A med spa covered by HIPAA needs a signed, written authorization from the patient before it uses before-and-after photos in marketing; verbal consent does not count. The authorization has to describe the photos, who may use them and where, the purpose, an expiration date and the patient's right to revoke it in writing. A practice that collects only verbal consent has no record that meets this requirement, and that gap is exposed the moment a patient objects to a posted photo. Curve Compliance runs the tracking for the Meta ads that feature those photos server-side, in place of the pixel, under a BAA on every plan.
Before and after photos in med spa marketing: HIPAA consent requirements is a compliance framework that ensures aesthetic practices obtain proper written authorization before using patient images for promotional purposes, protecting both patient privacy rights and practice liability. This framework combines HIPAA Privacy Rule requirements with state-specific consent laws to create legally defensible marketing practices. For med spa owners, cosmetic treatment marketing success depends on understanding these requirements before posting a single patient photo.
This guide examines the current enforcement landscape, financial penalties, technical compliance requirements, and protection strategies for aesthetic practices using patient imagery. You'll learn exactly what documentation you need, how violations occur, and how to implement compliant before and after photo programs that drive medspa growth without regulatory risk.
Book a call. Running before-and-after ads? Curve Compliance keeps the tracking behind them HIPAA-safe, with server-side conversions under a BAA. Book a call with Curve.
The Current Enforcement Landscape for Med Spa Marketing Compliance
Scrutiny of how healthcare providers use patient data in marketing has grown since OCR's December 2022 tracking guidance. HIPAA has required written authorization for marketing uses of PHI, including identifiable photos, since the Privacy Rule took effect.
OCR Enforcement Trends
OCR resolves most cases through technical assistance or corrective action, and publishes its settlements and penalties on its resolution agreements page. HIPAA's de-identification standard already lists full-face photographs and comparable images as identifiers, so a treatment photo of a patient's face is PHI when a covered entity holds it.
Common authorization gaps include missing patient signatures, incomplete forms, and no expiration date or event, all of which HIPAA requires.
Penalty amounts depend on violation level and culpability. OCR assesses violations across four tiers. After HHS's January 2026 inflation adjustment, minimums are $145 (did not know), $1,461 (reasonable cause), $14,602 (willful neglect, corrected) and $73,011 (willful neglect, not corrected) per violation, with a calendar-year cap of $2,190,294 for identical violations, meaning practices posting multiple non-compliant before and after photos face exponential exposure.
FTC Involvement in Aesthetic Practice Marketing
The Federal Trade Commission's Health Breach Notification Rule, amended in 2024, treats an unauthorized disclosure of health data, such as sharing it with advertising platforms, as a breach. It applies to vendors of personal health records and similar apps, not to HIPAA covered entities.
The FTC's dual enforcement authority with OCR creates overlapping compliance obligations for cosmetic treatment marketing. While HIPAA governs authorization requirements, the FTC regulates truthfulness in advertising and consumer data protection. In July 2023 the FTC and HHS jointly warned about 130 hospital systems and telehealth providers about the privacy risks of online tracking technologies.
Class-Action Lawsuit Explosion
Since 2022, plaintiffs have filed many class actions against healthcare providers over tracking pixels, mostly under state and federal wiretap and privacy laws. Reported hospital settlements include Advocate Aurora Health's $12.225 million.
HIPAA itself gives patients no private right to sue, so these cases rely on state law claims such as misappropriation of likeness, state privacy statutes and negligence.
Common plaintiff claims include unauthorized use of likeness, state privacy statute violations, and negligent data handling, often citing HIPAA's standards as evidence of the duty of care. Plaintiff firms now routinely scrape med spa social media accounts, comparing posted photos against consent documentation obtained through HIPAA right-of-access requests. Discrepancies between posted content and authorization forms provide clear evidence for litigation.
State-Level Actions and Privacy Laws
State attorneys general can enforce HIPAA under the HITECH Act and also use state consumer protection and privacy laws. In December 2023, for example, the New York Attorney General secured $300,000 from NewYork-Presbyterian Hospital over website tracking tools.
State privacy laws compound federal compliance obligations. The California Consumer Privacy Act (CCPA) exempts PHI held by HIPAA covered entities, but it can apply to practices outside HIPAA. Washington, Nevada and Connecticut have consumer health data laws, and several states regulate the use of a person's likeness in advertising, creating a complex compliance landscape for aesthetic practice growth across multiple jurisdictions.
Consent is one half of using results photos in ads; platform creative rules are the other. Our guide to Instagram ad creative guidelines for med spa injectables covers what gets approved and what gets rejected.
