Social Media Policy Checklist for Dental Clinics Serving Patients With Disabilities

A clear social media policy helps your dental clinic protect patient privacy, communicate accessibly, and respect each patient’s choices. Use this checklist to guide staff before creating, approving, or responding to social media content.

Obtain Written Patient Authorization

Before posting a patient’s identifiable photo, video, name, voice, treatment details, or other protected health information, verify that your clinic has a valid written authorization when required. A patient’s presence in the clinic or verbal agreement to be photographed does not, by itself, authorize a public social media post.

Your HIPAA authorization for social media should clearly describe what information may be shared, who may disclose it, where it may be posted, the purpose, and when the authorization expires. Include how the patient can revoke authorization. Keep the signed document in the appropriate record and ensure the post stays within the permission granted.

• Use a separate, optional authorization for promotional posts rather than bundling it with routine treatment paperwork.
• Do not make treatment or access to care depend on a patient agreeing to appear in social media content.
• Check the background for other patients, voices, names on screens, appointment boards, or records that could cause an unintended protected health information disclosure.
• Document the authorization and confirm it remains valid before publishing or reusing content.

Create Accessible Social Media Content

Make your posts usable by people with different disabilities. Accessible digital communications help patients find practical information about your clinic, understand what to expect, and contact your team using the communication method that works for them.

• Add accurate alt text to meaningful images when the platform provides that option.
• Caption videos, including relevant spoken information and sounds; do not rely on audio alone.
• Use plain language, readable text, descriptive headings where supported, and sufficient contrast in images or graphics.
• Avoid flashing effects and do not place essential information only in an image or video.
• Use accessible platform features and consider WCAG accessibility guidelines as a practical reference for digital content.

When sharing information about appointments or services, explain how patients can request communication assistance or discuss access needs. Do not ask people to disclose private medical details in public comments.

Assign Staff Roles and Approval Authority

Define who may draft, review, approve, and publish posts on behalf of the practice. Staff social media governance makes responsibilities clear and reduces the chance that an unreviewed post will expose patient information or make an inaccurate claim.

• Name an account owner and designate trained backups.
• Require privacy review for content that includes patient stories, images, testimonials, or treatment information.
• Set up a consistent approval process for routine posts and a higher level of review for sensitive content.
• Limit account access to authorized staff, use appropriate security controls, and remove access promptly when roles change.
• Tell staff how to report a suspected privacy incident or incorrect post and who can remove or correct content.

Apply Confidentiality and Professional Conduct Rules

Make clear that patient confidentiality applies on every platform and from every device. Staff should not post or discuss patient information in personal accounts, private groups, direct messages, or comments unless the disclosure is properly authorized or otherwise permitted.

Do not confirm that someone is a patient or discuss their care when responding to a review or public question. Use a neutral response that invites the person to contact the clinic through an appropriate private channel. Keep replies professional, avoid arguments, and do not share screenshots or behind-the-scenes material that could identify a patient.

Explain that removing a post later may not undo a disclosure: others may have copied, saved, or shared it. When a possible disclosure occurs, staff should follow the clinic’s incident-reporting procedures rather than trying to investigate or resolve it publicly.

Respect Patient Communication and Decision-Making

Do not assume that a disability means a patient cannot make decisions or provide authorization. Communicate directly with the patient, use their preferred communication method when possible, and provide reasonable time and support for them to understand the request and respond.

If someone else offers to sign, verify whether they are a legally authorized representative and whether their authority covers the specific decision. A family relationship or caregiver role alone does not necessarily establish authority. The scope of a representative’s authority can depend on applicable law and the relevant legal documents.

Even when a representative has authority, include the patient in the decision to the extent possible, attend to their expressed preferences, and pause if there is uncertainty or disagreement. Check with the clinic’s privacy lead before proceeding.

Train Staff on Privacy Procedures

Train employees, contractors, and anyone with access to the practice’s accounts before they post or respond. Provide refreshers when procedures, staff responsibilities, or platform features change.

• Teach staff how to recognize identifying details in photos, videos, captions, comments, and background material.
• Practice routing patient questions and complaints to private, appropriate channels without confirming treatment or patient status.
• Explain how to check authorization, verify representative authority, and request privacy review.
• Show staff how to use captions, alt text, and other available accessibility features.
• Review the process for reporting, documenting, and escalating possible privacy incidents.

In summary, a reliable policy combines documented authorization, accessible content, clear approval roles, confidentiality safeguards, respect for patient decision-making, and ongoing staff training.

FAQs

Do dental clinics need written consent before posting identifiable patient information?

When a HIPAA-covered clinic plans to use or disclose identifiable protected health information for a social media post and no exception applies, it generally needs a valid written HIPAA authorization. Ordinary verbal agreement or a general consent to treatment may not meet that requirement. Have your privacy lead review the specific post and authorization.

Can a guardian authorize social media posts for a patient with a disability?

Possibly, if the person is legally authorized to act for the patient and the relevant authority covers the disclosure. A caregiver or family member is not automatically authorized just because they assist the patient. Verify the person’s authority under applicable law, and involve the patient in the decision as much as possible.

How can dental clinics make social media content accessible?

Add useful alt text to images when available, caption videos, use plain language and readable text, and avoid conveying essential information only through sound or images. Use the accessibility features offered by each platform and consider WCAG accessibility guidelines when planning digital communications.

Who should approve posts made on behalf of a dental practice?

The practice should designate an account owner and trained approvers. Posts involving patient information, images, testimonials, or treatment details should receive privacy review before publication, while routine posts should follow a defined approval process.