Rehab Alumni Program Marketing Without HIPAA or FTC Risk

Rehab alumni program marketing works when your alumni coordinator keeps care and promotion on separate tracks, with written authorization before any story, photo, or review request leaves the building. Alumni are your strongest organic proof, but a public reply that confirms someone was a patient, or a video shot without a signed HIPAA authorization, creates risk that no referral will repay. Here's where the clean lines sit.

Rehab alumni program marketing starts with separating care from promotion

Your alumni program has two jobs, and they belong to two different groups of people. The first is care: check-ins, recovery meetups, relapse-prevention support, and a warm line back to clinical staff. The second is promotion: reviews, testimonials, video, and social proof. When the same person runs both with one shared contact list, a coordinator's friendly text about a review can read as pressure from the people who treated that alumnus.

Start with the list itself. Alumni contact data collected for care purposes shouldn't flow into your marketing platform by default. Under HIPAA (45 CFR Part 164), the fact that someone was a patient is protected information, so an email export from your EHR into a newsletter tool needs a documented basis. Ask your compliance lead, and your counsel, which uses are covered before anyone builds that connection.

Next, give promotion its own opt-in. An alumnus who wants to share a story should say so through a separate form that states what will be published, where, and for how long. A signed HIPAA authorization comes before any identifiable photo or video, and the person should be able to say no without losing access to alumni events or support.

Finally, decide who touches what. A workable split looks like this:

1. 1The alumni coordinator runs care touchpoints and never asks for reviews during them.
2. 2Marketing sends promotion requests only to alumni who opted in through the separate form.
3. 3Compliance signs off on every story, clip, and review reply before it goes public.

That structure also makes your social media and community work easier to run, because every post already has a documented permission behind it.

Review requests that stay inside the FTC Consumer Review Rule

The FTC Consumer Review Rule rules out the most common alumni review tactic, which is sending the request only to people you expect to be happy. If your coordinator filters the list by who sounds positive before the link goes out, that's review gating, and it's prohibited.

The safer approach is to send the same neutral request to every alumnus who opted in to promotion through the separate form described above. The message should invite an honest review on Google or another platform and make clear that any experience is welcome. It shouldn't suggest what to say, and it shouldn't ask for a rating before sharing the link.

Incentives need the same care. A gift card, raffle entry, or event discount can't depend on a positive rating, and it's wise to ask your counsel whether any reward tied to leaving a review is worth the exposure. Staff reviews are a separate problem. Posting a review as if you were an alumnus, or asking employees and their families to do it, counts as a fake review under the rule.

The practical workflow is short:

1. 1Pull the opt-in list only, never the full discharge roster.
2. 2Send one identical request, with a direct link and no scripted wording.
3. 3Leave the results alone, including critical reviews, and route them to compliance for a reply that follows HIPAA.

Our own view, after building these workflows for behavioral health teams, is that a plain request and a steady trickle of mixed reviews looks more credible to a family reading them than a wall of five-star praise. Our post on why review strategy matters in behavioral health marketing covers how those reviews affect admissions calls.

Public review replies and what HIPAA lets you say

A reply to a Google review is public, so a line like "Thanks for trusting us with your recovery" confirms the reviewer was a patient, and under HIPAA (45 CFR Part 164) that confirmation is a disclosure. The same applies when the reviewer posts under their own name and describes their stay in detail. The reviewer can share their own story, but your facility can't confirm or add to it without a valid written authorization.

A compliant reply speaks to the situation in general terms and never acknowledges treatment. It can thank the person for taking the time to write, say that you take feedback seriously, and offer a direct line for follow-up. It shouldn't mention dates, programs, staff names, or anything about the reviewer's care, even when the review is unfair and you're tempted to correct the record.

For a facility that treats substance use, 42 CFR Part 2 adds its own limits on confirming patient status, so the safe default is the same neutral language everywhere.

Build the reply process around a short template and a single approver:

Marketing drafts the reply from a pre-approved template, with no case details.

Compliance reviews it before it posts, especially for critical or highly specific reviews.

