Social Media Complaints Before Medical Board of California: License Risks for California Doctors

Why Social Media Has Become a Major Source of MBC Complaints Against California Doctors

For most of the Medical Board of California’s history, complaints arose from clinical encounters — missed diagnoses, surgical outcomes, prescribing concerns, communication failures. Over the past decade the source mix has changed dramatically.

Social media is now one of the fastest-growing categories of complaint reaching the Central Complaint Unit. Posts that would have remained private a generation ago are screenshotted, archived, shared, and submitted as evidence by patients, family members, colleagues, journalists, and competitors.

The general procedural framework that follows a social media complaint is the same as for any other MBC matter, and is set out in detail in our companion guide on how to respond to a Medical Board of California complaint.

Where social media cases differ is in the evidence base, the speed at which the public dimension can escalate, and the way the Board interprets professional identity online. The full disciplinary pathway from initial complaint to Final Decision is covered in our guide to the MBC disciplinary process step by step for California doctors.

The wider US context for state board enforcement of online conduct is covered in our national state board complaint response guide, but California physicians face a particularly demanding combination of HIPAA, the California Confidentiality of Medical Information Act, the California Consumer Privacy Act, Penal Code recording restrictions, and Business and Professions Code advertising rules.

Several drivers explain why social media cases are growing so rapidly at the Medical Board of California. Platform reach is now enormous; a single TikTok or Instagram reel can be seen by hundreds of thousands of California viewers within hours.

Screenshots are permanent evidence that survives even after a post is deleted. Anonymous reporting to the MBC online portal makes complaint submission frictionless. And public expectations of physician conduct online have tightened substantially since the COVID-19 era brought intense scrutiny to medical voices on social media.

The California Legal Framework: Why Social Media Risk Is Higher Here Than Most States

California physicians sit at the intersection of several layered legal regimes that govern social media conduct, and the Medical Board of California can investigate violations of any of them under the umbrella of unprofessional conduct.

Understanding which framework applies to which type of post is the foundation of an effective compliance strategy.

• HIPAA Privacy Rule. Federal law applies to protected health information whether posted on social media, displayed at a conference, or written in a medical record. Identifiability is broader than name — any combination of details that could allow identification by family or community is sufficient.
• California Confidentiality of Medical Information Act (CMIA). California Civil Code Section 56 et seq. provides additional state patient privacy protection enforced separately from HIPAA. Penalties for a single CMIA breach can be substantial.
• California Penal Code Section 632. California is a two-party consent state for audio recording. Recording a patient encounter, theatre conversation, or staff meeting without all-party consent is a criminal offence and is also unprofessional conduct under MBC rules.
• Business and Professions Code Section 651. Prohibits false, fraudulent, misleading, or deceptive advertising by physicians, including social media content. This covers credentialing claims, before-and-after photos, treatment outcome representations, and undisclosed paid promotions.
• Business and Professions Code Section 2234. The general unprofessional conduct provision under which the MBC investigates and disciplines social media misconduct that does not fit a more specific section.
• FTC Endorsement Guides. Federal advertising rules requiring clear disclosure of material connections in any product or service endorsement. Enforced by the FTC but cited regularly by the MBC in advertising investigations.
• California Consumer Privacy Act (CCPA). Adds a layer of privacy obligation for California physicians and their practices in handling consumer data, including data collected through social media interactions.

What Kind of Post Triggers an MBC Investigation

The Medical Board of California Enforcement Program tracks recurring categories of social media complaint that lead to formal action. California physicians can substantially reduce their risk by understanding the patterns that the Board investigators look for.

The following categories of post most reliably trigger a CCU file.

1. Patient identification without consent. Posting a clinical case, photo, video, or even a written description that could allow identification of a patient by family, community, or other patients. The Board treats indirect identification (room number plus date plus distinctive condition) as squarely within HIPAA and CMIA.
2. Mocking or denigrating patients. Posts that ridicule patient questions, weight, hygiene, intelligence, or behaviour, even where the patient is not directly identifiable. The MBC treats this as a fundamental professionalism breach under Section 2234.
3. Sexual or inappropriate content in clinical settings. Choreographed videos in operating theatres, treatment rooms, or with medical equipment that depict sexual themes or are otherwise inappropriate to the clinical environment.
4. Health misinformation contradicting scientific consensus. Particularly where the misinformation could harm Californians who rely on the physician’s credentialed authority. The MBC has stated publicly that physician misinformation falls within its enforcement remit.
5. Unsupported clinical or product claims. Promoting treatments, supplements, or devices with claims about efficacy that are not supported by evidence and are not properly qualified.
6. Undisclosed paid promotion. Endorsing a product or service in a way that appears to be independent professional opinion but is in fact compensated, in violation of FTC rules and Section 651.
7. Individualised medical advice without an established relationship. Replying to a patient’s direct message or comment with specific clinical advice creates a physician-patient relationship and corresponding duties that the physician usually cannot meet through social media.
8. Confirming a treatment relationship in a public response. Responding to a negative review or critical comment in a way that confirms the person was a patient is a HIPAA and CMIA breach independent of the underlying complaint.
9. Misrepresentation of credentials. Bio claims about board certifications, specialty training, hospital affiliations, or institutional positions that are inaccurate or out of date.
10. Recording patients or staff without consent. Capturing patient encounters, operating theatre activity, or clinical staff conversations on video or audio without proper consent under California two-party consent law.

