Can Therapists Use Client Testimonials? FTC and HIPAA Rules Explained

Client testimonials are one of the strongest trust signals in behavioral health marketing, and also one of the easiest ways to create real compliance exposure. Here's what actually governs whether and how a therapy practice can use them.

The short answer

Yes, with real limits. A testimonial from an actual client can be used in marketing if the client has given informed, specific consent for that use, the practice avoids clinical or outcome claims the testimonial can't support, and the practice discloses any material connection (like a discount or gift given in exchange for the review) per FTC rules. Skipping any one of those three pieces is where practices get into trouble.

Consent has to be specific, not implied

A general treatment consent form signed at intake is not the same as marketing consent. If you want to use a client's words, story, or likeness in an ad, on your website, or in a case study, you need a separate, specific release that names exactly how the testimonial will be used. That release should be kept on file for as long as the testimonial is in use, not filed away and forgotten.

For behavioral health specifically, there's an added layer: publishing a testimonial can itself disclose that someone was a client, which touches HIPAA even if the testimonial doesn't mention a diagnosis. The release should explicitly acknowledge that the client understands their relationship with the practice will be identifiable.

What the FTC actually restricts

The Federal Trade Commission's endorsement guidelines apply to testimonials regardless of medical vertical. The core rules that matter most for behavioral health testimonials:

• A testimonial has to reflect a typical result, or the ad has to clearly disclose what a typical result looks like if the testimonial describes an atypical one
• Any material connection between the practice and the person giving the testimonial (compensation, discounted care, a gift) must be clearly disclosed
• A testimonial can't be used to imply a guaranteed outcome that isn't accurate for most clients

This means a testimonial like "After eight sessions, my anxiety was completely gone" is risky even with consent, because it implies a specific, guaranteed timeline and outcome most clients won't experience. A testimonial focused on the experience of care, such as feeling heard or finding the right fit, carries much less regulatory risk than one focused on a specific clinical result.

A safer alternative: composite or anonymized language

Some practices choose not to use named, identifiable testimonials at all, and instead describe general client experiences in aggregate, non-identifying language, such as "clients often tell us they felt truly listened to for the first time." This avoids the consent and HIPAA-disclosure questions entirely, though it's a different, and generally weaker, trust signal than a real named testimonial.

What we recommend before any testimonial goes live

1. Get a specific, signed release naming exactly how the testimonial will be used and for how long
2. Review the testimonial's language for outcome or guarantee claims and soften anything that overstates a typical result
3. Disclose any compensation or discount given in exchange for the testimonial, in the ad itself
4. Keep the signed release on file for as long as the testimonial is published, and pull it down if the release expires or the client withdraws consent

Tridigiam is a marketing agency, not a law firm. We flag testimonial content that looks risky and won't publish one without a documented release, but the final compliance call on a specific testimonial, especially anything that touches clinical claims, should involve your own legal counsel or compliance officer.

For the wider picture on behavioral health marketing compliance, see our Behavioral Health Marketing: The Complete Guide.

Frequently asked questions

Can we use a testimonial without the client's name?

Using an anonymized quote still generally requires the same specific marketing consent as a named testimonial, since the client may still be identifiable to people who know them, especially in a smaller local market.

What if a former client posts a positive review on Google without being asked?

Unsolicited reviews on third-party platforms are treated differently than testimonials a practice actively solicits and republishes on its own site or ads. Responding to those reviews still requires care not to confirm or deny that the reviewer was a client.

Do these rules apply to video testimonials too?

Yes. Video and photo testimonials carry the same consent and FTC disclosure requirements as written ones, and add an identifiability question that written testimonials sometimes don't, since a face and voice are harder to anonymize.