Start with the broader framework: Healthcare Advertising & AHPRA: A Practical Guide for Australian Practices.
This is the single most common question we get from practice managers, and it usually arrives with a hopeful tone: we've got all these lovely reviews, surely we can put them on the site?
The instinct is completely understandable. You've done good work, patients are grateful, and social proof is how the rest of the internet builds trust. Then someone mentions AHPRA and the whole thing feels like a minefield. So people either paper the website with testimonials and hope nobody notices, or they panic and strip out every positive word a patient ever said. Both reactions are wrong, and the truth sits in a more workable place in between.
Here's the short version, then we'll show you exactly where the line is. You mostly cannot use reviews that touch clinical care. You have more room than you think with everything else. And the Google reviews sitting on your listing right now are almost certainly fine to leave alone.
This article is general information about advertising compliance, not legal advice. AHPRA's guidelines are the authority and the details change over time, so check the current guidance for your profession before you publish. This piece builds on our longer AHPRA advertising rules guide, which is the place to start if you want the full picture.
The short answer, and why the rule exists
Under Section 133 of the Health Practitioner Regulation National Law, you must not advertise a regulated health service using a testimonial about the clinical aspects of that service. That's the law, and it's not new or ambiguous.
The reason matters, because once you understand it the rest becomes intuitive. Think about who reads a patient testimonial. It's often someone unwell, worried, and trying to decide who to trust with their health. A glowing story about how a treatment cured someone else is powerful precisely because that reader is vulnerable and hungry for reassurance, and one person's outcome tells you almost nothing about what will happen to the next person.
Medicine doesn't work like a restaurant review. Two patients with the same diagnosis can have completely different results for reasons neither of them controls. A testimonial flattens all of that into "it worked for them, so it'll work for me," which is exactly the false expectation the law is trying to prevent. Any clinician has sat across from a patient carrying hope built on someone else's story, and it's a hard thing to gently unwind. The rule isn't bureaucratic caution. It's patient protection, and as a doctor-founded team we think it's right.
What actually counts as a "testimonial"
AHPRA's definition is broader than most people assume. A testimonial is a positive statement about a person or thing, so a negative review is not a testimonial, and it's caught by the ban when it refers to the clinical aspects of care.
A clinical aspect is present if the comment expresses any of these:
- A symptom: the reason the patient sought care ("I came in with crippling back pain").
- A diagnosis: the condition identified.
- A treatment: the specific procedure or care provided.
- An outcome: the result ("I'm completely pain-free now").
If a review touches any of those, it's a clinical testimonial and it cannot appear in your advertising: website, social media, brochures, ads, anywhere you control the message.
Here's the distinction laid out plainly:
| Comment | Clinical? | Usable in advertising? |
|---|---|---|
| "Dr Lee removed my skin cancer and I healed perfectly." | Yes, diagnosis plus outcome | No |
| "The treatment fixed my migraines completely." | Yes, symptom plus outcome | No |
| "Reception was warm and I never waited long." | No | Yes |
| "Easy to book, clear communication, great parking." | No | Yes |
| "Billing was transparent and the rooms were spotless." | No | Yes |
The test is quick: does the comment mention a symptom, diagnosis, treatment or outcome? If yes, leave it off. If it's purely about the experience of dealing with your practice, it's fair game.
The part everyone gets wrong: Google and third-party reviews
This is where practices tie themselves in knots, so it's worth being precise.
You are not required to remove reviews where you do not control the review function. AHPRA does not expect you to hunt down, edit or try to delete reviews patients leave on independent platforms. You remain responsible for profile content and advertising you control. A patient sharing their own experience online is not, by itself, your use of a testimonial.
That's a relief for most practices, because the fear that every clinical Google review is a liability simply isn't true. Those reviews existing is not you advertising.
The line you must not cross is using them. You breach the rule the moment you take a clinical review and turn it into advertising:
- Re-sharing or embedding a clinical Google review on your own website.
