Dermatology marketing: more patients without HIPAA trouble

Most lists of dermatology marketing ideas skip those rules. We didn't want to guess what real practices do. So on October 22, 2026, we opened the public Meta Ad Library and searched US ads for the word "dermatology." Of the first 27 ads it loaded, only 4 came from US dermatology practices.

This guide is for owners and managers of small US practices, medical, cosmetic or both. It covers what to set up first, what you may post and what gets practices fined.

Key facts on HIPAA-compliant marketing

• October 21, 2024: the FTC reviews rule took effect.
• June 20, 2024: a court vacated part of the HHS tracking guidance.
• 2019 to 2023: HHS acted against 4 practices over review replies, up to a $50,000 penalty.
• $15 per item, $75 per patient per year: the OIG gift limit for Medicare and Medicaid patients.
• 18 or older: the age Meta requires for cosmetic procedure ads.

What is dermatology marketing, and why split medical from cosmetic?

Dermatology marketing is every way a practice gets new patients and brings old ones back: search, maps, reviews, ads, email and referrals. Many practices run two businesses, so they need two plans. The tools match other local businesses, but patient privacy rules shape every step.

Our take: if you take insurance, fix the medical side first, because those patients already search with a clear need. Add cosmetic ads once your site and reviews are in order.

How should you set up Google Business Profiles for a practice?

Google treats doctors as "individual practitioners." Its Business Profile guidelines say a dermatologist who sees patients at a location can have their own profile. The practice gets a separate one for the location. A solo doctor at a branded practice shares one profile, named "Practice: Doctor."

• Name the practice profile exactly as on your sign and website. "Best Dermatologist Austin" breaks Google's naming rule.
• Name each doctor's profile with the doctor's name only, such as "Dr. Ana Reyes, MD." Leave the practice name out.
• One profile per doctor. Google says a practitioner "shouldn't have multiple Business Profiles" for each specialty.
• Add hours, a booking link and real photos of the office and team. Leave patient photos off.

How does Google rank practices in the map results?

Google says local results are "mainly based on relevance, distance, and popularity," per its tips to improve your local ranking. Relevance is how well your profile matches the words a patient types. Distance is how far you are from the searcher.

The third factor, which Google calls prominence, is how well known the practice is. Google says it uses "how many websites link to your business and how many reviews you have." It also says businesses with "complete and accurate info" are more likely to show up.

So fill in every field, and keep the practice name, address and phone the same on your site and every directory. Google adds: "There's no way to request or pay for a better local ranking on Google."

If you're new to maps rankings, our guide to what local SEO is explains how Google picks the 3 practices it shows. Then follow our Business Profile optimization steps one by one. For verification, reviews and suspension appeals, read our pillar guide to running a Business Profile.

What does a dermatology website need?

Your website is where a searcher decides to book. It needs a page for each service and condition, a bio for each provider and online booking that works on a phone. Build those pages before you pay for ads. Every ad click lands on one.

• One page per condition (acne, eczema, psoriasis, skin cancer screening) and per procedure (fillers, laser, chemical peels).
• Provider bios with training and board certification that a patient can check.
• Insurance accepted, written out by plan, on the medical pages.
• A booking button on every page, and a phone number that calls when tapped.

Check the basics first. Run your homepage and one service page through our free website audit tool. Planning a new site instead? Our guide to hiring a web designer for a small business lists the 12 questions to ask first. Fix missing titles, broken links and slow pages before you spend on ads. If you want the full process, our first SEO audit guide walks through it.

SEO for dermatologists: which keywords do patients search?

Google's SEO Starter Guide says to "think about the words that a user might search for." It notes that people new to a topic may use different words than experts do. So build your list from the words patients use, then check how often each one is searched.

• List each service with your city, such as "mole check Tucson" or "acne treatment Tucson."
• Add the plain words patients use at the front desk, such as "skin doctor" next to "dermatologist."
• Check search volume in Google Keyword Planner. Our Keyword Planner guide shows how to read its numbers.
• Give each main phrase one page, so 2 of your pages never compete for the same search.

Then put the phrase in the page title. Google says a good title "is unique to the page, clear and concise, and accurately describes the contents of the page." The same guide warns that keyword stuffing is against its spam policies.

How do you write skin condition pages Google trusts?

Skin conditions are health topics, so Google holds the pages to a higher bar. Its helpful content guidance says its systems give "even more weight" to strong E-E-A-T on topics that affect health. Google calls these "Your Money or Your Life" topics.

