never on an unencrypted drive or in a shared folder.
5. Audit: Check the release before you publish. Confirm the spelling of the name, that the channel you plan to use is listed, and that consent has not been withdrawn.

The downloadable template is yours to adapt. Change the practice name and contact email, then edit the permitted-channels list so it matches the places you actually publish.

Record consent status against the patient rather than in a spreadsheet. A flag reading “testimonial approved: website, social; expires 2027-09-24” is enough. That one field prevents accidental breaches and answers an auditor’s question in seconds.

Storing and managing signed release forms

A signed release is a legal record and has to survive as one. How you store it protects the patient’s privacy and your own defense at the same time.

• Retention period: Keep signed releases for the length of the consent plus three to five years. That matches the usual statute of limitations on contract disputes. Keep a withdrawal notice alongside the original release for three years.
• Encryption: Store digital copies encrypted, at AES-256 or equivalent. Physical copies belong in a locked cabinet with restricted access.
• Access control: Limit access to managers and marketing staff. Never hand releases to an outside marketing agency without a business associate agreement that binds them to HIPAA.
• Revocation handling: On a withdrawal request, pull every published testimonial and image. Ask third-party sites and social platforms to delete their copies. Then flag the patient record and file the withdrawal with the original release.

Practices that keep consent records inside the practice management system avoid the scramble through email approvals and loose paper. It also means the answer to “may we publish this one?” sits one click from the patient’s file.

How Pabau keeps consent, notes, and marketing in one record

Most practices run consent on two systems that never meet. The signed release sits in a shared drive or a filing cabinet, and the marketing calendar sits somewhere else. Checking a scope before a post means asking someone to go and look it up.

In Pabau the release is a form on the patient’s own record. The patient signs it on a tablet at the front desk, or from a link before they arrive. The signed copy then files itself against their record. Marketing staff can read the scope without opening a drive.

The same record holds the clinical notes the testimonial refers to. Pabau Scribe, our AI medical scribe, writes the treatment note straight into it, so the note, the photos, and the signed release stay together. When a patient withdraws consent, you can list every asset tied to them instead of guessing.

See how Pabau keeps testimonial consent auditable

Pabau collects the signed release on the patient’s record and keeps its scope visible to your marketing team. Every published testimonial traces back to the consent that allows it.

Book a demo

Conclusion

The form is the cheap part. What decides whether your testimonial program holds up is something else. It is whether anyone can find the signed release six months later, when a patient asks you to take a photo down.

So adapt the template once, then settle where the signed copies live before you collect the first one. A practice that files consent against the patient can publish quickly, because checking the scope costs nothing. A practice that files it in a drive ends up publishing cautiously, or publishing and hoping.

Book a demo to see how Pabau collects, stores, and audits patient consent alongside the treatment records it refers to.

Continue your research

Publishing testimonials on Instagram or Facebook? HIPAA and social media sets out what a practice can and cannot post about a patient.

Need to release records rather than a quote? The HIPAA medical release form covers disclosure of protected health information to a named third party.

Unsure how long to keep a signed release? How long to keep medical records explains the retention periods that apply to patient documentation.

Writing the privacy notice that sits behind it? The notice of privacy practices template tells patients how their information is used and shared.

Frequently asked questions