Why this is the rule clinicians break
Nobody sets out to publish a patient without permission. The breaches happen because consent feels like a box that was ticked once, somewhere, at intake — and because the obligation is narrower and shorter-lived than most practitioners assume.
The DHA standard requires documented written consent for any patient picture, video or statement used in social media advertisement content, and then constrains that consent in two ways that matter enormously in practice.
Constraint one: consent is confined to the subject requested
Consent does not generalise. It attaches to the specific use that was described to the patient when it was obtained.
A patient who consented to clinical photography for their medical record has not consented to appear on Instagram. A patient who consented to appear in a case discussion at a conference has not consented to a promotional reel. A patient who consented to one before-and-after image has not consented to that image being reused, a year later, in an advertisement for a different procedure.
If the use has changed, the consent has to be obtained again. There is no doctrine of close-enough.
Constraint two: consent has a shelf life
The standard is explicit that consent should not exceed the period for which the grant was made. This is the provision that turns a compliant archive into a non-compliant one without anybody touching it.
A post published in 2024 under a two-year consent is, in 2026, an identifiable patient published without consent. The post has not changed. The consent has run out. The practitioner is exposed, and nothing in the platform, the caption or the engagement metrics will indicate it.
The operational answer is a consent register with expiry dates, reviewed on a schedule, with removal treated as routine housekeeping rather than as an emergency.
What “identifiable” actually means
Practitioners tend to reason about identifiability from the perspective of a stranger. The relevant perspective is that of someone who already knows the patient.
A cropped face is not anonymisation. Nor is a black bar across the eyes, a technique that looks like diligence and provides very little of it. Tattoos, jewellery, scarring, dentition, hairline, body habitus, the visible corner of a treatment room, the date on the caption, the specificity of the presenting complaint — any of these can identify a person to their family, their colleagues, or themselves.
The test worth applying: could a person who knows this patient recognise them? If the answer is yes, or if you are not certain, you need consent.
Testimonials are patient content
The standard covers a patient's picture, video or statement. A five-star review reproduced as a graphic is a patient statement, and it requires documented written consent in the same way a photograph does. The fact that a patient published the words voluntarily on a review platform is not consent to their use in your advertising.
Where a testimonial is paid for, or given in exchange for a discount or a free service, the financial incentive must be documented and disclosed — a separate obligation that applies on top of consent.
A workable process
Consent is a records problem more than a legal one. What tends to work:
- A publication-specific consent form, distinct from the treatment consent and from the clinical photography consent, that names the platforms and describes the intended use.
- An explicit end date on every consent, recorded somewhere that is reviewed rather than somewhere that is filed.
- A register mapping every published post containing patient content to its consent record and expiry.
- A withdrawal route the patient actually knows about, and a commitment to remove content promptly when it is used.
- A scheduled audit — quarterly is realistic — that removes posts whose consent has lapsed.
MedZoro keeps a human approval step in front of every post for exactly this reason. Software can draft the content and hold the workflow open; it cannot know whether the patient in the photograph agreed to be there. That judgement stays with the clinician.
Related
For the wider regulatory picture, see can doctors advertise on social media in the UAE, and for the Dubai-specific requirements in full, the DHA standards explained.