HPCSA Advertising Rules: What Practice Websites Can Say

South African doctors and dentists are allowed to advertise. That surprises some practitioners and many marketing agencies, and it is where the problems start. The HPCSA’s ethical rules permit advertising that is truthful and professional, but they separately prohibit canvassing and touting, and the definitions of those two words catch much of what agencies write by default: claims of superior quality, “best practice”, guarantees, and offers designed to draw patients in. A compliant practice website is not a bland one. It is a factual one.

This article sets out what the rules say, how they apply to the typical content of a practice website, what Rule 4 suggests the website should display, and how the Protection of Personal Information Act applies to the health information that booking and contact forms collect. It is written from a web agency’s perspective and is not legal advice. Where the rules are open to interpretation, we say so, and practitioners should confirm their position with the HPCSA or an attorney.

The Rules That Apply

The relevant document is the HPCSA’s Ethical and Professional Rules, published as Booklet 2. The rules were made under section 49 of the Health Professions Act 56 of 1974, published as Government Notice R717 of 04/08/2006 and amended by Government Notice R68 of 02/02/2009. They apply to all registered health practitioners, and an annexure sets out additional rules for the Medical and Dental Professions Board, which covers medical practitioners, dentists, and medical and dental specialists, among others. The general rules on advertising therefore apply equally to doctors and dentists.

Rule 2 states that contravening the rules may lead to disciplinary steps, and that the listed rules are not a complete list of what may constitute improper conduct. The board may therefore act on unprofessional conduct that no specific rule names, which is why a practice website should be measured against the purpose of the rules, not only their wording.

Advertising Is Allowed. Canvassing Is Not.

Rule 3(1) is permissive. It provides that a practitioner shall be allowed to advertise his or her services, provided that the advertisement is not unprofessional, untruthful, deceptive or misleading, or causes consumers unwarranted anxiety that they may be suffering from any health condition.

Rule 3(2) then prohibits something narrower and more important: a practitioner shall not canvass or tout, or allow canvassing or touting to be done for patients on his or her behalf.

The definitions in Rule 1 are where most practice websites run into difficulty.

• Canvassing is defined as conduct which draws attention, either verbally or by means of printed or electronic media, to one’s personal qualities, superior knowledge, quality of service, professional guarantees or best practice.
• Touting is defined as conduct which draws attention, either verbally or by means of printed or electronic media, to one’s offers, guarantees or material benefits that do not fall in the categories of professional services or items, but are linked to the rendering of a professional service or designed to entice the public to the professional practice.

Both definitions name electronic media explicitly, so there is no argument that a website falls outside them. And both cover precisely the territory that standard healthcare marketing occupies. Words like “superior”, “quality of service” and “best practice” appear in the definition of canvassing itself.

Notice also the phrase “or allow canvassing or touting to be done … on his or her behalf”. An agency or marketing partner writing copy for a practice is very likely acting on the practitioner’s behalf, and Rule 3(1) extends to advertising a practitioner permits, sanctions or acquiesces to. The practitioner remains responsible for what is published in their name.

How This Applies to Typical Website Content

The table below applies the definitions to content we commonly see on practice websites. It is our reading of the rules, intended to help practitioners spot risk, and not a ruling. Where something is described as higher risk, it is because it appears to fall within the wording of the definitions above.

A note on symptom content: Rule 3(1) also prohibits advertising that causes unwarranted anxiety that a person may be suffering from a health condition. Educational articles about conditions are valuable, but copy written to alarm readers into booking, such as “Could your headaches be something serious?”, should be reviewed against that wording.

What Rule 4 Suggests a Practice Website Should Show

Rule 4(1) governs letterheads, account forms and, explicitly, electronic stationery. It requires that this stationery carry the following information, and limits it to information pertaining only to the practitioner’s:

• name
• profession
• registered category
• speciality or subspeciality or field of professional practice, if any
• registered qualifications or other academic qualifications or honorary degrees, in abbreviated form
• registration number
• addresses, including email address
• telephone and fax numbers
• practice or consultation hours
• practice code number
• dispensing licence number, if any

Group practices and partnerships are covered by Rule 4(2), which sets out a slightly different list. Whether a full website counts as electronic stationery is a question of interpretation. In practice, this list is a useful identity specification for the website’s contact page, footer and practitioner profiles. Publishing the HPCSA registration number and registered category is both consistent with Rule 4 and one of the strongest trust signals a practice can offer, because it allows any patient to verify the practitioner independently. The same details can be marked up as structured data so search engines associate them correctly with the practice.

