Almost every doctor has had the same small moment of doubt. You're looking at your own website, or a draft your marketer sent over, and you catch yourself thinking: am I actually allowed to say that?
It's a fair question, and the honest answer is that most of the confusion is avoidable. The rules are not secret and they are not vague. But they are written in legislation, interpreted through guidelines, and usually explained to doctors either by lawyers (who are cautious to the point of unhelpful) or by marketers (who often don't know the rules at all). We want to do something different and explain them the way you'd explain them to a colleague, plainly, from a doctor-founded team that works under these same rules every day.
This is the cornerstone guide our more specific compliance resources link back to. Use it to understand the framework, then check current official guidance for the profession and advertising context before publishing.
This article is general information about advertising compliance, not legal advice. AHPRA's guidelines are the authority, and the details can change, so always check the current guidance for your profession before you publish.
Why compliance belongs at the start
Healthcare advertising works better when the regulatory constraints shape the brief, not when they arrive as a proofreading step after everyone is attached to the copy.
A claim about being "leading", a patient story built around an outcome, or a before-and-after concept may require more than changing one word. The problem can be the idea the campaign is built around.
Our working principle is:
inform clearly without manufacturing certainty, superiority or an outcome the evidence cannot support.
That still leaves plenty of room to explain services, qualifications, access, referral pathways and useful health information.
Who these rules apply to
The governing rule is Section 133 of the Health Practitioner Regulation National Law, the "National Law" that each state and territory has enacted. It governs advertising of any regulated health service, which AHPRA defines broadly as a service usually provided by a health practitioner.
Here is the part that surprises people. It doesn't only apply to registered practitioners. It applies to anyone who advertises a regulated health service or a business that provides one, including your clinic as a company, and including a marketing agency acting on your behalf. You cannot outsource your way out of it, but nor does your agency get to walk away. The guidelines define the advertiser as whoever controls the advertising, and say so explicitly: control exists where someone "publishes or authorises content or directs someone to publish or draft content (including a third party, staff member or marketing agency)". Responsibility "rests with more than one person", and "any person who authorises the advertising of services, is responsible for that advertising."
So a non-compliant claim written by your agency and published on your site can expose both of you. There is a narrow carve-out for a business that "merely... prints or publishes an advertisement for another person", such as a printer or a platform, but an agency that drafts the copy and controls the website is not obviously inside it. We say that as the agency: it is our risk too, which is exactly why we treat your compliance as our problem rather than a box you tick after we hand over.
That's also why "my web person handled it" is not a defence worth relying on. You need to actually understand the rules, or work with someone who genuinely does.
The five things the law prohibits
Section 133 sets out five categories of advertising that are not allowed. In plain English, you must not advertise a regulated health service in a way that:
- Is false, misleading or deceptive, or even likely to be. This is the big one, and most other breaches are really versions of it.
- Offers a gift, discount or inducement without stating the terms and conditions. The offer itself is fine. Hiding the conditions is the breach.
- Uses testimonials about the clinical aspects of the service or business.
- Creates an unreasonable expectation of beneficial treatment: promising results you can't guarantee.
- Encourages the indiscriminate or unnecessary use of health services.
Almost everything below is an application of one of these five. Once you can see them, you start noticing breaches everywhere, including, probably, on a few pages you've published yourself.
Testimonials: the most misunderstood rule in Australian healthcare
This is the question we get asked more than any other, so it's worth getting exactly right.
You cannot use testimonials about the clinical aspects of a regulated health service in your advertising. A testimonial, in AHPRA's sense, is a recommendation or positive statement about the clinical side of care. The test is whether the comment refers to symptoms, diagnoses, treatments, or outcomes. If it does, it's a clinical testimonial, and it cannot appear in your advertising: website, social media, brochures, anywhere.
So a glowing patient story about how your treatment cured their pain? Not allowed. A five-star review that says "Dr Smith fixed my knee and I'm pain-free"? That's a clinical testimonial, and you can't feature it.
Now the nuance that actually helps you. Not every positive comment is a testimonial. Feedback about non-clinical things, such as reception staff, communication style, how easy the practice was to deal with and wait times, does not reference clinical care, so it is not a testimonial. Those comments are fine to use.
And the part almost everyone gets wrong:
- You are not required to hunt down and remove reviews on platforms you don't control. Unsolicited Google reviews, comments on independent directories, are not something you are expected to police, even if they contain clinical detail.
- But you must not use them as advertising. Re-sharing a clinical Google review on your own website, embedding it, quoting it in a post, or soliciting clinical reviews from patients, crosses the line from "a review exists" into "you are advertising with a testimonial."
- On platforms you do control, meaning your own Facebook page or your website's reviews section, you are responsible for what appears. If clinical testimonials pile up there, you may need to turn the reviews function off.
- Don't selectively edit reviews to show only the flattering clinical ones. Curating them can itself be misleading, which is its own breach.
One genuinely useful carve-out, since it comes up for our own clients: this prohibition is about clinical aspects of a health service. Reviews of an ordinary business that isn't providing a regulated health service, say testimonials about a marketing agency or a software product, aren't caught by this rule at all. The line is clinical care, not the word "review."
Claims, superlatives, and the words that quietly cause trouble
Most misleading-advertising breaches aren't dramatic. They're a single word someone added because it sounded good.
Superlatives and comparisons are the classic trap: "best", "leading", "safest", "#1", "top". The problem is you generally can't substantiate them, which makes them misleading by default. AHPRA's cosmetic guidance goes further and explicitly calls out self-promoting language like "world's best", "magic hands", "artist", "sculptor" and similar.
