HIPAA and GDPR are data-privacy laws, not advertising-content laws — most marketing risk under them comes from consent gaps, not ad copy. AHPRA is the exception: it directly restricts testimonial use in advertising.
Every market we work in has some version of advertising regulation specific to healthcare, and the acronyms get used loosely enough in marketing conversations that it's worth being precise about what each one actually restricts. This isn't legal advice, and the specifics vary by jurisdiction and should be checked against current local guidance, but here's the practical shape of what matters for marketing decisions specifically.
HIPAA (United States)
HIPAA is a privacy law, not an advertising law, and this distinction gets lost constantly. It governs how patient health information is handled and disclosed, not what claims a practice can make in an ad. Where HIPAA actually intersects with marketing is patient testimonials and case studies: using a real patient's story or image in marketing requires their explicit, informed consent, and that consent needs to be specific to marketing use, not just general treatment consent. The common mistake isn't HIPAA violations in ad copy itself, it's using patient photos or stories without properly documented marketing-specific consent.
AHPRA (Australia)
AHPRA's advertising guidelines are considerably more restrictive on testimonials than most other markets. Using patient testimonials in advertising is heavily restricted, in some contexts effectively prohibited, which is a real adjustment for practices used to review-driven marketing in less restrictive markets. AHPRA also scrutinizes claims about treatment superiority or guaranteed outcomes more strictly than general consumer advertising law would. The practical implication: Australian campaigns lean more heavily on credentials, clinical detail, and third-party review platforms rather than testimonials embedded directly in ads.
GDPR (United Kingdom and European Union)
GDPR is also fundamentally a data protection law, not an advertising content law, but it shapes marketing in concrete ways: consent requirements for cookies and tracking, how contact forms collect and store data, and what a practice can do with a patient's information for remarketing purposes. A contact form that doesn't clearly state how data will be used, or a cookie banner that doesn't offer a genuine opt-out, are common compliance gaps we find on practice websites in GDPR-covered markets, more often than any issue with the marketing copy itself.
A real-world example of the consent gap
A common scenario: a practice runs a promotion featuring a patient's before-and-after photos and a short quote about their experience. The patient verbally agreed to let the practice "use the photos." Months later, the practice wants to reuse the same images in a new campaign, on a different platform, with the quote repurposed as ad copy. Verbal, general consent given once for one use doesn't automatically extend to every future use across every channel. The safer approach is a written release, specific about which images, which platforms, and how long the consent lasts, before anything gets published the first time.
Where the real risk usually sits
In our experience across markets, the most common compliance problems aren't dramatic false claims, they're smaller structural issues: a testimonial used without proper documented consent, a before-and-after image posted without checking the specific rules for that procedure and jurisdiction, a contact form collecting data without a clear privacy statement. These are the kinds of things that get missed because they don't feel like "advertising claims" in the way a specific outcome guarantee obviously would.
A simple pre-publish checklist
Before anything goes live featuring a real patient, confirm there's a written, marketing-specific consent form on file, not just a general treatment consent. Before publishing any outcome or success-rate claim, confirm it's sourced from something you could show a regulator if asked. Before launching a new contact form or landing page, confirm it clearly states how submitted data will be used and stored. Before running a testimonial-based campaign in a new market, check that market's specific rules rather than assuming what worked in your home market applies elsewhere.
The practical approach
None of this means healthcare marketing has to be timid. It means building the compliance check into the process from the first draft rather than treating it as a final review step. A claim, a testimonial, or a piece of data collection that's fine in one market can be a real problem in another, and checking that before publishing is considerably cheaper than fixing it after a complaint or a platform flag.
Compliance requirements compound across markets
A practice operating in multiple countries, see our country-specific pages for the details, needs each market's content independently checked, since a testimonial or claim that's fine under one framework can be a real problem under another.
Quick answers
Q.Does this mean we can't use any patient stories in marketing?
No, it means getting specific, written, marketing-use consent first, and being clear with the patient about exactly where and how their story will be used, rather than relying on a verbal agreement made in the moment.
Q.What about content written by the doctors themselves rather than about patients?
Our content marketing service builds this in from the start. Physician-authored content, like a blog post explaining a procedure, carries far less compliance risk than patient testimonials do, since it's the practice's own professional opinion rather than a patient's private health story. It's one of the lower-risk, higher-trust content types available.
Q.Do these three frameworks (HIPAA, AHPRA, GDPR) cover every market you work in?
No, they're illustrative of how differently markets approach this. Australia, Germany, the UAE, and Singapore each have their own specific frameworks we check against, covered in more detail on our individual country pages.