Practice names

Rule 5 requires a private practice to use the practitioner’s own name, or the name of registered practitioners with whom they are in partnership or practise as a juristic person. A former partner’s name may only be retained with that practitioner’s express consent, or that of the executor or next of kin if the practitioner has died. A private practice may not use the words “hospital”, “clinic” or “institute” in its name, or any wording that suggests a connection with such an institution. This matters for domain names and branding as much as for the website copy. A domain name or brand that includes one of these words should be checked against this rule before it is registered.

Specialist titles and scope

Rule 1 defines a specialist as a practitioner registered as a specialist in a speciality or subspeciality who confines their practice to it, and the Medical and Dental Board annexure requires specialists to adhere to the regulations on specialities and subspecialities published under Government Notice R590 of 29/06/2001. Website copy should only describe a practitioner as a specialist in a field in which they are registered as one. Rule 21 also limits practitioners to acts for which they are adequately educated, trained and experienced, so service pages should not list procedures the practitioners do not perform.

Referral incentives

Rule 7 prohibits paying commission or offering material consideration to anyone for recommending patients, and prohibits sharing fees with anyone who did not take a commensurate part in the service. Referral reward schemes and “refer a friend” offers that are common in other industries should not be imported into a practice website, and Rule 7(1) separately prohibits accepting commission on goods used in the practice, which is relevant to any affiliate arrangement.

A Case Worth Knowing

The HPCSA does act on marketing conduct. In Dowley v Health Professions Council of South Africa, decided by the Gauteng High Court in Pretoria on 28/03/2024, an optometrist and franchise director had been found guilty of touting in connection with an SMS sent by a retail partner promoting eye tests and loyalty card points. The court set the finding aside on a single preliminary ground, that the practitioner was non-practising at the time, without deciding the merits, and ordered the HPCSA to pay the costs of the appeal.

The outcome turned on that narrow point, but the case shows two things practice owners should take seriously: the HPCSA has prosecuted touting arising from third-party marketing, and marketing done by a partner can bring the practitioner before a disciplinary process.

Testimonials, Reviews and Before-and-After Images

This is the area where the published rules are least specific. Booklet 2 does not mention testimonials or patient reviews. The HPCSA has published separate ethical guidelines on social media as Booklet 16, which practitioners should read directly in its current version before publishing patient stories, reviews or clinical images anywhere online. Aon, in commentary on medical professional liability, has cautioned that before-and-after photographs posted online, even with consent, may in some circumstances amount to canvassing.

Two further rules apply regardless. Rule 13 permits disclosure of patient information only on listed grounds, which include the patient’s express consent (or a parent’s or guardian’s written consent for a child under 12), so any patient story, image or case study requires that consent, and the HPCSA’s social media guidelines call for it in writing. And because a testimonial praising care draws attention to quality of service, the conservative position is to avoid curating patient praise on the practice’s own website until the practitioner is satisfied it is permitted. Reviews that patients leave independently on third-party platforms are a different matter from reviews the practice selects and displays.

POPIA: Health Information Collected Through the Website

The second compliance layer is data protection. Information about a person’s health is special personal information under section 26 of the Protection of Personal Information Act, and processing it is prohibited unless an exception applies. A booking form that asks “reason for visit”, a contact form where a patient describes symptoms, and a patient intake form are all collecting health information.

The healthcare exception, and its limits

Section 32(1)(a) provides the key exception: the prohibition does not apply to medical professionals and healthcare institutions where processing is necessary for the proper treatment and care of the data subject, or for the administration of the practice. Section 32(2) requires that the information is processed only by responsible parties subject to an obligation of confidentiality, whether by virtue of office, employment, profession or legal provision, or under a written agreement with the patient.

The limit is in the word “necessary”. Health information collected to book and prepare for an appointment falls comfortably within the exception. Using the same information for newsletters, remarketing or anything beyond treatment and administration does not, and would generally require the patient’s consent under section 27(1)(a), which POPIA defines as a voluntary, specific and informed expression of will. The practical rule for website forms is to collect only the health detail the appointment actually needs.

