Plastic surgery marketing: how to promote a practice within FTC, HIPAA and state board rules

Why a plastic surgery patient takes months to decide

Cosmetic surgery is elective and expensive. A primary care doctor does not prescribe it, and health insurance does not pay for it: the American Society of Plastic Surgeons (ASPS) points out that cosmetic procedures are cash-pay, so no insurer is checking the surgeon's credentials for the patient. The result stays on the face or body for years. That is why the gap between first interest and a booked operation is long, and why the patient spends it studying the practice and the individual surgeon.

Price is part of the hesitation. ASPS publishes average surgeon fees, and they are only part of the bill. At the time of writing its cost pages list $7,637 for rhinoplasty, $11,395 for a facelift and $4,875 for breast augmentation with implants. Each page says the figure does not include anesthesia, operating room facilities or other related expenses. A buyer who sees a five-figure total will save, compare and wait.

During those months the prospective patient usually does the following:

• studies the surgeon's before-and-after gallery and compares it with other surgeons;
• reads Google and Yelp reviews and the surgeon's profile on physician-rating sites, and asks friends who have had surgery;
• learns how the operation works, how long recovery takes and what can go wrong;
• works out a budget and looks for a practice that offers financing;
• books one or more consultations before deciding. ASPS advises patients to write their questions down beforehand and to ask about credentials, risks, recovery and what happens if they are unhappy with the result.

Three conclusions follow for marketing. An ad rarely sells an operation at first glance. Its real job is to bring a person to a consultation, or into a channel where they can keep getting to know the surgeon. Steady, repeated visibility matters more than one-off promotions. And exaggeration works against the practice: someone who spends months comparing surgeons notices grand promises and draws their own conclusions.

A note before the rules: this article summarizes public sources and is not legal advice. Rules differ by state, so have a health-care attorney in your state review ads, photo releases and consent forms.

What do the FTC and state medical boards allow in plastic surgery advertising?

The US has no single "medical advertising law" like some countries do. Several layers apply at once, and the practice is responsible for all of them:

• The FTC. Every ad, including a surgeon's, must be truthful and backed by evidence. The FTC's health products compliance guidance explains that health claims need competent and reliable scientific evidence, and that anecdotal testimonials and practitioner observations alone generally do not count as that evidence. The guidance is written for health products, but the logic carries over to claims such as "safe" or "painless" for a procedure.
• The state medical board. Each state sets its own rules for physician advertising, and a violation can mean discipline against the license. California is a useful example because its rule is specific: Business and Professions Code section 651 bars false, fraudulent, misleading or deceptive statements, claims or images in public communications, treats a violation as a misdemeanor, and makes it grounds for license discipline.
• The platforms. Google and Meta add their own, often stricter, ad policies (covered below).

Disclaimers need to be seen. There is no fixed percentage of the banner like in some countries. The FTC's test is whether a disclosure is clear and conspicuous, in the words of its endorsement guidance: placed where the audience will not miss it and matched to the format of the ad, not hidden behind a click. For a banner that means a readable line of text on the banner itself, including in the smallest sizes.

Promises of results are the most common problem. Phrases like "safe plastic surgery," "painless rhinoplasty," "no scars," "no complications" or "guaranteed natural results" are claims the practice cannot substantiate for every patient, and a skeptical reader spots them at once. Remove them first. Describe the process, the risks and the recovery instead.

Here is how a rewrite looks in practice. The ad "Painless rhinoplasty with guaranteed results. Hundreds of happy patients, see the before-and-afters!" makes an unsupported promise, points to hand-picked cases and implies that every patient gets the same outcome. The reworked version is calmer: "Rhinoplasty consultation with a surgeon certified by the American Board of Plastic Surgery. Financing available for qualified applicants. Surgery has risks; results vary." It is less emotional, it is verifiable and it does not promise a result that depends on one person's anatomy. The figure shows both side by side.

The FTC's rule on consumer reviews and testimonials (effective October 21, 2024) also lets courts impose civil penalties for knowing violations. Next: what exactly the surgeon is certified in.

Board certification claims: say exactly what you hold

Are you certified by the American Board of Plastic Surgery?