How Patient Identification Works in Practice for California Doctors

The single most common social media error by California physicians is misunderstanding what makes a patient identifiable for HIPAA and CMIA purposes. The Privacy Rule and the CMIA do not require a name to establish identification.

A patient is identifiable where the post contains information that, alone or in combination, could reasonably allow another person to determine who the patient is.

The combinations the Board encounters most frequently in social media cases include the following.

• Photo or video plus location. An image taken in a recognisable hospital corridor or treatment room, even with the patient’s face blurred, often identifies the patient to family members and other staff.
• Distinctive clinical detail plus date. Posts describing an unusual presentation or rare diagnosis on a specific date narrow the universe of possible patients to one.
• Body part with distinguishing feature. A close-up of a tattoo, surgical scar, deformity, or unique anatomical feature can identify the patient to anyone who knows them.
• Family or relationship reference. Mentioning that a patient is the spouse, parent, or child of another identified person collapses identification.
• Occupation or social context. Naming the patient’s employer, school, or community organisation often identifies them within that group.
• Direct paraphrase of patient speech. Quoting or closely paraphrasing what a patient said in a memorable encounter can identify the speaker to people who recognise the phrasing.
• Composite case studies. Even “a patient I once saw” descriptions can identify a patient where the clinical detail is sufficiently distinctive.

Advertising and Promotion Rules That Apply to California Physician Social Media

Many California physicians use social media commercially — to attract patients, promote cosmetic services, sell wellness products, or build influencer reach. Each commercial use is governed by Business and Professions Code Section 651 and the related FTC Endorsement Guides, both of which the Medical Board of California enforces.

The following commercial activities create recurring MBC exposure for California physicians.

• Before-and-after photographs. Section 651 requires accurate representation, patient consent, and disclosure that results vary. Filtered or surgically altered “after” images that misrepresent typical outcomes are a Section 651 violation.
• Testimonials and reviews. Soliciting, paying for, or selectively curating patient testimonials in a misleading way is unprofessional conduct under Section 651 and FTC rules.
• Credential and specialty claims. Bio descriptions or post hashtags claiming board certifications the physician does not hold, or claiming specialty status the physician is not qualified to claim under California rules.
• Risk minimisation in cosmetic posts. Posts promoting cosmetic procedures that omit material risks, recovery realities, or failure rates have been the subject of multiple recent MBC cases.
• Paid product promotion without disclosure. Endorsing supplements, devices, skincare, or other products that the physician is paid or compensated to promote, without clear and conspicuous disclosure of the material connection.
• Discount and incentive offers. Promotional offers must comply with California consumer protection law, the Knox-Keene Act where insurance interfaces are involved, and federal anti-kickback law where federal payors are touched.
• Live-stream consults or Q&A. Live sessions that drift from general education into specific advice for an identifiable individual create a physician-patient relationship and corresponding standard of care duties.

How to Audit Your Own Social Media Before Someone Else Does

Every California physician with any social media presence should conduct a structured self-audit at least annually, and after any significant practice change. The audit takes a few hours and can prevent the kind of surprise that an MBC investigation letter creates.

The following sequence catches the great majority of compliance issues before they become complaints.