• Put a named dermatologist on each page as the author or medical reviewer, with the date reviewed.
• Answer the questions patients ask at the front desk: what it is, what treatment looks like, what insurance covers.
• No cure claims and no promises about results.
• Update pages when guidance or your services change, and change the review date.

Structured data helps Google read who you are. schema.org has a MedicalClinic type for the practice and a Physician type for each doctor. After you add the code, test it with our schema markup validator. Our Rich Results Test guide shows how to read the result.

Is it safe to put ad pixels on your booking page?

Be careful. The HHS bulletin on online tracking warns that tracking tools on a page where people book appointments "may have access to PHI" in some cases. PHI means protected health information. Don't send ad traffic to a booking page until you've reviewed those tools.

The same HHS page notes that a federal court vacated part of the guidance on June 20, 2024. That part covered public pages that only show condition information. The booking-page warning still stands, and HHS says a line in your privacy policy is not enough. It wants a signed business associate agreement (BAA) with each tracking vendor first.

• List every script on your booking and contact forms: Meta Pixel, Google tags, chat widgets.
• Ask each vendor, and your booking or EHR vendor, whether they sign a BAA.
• If they don't, remove ad pixels from booking pages and count bookings another way, such as calls and confirmed visits.

How should a dermatology practice ask for reviews?

Ask every patient, the same way, and give nothing in return. Google's review policy bans incentives "such as payment, discounts, free goods and/or services" for any review. It also bans reviews from staff and others with a conflict of interest.

The FTC Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, is looser. It allows incentives if they don't require a positive or negative review, and the incentive should be disclosed. Follow Google's stricter rule for Google reviews: no gifts at all.

Make asking easy. Our free Google review link generator turns your profile into a short link and QR code for a front desk card or a follow-up text. Ask everyone, not only happy patients. For the timing and wording, see our guide to automating customer reviews.

How do you write HIPAA-compliant Google review responses?

Thank people, never confirm they are patients and take details offline. Google says the reviewer is notified when you reply, and the reply is public. Anything you write about a visit is public as soon as it posts. That's the safe default: a short thank-you and a phone number.

HHS has settled 3 cases over replies to online reviews. These are the amounts on its resolution agreement pages:

Read the cases on the HHS pages for Elite Dental, New Vision Dental and Manasa Health Center. The New Vision agreement says its replies included "detailed information about patient visits and insurance" in some cases. Keep in mind that these are settlement amounts from 2019 to 2023, not fixed fines. HHS also imposed a $50,000 civil money penalty on a North Carolina dental practice in 2022 over a reply to a negative online review.

Use replies like these. Positive: "Thank you for taking the time to share this. Our team appreciates it." Negative: "Thank you for the feedback. Privacy rules keep us from discussing details here. Please call our office manager at [main number]."

You may still contact an unhappy reviewer privately. The FTC's Q&A says the rule does not stop you from reaching out to resolve the issue. It also says you can't make false accusations about a reviewer.

What should a dermatology practice post on social media?

Post what helps a patient choose you and book, without any patient's information. Our take: these posts carry little legal risk. The aim is trust before the first visit, so show your people, your office and how simple booking is.

• Meet the team: short intros of each doctor and staff member, with their consent.
• Office tours, parking tips and what a first visit looks like, step by step.
• Answers to front desk questions, such as which plans you take and how to book.
• Short explainers on a service, reviewed by one of your doctors. No cure claims and no promised results.

Patient content follows the same rules as ads. A photo, video or story that shows or names a patient needs a signed authorization under 45 CFR 164.508, even on your own Instagram page.

Paid creators must disclose the deal. The FTC's Disclosures 101 for Social Media Influencers says to disclose any "financial, employment, personal, or family relationship" with a brand. It says terms like "ad" and "sponsored" work.

The same FTC page says the disclosure should sit in the post itself, not only on a profile page. In a video, it should be in the video, not just the description. For goals, platforms and a posting calendar, see our social media marketing strategy guide.

What do real US dermatology ads on Meta look like?

On October 22, 2026, we searched the Meta Ad Library without logging in. We set Country to United States, Ad category to All ads and status to Active, then searched the keyword "dermatology." It showed about 19,000 results. Only 4 of the first 27 ads came from US dermatology practices. Here's what we found.

We sorted the first 27 ads the page loaded:

• 4 were from US dermatology practices, mostly "book an appointment" or skin cancer screening ads.
• 3 were hidden behind "confirm your age by logging in," so we couldn't read them.
• 11 sold skincare or beauty products.
• 9 were something else: medical education, news, pet products and a clinic in Korea.

