Does HIPAA Apply to Med Spas? The Covered Entity Test

Whether HIPAA applies to a med spa depends on whether it is a "covered entity", which for a provider means one that sends health information electronically in connection with a standard transaction, such as an insurance claim (45 CFR 160.103). A med spa that bills health plans electronically, or has a billing service do it, is covered. A cash-only med spa that sends no such transactions is not, but the FTC Act, state privacy laws and ad platform terms can still apply to it. Curve Compliance tracks med spa ad conversions, removes PHI before anything is sent to an ad platform, and signs a BAA on every plan.

Book a call. Curve's team will review what your med spa's website sends to Meta, Google and TikTok with you, then set up server-side conversions under a BAA on every plan. Book a call with Curve.

The covered entity test, in the rule's own words

HIPAA names three kinds of covered entity: a health plan, a health care clearinghouse, and "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" (45 CFR 160.103). Only the third can fit a med spa. CMS turns it into two questions in its Covered Entity Decision Tool.

1. Do you provide health care? The tool asks whether the business does "furnish, bill, or receive payment for, health care in the normal course of business". Health care includes a procedure "that affects the structure or function of the body" (160.103). A med spa that offers medical treatments, such as injectables, prescription weight loss or hormone therapy, should expect a yes.
2. Do you send a covered transaction electronically? The tool asks whether the business does "transmit (send) any covered transactions electronically". If yes, it "is a covered health care provider and therefore a covered entity".

Covered transactions are the ones with standards in 45 CFR Part 162. Those a provider sends go to a health plan, including claims, eligibility checks, authorization requests and claim status checks.

What the test means for your med spa

You bill insurance. If your med spa electronically sends claims to a health plan, checks insurance eligibility or asks a plan to authorize care, it is a covered entity. CMS says: "Providers who submit HIPAA transactions, like claims, electronically are covered" (CMS). See what counts as PHI on a website.

A billing service does it for you. That does not change the answer. The CMS tool says: "If a healthcare provider uses another entity (such as a clearinghouse) to conduct covered transactions in electronic form on its behalf, the health care provider is considered to be conducting the transaction in electronic form."

You are cash only. If neither your med spa nor anyone acting for it sends a covered transaction electronically, the tool says it "is NOT a covered health care provider and therefore not a covered entity". HHS adds: "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS). The same test covers cash-pay telehealth.

You do both. The test looks at the business, not at each client. The Privacy Rule applies "to covered entities with respect to protected health information" (45 CFR 164.500), and the definition of protected health information does not ask who paid. A covered med spa's cash clients are covered too.

Your med spa	HIPAA covered entity?	What can still apply	Source
Sends electronic claims or eligibility checks to health plans	Yes	HIPAA for all client PHI, plus the cash-only rules below	45 CFR 160.103; Part 162
Has a billing service or clearinghouse send them	Yes	The same, plus a BAA with that vendor (45 CFR 164.502(e))	CMS decision tool
Cash only, no electronic transactions with a health plan	No	The FTC Act, state privacy laws and ad platform terms	CMS decision tool; HHS
Management company handling patient information for a covered practice	No, but a business associate	Business associate duties, a BAA with the practice, and the cash-only rules	45 CFR 160.103; HHS

For how these rules apply to your own structure and states, talk to your counsel.

The business associate route

A med spa business can come under HIPAA without being a covered entity. A business associate is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter", including "billing, benefit management, practice management" (45 CFR 160.103).

Suppose a med spa is two companies: a medical practice that bills insurance, and a management company that handles its scheduling, billing and marketing. The practice is the covered entity, and the management company fits the business associate definition. HHS says "business associates are directly liable for compliance with certain provisions of the HIPAA Rules" (HHS), and the two need a business associate agreement.

A referral is different: a provider that receives a covered entity's disclosures "concerning the treatment of the individual" is not a business associate for those disclosures (160.103).

Privacy law and platform rules apply either way

Falling outside the covered entity test takes a med spa out of HIPAA, not out of privacy law.

FTC Act section 5 (15 U.S.C. 45). Applies to: Most businesses nationwide, including "companies that collect, use, or share health information that aren't required to comply with HIPAA" (FTC guidance). The FTC says "disclosing consumers' health information for advertising without their affirmative express consent may be an unfair practice".