Specific Risks and Consequences of Non-Compliant Photo Marketing
Understanding the full spectrum of consequences helps aesthetic practices properly assess compliance investment needs. The risks extend far beyond initial penalty amounts, creating cascading effects that threaten practice viability.
Financial Penalties and Liability Exposure
Financial consequences for before and after photo violations occur across multiple categories simultaneously. The following table is an illustrative estimate, not reported data, for a mid-sized med spa with 500 patients and 200 non-compliant photos posted across marketing channels:
| Penalty Source | Per-Violation Amount | Potential Range | Typical Settlement |
|---|---|---|---|
| OCR Civil Penalties | $145 - $73,011 | $20,000 - $1,500,000 | $145,000 |
| State AG Penalties | Varies by state | $50,000 - $500,000 | $185,000 |
| Class-Action Settlement | $500 - $2,000 per patient | $250,000 - $1,000,000 | $650,000 |
| Legal Defense Costs | N/A | $150,000 - $800,000 | $425,000 |
| FTC Breach Notifications | $2 - $8 per patient | $1,000 - $4,000 | $2,500 |
| Total Exposure | $1,407,500 |
These figures are illustrative, not reported averages. Practices with multi-year violations face multiplied exposure, as each posted photo constitutes a separate violation with ongoing exposure until removed. Legal defense costs frequently exceed settlement amounts, as HIPAA litigation requires specialized healthcare counsel billing $400-$850 per hour over 18-24 month investigation timelines.
Insurance coverage rarely protects against these liabilities. Most professional liability policies exclude regulatory penalties and willful misconduct, leaving practices personally liable. Cyber liability policies typically exclude HIPAA violations from coverage, creating significant uninsured exposure for aesthetic practices relying on digital marketing.
Reputational Damage and Market Impact
OCR maintains the public "Breach Portal" (commonly called the "Wall of Shame") listing breaches affecting 500 or more individuals. Patients, referral sources, and competitors regularly review this database, creating lasting reputational consequences.
Media coverage amplifies enforcement actions beyond regulatory channels. Local news outlets routinely report HIPAA violations, particularly those involving recognizable before and after photos. A practice in the news for posting patient photos without consent can lose patients long after any settlement.
Patient trust erosion affects lifetime value and referral patterns critical to medspa growth. Aesthetic practices depend heavily on word-of-mouth marketing and repeat clientele for anti-aging treatment marketing success. A privacy failure can damage referrals and repeat visits.
Operational Disruption From Investigations
HIPAA investigations require substantial operational resources beyond financial penalties. OCR investigations can take many months, during which practices must produce comprehensive documentation, respond to information requests, and participate in interviews. Staff diversion to compliance activities reduces capacity for revenue-generating patient care and aesthetic practice growth initiatives.
Corrective action plans mandated in settlement agreements impose ongoing operational burdens. Typical requirements include risk analyses, staff training programs, policy revisions, and technology implementations. OCR monitoring periods usually last one to three years, with reports to HHS.
Technology system changes disrupt established marketing workflows. Practices must often redesign websites, rebuild social media presence under new consent frameworks, and implement new documentation systems. Rebuilding marketing infrastructure after an enforcement action can disrupt normal marketing activities for months.
Personal Liability for Executives and Owners
HIPAA's criminal provision, 42 U.S.C. 1320d-6, applies to individuals who knowingly obtain or disclose individually identifiable health information in violation of the rules. Criminal cases are rare and usually involve deliberate misconduct such as selling patient data.
Personal liability extends through multiple mechanisms. State licensing boards can sanction individual practitioners for privacy violations, resulting in license suspension or revocation. Medical directors approving non-compliant cosmetic treatment marketing face professional discipline separate from practice-level penalties. Board members of corporate practice entities face potential breach of fiduciary duty claims from investors or partners when compliance failures create financial losses.
Insurance limitations compound personal exposure. Directors and officers (D&O) policies typically exclude regulatory penalties and often contain healthcare-specific exclusions. Personal assets become vulnerable when practice assets prove insufficient to satisfy judgments, particularly in class-action settlements exceeding $1 million.
How Before and After Photo Violations Occur
Understanding violation mechanisms helps aesthetic practices identify and remediate risks before enforcement actions. Most violations result from technical configurations, vendor relationships, or staff actions rather than intentional non-compliance.