None of the 24 ads we could read named Botox or carried a typical-results line. Our take: the keyword feed is crowded with product brands, so a practice ad with a clear local offer and a booking button stands out.

Meta has its own rules here. Its Health and Wellness ad standard says cosmetic procedure ads "must be targeted to people at least 18 years or older" on Facebook and Instagram. Meta also bans text that attacks someone's appearance, so skip hooks like "Embarrassed by your acne scars?"

Can you run Google Ads and retargeting for dermatology?

Search ads, yes. Remarketing lists, mostly no. Keyword bids and location targeting don't need audience lists. Google's health ads policy puts "physical or mental health conditions" and "invasive medical procedures, including cosmetic surgery, surgical procedures, or injections" in a sensitive category.

Under the personalized advertising policy, advertisers in that category can't use "advertiser-curated audiences" at all. That means no Customer Match, no remarketing lists and no lookalike segments. So the old advice to "retarget everyone who didn't book" doesn't work for most dermatology services.

Large US dermatology groups do run search ads. On October 22, 2026, we searched 7 large US dermatology group websites in the public Google Ads Transparency Center, region United States, with no login.

5 of the 7 had ads on record: about 300, about 200, about 200, 82 and 78. We left the Transparency Center filters at any time, all platforms and all formats. 2 groups showed no ads under their websites.

• Bid on high-intent searches: "dermatologist near me," "mole check" plus your city, "acne treatment" plus your city.
• Target by location radius, not by audience lists. Don't fence other clinics or hospitals; our geofencing marketing guide lists the states that restrict it.
• Check the healthcare and medicines policy before you put prescription drug names in ads. Google restricts those terms.
• Tag every ad link with our UTM builder so you can see which ads lead to calls and bookings.

Health ad policies make Google Ads harder to run than in most fields. If you'd rather not risk disapproved ads, our search ads team can set up and manage your campaigns within these rules. (DigitalTreed sells this service.) Our PPC guide explains how the auction works if you run it yourself.

When can you use before-and-after photos and testimonials?

Only with a signed authorization and honest results. Under 45 CFR 164.508(a)(3), a practice "must obtain an authorization" before it uses health information for marketing, with 2 narrow exceptions. Among other required elements, a valid form has an expiration date and the patient's signature and date.

A cropped photo isn't a loophole. The HIPAA de-identification list at 45 CFR 164.514 includes "Full face photographic images and any comparable images" as identifiers. A tattoo or birthmark can identify a patient too.

The FTC adds a second rule. Its Health Products Compliance Guidance warns about testimonials with results "more dramatic than users can generally expect" as likely to be deceptive. A "Results not typical" footnote doesn't fix that, the FTC says.

Staff and family testimonials need a clear disclosure. The FTC Endorsement Guides FAQ says that if you encourage employees to post reviews, you are responsible for monitoring their disclosures and claims. Your state medical board may add its own advertising rules, so check those too.

Are patient emails and referral rewards allowed?

Emailing your own patients about your own services is generally not "marketing" under HIPAA. The definition in 45 CFR 164.501 excludes describing a covered entity's own health-related services. That exception ends if someone pays you to send the message. Paying for referrals isn't that simple.

Referral rewards are riskier. The HHS Office of Inspector General says "paying for referrals is a crime" in federal health care programs. It also says the kickback rule "applies to all sources of referrals, even patients."

For Medicare and Medicaid patients, small gifts have a cap. The OIG policy statement on nominal value (PDF) from 2016 sets it at $15 per item and $75 per patient per year. Gifts can never be cash or cash equivalents. That is the figure on the OIG site as of October 2026.

Our take: send thank-you notes to referring primary care doctors, and pay nobody per patient. Have a healthcare attorney review any patient reward before you launch it.

How should you email patients about recalls and offers?

Email is allowed with care. HHS says in an FAQ on email with patients that providers may email patients "provided they apply reasonable safeguards when doing so." The same care covers recall reminders and newsletters, and promotional email also falls under the CAN-SPAM Act.

Its examples include checking the address before you send and limiting the health details in unencrypted email. HHS also says a provider should honor a patient's reasonable request to get appointment reminders by email.

• Recall reminders: remind patients of follow-up visits their doctor set. Keep the text short, with no diagnosis in it.
• Newsletters: announce new services, hours or providers, which is generally not HIPAA "marketing" when nobody pays you to send it.
• Opt-outs: put a clear unsubscribe link in every promotional email.

Promotional email also falls under the CAN-SPAM Act. The FTC's CAN-SPAM compliance guide says each message must include "your valid physical postal address" and a clear way to opt out.

