In our words
The rule you are working under
What the rule requires, in our words
A covered entity must obtain valid, written authorization from the patient before publishing a testimonial that uses their protected health information for marketing.
The authorization has required elements of its own — what may be used, where it may appear, when it expires, and how the patient may revoke it. If you are a psychologist or a counselor, a second rule applies before any of that: APA Standard 5.05 says psychologists do not solicit testimonials from current therapy clients, and the ACA code says the same for counselors.
Hazelsong does not interpret this rule and does not make anyone compliant with it. It gives you the record and the controls; the judgment stays yours.
What it does
What Hazelsong does about it
It records the permission as a sentence, not a checkbox
Your patient reads exactly what they are agreeing to, checks off where you may show it, and that sentence, those places and the date are kept with their words.
It enforces the places they allowed
A patient who allowed your website but not your social media cannot be turned into a social media image: the request for one comes back empty. The permission decides it on every request, not a setting you can switch off.
It marks personal detail before you publish
A diagnosis, a phone number, an address, another practice named by the patient — each is flagged with the reason, and can be replaced with [removed] without a word of the rest being touched.
It warns you before you ask a current client
The invite screen says plainly that a therapist's or counselor's code forbids soliciting a testimonial from a current client. The product will not help you walk into that.
What it gives you is the record and the refusal: written permission with its date, a machine that reads every testimonial for protected detail before you publish, and a widget that obeys what the patient allowed even when you forget.
Before anything is public
Read for what your rule cares about
A promised result, a figure, a claim of specialization, a client's private detail — each is marked with the words that triggered it and one plain sentence of why, and nothing is published until you approve it.
How the reading worksEvery word arrives as they wrote it — even the 555-0142 they meant to leave out.
Limits, stated
What it does not do
- Hazelsong is not a HIPAA authorization form. Its consent record has no expiry date and no revocation mechanism of its own — a compliant authorization needs both, and yours should come from your lawyer.
- Hazelsong does not make your practice HIPAA compliant, and does not audit you.
- Nothing here is legal or clinical advice.
Your clients already wrote the words
Send one link and their words arrive here instead — with the date, with the permission, and read for risk before you publish.