Technical Configuration Vulnerabilities
Marketing tracking technology creates the most common pathway for before and after photo violations. When practices embed Meta Pixel, Google Analytics, or similar tracking on webpages displaying patient photos, these tools transmit data to third-party servers without business associate agreements. OCR's tracking guidance, first issued in December 2022, says disclosing PHI to tracking vendors without a BAA or authorization is impermissible. A June 2024 court ruling (AHA v. Becerra) vacated the part covering IP addresses on unauthenticated public pages, so a public gallery page is a weaker case than a page that collects patient details.
Default tracking configurations capture more data than practices realize. Standard Meta Pixel implementations automatically send IP addresses, device identifiers, and page URLs (often containing patient information) to Meta servers. When installed on before and after gallery pages, these pixels enable Meta to create profiles connecting individuals to specific treatments,precisely the type of disclosure HIPAA prohibits without authorization.
URL parameter exposure represents another technical vulnerability. Practices using URL tracking parameters (UTM codes) on pages with patient photos inadvertently disclose PHI when those URLs are shared or indexed. For example, URLs that carry appointment IDs can expose patient details to Google Analytics on every page view.
Form tracking on consultation request forms adjacent to before and after photos creates disclosure chains. When practices use third-party form tools that share data with advertising networks, submitting a consultation request while viewing patient photos can associate the requester with specific treatments shown, constituting PHI disclosure. Third-party widget data transmission occurs even when practices believe they control their website environment.
Vendor Relationship Gaps
Business associate agreement failures create substantial liability for medical spa advertising programs. HIPAA requires covered entities to obtain signed BAAs from any vendor that creates, receives, maintains, or transmits PHI on their behalf. Advertising technology providers and website hosts that handle PHI for you may need BAAs. Social media platforms are different: posting a photo the patient has authorized is a permitted disclosure, not a business associate arrangement.
Vendor audit obligations compound relationship risks. HIPAA requires a signed BAA and action if you learn a business associate is violating it; it does not mandate routine vendor audits, though periodic reviews are good practice.
Subcontractor chains extend liability through multiple tiers. When a practice's website vendor uses third-party hosting or content delivery networks, those subcontractors also require BAAs and compliance oversight. Many practices remain unaware of these subcontractor relationships until enforcement actions reveal the full technology stack accessing patient data.
Staff Actions and Training Gaps
Marketing team pixel implementations often occur without IT or compliance review. Many aesthetic practices let marketing staff add tracking codes to websites without review. Well-intentioned efforts to improve body contouring ads performance inadvertently create HIPAA violations when staff lack training on compliant implementation methods.
IT misconfigurations stem from incomplete understanding of healthcare requirements. Technology teams experienced with general commercial websites may not recognize that healthcare environments require different tracking approaches. Google says it does not offer a BAA for Google Analytics and that customers must not send it PHI, so a default installation on pages with patient details is a risk.
Content management errors occur when multiple staff access posting capabilities. Aesthetic practices typically employ 6-12 team members with social media posting access, creating numerous opportunities for unauthorized photo use. Without centralized approval workflows and consent verification systems, staff may post photos believing verbal consent suffices or misunderstanding which authorization forms cover marketing use.
Social media cross-posting multiplies single violations across platforms. Practices often post identical before and after content to Instagram, Facebook, TikTok, and websites simultaneously. When consent documentation proves deficient, a single photo creates four separate violations, each with independent penalty exposure. Automated cross-posting tools compound this risk by removing human review from the publishing process.
Audit Triggers and Red Flags
Patient complaints initiate most enforcement actions. Most OCR cases begin with complaints or breach reports. Patients may file complaints years after treatment, particularly following practice disputes, billing disagreements, or negative treatment outcomes. Authorization forms with expiration dates provide some protection, but indefinite authorizations create permanent exposure.
Competitor complaints represent a growing audit trigger. The aesthetic industry's competitive dynamics incentivize practices to report suspected compliance violations at competing med spas. Some practice owners routinely monitor competitor social media, comparing posted photos against publicly available consent forms to identify potential violations for regulatory reporting.
Data breach discoveries often reveal marketing compliance gaps during forensic investigations. When practices experience broader security incidents, forensic analysis typically examines all data flows,frequently uncovering unauthorized PHI disclosures through marketing channels. These discoveries must be reported to OCR, triggering comprehensive compliance reviews that extend beyond the initial breach incident.
OCR also runs periodic HIPAA compliance audits. These audits examine all HIPAA compliance areas, but marketing authorization documentation receives particular scrutiny given the visibility of before and after photos in digital channels.
