Med Spas, Photos and Patient Data: What Actually Applies to You
Most med spas sit somewhere between a salon and a clinic, and the rules follow what you do rather than what you call yourself. Here's the practical version.
A med spa owner asks whether HIPAA applies to them. The honest answer is: probably, in part, and the part that matters most is the one nobody thinks about — the photos.
This is not legal advice and we are not lawyers. But we build these systems, and there is a practical version of this question that is worth understanding before you pick software or set up a texting workflow.
What decides it
It is not your signage or your business name. It comes down to whether you are a covered entity, and the usual trigger is billing insurance electronically for a service.
Most purely aesthetic clinics do not bill insurance, and on a strict reading are not covered. But a great many med spas have drifted into places where it stops being clean:
- A medical director prescribing under a supervising relationship
- Hormone, weight-loss or IV programmes that are genuinely clinical
- Anything billed to insurance, even occasionally
- State medical privacy laws, which are often stricter than the federal rule and do not care what you bill
The upshot: assuming you are exempt because you are "just aesthetics" is a decision you are making without checking, and it is worth twenty minutes with a healthcare attorney to know rather than guess.
The part everyone underestimates
Before-and-after photos.
They are identifiable, they are health-related, and they are the single most common way small clinics create a problem for themselves. The usual failures are not dramatic:
- Photos taken on a personal phone, syncing to a personal cloud account, backed up beside holiday pictures
- Photos shared in a staff group chat to ask a colleague's opinion
- Photos posted to social media on the strength of a verbal "sure, you can use that"
- Photos kept forever, including for clients who left years ago
The fix is not complicated, and it is mostly about where the images live. They belong in the client record, in a system with access controls, captured on a clinic device or straight into your platform rather than into a camera roll. Consent for marketing use should be separate, written, specific about where the image will appear, and revocable.
"She said it was fine" is not a record. A tick box with a date and a name is.
Texting
Appointment reminders are usually fine. Where clinics get into trouble is drifting from logistics into clinical content in the same thread.
"You're booked Thursday at 2" is a reminder. "How is the swelling from your filler?" names a treatment and a person in a channel that may be sitting unlocked on a kitchen table. It is also the kind of message you actually want to send, because it is good care.
The practical middle: keep proactive messages non-specific, and move the moment a client replies with clinical detail. Do not repeat their condition back to them by text. And be careful where those replies land — a shared inbox that half the team can read is a different risk to a record only the treating provider opens.
What to ask any software vendor
Whether or not you conclude you are covered, these questions separate serious platforms from consumer tools:
- Will you sign a BAA? If the answer is no, that tool cannot hold clinical detail. This rules out most general-purpose scheduling and messaging apps.
- Is access role-based? Your front desk needs the calendar, not the clinical notes and photos.
- Is there an audit log? Who viewed which record, and when. This is the thing you will want if there is ever a dispute, and it is the thing consumer tools never have.
- What happens to data on export? You should be able to leave with your records.
The honest caveat
Plenty of med spas run for years on a booking app and a shared phone and never have an incident. The risk here is not that regulators are hunting small clinics — they are not.
The risk is the ordinary bad day. A phone is lost. A staff member leaves badly. A client sees her own photo in an ad she does not remember agreeing to and is upset enough to complain. None of those are exotic, and all of them are much smaller problems when the photos are in a system with a log and a consent record attached.
Getting this right is not about fear. It is that a clinic which handles records properly is easier to sell, easier to staff, and easier to defend.
We build booking, records and messaging for US med spas on infrastructure that supports a BAA where it is needed. See how it fits together, or tell us how you handle records today.