In our words
The rule you are working under
What the rule requires, in our words
A covered entity must obtain valid, written authorization from the patient before publishing a testimonial that uses their protected health information for marketing.
The authorization has required elements of its own — what may be used, where it may appear, when it expires, and how the patient may revoke it. If you are a psychologist or a counselor, a second rule applies before any of that: APA Standard 5.05 says psychologists do not solicit testimonials from current therapy clients, and the ACA code says the same for counselors.
Hazelsong does not interpret this rule and does not make anyone compliant with it. It gives you the record and the controls; the judgment stays yours.
What it does
What Hazelsong does about it
It records the permission as a sentence, not a checkbox
Your patient reads exactly what they are agreeing to, checks off where you may show it, and that sentence, those places and the date are kept with their words.
It enforces the places they allowed
A patient who allowed your website but not your social media cannot be turned into a social media image: the request for one comes back empty. The permission decides it on every request, not a setting you can switch off.
It will not help you ask only the satisfied patients
The 0-to-10 question is sold elsewhere with routing attached: the high answers to a public review, the rest to a private form. Here the score changes the wording of the question and nothing else, and your figure counts every answer — including the ones you chose not to publish.
A patient can check how their words were handled
Each published testimonial links to its own record: the authorization sentence they agreed to, its date, where they allowed it, whether a part was removed and whether anything was given for it. On our address, not yours, so it is not something the practice can dress up.
Your own authorization can sit beside our permission
On a form of your own (Starter and Pro), paste the authorization your lawyer wrote. The patient must check it as well as the permission or nothing is sent, and its exact words, its version and the date are kept with their testimonial, put in your export and printed on its record. Hazelsong does not write it or check it, and it does not change the places the patient allowed.
It marks personal detail before you publish
A diagnosis, a phone number, an address, another practice named by the patient — each is flagged with the reason, and can be replaced with [removed] without a word of the rest being touched.
It warns you before you ask a current client
The invite screen says plainly that a therapist's or counselor's code forbids soliciting a testimonial from a current client. The product will not help you walk into that.
What it gives you is the record and the refusal: written permission with its date, a machine that reads every testimonial for protected detail before you publish, and a widget that obeys what the patient allowed even when you forget.
Before anything is public
Read for what your rule cares about
A promised result, a figure, a claim of specialization, a client's private detail — each is marked with the words that triggered it and one plain sentence of why, and nothing is published until you approve it.
How the reading worksEvery word arrives as they wrote it — even the 555-0142 they meant to leave out.
Limits, stated
What it does not do
- Hazelsong is not a HIPAA authorization form. Its consent record has no expiry date and no revocation mechanism of its own — a compliant authorization needs both, and yours should come from your lawyer. Where you add your own, Hazelsong records that the patient checked it; whether its words are enough is not something Hazelsong judges.
- Hazelsong does not make your practice HIPAA compliant, and does not audit you.
- Nothing here is legal or clinical advice.
Your clients already wrote the words
Send one link and their words arrive here instead — with the date, with the permission, and read for risk before you publish.