The reply invites the person to contact a named number or email, and the real conversation moves offline.

Keep the template short, and don't customize it with details from the reviewer's post. Staff who respond from memory of a patient's file are where most violations happen, so remove that option. Replies to positive reviews follow the same rules as replies to negative ones, which means a warm "we're so glad your stay helped" is just as risky as a defensive one.

Alumni video and photos need written authorization first

A face, a voice, or a recognizable setting in a clip is enough to identify a former patient, so every alumni video or photo needs a signed HIPAA authorization before the camera turns on. Verbal consent, a social media comment, or a sign-up sheet at an alumni dinner won't count. The same applies to group shots at events, where a former patient may be visible in the background of someone else's photo.

The authorization form should name what's being captured, where it will appear, and who can see it. It should also say that the alumnus can revoke permission in writing and that saying no won't affect their access to alumni care. Your counsel should draft or approve the form, because the required elements are specific.

On the day of a shoot, expect to handle a few things in order:

Confirm the signed authorization is on file before anyone sets up lighting or sound.

Let the alumnus review the final cut and approve it before it publishes.

Keep clinical areas, whiteboards, intake paperwork, and other patients out of frame.

Revocation needs a plan too. If someone withdraws permission, your team should know which website pages, social posts, and ad creative carry that clip so it can come down quickly. A simple log of where each asset lives makes that possible.

We build on-site video around those boundaries, with authorization and approval steps set up before filming. Our PR for rehab centers work follows the same rule for press features, where an alumnus's story gets the same written permission as any clip on your own channels.

Referral thank-yous and the EKRA line for alumni coordinators

Alumni often send the most valuable referrals you'll get, a friend, a coworker, or a family member who needs care, and the way you thank them decides whether the practice stays legal. EKRA (18 U.S.C. 220) prohibits paying or rewarding anyone per patient or per admission for referrals to recovery homes, clinical programs, and labs. That covers cash, gift cards, and any bonus that rises with the number of people who enter treatment.

The same rule applies to your own staff. An alumni coordinator can't have a salary, commission, or bonus tied to how many alumni referrals turn into admits. If a coordinator's pay depends on census numbers from that channel, have counsel review the arrangement before it continues.

A thank-you that doesn't depend on an admission looks different. A handwritten note, a public thank-you at an alumni event that names no one's treatment, or an invitation to a recovery meetup doesn't change based on whether the referred person was admitted. Don't tell the alumnus whether the person they referred enrolled, because that confirms patient status under HIPAA and 42 CFR Part 2. Here's a clean way to handle it: thank everyone who shares your name, and let the person they referred contact admissions on their own terms.

Keep tracking separate from rewards as well. Your admissions team can note "referred by an alumnus" as a source category without naming the alumnus in marketing reports. Our post on EKRA marketing compensation covers how to structure those arrangements for agencies, marketers, and internal staff.

How Sweet Media builds on-site video, review workflows, and alumni community

We're a behavioral health marketing agency in Costa Mesa, California, and we build alumni systems so the paperwork is finished before any content gets made. Your compliance lead and counsel stay in charge of the authorization language. Our job is to turn those rules into a production process your team can repeat.

For on-site video, we plan the shoot around your signed authorizations. That means a shot list that keeps clinical areas and other patients out of frame, an approval step where the alumnus sees the final cut, and an asset log that records every page, post, and ad carrying each clip. If someone revokes permission, your team can find and pull the clip the same day.

For reviews, we set up one neutral request that goes only to alumni who opted in to promotion. We route every incoming review, including critical ones, to a reply template that compliance has already approved. We don't script wording, filter recipients by sentiment, or attach rewards to ratings.

For community, we build your social media presence around alumni events and recovery milestones that carry no identifying detail unless authorization is on file. Your coordinator keeps running care, and marketing works from its own opt-in list.

Our tracking uses a "referred by an alumnus" source category, so you can see whether the channel produces calls without naming anyone in a report.

If your alumni program already produces stories and referrals but has no clean process behind them, we can audit that workflow with you. Book a free strategy call through our contact page or reach us at (714) 503-8548.