Protection Strategies for Compliant Before and After Marketing
Implementing comprehensive protection requires action across immediate, short-term, and long-term timeframes. The following strategies create defensible compliance postures while maintaining marketing effectiveness essential for medspa growth.
Immediate Actions (This Week)
Audit current tracking implementations across all digital properties displaying patient photos. Use browser developer tools or privacy-focused browser extensions to identify all tracking pixels, analytics code, and third-party scripts on pages with before and after galleries. Document each tracking technology, its vendor, and what data it collects. This audit provides the foundation for remediation prioritization.
Review vendor BAA status for every technology provider accessing your marketing systems. Create a spreadsheet listing website hosts, social media management tools, email marketing platforms, advertising networks, and analytics providers. Document which vendors have signed BAAs, which claim BAAs are unnecessary, and which have refused to sign. Vendors refusing BAAs must be removed from environments accessing PHI or patient images immediately.
Check for PHI in marketing data by reviewing analytics dashboards, advertising platform audiences, and CRM systems. Search for patient names, appointment details, treatment specifics, or other identifiers that should not appear in marketing systems. Export data samples from each platform to verify no PHI appears in tracking implementations. Even small PHI leakage requires immediate remediation.
Document current state through screenshots, configuration exports, and written descriptions of existing systems. This documentation establishes your baseline and demonstrates good faith compliance efforts if violations are later discovered. Include dates, responsible parties, and specific findings in all documentation to create audit-ready records.
Short-Term Fixes (This Month)
Remove or reconfigure risky tracking on all pages displaying patient images. Replace client-side tracking (pixels) with server-side implementations that prevent direct PHI transmission to third parties. For practices lacking technical resources to implement server-side tracking immediately, remove all tracking from before and after galleries until compliant alternatives are deployed. Lost analytics data is preferable to ongoing violation exposure.
Implement server-side tracking through Google Tag Manager Server, Segment, or healthcare-specific platforms like CurveCompliance. Server-side architectures allow your servers to strip PHI before transmitting data to analytics and advertising platforms, maintaining marketing functionality while achieving compliance. Implementation typically requires 20-40 hours of development time but eliminates the highest-risk violation pathways.
Update privacy policies to accurately describe marketing data practices, including specific disclosure about before and after photo use, consent requirements, and patient rights regarding their images. Post updated policies prominently on websites and provide copies to all patients who previously signed authorization forms. Policy updates demonstrate transparency and may mitigate penalties if violations are discovered.
Train marketing staff on HIPAA requirements specific to patient imagery and digital advertising. Cover authorization requirements, technical compliance considerations, and approval workflows for posting patient content. Require annual training with documented completion for all staff with content posting access. Training documentation provides important evidence of compliance intent during investigations.
Long-Term Compliance Infrastructure
Build a compliance technology stack specifically designed for healthcare marketing requirements. This infrastructure should include HIPAA-compliant analytics (replacing Google Analytics for pages with PHI), compliant advertising tracking, secure form systems with BAAs, and consent management platforms. This costs far less than responding to an enforcement action.
Establish ongoing monitoring systems that continuously verify compliant configurations. Automated monitoring tools can alert administrators when unauthorized tracking code appears on websites, when new third-party scripts are added, or when data flows change. Monthly compliance audits should review all marketing channels, verify consent documentation completeness, and test data transmission paths to third parties.
Implement regular audit schedules covering vendor relationships, staff training, technology configurations, and authorization documentation. Quarterly internal audits combined with annual third-party assessments create strong compliance postures that withstand regulatory scrutiny. Document all audit findings and remediation actions to demonstrate ongoing compliance commitment.
Develop documentation practices that create audit-ready records of all marketing activities. Maintain centralized repositories of signed authorization forms, BAAs, training records, audit reports, and compliance policies. Implement version control for consent forms and track which versions individual patients signed. Strong documentation often differentiates practices receiving minimal penalties from those facing maximum enforcement.
Vendor Evaluation Criteria for Marketing Tools
Assess BAA availability and terms before implementing any marketing technology. Vendors should provide BAAs willingly, without price increases or special negotiations. Review BAA terms carefully,they should clearly define the vendor as a business associate, specify permitted uses of PHI, and include required regulatory language. Vendors unable or unwilling to sign appropriate BAAs cannot be used in healthcare marketing contexts.
Verify technical compliance capabilities through detailed vendor questionnaires addressing PHI handling, data encryption, access controls, and breach notification procedures. Request specifics about how their technology prevents unauthorized PHI disclosures,vague assurances about "HIPAA compliance" are insufficient. Vendors should articulate concrete technical safeguards and provide evidence of healthcare expertise.
