The Goal: A Before-and-After Library You Can Actually Run Ads With
Here’s what you’re after. A set of before-and-after photos your practice can post on Instagram, put on your website, and run in paid campaigns without a takedown notice, a board complaint, or a patient calling to say they never agreed to be on a billboard in their own zip code.
That’s achievable. It takes a documented consent process, a shooting standard your staff follows every time, disclaimer language your own counsel signed off on, and a channel-by-channel plan that respects the fact that Meta and Google do not want your surgical photos in their ad units.
Before and after photo marketing compliance for plastic surgeons means getting four things right at once: a written photo release separate from the surgical consent, HIPAA-compliant handling of images (which are protected health information the moment they’re tied to a patient), advertising language that meets your state medical board’s rules on results claims and disclaimers, and ad platform policies that restrict how surgical imagery can be displayed. Miss any one and the photo becomes a liability instead of an asset.
One caveat before we go further, and it’s a real one, not a throat-clear. We’re a patient acquisition agency. We are not your lawyer. State medical board advertising rules vary enormously, and the FTC’s endorsement and testimonial guidance has teeth. Everything below is the operational side: how to build the process. Run the final language past your own healthcare attorney and check your state board’s advertising regulations before anything goes live.
Step 1: Build a Photo Release That Is Separate From Surgical Consent
The single most common mistake we see: the practice buries a photo clause in the pre-op consent packet, the patient signs 14 pages at once, and three years later nobody can prove what she actually agreed to.
Separate document. Separate signature. Separate date. That’s the standard.
A photo release worth relying on spells out the specific uses, not “marketing purposes.” List them out: practice website, practice social media accounts, paid advertising on Meta and Google, printed materials in the office, third-party review sites, conference presentations, medical education. Let the patient initial each one. Some patients will say yes to your website and no to Instagram, and that’s fine. What you need is a record of exactly which yes you got.
The release should also cover:
- Scope of the image. Face included or cropped? Identifying tattoos, scars, jewelry visible? Patients care about this more than practices expect.
- Duration and revocation. How long the permission runs, and the process for the patient to withdraw it. Give them a real path to revoke, in writing, to a named person at the practice.
- No compensation language. If you gave a discount or free treatment in exchange for photos, that’s a material connection under FTC endorsement rules and it changes what you have to disclose. Document it either way.
- Acknowledgment that once posted publicly, images may be copied. You cannot un-ring the internet bell, and the patient should know that going in.
What can go wrong here
Verbal permission. It happens constantly. A patient is thrilled with her result, says “post it, I don’t care,” the front desk snaps a photo on a personal phone, and it goes up. No signature, no scope, and the image lived on an unencrypted personal device on the way there. When the patient’s ex-husband recognizes her in an ad six months later, the practice has nothing to stand on.
The fix is boring and it works: no image enters the marketing library without a signed release attached to it in the same system. Make it a hard gate.
Step 2: Treat Every Image as PHI Until It Is Cleared for Release
A photo of a patient, taken in a clinical setting, connected to their chart, is protected health information. It does not become marketing material because someone dragged it into a folder called “Marketing.”
Practically, this means your storage and transfer chain has to hold up. That looks like:
- Photos captured on a practice-owned device, not a staff member’s personal phone, and not synced to a personal iCloud account.
- Images stored in an encrypted, access-controlled system. If you’re using a cloud tool, you need a business associate agreement with that vendor.
- No patient images sent over regular text or personal email, including to your marketing agency. If your agency accepts patient photos in a Gmail thread, that’s a signal about how they handle everything else.
- A clear internal handoff: cleared images move to a separate marketing library, stripped of chart identifiers, with the release document referenced by ID.
We work with practices on the acquisition side, and the BAA question comes up early for exactly this reason. Any vendor touching identifiable patient content needs one. If a prospective agency looks confused when you ask, keep looking.
The metadata problem nobody thinks about
Photo files carry EXIF data. Device ID, timestamp, sometimes GPS coordinates. If a clinical photo is geotagged at your practice address that’s not a disaster, but if a patient sent you a photo from home and you posted it with location data intact, you have published where a specific person lives alongside their surgical result. Strip metadata before publishing. Most image editing software does it on export; make it a checklist item so it’s never a judgment call.
Step 3: Standardize How the Photos Are Shot
This step is where compliance and marketing effectiveness collide in your favor. Consistent photography protects you legally and converts better. Same win, two reasons.
Inconsistent before-and-afters read as manipulated even when they aren’t. Different lighting, different distance, different pose, better makeup in the after, a flattering angle that wasn’t there in the before. Regulators and state boards care about this because it edges into deceptive advertising. Prospective patients care because they can tell, and it costs you trust.
Set a shooting standard and enforce it:
| Variable | Standard to lock | Why it matters |
|---|---|---|
| Lighting | Same fixture, same position, no flash variation | Lighting change alone can fake a result |
| Background | Single solid color, same wall every time | Removes visual noise and distraction |
| Distance and lens | Marked floor position, fixed focal length | Focal length changes facial proportions |
| Pose and angle | Documented set (front, 45, profile), repeated exactly | Angle shifts are the most common accidental distortion |
| Makeup and jewelry | Removed for both shots | Makeup in the after photo is an implied claim you can’t back |
| Clothing | Same garment or standard drape | Compression garments change body contour |
| Timing post-op | Recorded and disclosed | A 3-month result and a 12-month result are different claims |
On editing: color correction and cropping are normal. Smoothing skin, slimming, removing a blemish, or brightening only the after image is not. The rule I’d hold to is simple. If an edit changes what a reasonable person would understand about the outcome, don’t make it.
Step 4: Write Disclaimers That Say Something True
“Results may vary” in 8-point gray type at the bottom of a page is not a disclaimer. It’s decoration.
