Social media for hospitals and health systems: a practical guide

People follow a hospital for practical reasons: visiting times, parking, where to go, waiting times and service changes. They also look to you for health information they can trust, and many staff and future staff watch closely. Those audiences shape your platforms.

Google's Business Profile guidelines say departments within hospitals may have their own profiles. Publicly facing departments that operate as distinct entities should have their own page with a distinct name and main category, and Google gives "Massachusetts General Hospital Department of Dermatology" as an acceptable example. Keep each one's hours and entrance details accurate.

Source: Google Business Profile Help: Guidelines for representing your business on Google, checked 15 October 2026

Most hospital teams aim for one post a day on the main channels, but consistency matters more than volume. Agree who checks clinical content, and keep a bank of approved evergreen posts for busy weeks.

• One health information post, checked by a clinician, linking to your own patient pages.
• One people post: a nurse, porter, cleaner, therapist or volunteer and what they do.
• One practical post: parking, visiting, a new clinic or a change to a service.
• One recruitment or training post.
• Awareness days you genuinely take part in, with a local angle.

US: HHS explains that the HIPAA Privacy Rule generally requires a patient's written authorisation before their protected health information is used or disclosed for marketing. Some communications are not marketing, such as a hospital using a general publication to announce a new specialty group or new equipment, and communications for the individual's treatment. If a third party pays for the marketing, the authorisation must say so.

UK: the GMC's social media guidance says doctors must not disclose identifiable information about patients on social media without explicit consent, and warns that individual details may not breach confidentiality on their own, but the sum of what is shared can be enough for a patient or someone close to them to recognise the case. It also says information must not be false or misleading, that doctors commenting on health should usually say who they are, and that anyone advertising services must follow CAP, ASA and CMA rules.

This is general information, not legal advice. Rules differ by country and change, so check with your regulator, professional body or a lawyer before you post claims, prices or patient stories.

1. Use your organisation's written authorisation or consent form for every patient story, photo and film.
2. Explain where the story will appear and for how long, and how to withdraw.
3. Clear the frame of other patients, screens, wristbands, whiteboards and notes.
4. Brief staff never to film or photograph on wards for their own accounts.
5. Have the patient, or their representative, review the final words and images before posting.

Sources: HHS: HIPAA Privacy Rule guidance on marketing, checked 15 October 2026; GMC: Using social media as a medical professional, checked 15 October 2026

Social ads usually rely on tracking code from the platform on your website. HHS guidance on online tracking says HIPAA regulated entities must not use tracking technologies in a way that results in impermissible disclosures of protected health information to tracking vendors, and that disclosing it for marketing without HIPAA-compliant authorisation would be impermissible.

In June 2024 a US federal court vacated part of that guidance: the part saying HIPAA applies when tracking connects a person's IP address with a visit to a public, unauthenticated web page about specific health conditions or providers. HHS's page notes the order and says it is evaluating next steps. Pages behind a patient login, appointment booking and symptom forms still need care, so ask your privacy officer to review every pixel and tag before you run ads.

Source: HHS OCR: Use of online tracking technologies by HIPAA covered entities and business associates, checked 15 October 2026

UK: prescription-only medicines cannot be advertised to the public under rule 12.12 of the CAP Code, and the ASA says any reference to them on your social media pages, including images and hashtags, is likely to be treated as an implied ad. A reference to a consultation for an area of treatment is likely to be acceptable if the medicine is not referred to directly or indirectly. The MHRA's Blue Guide is the detailed guidance on advertising medicines in the UK.

When people describe symptoms or treatment in comments, give general information and point them to the right service. Never confirm that someone is or was a patient, even if they say so first. Google's review advice is to never share a reviewer's private information and to ask them to get in touch privately when a situation is complex.

Sources: ASA Advice Online: Healthcare, prescription-only medicine, checked 15 October 2026; GOV.UK (MHRA): Blue Guide, advertising and promoting medicines, checked 15 October 2026; Google Business Profile Help: Tips to get more reviews, checked 15 October 2026

Write holding statements now for the situations you can predict: severe weather, IT outages, strikes, major incidents and service closures. Agree who can approve them out of hours, and pause scheduled posts when an incident starts.

Disclosure: Zolyp, which publishes this guide, makes an AI social media manager. It plans a balanced week across your content pillars, writes the captions and designs the visuals in your brand voice, and schedules them to Instagram, Facebook, LinkedIn, Google Business, X, TikTok, YouTube, Pinterest, and Threads. You can add your own photos to any post, and you start by approving every post. Zolyp does not check posts against HIPAA, GMC or ASA rules, and patient information should never be put into it. Keep clinical and communications approval in your own process. Everything in this guide works just as well done by hand.

• Each month: one series on a service, one staff series and one public health theme.
• Each quarter: review department profiles, links and visiting information.
• Before winter: prepare posts on which service to use and when.
• After an incident: thank staff and the public, and share what changes.