The first question ASPS tells patients to ask a plastic surgeon

Patients are told to ask that, so make the answer easy to find and impossible to misread. ASPS says a patient should look for certification from a board recognized by the American Board of Medical Specialties (ABMS) and, for cosmetic plastic surgery, from the American Board of Plastic Surgery. It also warns that some doctors call themselves "board certified" without making clear which specialty or which board stands behind the phrase. ABMS describes itself as the umbrella for 24 member boards, and patients can check a doctor's certification through its Certification Matters tool.

The law adds a floor. Under the California statute cited above, a physician may not use the term "board certified" unless the full name of the certifying board is also given with comparable prominence, and the board must meet the statute's recognition conditions (ABMS-recognized, or approved by the Medical Board of California as equivalent). Other states have their own wording, so check your board's rule instead of assuming California's applies, or does not.

• Write the full board name every time: "certified by the American Board of Plastic Surgery," not just "board certified."
• Verify each surgeon on the team yourself and keep the proof on file. Do not list a fellow, a resident or a surgeon who is only board-eligible as certified.
• List hospital privileges only if they are current. ASPS suggests patients ask where the surgeon can operate and treat complications.
• Keep photos, bios, Google Business Profile text, directory listings and ads consistent. One outdated profile is enough for a complaint.

Where can you show before-and-after photos, testimonials and videos?

Patients want to see the surgeon's work, and marketers want to put the best cases straight into ads. The practice faces three layers here: HIPAA, the FTC and state rules, and the ad platforms.

HIPAA. A patient's photograph taken for care is health information. The HIPAA de-identification rule lists full-face photographic images and any comparable images among the direct identifiers, so a face or a recognizable body view is not anonymous. Use of such information for marketing generally needs the patient's written permission: 45 CFR 164.508 requires an authorization for marketing uses and disclosures, with narrow exceptions such as a face-to-face communication or a gift of nominal value. A valid authorization states what will be used, who may use it, who may receive it, the purpose, an expiration date or event, and the patient's signature and date, and the patient can revoke it in writing. HIPAA defines marketing as a communication that encourages people to buy or use a product or service, which describes a before-and-after gallery on a sales page.

One caveat: HIPAA binds "covered entities," meaning health-care providers who transmit health information electronically in connection with covered transactions, such as insurance claims. A practice that also does reconstructive work billed to insurance usually is one. A strictly cash-only practice may not be, but state privacy law and professional ethics still apply, and the sensible default is the same: get a specific written release.

Use a separate release, not a paragraph in the intake packet: which photos, where they will appear (website, social, paid ads, print), whether the face is covered, and for how long. A refusal must never change how the patient is treated.

FTC and state rules. Before-and-after galleries imply results, and the FTC's endorsement guidance says a claim about exceptional outcomes needs proof that those results are typical, or a clear statement of what is typically expected. California goes further: under section 651, a patient photo must say in a prominent place which procedures were performed, the views must be comparable in presentation so favorable poses and lighting do not distort the result, and the image must carry a statement that the same results may not occur for all patients. Even where your state has no such sentence, copying it is a good habit.

Platforms. Meta's Health and Wellness policy says ads for cosmetic products, procedures or surgeries must be targeted to people 18 or older, and it lists cosmetic procedures and surgeries "depicting before and after transformation" among what can run for that audience. The same policy bans statements of inferiority about physical appearance, so "fix your ugly nose" style copy is out. Policies change often (this page lists revisions in July 2026), so read the current text before each campaign.

Google works differently. Its restricted targeting policy says advertisers promoting products and services in sensitive interest categories, which include health, cannot use advertiser-curated audiences, such as remarketing lists and customer match lists. Check with your Google Ads rep or the policy page whether your procedures fall in that category; if they do, plan campaigns around search intent, location and Google's predefined audiences rather than around lists of people who visited your procedure pages.

A special case is a patient who posts her own photo and tags the practice. Reposting it next to a price and a "Book now" button turns her story into your advertising, so get written permission first. Paid or free-procedure influencers add a disclosure duty: the FTC expects any material connection to be disclosed clearly.

A short guide helps avoid deciding each case from scratch:

The table is not a substitute for a lawyer: a gallery next to an offer or a booking form is advertising, whatever the page is called.

Trust in the surgeon: what to show instead of results

If results cannot go into every ad, trust moves to the surgeon. The surgeon's page on your site and on directory profiles should answer the questions people ask silently:

• training, certification (with the full board name) and years in practice;
• which procedures the surgeon performs most often and which ones they do not offer;
• hospital privileges and where complications would be treated, if applicable;
• how a consultation works, how long recovery takes after major procedures, and the risks;
• a video in which the surgeon explains how they decide the scope of surgery and when they decline to operate.

