Social media: HIPAA and ethics considerations providers should know

Social platforms like Instagram, Facebook, and TikTok offer incredible opportunities to connect with potential clients and grow your business. But let’s face it: Things can easily get dicey when it comes to Health Insurance Portability and Accountability Act (HIPAA) rules and regulations, privacy concerns, and ethical considerations.

The answer isn’t necessarily to avoid social media altogether, but to educate yourself about the ins and outs of using social media as a mental health professional. You’ll also want to come up with a clear social media policy for your practice, and learn some tips for how to use social media ethically and responsibly.

This guide will help you do all of those things, whether you’re a new therapist, or a more experienced one looking to expand your practice.

Why do HIPAA and ethics considerations matter when using social media?

The vast majority of adults in the U.S. use social media. A 2025 report from the Pew Center found that 84% of American adults use YouTube, 71% use Facebook, and 50% use Instagram. It makes sense for anyone growing their business to have a social media presence. Mental health professionals can use these platforms to educate their audience about mental health issues, build community, and attract new clients.

But using these platforms isn’t risk-free, and as a therapist, it’s essential that you educate yourself about the specific risks of using social media.

Risks of social media in clinical practice

The major risk of using social media involves exposing a client’s protected health information (PHI). According to HIPAA rules, therapists can’t disclose their client’s PHI on social media or any online platform without authorization. That includes information related to a person’s mental health conditions and delivery of care (present, past, or future) and the manner in which care was delivered. It also refers to any common personal identifiers, such as a client’s name, address, Social Security information, and birth place. 

Some may think this means that if they post about a client anonymously, it’s okay, but that’s not true. You need written authorization to reference a client, even anonymously. Additionally, it can infringe on client/therapist confidentiality to like, share, or comment on a client’s social media posts, because of the potential to expose yourself as their therapist. 

Professional vs. personal social media accounts

While many therapists take action to protect their clients’ PHI on their professional or business social media accounts, they may not take the same precautions with their own personal accounts. Even if your account isn’t public and you only share content with close friends or family members, posting about a client (even anonymously) on a personal social media account is a violation of HIPPA. 

Understanding HIPAA requirements in online settings

As mentioned earlier, HIPPA stands for the Health Insurance Portability and Accountability Act. Its job is to protect clients’ PHI, and those protections require important considerations online, especially when dealing with social media. 

The minimum necessary standard and social media content

When it comes to disclosing PHI, you are required to consider the minimum necessary standard. This means that you take care to disclose as little personal information about a client as possible.

What might that look like on social media? Besides the obvious, like not sharing any personal identifying information about clients (name, location, mental health issues, etc.), it also means not interacting with clients in online spaces, which can include something as subtle as liking a post or comment of theirs. It means not responding to online reviews, and not sharing anonymous stories about a client without their written permission.

Business associate agreements with social media and marketing vendors

As a therapist, there will be times that you will need to interact with other business entities and share PHI of your clients. For example, you might need to share this information with health insurance companies, or your clients’ healthcare providers or psychiatrists.

It’s vitally important that you ensure that these vendors treat your client’s PHI with care, including on social media platforms or other online platforms. This involves keeping PHI private and also making sure that all technology used is HIPAA-compliant.

Solo providers should create business associate agreements (BAAs) with any outside vendor who might potentially handle your patient’s PHI.

How can Grow help me maintain HIPAA requirements on social media?

Grow Therapy offers a course in how to grow your social media presence as a therapist, taking into consideration factors like ethics and confidentiality.

While social media is a wonderful way to advertise your services and grow your business, it’s not the only option. Partnering with Grow Therapy is a great way to make your profile more visible and increase your online presence.

Maybe the best way to grow your business is to connect with other mental health providers. Grow Therapy’s provider community is available to any Grow Therapy therapist and is an incredible way to build community, network, and share ideas and best practices about social media use. 

Want to learn more about Grow?Chat with our team

Patient-facing concerns when using social media

It’s inevitable that you are going to be online and you aren’t banned from using social media just because you’re a therapist. That includes having a personal, non-business account. The idea is to learn how to use social media ethically and responsibly, especially when it comes to protecting the PHI of your clients.

Avoiding disclosure of client information on social media

Protecting your clients’ PHI isn’t just about refraining from directly sharing any identifying information about them online. It also includes:

• Not sharing photos that might disclose any identifying information about clients.

• Not discussing cases online, in DMs, in texts, or in closed groups, even anonymously.

• Not describing vague scenarios that might inadvertently reveal personal information about clients.

• Not “Liking” posts or comment on posts written by, or related to, a client.

• Not interacting with online reviews in any way that could expose client PHI.

• Not sharing funny or endearing anecdotes about clients, even if they don’t reveal mental health diagnoses or treatment plans.

Informed consent for digital and social media communication

When it comes to getting permission to share details of a client case, you need permission from the client. Verbal permission isn’t good enough. It’s best to get written authorization to share any information about a client online, even if you are posting without using their name.

Business-facing concerns when using social media

Using social media ethically is more than protecting client confidentiality. There are ethical concerns about using social media for advertising your business, too. 

Use of social media for psychoeducation versus therapy

One major area of concern is psychoeducation. Social media is full of therapists explaining symptoms, describing different scenarios pertaining to mental health diagnoses, offering relationship advice. You name it, there’s a social media post by a therapist out there discussing it.

These posts can be helpful for people who have never been to therapy, or are looking to hear their own stories and situations reflected back to them in the words of a trained therapist. These types of social media posts break down stereotypes, reduce stigmas, and make therapeutic concepts more accessible to the general public.

There’s only one catch: It’s vital that your social media posts about mental health aren’t confused with therapy. Posts that oversimplify concepts, or make listeners feel able to diagnose themselves or others with a specific mental health condition, are a slippery slope.