Require audit reports and SOC 2 certifications demonstrating vendor security practices. As of 2026, reputable healthcare technology vendors maintain current SOC 2 Type II reports covering security, availability, and confidentiality. Review these reports for findings related to data handling and access controls. Absence of third-party audit reports should raise significant concerns about vendor reliability.
Prioritize vendors with healthcare-specific experience and existing healthcare customer bases. Vendors serving multiple healthcare clients understand regulatory requirements and have refined compliant implementations. Request healthcare client references and verify that similar practices successfully use the vendor's solutions for before and after photo marketing without compliance issues.
CurveCompliance: Purpose-Built Protection for Med Spa Marketing
CurveCompliance addresses each risk vector in before and after photo marketing through healthcare-specific technical architecture and comprehensive legal protection. The platform was designed specifically for aesthetic practices and medical spas navigating the complex compliance landscape of 2026.
Automated PHI stripping eliminates technical risk by processing all tracking data through compliant servers before transmission to analytics and advertising platforms. CurveCompliance's server-side architecture intercepts data that would normally flow directly from patient browsers to third-party platforms, removes all PHI and identifiers, then forwards only compliant data elements. This technical approach eliminates the primary violation pathway in med spa marketing while maintaining full analytics and advertising functionality.
Curve Compliance signs a BAA on every plan, covering the PHI that passes through Curve. The platform provides comprehensive business associate agreements covering all data processing activities, with clear liability allocation and breach notification procedures. Unlike general marketing tools requiring complex vendor management, CurveCompliance consolidates BAA requirements into a single agreement covering analytics, tracking, and advertising measurement.
Built-in audit trails document every data processing activity, creating the compliance records essential for regulatory defense. CurveCompliance automatically logs what data was collected, how it was processed, what PHI was stripped, and what compliant data was forwarded to downstream platforms. These immutable audit logs provide clear evidence of compliant practices during investigations, substantially reducing penalty exposure even if other violations occur.
Healthcare-specific design reflects deep understanding of aesthetic practice workflows and compliance requirements. Unlike general analytics platforms adapted for healthcare use, CurveCompliance was architected specifically for medical spa advertising, cosmetic treatment marketing, and aesthetics marketing challenges. The platform includes pre-built configurations for before and after galleries, treatment landing pages, and consultation funnels that maintain HIPAA compliance without sacrificing conversion optimization.
Curve's team does the setup, and most customers are live in about a week, not the months a custom server-side build takes. CurveCompliance's tag-based deployment requires no complex development from your practice. This implementation speed dramatically reduces the compliance gap period when practices remain exposed to violations while building custom solutions.
Self-Assessment Compliance Checklist
Use this checklist to evaluate your current compliance posture for before and after photo marketing:
- All patients shown in before and after photos signed HIPAA-compliant authorization forms specifically permitting marketing use
- Authorization forms include all required elements: specific description of PHI, purpose of disclosure, expiration date, right to revoke, and signature
- Authorization forms are stored securely and can be retrieved within 24 hours for any posted photo
- No tracking pixels or analytics code exists on webpages displaying patient photos unless implemented server-side with PHI stripping
- All vendors with access to patient photos or marketing systems have signed business associate agreements
- Social media management tools, scheduling platforms, and posting applications are covered by signed BAAs
- Website hosting, content delivery networks, and all technology subcontractors have appropriate BAAs or attestations
- Privacy policies accurately describe before and after photo practices and patient rights
- Staff with posting access have completed HIPAA training covering marketing requirements within the past 12 months
- Approval workflows require consent verification before any patient photo is posted
- Photos with expired authorizations have been removed from all platforms
- Photo metadata (EXIF data) has been stripped before posting to prevent location or device disclosure
- Facial recognition features are disabled on all platforms where photos are posted
- Third-party commenting and tagging is disabled or monitored to prevent patient identification
- Quarterly audits verify ongoing compliance with authorization and technical requirements
If you cannot check every item, you have compliance gaps requiring immediate attention. Each unchecked item represents potential violation exposure and penalty risk. Prioritize technical tracking issues and missing BAAs as the highest-risk areas requiring urgent remediation.
Don't Wait for Enforcement Action
Every day without compliant before and after photo marketing is a day of regulatory risk exposure. Scrutiny of how healthcare providers use patient data in marketing keeps growing. The combination of OCR enforcement, FTC oversight, class-action litigation, and state-level actions creates unprecedented liability for practices using patient imagery without proper compliance infrastructure.