An honest discussion of risk reassures more than promises do. A nervous person relaxes when the surgeon does not hide limits: how long to wear compression garments, when it is safe to return to work, and when it is better not to operate. "Safe" and "painless" do the opposite.

Show your real operating room, recovery rooms and staff, not stock images, and if you offer a private entrance or discreet arrival, say so.

There is a strategic risk as well. If all advertising rests on one star surgeon, the practice depends on that person: when the surgeon leaves, some patients leave too. Show the team and the practice's standards next to individual profiles. Local visibility for each location, covered in our guide to SEO for local businesses, supports the same goal.

Consultations and patient coordination: how to handle doubts

The consultation is the key conversion point in plastic surgery. It is where a person meets the surgeon, asks questions they hesitated to write down and hears an honest assessment. Build ads, social pages and messages around booking the consultation and talk about the operation only after that.

Consultations are mostly about managing expectations, and ads promising a "new you" attract people the surgeon must then bring back to reality. ASPS tells patients to ask whether their expectations are realistic and what happens if they are unhappy, so answer those on your site.

Between the first inquiry and the consultation sits the patient coordinator (some practices say "patient care coordinator" or "treatment coordinator"). They answer first questions, book the visit, send reminders and support the patient before and after surgery. They need a script with clear rules:

• state the consultation fee and the typical price range, and explain honestly what drives the final number: surgeon's fee, anesthesia, facility, garments and follow-up visits. ASPS lists the last one among the questions patients should ask;
• do not promise results or judge the scope of surgery from photos sent by text; that belongs to the surgeon's in-person exam;
• do not pressure hesitant people with countdown offers;
• explain financing calmly and disclose the terms in full;
• log objections so marketing can answer them in content.

Texting needs care. Under 47 CFR 64.1200, advertising or telemarketing messages sent with an autodialer or prerecorded voice to wireless numbers require the recipient's prior express written consent, and the consent agreement must say the person is not required to sign it as a condition of buying anything. Whether a given reminder counts as marketing or as care-related is a question for your attorney. The simple habit: ask for opt-in on the web form, repeat it at the start of a text thread, and honor "STOP" at once. The example below shows the start of such a conversation.

Financing answers one of the biggest objections, since an operation can cost many thousands of dollars. Treat it as a regulated topic. The Consumer Financial Protection Bureau explains that deferred-interest medical credit cards can charge interest on the full original amount if the balance is not paid off by the end of the promotional period, and that the rate afterward can be above 25 percent. If you advertise third-party financing such as CareCredit or Cherry, describe it the same way: say "financing available for qualified applicants," show the lender's real terms, and never imply that every patient will get a particular monthly payment.

If your own ad states a payment amount or number of payments, Regulation Z's closed-end credit advertising rule, 12 CFR 1026.24, treats them as triggering terms that require the down payment, repayment terms and annual percentage rate to appear too. The rule applies to creditors, so ask your lender and attorney who that is before you publish "$250 a month."

After booking, send a short confirmation: the surgeon's name, date and time, the address with parking, a request to arrive 15 minutes early, a phone number for rescheduling and a link to a consultation checklist. Keep it discreet. A subject line like "Your appointment on November 14" says less to a family member glancing at the screen than one naming a procedure.

How to get inquiries from Google, Meta and social media despite the restrictions

On Google Search, plastic surgery is a high-intent category: people search for specific procedures and surgeons in their city. Build campaigns around one procedure each (rhinoplasty, blepharoplasty, breast augmentation) with a dedicated landing page for each. Photos of the surgeon, the consultation and the facility are easier to get approved than patient bodies. Remember the Google targeting limit described above before you plan any retargeting.

On Instagram, Facebook, TikTok and YouTube, patients get to know a surgeon gradually. These patterns repeat in practice:

• many people follow the surgeon's account and watch educational posts for a long time before they request a consultation, so follower-building pays back slowly but more steadily;
• before-and-after content works best on your own profile and website, where people arrive on their own, with the authorization, procedure label and results-vary note described above; if a post carries a price and a booking link, treat it as an ad;
• consultation and financing offers usually bring leads at lower cost than ads showing patient results, but test that on your own account.

