Compliance guide
HIPAA-aware, compliant dental marketing in the United States
In the US, your state dental board sets the advertising rules, and federal law adds strict requirements on reviews, patient privacy, texts and calls. Here is how they apply, and how 230fix builds them into each service.
Last reviewed September 2026. General information, not legal advice.
Who sets the rules
State and federal rules overlap. The state board licenses you; federal agencies police reviews, privacy and phone and text outreach.
State dental boards
Each state’s dental practice act restricts false or misleading advertising and specialty claims. The ADA Code of Ethics (section 5.F) sets the same expectation for members.
Federal Trade Commission
The FTC Act bans deceptive advertising. Its 2024 rule on consumer reviews and testimonials bans fake reviews, review suppression and incentives tied to positive reviews, with civil penalties.
HHS Office for Civil Rights
The HIPAA Privacy Rule protects patient information, including in review replies, testimonials, tracking tools and vendors that handle it.
Federal Communications Commission
The TCPA requires consent for automated calls and texts. Since 2024, AI-generated voices count as “artificial” voices under the TCPA.
State privacy & recording laws
Laws such as California’s CCPA and CMIA and Washington’s My Health My Data Act add duties; states like California and Illinois require all-party consent to record calls.
The rules that matter most for dental marketing
Details vary by state, so your board’s rules always take priority. These apply almost everywhere.
No false or misleading claims
State boards, the FTC and the ADA Code all prohibit claims you cannot back up.
In practice: no guaranteed results, “painless” promises or unsupported “best in town” claims.
Specialty claims only where qualified
Specialist titles are limited to recognized specialties the dentist is qualified in, and some states require general dentists who advertise specialty services to say they are general dentists.
In practice: service pages describe what you do, with any disclosures your state requires.
Reviews must be real
The FTC’s review rule bans fake or bought reviews, suppressing negative ones, and incentives conditioned on a positive review.
In practice: we ask every patient the same way, offer no rewards, and never filter who gets asked based on how they feel.
Review replies must not reveal patient information
HHS has fined dental practices for replying to online reviews with patient details.
In practice: responses never confirm that someone is a patient or mention any treatment. We invite them to call the practice instead.
Testimonials need written authorization
Using a patient’s story, name or photo in marketing requires a HIPAA-compliant authorization from that patient.
In practice: no patient content is published without a signed authorization on file.
Texts and automated calls need consent
The TCPA requires the right level of consent, and marketing texts need prior express written consent.
In practice: reminder and marketing messages are kept separate, and marketing only goes to patients who opted in.
How 230fix builds this into each service
Compliance is part of how the work gets done, not a check at the end.
| Service | Where the risk is | What we do |
|---|---|---|
| Dental website | Advertising rules apply to every page, and tracking tools can expose patient information. | Copy is checked against your state’s rules. Analytics are configured to keep patient information out, and sites are built to WCAG 2.1 AA accessibility. |
| SEO & AI answers | Superlatives and specialty claims creep into search copy. | We target services and locations, and keep specialty wording within what your license allows. |
| Google Business Profile & reviews | The FTC review rule and HIPAA both apply to how reviews are gathered and answered. | Requests go to every patient with no incentive, and replies never disclose patient information. |
| Social media | Patient stories and photos are marketing uses of health information. | Nothing featuring a patient is posted without a signed HIPAA authorization. |
| AI voice & chat | The assistant handles protected health information, and recording laws vary by state. | Where our systems handle patient information we work under a Business Associate Agreement, callers are told calls are recorded, and clinical questions go to your team. |
| Email & SMS | CAN-SPAM and the TCPA govern marketing messages. | Consent is captured and stored, and every message identifies the practice and includes an opt-out. |
Common questions
Yes, but never confirm the reviewer is a patient or mention any treatment detail. HHS has fined dental practices for review replies that disclosed patient information. A short, neutral reply inviting them to call the practice is safest.
You need one with any vendor that creates, receives or stores protected health information for you, such as an AI receptionist, chat or booking system. An agency that never touches patient information usually does not.
It is best not to. Google’s policies prohibit incentivized reviews, and the FTC rule bans incentives conditioned on a positive review.
Only with the right consent. The FCC treats AI-generated voices as artificial voices under the TCPA, so automated outbound calls and marketing texts need prior consent.
This guide is general information, not legal advice. Rules change and differ between states and provinces, and you remain responsible for advertising about your practice. Check your regulator’s current guidance, and speak to your professional indemnity insurer or a health lawyer about specific situations.
Official sources
Marketing by city
Want your marketing checked?
Our free audit flags compliance risks on your website, profile and social pages alongside your rankings.
Or call/text +1 (661) 727-3766.