The investment in compliance is modest compared to penalty exposure. Implementing compliant tracking, obtaining proper authorizations, and securing appropriate BAAs costs far less than responding to an enforcement action or lawsuit.
CurveCompliance eliminates the complexity and uncertainty of building compliant marketing infrastructure. With automated PHI stripping, included BAAs, comprehensive audit trails, and rapid implementation, the platform delivers enterprise-grade compliance at prices accessible to growing aesthetic practices. Schedule a compliance assessment to understand your specific risk exposure and receive a customized implementation plan.
Take action today: Schedule a Compliance Assessment with CurveCompliance and protect your practice from the escalating enforcement landscape of 2026. Your before and after photos drive growth,make sure they don't create catastrophic liability.
Frequently Asked Questions
What are the penalties for HIPAA violations involving before and after photos?
HIPAA civil penalties currently range from $145 to $2,190,294 per violation, with a calendar-year cap of $2,190,294 for violations of the same requirement (Federal Register, January 28, 2026). Private lawsuits are brought under state law and can add significant costs. Each posted photo without proper authorization constitutes a separate violation with independent penalty exposure, creating substantial cumulative risk for practices with extensive marketing galleries.
Can aesthetic practices be sued for using Meta Pixel on before and after galleries?
Yes, aesthetic practices face significant class-action lawsuit risk for using Meta Pixel on pages displaying before and after photos. Many hospitals and health systems have faced class actions over pixel-based disclosures, with settlements such as Advocate Aurora Health's $12.225 million. When Meta Pixel tracks users viewing patient photos, it transmits data to Meta without a business associate agreement, constituting impermissible PHI disclosure under HIPAA regulations and creating both regulatory penalties and civil liability.
How do I know if my med spa marketing is HIPAA compliant?
Med spa marketing is HIPAA compliant when all patient photos have documented authorization forms with required elements, no tracking technology transmits PHI to third parties without BAAs, and all vendors handling patient data have signed business associate agreements. Conduct technical audits to verify tracking implementations, review authorization documentation completeness, and confirm BAA coverage for all marketing technology platforms. If any patient photo lacks proper authorization or if tracking pixels exist on photo galleries without compliant server-side implementations, compliance gaps require immediate remediation.
What should I do if I discover before and after photos posted without proper consent?
Immediately remove all photos lacking proper authorization from websites, social media, and advertising platforms. Document the discovery with dates and scope of affected patients. Consult healthcare compliance counsel to determine whether breach notification is required under HIPAA or state laws. Implement corrective measures including staff training, authorization form updates, and approval workflows to prevent recurrence. Consider voluntary disclosure to OCR if violations are substantial, as self-reporting may reduce penalties. Do not wait for patient complaints or regulatory inquiry,proactive remediation demonstrates good faith and mitigates enforcement consequences.
Do verbal consents satisfy HIPAA requirements for marketing photos?
No, verbal consents do not satisfy HIPAA authorization requirements for marketing use of before and after photos. HIPAA requires written authorization forms signed by patients that include specific elements: description of PHI to be disclosed, purpose of disclosure, expiration date, right to revoke authorization, and patient signature. Verbal agreements, even if documented in medical records, lack the formality and specific disclosures required for valid HIPAA authorization. Practices relying on verbal consent face the same violation exposure as those with no consent documentation.
What must a HIPAA photo authorization include?
Under 45 CFR 164.508(c): a specific description of the information (the photos), who may make the disclosure, who may receive it, the purpose, an expiration date or event, and the patient's signature and date. It must also state the right to revoke in writing, whether treatment depends on signing, and that information disclosed may be redisclosed by the recipient. It must be in plain language, and the patient gets a copy.
Does HIPAA apply to a med spa that only does cosmetic treatments?
HIPAA applies to a health care provider that "transmits any health information in electronic form in connection with a transaction covered by" the HIPAA rules, such as electronic insurance claims (45 CFR 160.103). A med spa that conducts none of those transactions may not be a covered entity, but state privacy and publicity laws and Meta's ad rules still apply, so a written release is still the safe default.
Can a med spa use before-and-after photos in Meta ads?
Yes, within Meta's rules. Meta allows general cosmetic procedures "depicting before and after transformation" when the ad targets people 18 or older, and bars statements of inferiority about physical appearance (Meta Health and Wellness policy). Curve Compliance keeps the tracking on those campaigns server-side, so treatment names never reach Meta.
Sources
Primary sources for the platform rules and laws on this page, checked October 6, 2026: