Can ABA practices use client photos in marketing?

Only with a valid, specific, revocable HIPAA authorization signed by the guardian — a general media-release buried in intake paperwork is shaky ground, and the BACB adds its own informed-consent expectations. The safer default most practices land on: photograph spaces and staff, not clients.

Are testimonials allowed under the BACB Ethics Code?

The code (Section 5) prohibits behavior analysts from soliciting testimonials from current clients for advertising, because the ongoing service relationship makes consent inherently pressured. Unsolicited public reviews are the client's own speech — but using them in your marketing, and anything from former clients, carries specific disclosure and consent requirements. When in doubt, don't reuse.

Can we respond to Google reviews?

Yes, but the response must not confirm the reviewer is or was a client — that confirmation is itself a disclosure. Respond generically ('Thank you for the kind words'), take anything substantive offline, and never discuss care details, even to correct a false negative review.

Do analytics and ad pixels violate HIPAA?

They can. HHS's Office for Civil Rights has treated tracking technologies that send identifiable data from health-condition pages to third parties as potential HIPAA violations, and enforcement actions and lawsuits have followed the Meta-pixel reporting. Configure analytics deliberately, keep ad pixels off intake and condition pages, and get BAAs where required.

HIPAA-compliant ABA marketing: what the rules actually prohibit

Most ABA marketing anxiety is about the wrong things. The rules that bite: PHI in testimonials and photos, tracking pixels on health pages, review responses that confirm a client relationship, and the BACB's own advertising code.

Compliance fear makes ABA practices do strange things: no reviews program at all, websites scrubbed of any useful information, marketing frozen because “HIPAA.” Meanwhile the actual violations in the wild are specific and avoidable — a client photo posted from a good-faith consent that wasn’t a HIPAA authorization, a review response that confirmed a family’s status, a Meta pixel quietly firing on an intake form.

The rules are narrower than the fear. Here is what they actually prohibit, in the four places marketing touches them.

The map: four rule sets, four surfaces

Rule set	What it governs in marketing	The line
HIPAA Privacy Rule (45 CFR 164.508)	Using PHI — names, photos, any identifying detail — in marketing	Specific written authorization, revocable, before use
HHS tracking guidance	Analytics/pixels on pages about health conditions	No identifiable data to third parties without authorization/BAA
BACB Ethics Code, Section 5	Public statements, testimonials, social media conduct	No soliciting current-client testimonials; truthful, non-deceptive claims
FTC & state consumer-protection law	Outcome claims, advertising substantiation	Claims you can support; no implied guarantees

The whole discipline in one question. Everything downstream of "could this identify a client?" is either an authorization workflow or ordinary honest advertising.

Surface 1: photos, stories, and testimonials

Any marketing use of a client’s identity — photo, video, name, or a story specific enough to identify them — is a HIPAA marketing use of PHI requiring specific written authorization: what will be used, where, revocable at any time. A media release blended into intake paperwork years earlier is weak footing, and consent obtained at intake for future marketing sits exactly in the pressured-consent zone the BACB code exists to prevent.

The BACB layer is stricter than HIPAA here: Section 5 bars soliciting testimonials from current clients outright — the power imbalance makes free consent suspect — and requires disclosures around former-client testimonials. Practical default: build the brand on staff, spaces, program explanations, and data. It photographs better than it sounds.

Surface 2: reviews

You cannot stop families from reviewing you, and you shouldn’t want to — reviews decide the map pack. The compliance mechanics: never incentivize, never draft, never solicit from current clients; respond to every review as if the reviewer might be a stranger (no confirmation of any care relationship); move substance offline (“we’d welcome a call to discuss any experience with our office”). The single most common violation in this surface is the well-meaning detailed reply to an unfair negative review. There is no HIPAA exception for being right.

Surface 3: your website’s plumbing

HHS OCR’s tracking-technology guidance put analytics on the compliance map: identifiable data flowing from health-condition pages to advertising platforms is treated as a disclosure. For an ABA site that means: no ad pixels on intake, contact, or condition-specific pages; analytics configured without identifiers where possible, or under a BAA where not; intake forms flowing into BAA-covered systems only (the website guide covers the build). Remarketing lists built from site visitors are the specific pattern the guidance — and Google’s and Meta’s own health-category ad policies — foreclose.

Surface 4: claims

“Evidence-based” is defensible; “recover” and outcome guarantees are not — under the FTC’s substantiation standard and the BACB’s non-deceptive-statements rule alike. Publish what you can support: your process, your credentials, your availability, and real data. (This is, not coincidentally, the entire editorial model of this site.)

What this leaves you — which is plenty

Everything in the rest of this series survives compliance intact: the referral engine (built on usefulness, not inducements — the anti-kickback line lives there), local SEO with a compliant reviews cadence, paid search on client-intent terms without health-data remarketing, education-first content, staff-and-spaces brand photography, and every piece of public data you can put in front of families. The practices that market well in this category aren’t the ones taking risks; they’re the ones who know exactly where the lines are and use all the room inside them.

This guide is orientation, not legal advice — application to your practice belongs with a healthcare attorney.

Sources

HIPAA marketing provisions: 45 CFR 164.501, 164.508 (marketing definition and authorization). Tracking: HHS OCR, “Use of Online Tracking Technologies by HIPAA Covered Entities” (guidance as updated; enforcement posture continues to evolve — dated August 2026 reading). BACB: Ethics Code for Behavior Analysts, Section 5 (public statements, testimonials, social media). Advertising claims: FTC Act §5 substantiation doctrine. Reviewed against live sources August 12, 2026.