The 2026 health information regulations

In March 2026 the Information Regulator published the Regulations relating to the Processing of Data Subjects’ Health Information by Certain Responsible Parties, 2026, in Government Gazette 54268 of 06/03/2026, effective on publication. Despite the attention they received, their application is limited to insurers, medical schemes, medical scheme administrators, managed healthcare organisations, administrative bodies, pension funds, employers, and institutions working for employers, administrative bodies or pension funds. They do not apply to a practice’s processing of patient information, which remains governed by section 32(1)(a) and the general conditions of POPIA. Employers are a listed category, however, so a practice that processes its own staff’s health information, such as sick notes or incapacity records, should treat that processing as falling within the regulations.

The obligations that do apply

• Notification at collection (section 18): forms should tell patients what is being collected and why. Our POPIA website compliance checklist covers what the privacy notice needs.
• Security safeguards (section 19): appropriate technical and organisational measures, which on a website means maintained software, encrypted connections and controlled access to submissions.
• Breach notification (section 22): where there are reasonable grounds to believe form submissions have been accessed or acquired by an unauthorised person, the practice must notify the Regulator and affected patients as soon as reasonably possible.
• Cross-border transfers (section 72): sending personal information to a third party in another country is restricted unless conditions such as adequate protection or consent are met.

Cross-border transfer is the hidden exposure on many practice websites. Form plugins that store submissions with an offshore service, cloud form builders, US-hosted CRMs and messaging platforms can all move patient health information out of South Africa. For special personal information, section 57(1)(d) also requires prior authorisation from the Regulator before a transfer to a third party in a foreign country that does not provide an adequate level of protection. We set out how ordinary website tools move data offshore in your website is sending customer data overseas. For a practice, the simplest position is to keep form submissions on the practice’s own South African-hosted website and email notifications free of clinical detail.

Advertising the Practice Beyond the Website

Google’s advertising policies add a platform layer to the ethical rules. Health is a sensitive interest category under Google’s personalised advertising policy, which prevents advertisers in that category from using their own audience lists, such as customer lists and website visitor segments, for targeting. In South Africa, Google’s healthcare policy also prohibits advertising prescription drugs. Remarketing to people who visited a practice’s website, a standard tactic elsewhere, is therefore generally unavailable to practices on Google, before the ethical rules are even considered.

Summary

Frequently Asked Questions

Are doctors and dentists allowed to advertise in South Africa?

Yes. Rule 3(1) of the HPCSA’s Ethical and Professional Rules allows practitioners to advertise their services, provided the advertising is not unprofessional, untruthful, deceptive or misleading, and does not cause unwarranted anxiety about a health condition. Canvassing and touting are prohibited separately.

What is canvassing under the HPCSA rules?

Rule 1 defines canvassing as conduct that draws attention, verbally or through printed or electronic media, to a practitioner’s personal qualities, superior knowledge, quality of service, professional guarantees or best practice. Claims such as “the best” or “leading” practice fall within this wording.

Can a medical practice publish patient testimonials on its website?

The HPCSA’s Booklet 2 does not address testimonials directly, but testimonials praising care appear to draw attention to quality of service, and any patient information requires express consent under Rule 13. Practitioners should read the HPCSA’s social media guidelines (Booklet 16) and seek guidance before publishing them.

Should a practice website show the HPCSA registration number?

Yes. Rule 4 requires the registration number on letterheads, account forms and electronic stationery, and publishing it on the website lets patients verify the practitioner independently, which is a strong trust signal.

Do the 2026 POPIA health information regulations apply to medical practices?

Not to patient information. The regulations published on 06/03/2026 apply to insurers, medical schemes, medical scheme administrators, managed healthcare organisations, administrative bodies, pension funds, employers and institutions working for employers, administrative bodies or pension funds. Practices process patient health information under section 32(1)(a) of POPIA. A practice’s processing of its own employees’ health information, such as sick notes or incapacity records, should be treated as falling within the regulations, because employers are a listed category.

Can a practice name include the word “clinic”?

Rule 5 prohibits a private practice from using the words “hospital”, “clinic” or “institute” in its name, or wording that suggests a connection with such an institution. The rule refers to the name of the practice, and in our view the safe approach is to apply it to branding and domain names as well.