<
Compliance Charter

Most agencies say
"we follow all the rules."

We're going to tell you exactly which ones, and exactly what we do about each.

Last updated: May 06, 2026 · Reviewed quarterly
Why this page exists

Your license is the most expensive thing you own. An agency that doesn't understand healthcare can vaporize it in a single Reel.

We built White Coat Media so doctors would stop having to choose between staying offline and risking a board complaint. This page is the receipt. If anything below isn't true on the day you read it, we want to hear about it.

What we commit to
  • Every team member who touches client work completes HIPAA training before their first day on a healthcare account. We re-train annually.
  • We sign a Business Associate Agreement (BAA) with any client who requests one, before any patient-adjacent work begins.
  • We use encrypted, access-controlled storage for any client material that could contain PHI.
  • We never request, store, or post identifiable patient information without written, specific authorization tied to that exact use.
  • If a patient appears in client content, the client provides us with the signed media release. We keep a copy. No release, no post.
What this means in practice

If a clinic sends us a clip and there's a chart visible in the background, we flag it before it goes anywhere near an editing timeline. That's the job.

What we commit to
  • Every sponsored post, paid partnership, or affiliate link gets a clear, conspicuous disclosure (#ad, "paid partnership," or platform-native disclosure tools), not buried in hashtags, not in the third line of the caption.
  • Testimonials reflect the typical experience or are clearly labeled when they don't.
  • We don't write reviews from the client's voice. If you didn't say it, we don't post it as if you did.
  • Health claims are tied to evidence we can show on request, or they don't run.
What this means in practice

If a brand offers your practice $5K to post about a supplement and we don't believe the evidence holds, we'll tell you and we won't write the post. You can override us. We'll document that you did.

What we commit to
  • We maintain a working file on advertising rules for every U.S. state where our clients practice. These rules differ, what's fine in Texas can be a violation in California.
  • Before launching any campaign, ad, or recurring content series, we cross-reference your state's specific physician advertising regulations.
  • We flag risky language before it ships: "best," "leading," "guaranteed," "cure," "#1," and unsupported superlatives get cut or qualified.
  • We keep your professional designations accurate (MD vs DO, board-certified in what, state of licensure when relevant).
What this means in practice

When a strategy meeting produces the line 'the only practice in the city offering X,' we're the ones who say prove it or change it.

What we commit to
  • Written, specific consent from the patient for the exact use (social, ads, website, all of the above). General clinic intake forms don't count.
  • Right to revoke. If a patient asks for their photo to come down, it comes down within 48 hours and we document the removal.
  • No deceptive editing. Color, lighting, angle, and crop are matched between before and after. No filters, no liquify, no retouching that misrepresents the result.
  • Realistic framing. Captions describe what was done, the typical recovery, and that individual results vary. We don't write "everyone gets this result" and we won't post copy that implies it.
  • Minor patients: parental/guardian consent in writing, and we lean conservative on whether to post at all.
What this means in practice

Before/after content goes through a separate review checklist before scheduling. It takes longer. It's worth it.

What we commit to
  • All 13 team members complete HIPAA training before client work.
  • Anyone working on a U.S. healthcare account is trained on FTC disclosure requirements and state board advertising basics.
  • We maintain training records and can provide them on request as part of any BAA.
  • Background checks for any team member with access to PHI-adjacent material.
  • When team members leave, their access is revoked the same day.
Things we won't do
  • Post content we believe misleads patients about a medical claim
  • Make up testimonials, reviews, or patient stories
  • Use AI-generated images of "patients" or fabricated case photos
  • Run before/after content without proper consent
  • Hide ad disclosures
  • Use a client's account to attack a competitor or another physician
What this means in practice

If a client insists, we end the engagement. We've done it before. We'll do it again.

What we commit to
  • We do everything above. But the final word on what gets posted from your account is always yours.
  • Every piece of client-facing content goes through your approval before publishing.
  • Our job is to flag the risk, write it right, and never make you choose between speed and safety. Your job is to approve it.

Questions about how this applies to your specialty?
Bring them to the Strategy Audit.

We'll go through your specific state, your specialty's board rules, and your existing content before any contract is signed.

Book the audit - $750 →
Book the Audit →