Is It HIPAA-Safe to Post About Clients on Social Media? A Guide for ABA Clinics

Key Takeaways

• HIPAA doesn’t ban social media use, it regulates protected health information, so understanding what counts as PHI is the real starting point.

• A client’s name, photo, diagnosis, or session details all count as PHI if they’re identifiable in any way.

• Verbal permission from a parent isn’t enough. Clinics need written, specific consent before posting anything identifiable.

• A proper release should state which platforms content can appear on, what type of content is allowed, and how long consent stays valid.

• Small details like location tags, progress captions, or “before and after” posts can unintentionally reveal PHI, even without a name attached.

• Staff posting clinic content on personal social media accounts creates risk, since personal privacy settings don’t meet clinic compliance standards.

• Clinics can still post consistently without any client information, using educational content, staff spotlights, and general parent tips.

• Building consent into intake paperwork makes the process simple instead of an awkward, last-minute request.

• Each platform serves a different purpose. Facebook works for community content, Instagram for visual storytelling, and LinkedIn for referral relationships.

• A careful, compliant approach to social media becomes a trust signal itself, since families are watching how a clinic protects privacy before they ever become a client.

A proud parent tells you their child finally made eye contact during a session, and your first instinct is to share that win. Then you pause, because posting anything about a client on social media raises a real question: is this actually allowed? Clinic owners using social media for ABA therapy face this exact worry almost every week. At Impactory Media, we hear this concern from nearly every clinic we work with, and the good news is that HIPAA doesn’t mean you can’t post at all. It just means you need a clear process before you do.

What HIPAA Actually Covers on Social Media

HIPAA doesn’t regulate social media directly. It regulates protected health information, often shortened to PHI. That includes a client’s name, photo, diagnosis, appointment details, or anything else that could identify them as a patient. Posting a photo of a child during a session without proper consent could count as sharing PHI, even if the caption seems harmless. Understanding this distinction is the first step to using social media confidently instead of avoiding it out of fear.

The Consent Question: What Written Authorization Really Means

A parent saying “sure, go ahead” out loud isn’t enough. Clinics need written, specific authorization before posting anything identifiable. A proper release should state exactly which platforms the content may appear on, what type of content is allowed (photos, videos, written stories), and how long the consent stays valid. Vague or verbal permission puts your clinic at risk, even when the parent’s intentions were genuinely supportive.

Common Mistakes Clinics Make Without Realizing It

Small details cause most of the problems. A “before and after” progress post might unintentionally reveal a diagnosis. Tagging your clinic’s exact location in a photo that includes a child’s face narrows down who they are. A caption that mentions a specific therapy goal can confirm details a family never agreed to share publicly. Staff posting clinic photos on personal accounts is another common slip, since personal privacy settings rarely match a clinic’s compliance standards.

What You Can Post Safely Without a Release

There’s still plenty of room to post consistently and safely. General educational content about ABA therapy, staff introductions, empty facility photos, and parent-focused tips don’t involve any client information at all. Anonymized success stories, written without identifying details, or stock imagery paired with real advice also work well. This kind of content still builds trust and keeps your page active, without touching compliance concerns.

Building a Simple Social Media Consent Process

The easiest fix is making consent part of your standard intake paperwork instead of an afterthought. Decide whether you’ll use a one-time release or one that needs renewal each year. Keep a simple record of who signed, what they agreed to, and when it expires. A five-minute conversation during intake saves your team from awkward guesswork later, and it protects families just as much as it protects your clinic.

Social Media Platforms Best for ABA Therapy

Not every platform fits the way ABA clinics communicate with families. When clinic owners ask which social media platforms are best for ABA therapy, the honest answer depends on the goal. Facebook tends to work well for longer, community-focused posts and connecting with local parent groups. Instagram is better suited for short, visual content like staff spotlights or general education through reels and stories. LinkedIn can help with referral relationships, especially reaching pediatricians and other professionals rather than parents directly. Choosing the right platform for your goals matters just as much as what you post. 

Why This Builds More Trust Than It Costs You

Parents notice when a clinic handles privacy carefully. A thoughtful, compliant approach to social media doesn’t just avoid risk, it actually becomes a trust signal on its own. Families researching ABA services are comparing more than services and pricing. They’re watching how a clinic treats other families’ privacy, since that’s a preview of how their own child’s information will be handled. Working with an ABA marketing agency that understands these boundaries means your clinic can stay active and visible without ever second-guessing a post. That’s exactly the kind of steady, careful approach Impactory Media builds into every strategy we create for ABA clinics.

Frequently Asked Questions

Can an ABA clinic post photos of clients on social media?

Yes, but only with specific written consent from a parent or guardian first. The release should clearly state which platforms the photo may appear on and for how long. Without that documentation, even a well-meaning post can create compliance risk for the clinic.

Do parents need to sign a release before a clinic posts about their child?

 Yes, verbal permission alone isn’t considered sufficient documentation under HIPAA guidelines. A written release protects both the family’s privacy and the clinic’s compliance standing. Most clinics build this into their intake paperwork so it’s handled early and consistently.

What happens if a clinic accidentally violates HIPAA on social media?

Consequences can range from a formal complaint to financial penalties, depending on the severity of the disclosure. Even unintentional posts, like a caption confirming a diagnosis, can create real liability. Acting quickly to remove the content and review your consent process helps limit further risk.

Can staff members post about clients on their personal social media?

This should be avoided entirely, even with good intentions. Personal accounts don’t follow the same privacy and security standards a clinic maintains, and consent given to a clinic doesn’t automatically extend to an employee’s personal page. Clear internal policies help prevent this from happening.

Is it safe to use testimonials from parents on social media?

Yes, as long as the parent gives specific written permission for their words and any identifying details to be shared publicly. Keeping testimonials general, focused on the family’s experience, rather than clinical specifics, adds an extra layer of safety. Written consent should always be documented and kept on file.