It’s crucial that you distinguish between psychoeducation and therapy in your social media videos and posts. Always add disclaimers in your posts that what you are posting shouldn’t be confused with medical advice, and encourage listeners to seek care for a mental health provider if they have concerns. 

Interacting with colleagues and professional communities online

Online arenas and social media are a great space for connecting with colleagues. Social media platforms often have closed groups for therapists, and you may be able to find likeminded therapists in these groups.

But even a closed group is a public space. It’s also a space where information can leak out to the rest of the world. Likewise, sharing information through an online message app or via a DM is still risky, especially if you share any identifying information about a client. Plus, most of these platforms are not HIPAA-compliant. 

Developing a social media policy for mental health practice

Social media can be a huge asset to a therapist, but only if you go in with a plan. That’s where having a clear social media policy for your private practice comes into play. 

Core elements of a written social media policy

A social media policy for your private practice should:

• Contain information about how you’ll go about protecting your clients’ PHI while using social media platforms to grow and advertise your business.

• Establish policies detailing under which circumstances you will post on social media and how.

• Provide guidelines about how you’ll protect PHI while interacting with colleagues, in online groups, and over email and DMs.

• State how your social media posts, photos, and videos will protect PHI, including when it comes to psychoeducation.

• Offer policies about how you will enter business associate agreements (BAAs) with any outside vendors, which will include guidelines for protecting any shared PHI. 

Some providers may specifically mention in their agreements at the start that they won’t engage with clients via social media — that way, patients know from the outset not to reach out. 

Regular review and updating of policies

HIPAA rules and regulations are often updated. Likewise, the social media landscape is constantly changing. That’s why you should revisit your social media policies on a regular basis, and update and adapt as needed. 

Responding to breaches, complaints, and mistakes online

There are specific rules in place that therapists must follow if there’s a potential HIPAA breach, where personal identifying information of one of your clients is revealed.

Recognizing and documenting a potential HIPAA breach

How do you know if a HIPAA breach has occurred? A HIPAA breach happens anytime a client’s PHI is shared without written permission or authorization.

In terms of social media and technology, this might look like:

• Sharing a client’s PHI in social media posts or comments without their permission or written authorization.

• Revealing a client’s PHI in a photo or video, even inadvertently.

• Sharing a client’s PHI electronically among colleagues without authorization.

• Sharing PHI from therapist to client using non-HIPAA-compliant technology.

• Leaving a client’s electronic paperwork unsecured in any manner. 

Notification obligations

After any kind of HIPAA breach, even a suspected one, you must:

• Stop the breach immediately.

• Secure all technology used in the breach.

• Document what occurred.

• Notify all individuals involved.

• Notify law enforcement if you suspect an outside entity may have been responsible in some way, such as a cybersecurity beach.

Additionally, the Breach Notification Rule requires that any client breaches are reported within 60 days to the Department of Health and Human Services Office of Civil Rights. 

Practical best practices and decision-making frameworks

Understanding the basics of best practices in social media is one thing. But different scenarios are bound to come up as you use these platforms. Here are some situations and considerations to keep in mind, and how to handle them. 

Guidelines for posting and engagement

It’s okay — and totally encouraged — for you to post publicly on your business social media platforms. You can advertise your business, share thoughts about your approach to therapy, provide some basic psychoeducation, and share your “vibe” as a therapist with any potential clients.

Clients may be more likely to want to work with you if they feel like you are a real person who has warmth, compassion, and who will “get” them. But it can be easy to slip away from professionalism and ethics when you are being “real” on social media.

Again, you should never share a case that could reveal anything about a client, even if it’s just to share a heartwarming or humorous moment. You should also never share clinical advice that is individualized. Any mental health education you provide should not be sensationalistic, and any data shared should be evidence-based. 

Handling clients who reach out to you

Sometimes clients will reach out directly to you on your personal or business social media account. They may request a connection or follow. They may directly message you or comment on one of your posts. This may happen when they are currently your client or after they’ve stopped being your client.

It’s important to maintain clear boundaries with any current or past clients on any of these platforms, including not engaging in public comments, not accepting friend requests, and being cautious when responding to direct messages.

Most or all social media platforms are not HIPAA-compliant so no health information should be shared there, and appointments should never be made on one of these platforms. When necessary, you can direct your client to your HIPAA-complaint messaging platform.

Some other tips to keep in mind about using social media as a therapist:

• Be mindful of what you post on social media, even on a personal account that you think isn’t visible to others — anyone can take a screenshot of what you post and easily distribute it.

• Think before sharing others’ posts. Ask yourself if what you are sharing is from someone reputable, if the information is evidence-based, and if it contains anything that may be offensive or insensitive to others.

• Whenever you post, comment, or engage with others on social media, do so in a civil and respectful manner.

• Be cautious about what public posts you like or comment on, as these can be seen by clients and colleagues as well. 

Final thoughts

Social media is not something to shy away from, even when you realize how cautious you need to be with it as a mental health professional. Once you understand and digest the basic guidelines, you can use social media frequently and in a fruitful way that can benefit your practice.

If you have any lingering questions or encounter challenges going forward, you can consult your professional licensing board, who can offer you guidance for navigating social media as a solo provider. You can also review this detailed guidance for mental health professionals from the American Psychological Association.

How can Grow help build your social media presence

Grow Therapy can also help you build your social media presence by offering tips, continuing education, and a provider community to brainstorm and share ideas with fellow therapists. Grow’s provider spotlight program is an excellent way for therapists to get their names out there, elevate their online profile, and connect with writers, journalists, and PR opportunities. 

See if Grow is right for you.Talk to our team