The HIPAA Privacy Rule requires that you obtain valid, written authorization from a patient before you can publish any testimonial involving that patient on your website, social media platform, or through any other medium of communication (e.g., print, radio).