AHPRA Social Media Policy: The Rules for Practitioners and Practices

Key Takeaways

• Ahpra's social media guidance does not create new rules; it applies existing ones online. The s 133 advertising prohibitions, the testimonial ban, confidentiality obligations and the professional Codes of Conduct all reach social media.
• A practice is responsible for content it controls or adopts: its own posts, patient stories it shares, comments it pins or replies to approvingly and reviews it republishes.
• Personal accounts are not a safe harbour. Practitioners have faced regulatory action over personal posts where the conduct fell short of professional standards or undermined public confidence, even without naming patients or the practice.
• Patient confidentiality is breached more easily than people expect: a de-identified story can still identify a patient to their community, and consent to treatment is not consent to content.
• The fix is a system, not a memo: who may post, what gets approved, how comments and reviews are handled and what happens when something goes wrong.

1. 1.The Practice Account Is Advertising, Full Stop
2. 2.Patient Stories, Consent and Confidentiality
3. 3.The Personal Account Problem
4. 4.Comments, Reviews and the Content You Did Not Write
5. 5.The System a Practice Actually Needs
6. 6.Frequently Asked Questions

Social media is where the advertising rules, the professional conduct rules and ordinary human behaviour meet, usually at speed and often at 9pm. Ahpra's social media guidance exists because the platforms blur lines the National Law keeps sharp: between the practice's voice and the practitioner's, between a patient's own words and the practice's advertising, and between a private opinion and a professional standard. The guidance is short. Its implications for how a practice actually runs its accounts are not.

This article covers the practice account, the personal account, the recurring content problems (patient stories, reviews, before-and-afters) and the compliance system that keeps a practice out of the regulator's inbox. It pairs with our guide to the AHPRA advertising guidelines, which covers the underlying s 133 prohibitions in detail.

The Practice Account Is Advertising, Full Stop

Everything a practice posts about its services is advertising a regulated health service, so every s 133 prohibition applies: nothing misleading, inducements only with their terms, no testimonials about clinical care, no unreasonable outcome expectations, nothing that pushes unnecessary treatment. The platform does not soften the rule. A boosted Instagram reel is held to the same standard as a billboard, and a caption written in ten seconds carries the same exposure as approved campaign copy.

Two platform-specific mechanics deserve attention. First, engagement is adoption: when the practice pins a glowing comment, replies "so glad you loved your results!", or reshares a patient's story to its own account, it has arguably used a testimonial in its advertising even though a patient wrote the words. Second, ephemerality is not a defence: stories and live streams are advertising while they run, and screenshots outlive them.

Patient Stories, Consent and Confidentiality

Confidentiality on social media is breached by inference as often as by name. A practice in a small community that posts "our wonderful patient came in for X" can identify that patient to everyone who matters to them without ever naming them. De-identification has to survive the audience who knows the patient, not just a stranger's reading.

Consent needs the same care. Consent to treatment is not consent to content, and consent to content is not perpetual: a patient is entitled to change their mind, and the practice needs a process for taking material down when they do. For clinical images, the advertising guidelines' conditions on before-and-after photographs apply on social platforms exactly as they do on the website, and for cosmetic work the dedicated guidance adds more.

The Personal Account Problem

The uncomfortable part of Ahpra's guidance for many practitioners is that registration does not switch off at the end of the workday. The Codes of Conduct require behaviour consistent with professional standards, and regulators and tribunals have treated public social media conduct as capable of falling short of them: giving clinical advice in comment threads, commentary that undermines public health messaging in a practitioner's field, disparaging patients or colleagues, and content that ties identifiable clinical work to a personal brand without the safeguards the professional account would apply.

None of this means practitioners cannot have opinions or a public presence. It means the account bio saying "views my own" does not change who the regulator considers you to be. The practical test we give clients: assume any post could be read aloud at a notification assessment with your registration number attached, because that is precisely how it would arrive.

Comments, Reviews and the Content You Did Not Write

Practices are not automatically responsible for everything third parties post at them. They become responsible for what they control and what they adopt. A review sitting on Google is the platform's content; the same review quoted in your highlights is yours. An unsolicited comment describing a patient's recovery is theirs; your reply celebrating the outcome starts to look like use. The guidance expects practices to moderate what they reasonably can, and a comment policy plus a takedown habit is usually enough, provided someone actually operates it.

The System a Practice Actually Needs

• Named ownership. One person accountable for every account, including the ones a former employee set up.
• An approval path for clinical content. Anything describing treatments, outcomes or offers gets a second set of eyes against the s 133 checklist before it posts.
• A consent process for patient content. Written, specific to marketing use, revocable, with a takedown workflow.
• Comment and review handling rules. What gets hidden, what gets a neutral reply, what never gets engaged with, and the standing rule that clinical detail never goes in a public reply.
• A personal-accounts clause. Employment agreements and contractor terms should say what staff may post about the practice and its patients, because the practice wears the fallout either way.
• An incident response habit. When a post goes wrong, screenshot, take down, assess whether it is a notification risk and get advice before responding publicly. Our AHPRA investigation guide covers what happens if the regulator is already involved.

Frequently Asked Questions

Does AHPRA really look at personal social media accounts?

Notifications do, which amounts to the same thing. Complaints from patients, colleagues and members of the public routinely attach screenshots of personal posts, and the assessment considers whether the conduct meets professional standards regardless of which account carried it.

Can my practice reshare a patient's positive post about us?

Treat a reshare as using a testimonial in your advertising. If the post speaks to clinical aspects of care, resharing it to the practice account is the kind of use the National Law prohibits, even though the patient wrote it freely.

Can I answer clinical questions in comments or DMs?

General information is safer than advice, and public replies should never include clinical detail about an identifiable person. The moment a reply becomes advice to a specific person about their situation, you have created a practitioner-patient interaction in a public, permanent medium.

Who is liable if our marketing agency posts something non-compliant?

The practice remains exposed: s 133 binds the person advertising the regulated health service, and the campaign is being run for you. Agency agreements should require compliance with the National Law and the Ahpra guidelines and give you approval rights over clinical content.

Auditing your accounts, or dealing with a post that went wrong? Call Astris Law on (07) 3519 5616. See our AHPRA advertising guidelines explainer and our health and medical industry page.

This article is for general information purposes only and does not constitute legal advice and should not be relied on as such. While we take reasonable care to ensure the accuracy of the information provided, we make no representations or warranties as to its completeness, currency or reliability. We accept no liability for any loss or damage arising directly or indirectly from the use of, or reliance on, this website's content. You should always seek professional advice tailored to your specific circumstances before acting on any information in this article. Liability limited by a scheme approved under Professional Standards Legislation.