FTC Authority Is Not HIPAA
These get mixed up constantly. HIPAA is enforced by HHS Office for Civil Rights and it binds covered entities and their business associates. If you are a health educator selling courses, you are usually neither, so HIPAA usually does not reach you. That is not the end of it. The FTC reaches deceptive or unfair data practices by almost any commercial actor under Section 5, including broken privacy promises and sloppy handling of health information, whether or not HIPAA applies to you.
The FTC also enforces the Health Breach Notification Rule at 16 CFR Part 318. It covers vendors of personal health records, related entities and their service providers, which since the 2024 amendments plainly includes many health and wellness apps. If you build or operate anything that collects identifiable health information from users, read Part 318 and do not assume that being outside HIPAA means being outside notification duties.
Where the FTC's Authority Comes From
Most health content creators know they need a disclaimer somewhere. Fewer understand that the FTC's 2023 updates to the Endorsement Guides fundamentally changed what is required, and that the old "results not typical" language is no longer sufficient.
The FTC's authority comes from Section 5 of the FTC Act, 15 U.S.C. 45, which prohibits unfair or deceptive acts or practices in or affecting commerce. Health claims, testimonials and endorsements in commercial contexts all fall inside it. The rules for endorsements are set out in the Endorsement Guides at 16 CFR Part 255. The Guides are interpretive: they are the FTC's statement of how it reads Section 5, not a standalone rulebook. The FTC's usual first move is an investigation or a demand that the conduct stop, followed by a consent order. Civil penalties are a second stage remedy. Under Section 5(l) they apply when someone violates a final order, and under Section 5(m)(1)(B) when someone received a Notice of Penalty Offenses and did the thing anyway. The Endorsement Guides are interpretive guidance, not a rule, so breaking them does not by itself trigger a fine. The per violation maximum is adjusted for inflation every January and published at 16 CFR 1.98, so check that section rather than relying on a number you read in a blog post. Consumer redress under Section 19 is the more realistic exposure for most creators.
This post covers the requirements that come up most for health educators, supplement recommendations and testimonial based marketing.
One thing first. I am a PharmD, not an attorney. This is general information about how the FTC approaches health advertising, current as of publication, and it is not legal advice and does not create an attorney client relationship. The FTC's Endorsement Guides are interpretive guidance rather than binding rules, they change, and state consumer protection law, state scope of practice rules and individual platform policies all apply on top of anything here. If real money or your license is on the line, have a lawyer licensed in your state look at your specific claims.
The 2023 Endorsement Guide Updates
What the 2023 revision actually changed: "clear and conspicuous" now has a written definition at 16 CFR 255.0(f), meaning difficult to miss and easily understandable, with a visual disclosure for a visual claim, audio for an audio claim, and both for video; tagging a brand can itself be an endorsement, alongside fake reviews and virtual influencers; a platform's built in disclosure tool may not be adequate on its own; procuring, suppressing, boosting or editing consumer reviews is addressed in detail, including incentivized reviews, employee reviews and fake negative reviews of competitors; and advertisers, endorsers and intermediaries each carry their own liability.
The rules below on material connections, typicality and honest opinions are older than 2023, but they are the ones that catch people:
Material connections must be disclosed clearly and conspicuously. If you receive a product for free, if you are paid to mention something, or if you have an affiliate relationship, that must be disclosed in a way that is hard to miss. A small asterisk at the bottom of a page does not satisfy this requirement.
"Results not typical" does not save an atypical testimonial. This is not new. The FTC killed that safe harbor in the October 2009 revision of the Guides and it has been the rule ever since. Under 16 CFR 255.2(b), if you feature a testimonial about a central benefit of your product or program, you are treated as claiming the endorser's result is what consumers will generally get. Either hold substantiation that the result is representative, or clearly and conspicuously disclose the performance consumers can generally expect. A disclaimer saying the result is unusual is the thing the FTC says does not work.
Endorsements must reflect honest opinions. You cannot feature a testimonial from someone who was paid to give it without disclosing the payment. You cannot feature a testimonial that you know is not representative of typical results without the required disclosures.
Social media disclosures go in the post itself. A disclosure in your bio, on an about page, or in a separate post does not cover an individual endorsement, because people land on the single post without ever seeing your profile. Four specifics the FTC names. Put it at the front, not the end, since disclosures behind a MORE tap are easy to miss. Do not bury it in a hashtag block: #ad and #sponsored are fine, while sp, spon, collab, thanks and ambassador are not. In video, say it in the video, because the description field is not enough, and repeat it periodically on a livestream. And do not lean on the platform's label, because the 2023 revision states a platform's built in tool might not be adequate.
Prohibited Language for Health Educators
Two agencies police health claims and they are not interchangeable. The FDA regulates labeling and decides what counts as a drug claim. The FTC regulates advertising and asks whether a claim is deceptive and whether you can substantiate it. Clearing one does not clear the other. The claim types below draw attention from one or both:
Disease claims: Any statement that a product diagnoses, cures, treats, mitigates, or prevents a disease. "This supplement cures diabetes" is a drug claim that requires FDA approval. "This supplement supports healthy blood sugar levels" is a structure/function claim under FDA labeling rules. That does not make it safe with the FTC. The FTC's Health Products Compliance Guidance says the DSHEA structure/function provisions do not govern how the FTC evaluates the same claim in advertising. You still need competent and reliable scientific evidence that the product does what you are saying it does. Rewriting a disease claim into structure/function language changes which agency's line you are near, not whether you need proof.
