How should before and after photos be handled on a practice site?

Before and after photos should be handled as patient information with a marketing purpose. Publish a pair only under a signed authorization that names that use, capture it under one consistent protocol, remove identifying details the authorization does not cover, and caption it with the context a reader needs. Keep the form, the original files, and every published copy linked in one log, so a patient who withdraws permission can be honored quickly.

Galleries are often built from whatever is on the clinic camera or a provider's phone. Months later, nobody can say which patient signed what, whether the form covered social media, or where else the image was posted. The photo is still live, and the paperwork is a guess.

This is a content-operations question for practice owners and marketing leads. It is not legal advice; bring specific cases to your privacy officer or counsel, and check your state's rules for your profession. How a gallery reads as a claim about results is covered in our pages on cosmetic dental content and med spa treatment content. This page covers the handling.

Match the authorization to every use

A patient who agrees to a photo on the practice website has not necessarily agreed to a paid social ad, a printed brochure, or a slide at a conference. Under 45 CFR 164.508, a valid HIPAA authorization includes "A description of each purpose of the requested use or disclosure" and "An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure." Your privacy officer owns the form. Marketing owns the habit of checking each planned use against what the form actually says.

Build the check into the publishing routine. Before any image goes live on a new channel, someone confirms the form covers that channel and has not expired. A simple audit question for the marketing lead: "Which of our published photos could we match to a signed form in under five minutes?" If the answer is not all of them, the unmatched images come down until the paperwork is found.

Cropping does not make a photo anonymous

It is tempting to crop out the eyes and assume the image is now safe to use freely. HHS guidance on de-identification lists, among the identifiers removed under its Safe Harbor method, "Full-face photographs and any comparable images" and "Any other unique identifying number, characteristic, or code." A cropped photo is not a de-identified photo. A tattoo, a birthmark, distinctive jewelry, or a recognizable room in the background can still point to one person.

Dates are part of this too. The same Safe Harbor list includes "All elements of dates (except year) for dates that are directly related to an individual." Image files may carry capture dates in their embedded data, and captions often add a treatment date for context. Whether a given image counts as de-identified is a question for your privacy officer; the practical habit is to assume it is identifiable, publish it only under authorization, and strip what the authorization does not cover.

Capture every pair under one protocol

A fair comparison needs the same conditions on both sides. Write a short capture protocol and keep it in the room where photos are taken: the same background, lighting, camera distance, and angle; the patient's position; and no makeup or styling differences unless the protocol records them. Record the interval between the two images and the treatments performed in between.

Decide in writing which edits are allowed. Cropping and exposure correction to match the two frames may be acceptable; any change to the treated area is not. Keep the unedited originals in the practice's secure system, never in a shared marketing drive or a personal phone, and name files by an image ID rather than the patient's name.

Publish with words, not just pixels

An image without text tells a reader very little about what they are looking at. Google's image documentation calls alt text "the most important attribute when it comes to providing more metadata for an image," and says "Google extracts information about the subject matter of the image from the content of the page." The same page says a filename "can give Google very light clues about the subject matter of the image."

For a practice, that means each pair gets a caption with the treatment, the interval between images, and who performed it; alt text that describes the image for someone using a screen reader; and a filename that names the procedure, not the person. None of that text should identify the patient. A caption that says what was done and when gives a reader the context a bare image never carries, and it keeps the claim the image makes within what the practice can explain. Our article on proof that helps buyers choose covers how evidence and copy should fit together.

When a patient withdraws permission

Authorizations can be withdrawn. The same regulation says an individual "may revoke an authorization provided under this section at any time, provided that the revocation is in writing," except to the extent that "The covered entity has taken action in reliance thereon." What reliance covers in a given case, such as a printed brochure already distributed, is a question for counsel. What the practice can control is how fast it finds every copy.

Here is a hypothetical removal log from a fictional plastic surgery practice in Nevada. It shows the record, not any real practice's patients.

With a log like this, a written withdrawal turns into a checklist instead of a search. The person handling it should not have to invent where an image might be; the log already says, because each placement was recorded on the day it went live.

In Hudson South's process, the Authority Asset gathers the practice's approved knowledge and evidence, including which images are authorized and for what. Hudson Twenty-One records how the practice communicates across 21 dimensions, Market Intelligence researches the questions patients ask and the market around the practice, and AEO Creation turns those inputs into answer-first content. See our overview of content for medical, dental and wellness practices for the rest of the pages.

Check how your gallery compares

On a free 30-minute call, Hudson South walks you through how your proof pages compare with the practices patients look at next.

Sources

1. 45 CFR 164.508: Uses and disclosures for which an authorization is required. Electronic Code of Federal Regulations. Read 2026-10-16.
2. Methods for De-identification of PHI. U.S. Department of Health and Human Services. Read 2026-10-16.
3. Image SEO Best Practices. Google Search Central. Read 2026-10-16.