- Quoting a patient's clinical story in a social post or an ad.
- Screenshotting flattering clinical reviews into a "what our patients say" section.
- Asking patients specifically for praise about their treatment or outcome and then using it in advertising.
There's a subtler trap too. Engaging with a clinical review may amount to using the testimonial in advertising. Do not repeat or endorse clinical praise, and never confirm a diagnosis, treatment or patient relationship in public. Where a review contains clinical content, the lowest-risk option is not to reply.
And on platforms you do control, such as your own website's review widget or your Facebook page's recommendations, you are responsible for what appears. If clinical testimonials accumulate there, the fix may be to switch the reviews function off. You can't claim "the patients posted it, not me" when it's your surface displaying it.
One last thing practices do that quietly creates risk: selectively showing only the glowing clinical reviews. Curating the flattering ones and hiding the rest can be misleading in its own right, which is a separate breach. If you're going to show feedback, don't cherry-pick it into something rosier than reality.
Star ratings, awards, and the "review of the business" carve-out
A couple of nuances worth knowing, because they open up genuine, compliant options.
Star ratings and award symbols. AHPRA says publishing an award symbol or rating is not likely to breach the testimonial prohibition unless you also republish the underlying testimonials. The rating must still be current, accurate and not misleading. Do not pair a rating with clinical review excerpts or patient outcome stories.
Reviews of your business, not your clinical care. The prohibition is specifically about the clinical aspects of a regulated health service. Feedback about an ordinary business that isn't providing clinical care isn't caught at all. That's why a marketing agency, a software company, or a consultant can happily publish client testimonials, including us. The line AHPRA draws is clinical care, not the word "review." If your practice runs a genuinely non-clinical arm, the same logic can apply, but be honest about where the clinical service starts.
What you can safely do instead
Read all of the above and it's tempting to conclude the safe website has no social proof at all. Not true. There's plenty you can do that builds trust without going near the line:
- Publish non-clinical feedback. Comments about reception, communication, ease of booking, wait times, accessibility, billing clarity, and the feel of the rooms are not testimonials. This is real, usable social proof.
- Show an accurate overall rating without the clinical stories. Keep it current and do not republish the underlying clinical reviews.
- Leave independent Google reviews where they are. Do not import them. Treat replies to reviews containing clinical praise cautiously because engagement may amount to using the testimonial.
- Lead with substance. Your qualifications, training, memberships, the services you offer, your fees, and factual health education are all not just permitted but genuinely useful. A trustworthy medical site is built on verifiable facts, not on borrowed outcomes.
- Reframe the win. Instead of "this treatment changed my life," a compliant site says what you do, who you are, and why patients find the practice easy to deal with. That's more durable trust anyway.
If you want a system for gathering the safe feedback, managing your Google presence, and keeping replies compliant, that's exactly what our Google Business Profile service is built to do. It collects and surfaces the non-clinical social proof you're allowed to use, and handles the review platforms properly rather than nervously.
The habit that keeps you safe
You don't need to memorise the National Law to get this right. You need one reflex before anything with a patient's words goes live: does this mention a symptom, diagnosis, treatment, or outcome?
If it does, it doesn't go on a surface you control. If it's about the experience of dealing with your practice, it may be usable if it is accurate and not misleading. Leave independent reviews where they are, do not import clinical praise, and treat any public reply to clinical content cautiously.
That single question resolves the vast majority of the anxiety we hear about reviews. It's not that you can't show social proof. It's that the proof has to be about the experience, not the medicine.
Getting this right at the design stage is far cheaper than untangling it after a complaint, which is why we bake it into how we build. If you'd rather not carry the risk of interpreting all of this yourself, our AHPRA-compliant content service writes and reviews your site to stay on the right side of these rules, and our Google Business Profile service handles the reviews side properly. Either way, the goal is the same: a website patients trust, built on things you can actually stand behind.