You must honor an opt-out within 10 business days, the FTC guide says. It lists penalties of up to $53,088 for each email that breaks the law, as of October 2026.

For list building and sender rules, see our email marketing strategy guide.

How do you know which marketing is working?

Start with numbers that don't touch patient records. Google's Business Profile performance help lists the actions it counts on your profile. They include calls, website clicks, directions and bookings. Those counts, plus new patients by source from your front desk log, show which channels bring patients in. No ad pixel is needed.

• Calls: taps on the call button on your profile.
• Website clicks: taps on your website link.
• Directions: requests for directions to your office.
• Bookings: completed bookings, if you take them through a booking provider.

Google notes that this data includes actions from both organic search results and Google Ads. So also tag every ad link with UTM codes and compare the two sources.

Our take: once a month, count new patients by source from your front desk log. Match that to your ad spend and your profile numbers. That avoids sending patient data to ad pixels.

Example: a two-doctor practice in Tucson

Example: Saguaro Skin & Laser is a made-up practice in Tucson, Arizona, with 2 dermatologists. Half its patients use insurance; half pay cash for cosmetic care.

• Profiles: one for "Saguaro Skin & Laser," plus "Dr. Ana Reyes, MD" and "Dr. Tom Hale, MD."
• Website: 6 condition pages and 5 procedure pages, each reviewed and signed by one of the doctors.
• Reviews: the front desk hands every patient the same card with a review QR code. No gifts. Replies use the templates above.
• Ads: Google search ads for "mole check Tucson" within a 15-mile radius, no remarketing lists. Meta filler ads target people 18 and over.
• Photos: before-and-after images from 3 patients with signed authorizations, no misleading edits and a typical-results caption.
• Referrals: thank-you letters to primary care doctors. No payments.

A "rules first" approach works in other regulated fields. Our guide to SEO for law firms covers the legal side.

Your next step

This week, check your Business Profiles and your last 10 review replies. Rewrite any reply that confirms a patient or mentions a visit.

When you're ready to add paid search, our search ads team can plan a campaign that fits Google's health rules, with a fixed quote first.

How we made this guide: Aijaz Alam wrote it from primary sources. They include the HIPAA rules on eCFR, HHS and OIG pages, FTC guidance, and Google and Meta policy pages. On October 22, 2026, we searched the public Meta Ad Library and Google Ads Transparency Center without logging in and counted what we saw. Sources are linked where each claim appears, and we checked every number against its source the same day. Updated October 23, 2026: added map ranking factors, keyword research, social media posts, patient email and recalls, measuring results and an AI Overviews FAQ. Updated October 25, 2026: added key facts and a direct answer under each question.

First published February 2023. Rewritten October 2026: new US rules on reviews, photos, ads and referrals, our own count of US dermatology ads, and review reply templates. We removed an unsupported client claim and outdated retargeting and photo advice.

Sources

• eCFR: 45 CFR 164.501, Definitions (marketing)
• eCFR: 45 CFR 164.508, Uses and disclosures requiring an authorization
• eCFR: 45 CFR 164.514, De-identification
• HHS: HIPAA marketing guidance
• HHS: Elite Dental Associates resolution agreement, 2019
• HHS: New Vision Dental resolution agreement, 2022
• HHS: Manasa Health Center resolution agreement, 2023
• HHS: Use of online tracking technologies by HIPAA covered entities
• HHS OIG: A Roadmap for New Physicians, Fraud and Abuse Laws
• HHS OIG: Policy Statement on Gifts of Nominal Value, 2016 (PDF)
• FTC: Health Products Compliance Guidance
• FTC: Endorsement Guides, what people are asking
• FTC: Consumer Reviews and Testimonials Rule Q&A
• Google Maps: Prohibited and restricted content (reviews)
• Google Business Profile Help: Reply to reviews
• Google Business Profile Help: Guidelines for representing your business
• Google Ads policy: Health in personalized advertising
• Google Ads policy: Personalized advertising
• Google Ads policy: Healthcare and medicines
• Meta: Health and Wellness ad standard
• Google Search Central: Creating helpful, reliable, people-first content
• schema.org: MedicalClinic
• Meta Ad Library
• Google Ads Transparency Center
• Google Business Profile Help: Tips to improve your local ranking
• Google Search Central: SEO Starter Guide
• Google Business Profile Help: Performance and insights
• Google Search Central: AI features and your website
• FTC: Disclosures 101 for Social Media Influencers
• HHS: HIPAA FAQ on email with patients
• FTC: CAN-SPAM Act compliance guide for business