Many state medical boards have specific requirements about how results are represented in advertising, and some address before-and-after imagery directly. Requirements differ by state, so this is a place to get your own guidance rather than copy what the practice down the street does. What generally holds up better than boilerplate is specificity attached to the image itself:
- Time elapsed since the procedure (“Photos taken 6 months post-op”).
- Whether the images are of an actual patient of the practice and, when applicable, which surgeon performed the procedure.
- A statement that individual results vary and that the images are not a guarantee or prediction of outcome.
- Disclosure if the patient received any compensation, discount, or free service in connection with the photos. FTC endorsement guidance treats that as a material connection that has to be disclosed clearly, not in a footnote.
- Whether any combination of procedures was performed, if the visible result came from more than one.
That last one gets practices in trouble more than they realize. If the dramatic abdominal result involved surgery plus a separate treatment plan, attributing it entirely to one procedure is a misleading claim, even if nobody meant it that way.
What can go wrong here
Stock before-and-afters supplied by a device manufacturer, run in an ad that implies they came from your practice. It’s common, it’s an easy oversight, and it’s exactly the kind of thing that generates board complaints. If the photos aren’t yours, either say so plainly or don’t run them.
Step 5: Match the Photo to the Channel’s Actual Rules
Platform policy is separate from legal compliance, and it’s the piece that quietly kills campaigns. You can have flawless consent and still get an account restricted.
Meta’s advertising policies restrict content depicting surgical or cosmetic procedures, unexpected or shocking imagery, and ads that focus on an individual’s body or imply a negative self-perception. Before-and-after images in ads have been a restricted category on Meta for years. Google Ads has its own rules around healthcare and personalized advertising. Both platforms update policy regularly, so verify current policy in the ad platform’s own help center before you build a campaign around imagery.
What that means in practice: your best photos usually belong on property you control.
| Channel | Before-and-after usage | Practical approach |
|---|---|---|
| Practice website gallery | Most permissive; you control the page | Build the deep gallery here, organized by procedure, with per-image disclaimers |
| Google Business Profile | Photos allowed, but avoid graphic clinical content | Use facility, team, and consultation imagery; link the gallery from your site |
| Organic social | Generally allowed, subject to community standards; enforcement is inconsistent | Post conservatively, expect occasional removals, never rely on it as the only home |
| Paid social ads | Restricted category, high rejection risk | Run lifestyle, consultation, or educational creative; drive clicks to the on-site gallery |
| Paid search | Text-driven, low imagery risk | Capture procedure-intent searches, land them on the gallery page |
| Email to opted-in list | Permissive, but the release must cover it | Strong performer for existing patients considering a second procedure |
This is why I push practices toward the same architecture almost every time: the website gallery is the asset, and every channel’s job is to get qualified people to it. Your ads carry the message. The gallery carries the proof. That structure survives a platform policy change, which a strategy built entirely on Instagram does not.
Step 6: Set Up a Review Gate Before Anything Publishes
Every practice needs one named person who signs off before an image goes live. Not a committee. One person, with a checklist.
The checklist is short:
- Signed release on file, and this specific use is one the patient initialed.
- Release has not been revoked (check the revocation log, and keep one).
- Metadata stripped, chart identifiers removed from the file name.
- Photo pair meets the shooting standard, no editing beyond color and crop.
- Post-op timeframe recorded and shown.
- Required disclaimer attached to the image, not just to the page footer.
- Any compensation to the patient disclosed.
- Channel policy checked for this specific placement.
Then keep an audit trail: which image, which release, which channel, who approved, what date. If a complaint ever lands, the difference between a stressful afternoon and a genuine problem is whether you can produce that record in five minutes.
Handle revocations like they’re urgent, because they are
A patient who asks you to take her photos down should see them gone within days, not “whenever the web person gets to it.” Build the removal path in advance: website gallery, social posts, paid ad libraries, printed materials, any third-party sites you’ve syndicated to. Knowing where every image lives is the whole job, and it’s why a central marketing library beats photos scattered across three staff phones and a shared drive.
What to Do After the Process Is Running
Once the gate is in place and staff aren’t fighting it, the interesting work starts: making the gallery actually pull patients in.
Organize by procedure, not by date. Someone researching rhinoplasty does not want to scroll past body contouring. Give each procedure its own gallery page with real copy on it, since those pages can rank for procedure-plus-city searches and they’re where paid traffic should land. Add case detail where you can do it without identifying anyone: general age range, procedure performed, time elapsed. Depth of detail is what separates a gallery that builds confidence from one that looks like a screensaver.
Track it. Time on gallery pages, gallery-to-consult-request rate, which procedures get the most views. Say you’re a 4-surgeon practice in a competitive metro and your gallery is the second-most-visited section of your site but almost nobody requests a consult from it. That’s a conversion problem, not a photo problem, and it’s fixable with a booking path on the page itself.
Then re-audit twice a year. Releases expire. Patients move on. Platform policies change without much warning. A gallery that was compliant in 2024 may include images whose permissions have quietly lapsed.
We’ve written separately about plastic surgery marketing strategy more broadly, but the short version is that before-and-after photos are the highest-trust asset a surgical practice owns, and most practices either underuse them out of fear or overuse them without a process. Neither is necessary.
Get a Second Set of Eyes on Your Gallery and Your Funnel
If your before-and-after photos are sitting in a folder because nobody’s sure what’s allowed, or they’re live and you’re not entirely sure what’s backing them up, that’s worth an hour.
Book a free strategy call and we’ll walk your current gallery, your consent workflow, and where consult requests are leaking out of your funnel. No obligation, no sales pressure, and we’ll tell you plainly if your setup is already solid. (Bring your attorney into the compliance-language conversation. We’ll handle the part where the photos actually bring patients in.)