Be careful with location filters. Patients do travel for surgery, but distance hurts when complications arise. If you welcome out-of-town patients, spell out where to stay, when to come for a check and how to reach the surgeon afterward; if not, add a qualifying question to the lead form.

Email and texting carry their own rules. The FTC's CAN-SPAM guide requires accurate sender information, truthful subject lines, a clear ad label for commercial messages, a physical postal address and a working opt-out honored within 10 business days, and states that each non-compliant email can draw penalties of up to $53,088. The practice is liable even when an email vendor sends the messages.

A surgeon's feed works best for education: common questions, preparation, recovery and fears. A post with a price, an offer and a booking call is an ad.

Influencers bring reach but are a risky channel for surgery: a creator's story of her own operation packs a result and a testimonial into one post. Keep them to the consultation, the practice and preparation, and put the disclosure duty in the contract.

Maps, review sites and reviews: where patients compare surgeons

For most practices the Google Business Profile is the first impression, and it must match your website: name, address, phone number, hours, categories and a link to booking. Add photos of the entrance, reception and recovery rooms, list each surgeon where the platform allows, and keep specialties accurate. The profile appears in Google Search and Maps as a list with rating, review count and address. We cover the setup in more detail in SEO for local businesses.

From the list a patient opens the practice's profile, which shows the rating, hours, phone, address and a directions button.

Plastic surgery reviews are read more closely than in almost any other specialty. Ask every patient for a review after the follow-up visit, but do not offer a discount or gift for it. Google's Maps user-generated content policy prohibits offering payment, discounts or free goods or services in exchange for a review, and also bans selectively soliciting positive reviews or discouraging negative ones, which is exactly what "review gating" is. Yelp goes further and asks businesses not to request reviews at all, and its software tends to put solicited reviews into the not-recommended section. So treat Yelp as a profile you keep accurate, not a campaign.

The FTC's rule on consumer reviews and testimonials adds federal teeth. It bans fake or misleading reviews, requires disclosure when insiders such as employees or relatives post, and prohibits using false accusations, threats or groundless legal threats to suppress negative reviews. It does not forbid every incentive, but an incentive cannot be tied, expressly or by implication, to a particular sentiment. Since the platforms are stricter than the rule, the safe policy is no incentives.

The Consumer Review Fairness Act matters for consent paperwork. It makes it illegal to put terms in a form contract that bar or restrict a customer's ability to review the business, penalize reviews, or take over the intellectual property in the review. Check that your patient agreement has no gag clause.

Negative reviews are a special problem here, because HIPAA limits what you can say. A covered entity may not use or disclose protected health information except as the rules permit, and confirming that the reviewer was a patient already discloses something. So the public reply stays generic: thank the person, say you take feedback seriously, state your general process and invite them to call you. Do not confirm the person had treatment, mention what was done or argue about the outcome. The example shows a review and a reply without any treatment detail.

One last rule: do not lift a platform review into an ad. On Google it is the patient's opinion. On a banner the same sentence is a testimonial that you chose, which brings in the FTC's endorsement rules and, for a patient, the privacy rules above. Get written permission first, and keep the result claim typical.

The long cycle: staying visible, privacy and return on investment

While a person decides, the practice should stay visible without becoming annoying. Educational pages are the base: how a rhinoplasty works, how to prepare for blepharoplasty, how long recovery after a facelift takes. They bring search traffic long before a consultation is booked, and your own booking data will show seasonality better than any rule of thumb.

Follow-up rules:

• show ads about consultations and recovery to visitors of procedure pages, within the targeting limits above;
• email and text only people who have agreed, with a clear unsubscribe;
• segment by procedure and use neutral subject lines that do not name it;
• after surgery, cover follow-up visits and answer questions before you ask for a review.

A note on data. Which procedure someone looked at is sensitive health information. Keep text from forms, complaints and photos out of page URLs, goal names and analytics events. If you are a covered entity, ask your attorney before placing ad pixels or analytics on booking forms or patient-portal pages, because sending health information to an advertising vendor can be a disclosure under HIPAA. Do not upload patient lists to ad platforms without a clear legal basis.

The last click is almost meaningless here. A person might arrive from search, follow a surgeon's Instagram for half a year and then book by calling the number on a Google profile. Tie inquiries to sources with UTM tags and call tracking, and track two numbers per channel: the cost per patient who attends a consultation, and the share of consultations that become surgery. An expensive channel with a high surgery rate can beat a cheap one that brings only the curious.

Frequently asked questions