Downplaying pain or risk is another. Describing a procedure as "painless", or as "safe", "risk-free" or "effective" without acknowledging possible adverse effects, creates an unrealistic expectation. Different patients experience procedures differently, and the advertising has to respect that.
Guarantee language is prohibited outright. You can't describe treatment as infallible, magical, miraculous, a certainty, guaranteed, or a sure cure. This is where the "permanent cure" and "miracle result" claims land practices in trouble. AHPRA has acted on exactly these. Any claim of benefit needs to be backed by acceptable evidence, not enthusiasm.
The mindset that keeps you safe: describe what you do, factually, and let it stand on its own. The moment you reach for a word that inflates it, you're in risk territory.
Titles: "specialist", "surgeon", and the 2023 change people miss
Titles are protected, and one recent change catches a lot of practices out.
Using "specialist", "specialises in", or "specialty" when you don't hold specialist registration in that area is misleading and can breach title-protection provisions. That one's long-standing.
The newer trap: since 2023, "surgeon" is a protected title. Only medical practitioners with specialist registration in surgery, obstetrics and gynaecology, or ophthalmology may call themselves a surgeon. A practitioner with general registration, or specialist registration in another field like general practice or dermatology, cannot advertise as a "surgeon", and that includes "cosmetic surgeon". If the term appears anywhere in your advertising, on a website, social media, letterhead, business cards or signage, it needs to come off. If you're not certain your titles are correct, that's worth an urgent check.
Before-and-after photos: high-risk, and increasingly scrutinised
If you work in cosmetic, dermatology, plastics, or dental, before/after images are one of your highest-risk assets. AHPRA treats them as having significant potential to mislead. To use them compliantly, the requirements are strict:
- Standardise the conditions. The before and after images must be as similar as possible in lighting, camera angle, background, framing, exposure, posture, clothing and makeup, so the comparison is genuine, not flattered.
- Don't edit them. No filters, retouching, airbrushing or similar. Only real, unaltered images.
- Include a "results may vary" warning.
- Get written consent from the patient for that specific use.
- Don't use images of vulnerable patients, or where the ability to consent may be impaired.
AHPRA reaffirmed and tightened these expectations for non-surgical cosmetic procedures in guidelines that took effect in September 2025, alongside a strengthened ban on influencer testimonials and new protections around advertising to under-18s. If you touch cosmetic injectables or similar, work from the current guidance, not a summary from a few years ago.
What you absolutely can say
It's easy to read all of this and conclude the safest website is a blank one. Not so. AHPRA is explicit that plenty is not just allowed but genuinely useful to patients:
- Your qualifications, training and experience, stated accurately, including where a qualification was issued.
- Professional memberships, accurately described.
- The services you offer, your locations, hours, and how to book.
- Fees and pricing. (If you advertise a discount or inducement, you must state the full terms.)
- Factual, general health education that doesn't make unsubstantiated benefit claims.
- Your AHPRA registration details, and genuine specialist registration where you hold it.
- Non-clinical feedback about the experience of dealing with your practice.
That's a lot of substance. A compliant medical website isn't a thin one. It's one built on facts a patient can rely on, rather than claims you'd struggle to defend.
The stakes, and why this is being taken seriously
The penalties are real. The current maximum for a Section 133 advertising breach is up to $60,000 per offence for an individual and up to $120,000 per offence for a company. Those figures come from a 2022 amendment to the National Law, and they have applied in every jurisdiction, including Western Australia, since July 2024. You may still see the older $5,000/$10,000 figures referenced; they're superseded, so don't rely on them.
One clarification worth making, because it circulates widely and we had it wrong here ourselves: imprisonment is not on the table for an advertising breach. That penalty attaches to the unlawful use of a protected title, calling yourself a surgeon or a specialist when you are not, which is a separate offence under the National Law. An advertising breach carries a fine and regulatory consequences for your registration, which is serious enough without the embellishment.
Enforcement has stepped up too, particularly in cosmetics. AHPRA investigated around 360 notifications about non-surgical cosmetic procedures between September 2022 and March 2025, with around 300 of those since closed, and its cosmetic surgery hotline has taken more than 1,500 calls. This is not a theoretical risk sitting in a dusty guideline.
How to actually stay on the right side of this
You don't need to memorise the National Law. You need a habit. Before anything goes live on your site, run it through four questions:
- Is every claim factual and substantiated? If you couldn't defend it with evidence, cut it or soften it.
- Does anything here read as a clinical testimonial? Patient outcomes, success stories, clinical reviews: out.
- Are the titles correct? Especially "specialist" and "surgeon".
- Would a reasonable patient come away with an unrealistic expectation? If yes, rework it.
That four-question pass catches the overwhelming majority of breaches, and it takes minutes.
This is also, frankly, why we do compliance review as part of building a site rather than as an afterthought. Getting the copy right the first time is far cheaper than a notification. If you'd rather not carry the risk of interpreting all this yourself, our AHPRA-compliant content service exists precisely for that: content written and reviewed to stay on the right side of these rules, by people who understand both the medicine and the marketing. And if cosmetic advertising is your world specifically, we go deeper on the recent crackdown in our guide to AHPRA's 2025 cosmetic advertising changes.
Get the rules right once, build the habit, and the small moment of doubt goes away. You stop wondering whether you're allowed to say something, because you already know.