Unsubstantiated efficacy claims: Any claim about a product's effect that you cannot back with competent and reliable scientific evidence. The FTC defines that as tests, analyses, research or studies conducted and evaluated objectively by qualified people, using procedures generally accepted in the field as producing accurate and reliable results. For a health benefit claim the agency says randomized controlled human trials are the most reliable evidence and are generally what experts would require. The research also has to match what you are selling: the same or an essentially equivalent formulation and dose, studied in a comparable population. A mechanism paper, an animal study, or a trial on a different dose of a different form does not carry a human benefit claim.
Deceptive testimonials: Testimonials that are not representative of typical results, without the required disclosures.
Compliant Language Patterns
The following patterns are compliant for health educators:
Structure/function claims: "Supports healthy [body function]," "promotes [normal physiological process]," "helps maintain [normal health state]." These describe how a nutrient or ingredient affects normal structure or function, not how it treats a disease.
Educational framing: "Research suggests that [nutrient] may play a role in [physiological process]. This is not medical advice. Consult your healthcare provider before making changes to your supplement regimen."
A workable testimonial structure: "Sarah completed the program in [timeframe] and reported [specific result]. Across [number] participants, the typical result was [actual figure from your own data]. Sarah received [free access, a discount, payment] in exchange for sharing her experience."
Note what is not in there. No "individual results vary" and no "results may not be typical". Those are the disclaimers the FTC found do not work, which is why the safe harbor is gone. The affirmative statement of typical results is what does the work, and it requires you to actually have outcome data on your own participants. If you do not have that data, you do not have a compliant testimonial, you have a testimonial you should not run yet.
The Affiliate Disclosure Requirement
If you use affiliate links (Fullscript, Amazon, supplement brands), every post, page, or video that contains those links must include a clear disclosure. The FTC's guidance says the disclosure must be:
- Clear and conspicuous as 16 CFR 255.0(f) defines it, meaning difficult to miss and easily understandable by ordinary consumers
- Unavoidable, not something the reader has to click, scroll or expand to reach
- In the same form as the claim: visual disclosure for a visual claim, audible for a spoken one, both for video
- In close proximity to the endorsement or link, and better still, part of it
- In plain language, not legal or industry phrasing
A compliant disclosure: "This page contains affiliate links. If you purchase through these links, I may earn a commission at no additional cost to you."
An insufficient disclosure: A small asterisk that links to a separate disclosure page.
The Educator vs. Coach Distinction
Calling yourself an educator rather than a coach or practitioner does nothing for you with the FTC. There is no title based protection anywhere in Section 5 or the Endorsement Guides. The agency asks what your marketing conveys to a reasonable consumer taken as a whole. Titles do matter for state scope of practice and licensure, which is a separate body of law with separate regulators. An educator shares information. A coach or practitioner implies a professional relationship with specific outcomes.
The FTC looks at the totality of the representation, not just the title. If your marketing implies that your program will produce specific health outcomes, the title "educator" does not protect you from FTC scrutiny of those implied claims.
The safe approach: describe what your program teaches, not what it will do for the client. "You will learn how to read your lab results" is safer than "You will optimize your health." The first is an educational outcome. The second is a health claim.
Building Compliance Into Your Content System
The most practical approach is to build compliance into your content creation workflow rather than reviewing for compliance after the fact.
For every piece of content that includes a health claim, testimonial, or product recommendation, run it through these questions:
1. Is this a structure/function claim or a disease claim? If it is a disease claim, rewrite it.
2. Is this testimonial representative of typical results? If not, add the required disclosure.
3. Is there a material connection that needs to be disclosed? If yes, add the disclosure in the content itself.
4. Is the educational framing clear? Does the content make clear that this is information, not medical advice?
5. Does this piece contain before and after imagery? Photos make a performance claim as surely as words do. You need substantiation that the depicted result is representative, or a clear disclosure of what people generally achieve, plus disclosure of anything else the person was doing at the time, such as a diet, a medication or a training program.
6. Do I already hold the substantiation, in writing, for every efficacy claim in this piece? Substantiation has to exist before the claim goes out, not after someone questions it.
That review takes a few minutes and heads off the errors that come up most often. It is not a substitute for a lawyer reviewing your program's claims, and it does not eliminate risk.
The Takeaway
The core of FTC compliance for health content creators comes down to a few habits: know the difference between a structure/function claim and a disease claim, disclose material connections clearly and conspicuously and in the post itself, hold your substantiation before you publish, and make testimonials representative or disclose what typical results actually are. The habits are learnable. The judgment calls at the edges are not, and that is where you pay a lawyer.
The 2023 revision raised the bar on reviews and on what counts as a clear and conspicuous disclosure. The typicality rule is older than that and has applied since 2009. Build the compliance review into your workflow from the start.