1. Search yourself across platforms. Search your name, credentials, and practice name on Google, X, Instagram, TikTok, Facebook, LinkedIn, YouTube, and Yelp. Note every account, mention, and review that appears.
2. Verify all credential and bio claims. Check that every bio across every platform accurately reflects current board certification, current licensure, current affiliations, and current specialty designation.
3. Review every post involving a patient encounter. Identify any post, photo, video, or story that references a patient encounter, clinical setting, or specific case. Apply the patient identification test to each one.
4. Check before-and-after content. Confirm that every before-and-after photo has documented written consent for the use, accurate representation, and proper disclosure of variability of results.
5. Audit endorsements and product mentions. Identify any post promoting a product, service, supplement, or device. Confirm that any material connection is clearly and conspicuously disclosed.
6. Review responses to negative reviews. Check every public response on Yelp, Google, Healthgrades, and similar platforms. Confirm that none confirms a treatment relationship or discloses any patient information.
7. Review old content. Compliance applies to historic posts. Posts from years ago are still searchable and discoverable, and are still actionable by the MBC.
8. Document the audit. Record the date, scope, findings, and remedial actions in a private compliance file for your own records and potential future use.
9. Repeat after every change. Repeat the audit after any new credential, change of practice, change of platform, or significant CME activity related to social media.

If You Have Already Posted Something Concerning: Damage-Control Steps for California Physicians

California physicians who become aware of an actual or potential complaint arising from social media activity have a narrow window to make decisions that significantly affect the eventual outcome. Acting impulsively in the first 24 hours often makes things worse.

The following sequence is the structured approach that California-experienced MBC defense counsel typically recommend.

1. Stop posting on the topic immediately. Do not respond, clarify, defend, apologise publicly, or engage with critics. Every additional post becomes additional evidence.
2. Do not delete the original content yet. Deletion can be characterised as evidence destruction. Take instructed action only after consulting counsel.
3. Preserve the content with timestamps. Take screenshots of the original post, all comments, all reposts, and any media coverage. Save to a private folder with file metadata intact.
4. Notify your professional liability insurer. California physician carriers including CAP-MPT, NORCAL, The Doctors Company, and MIEC almost always require prompt notice of potential claim or board action.
5. Engage California-experienced MBC defense counsel. Do not make this decision through Google reviews of attorneys. Use insurer panel counsel or CMA referral resources.
6. Review platform settings under guidance. Counsel may recommend specific platform actions including changing privacy settings, restricting comments, or eventually removing content with proper preservation.
7. Begin remediation CPD immediately. Enrol in social media professionalism, boundaries, and confidentiality CPD without waiting for any formal complaint. Documentation of voluntary remediation is significantly stronger than CPD initiated only after a complaint arrives.
8. Prepare a structured reflective statement. Working with counsel, prepare a reflective statement covering what was posted, what was understood at the time, what is now understood, what has been remediated, and what is now different in practice and online presence.
9. Implement and document practice changes. A revised social media policy for yourself and any staff who post on your behalf, a new pre-post checklist, and a written commitment to ongoing audit are concrete evidence of practice change.

How CPD Courses Strengthen Both Prevention and Response in MBC Social Media Cases

Documented continuing professional development on social media professionalism, boundaries, confidentiality, and digital ethics serves two purposes for California physicians.

The first is prevention. A physician who has worked through a structured course on patient identification, advertising rules, FTC endorsement disclosure, California two-party consent, and the boundary between professional and personal online presence is significantly less likely to make the categories of error that bring MBC complaints.

The structural frameworks taught in CPD courses give a physician a quick mental check before posting that is far more reliable than informal intuition.

The second purpose is mitigation if a complaint does arrive. The Medical Board of California has explicitly identified completed remedial education on the topic of the allegation as a mitigating factor in its published Disciplinary Guidelines.

At Stipulated Settlement negotiations — the stage at which most contested cases resolve — documented social media professionalism CPD regularly translates into reduced probationary terms or substitution of a Public Letter of Reprimand for probation.

The strongest evidence packages combine three categories. First, direct CPD on social media professionalism and boundaries, demonstrating understanding of the specific online context.

Second, foundational CPD on confidentiality, privacy, and consent that applies to all clinical conduct including online conduct. Third, broader professionalism and ethics CPD that establishes ongoing investment in the values the Board expects.

Each completed course should be paired with a structured reflective statement linking the learning to a concrete practice change. The certificate alone has limited value; the certificate plus the reflective statement plus the documented practice change is the package that influences MBC outcomes.

What California Doctors Say About Our Courses

Frequently Asked Questions

Official California Regulatory Resources

Every California physician with a social media presence should be familiar with the following official California resources:

• Medical Board of California — The state licensing authority for all allopathic physicians in California, responsible for licensure, enforcement, and discipline including social media misconduct cases. Visit www.mbc.ca.gov
• California Office of the Attorney General — Privacy Enforcement — State enforcement of CMIA, CCPA, and related California privacy law that intersects with physician social media activity. Visit oag.ca.gov/privacy
• California Department of Consumer Affairs — BreEZe License Search — Public license lookup system showing current California license status, any public discipline, and associated documents. Visit www.breeze.ca.gov