Texas Health and Safety Code chapter 181. Applies to: A Texas "covered entity": any person who "comes into possession of protected health information". The term includes a "clinic, health care provider, or person who maintains an Internet site" (section 181.001). A covered entity "may not electronically disclose an individual's protected health information to any person without a separate authorization", with listed exceptions (section 181.154).

California Confidentiality of Medical Information Act (Civil Code 56.05, 56.10). Applies to: A "provider of health care", which includes a person licensed under the Business and Professions Code's Healing Arts division (medicine, nursing, physician assistants). Unless the patient expressly authorizes it or a listed exception applies, a provider "shall not intentionally share, sell, use for marketing, or otherwise use medical information for a purpose not necessary to provide health care services to the patient".

Washington My Health My Data Act (RCW 19.373.010, .030, .100). Applies to: An entity that does business in Washington or targets Washington consumers and decides how consumer health data is used. HIPAA protected health information and health care information handled under chapter 70.02 RCW, which has its own disclosure rules, are exempt. Sharing consumer health data, which includes "Data that identifies a consumer seeking health care services", takes consent "separate and distinct from the consent obtained to collect consumer health data", unless it is needed to provide what the consumer asked for.

Meta Business Tools Terms. Applies to: Any business using Meta Business Tools such as the Meta Pixel or Conversions API. No data that "includes or is based on, directly or otherwise, health information". Meta's examples include "Medical procedures, treatments and testing" (Meta help).

Google Ads personalized advertising policy (Health, targeting). Applies to: Google advertisers in a sensitive interest category. Google's health category lists "Invasive medical procedures, including cosmetic surgery, surgical procedures, or injections". These advertisers "are unable to use advertiser-curated audiences".

Other states have their own laws. On consent, see is a cookie banner enough for HIPAA.

How Curve Compliance helps med spas

Curve Compliance replaces browser ad pixels with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, and events can use neutral names, so a booking counts without naming the treatment. Curve checks every event for PHI-like patterns and removes PHI before anything is sent to an ad platform. The setup is the same whether your med spa is a covered entity or not.

Curve keeps the ad click when a client leaves your site to book in Boulevard, Vagaro, Mindbody, Square, Acuity, Setmore or Booker, and credits call and consult outcomes to the original ad click. Event Logs show what each platform accepted. Curve signs a BAA on every plan, and Curve's team does the setup; most customers are live in about a week.

See Curve for med spas, what the best med spa conversion tracking does and which lead form fields are safe to track, run the free website scan, or book a call with Curve.

Sources, checked October 13, 2026: 45 CFR 160.103, Part 162, 164.500 and 164.502; HHS on covered entities; CMS, Are You a Covered Entity? and its decision tool; 15 U.S.C. 45; FTC health information guidance; Texas Health and Safety Code chapter 181; California Civil Code 56.05 and 56.10 and BPC Division 2; Washington chapters 19.373 and 70.02 RCW; Meta Business Tools Terms and prohibited information; Google health and targeting policies.

Frequently Asked Questions

Does HIPAA apply to a med spa?

It depends on whether the med spa is a covered entity: a health care provider that sends health information electronically in connection with a standard transaction, such as an insurance claim (45 CFR 160.103). A med spa that bills health plans electronically is covered, and a cash-only one that sends no such transactions is not, though other privacy laws can still apply.

Is a cash-only med spa a HIPAA covered entity?

No, if neither it nor anyone acting for it sends a covered transaction electronically; the CMS decision tool then says it is not a covered entity. The FTC Act, state privacy laws and ad platform terms can still apply.

Does using a billing service make my med spa a covered entity?

Yes, if the service sends covered transactions electronically for you. CMS says the provider "is considered to be conducting the transaction in electronic form" (CMS decision tool).

If we bill insurance for a few services, does HIPAA cover our cash clients too?

Yes. The test looks at the business, not at each client, and the definition of protected health information does not ask who paid (45 CFR 160.103).

What privacy laws apply to a med spa that HIPAA does not cover?

The FTC Act, state laws such as Texas Health and Safety Code chapter 181, California's Confidentiality of Medical Information Act and Washington's My Health My Data Act, and the terms of the ad platforms it uses.

Does a med spa need a BAA with Meta or Google Ads?

Neither signs one, according to Curve's BAA Directory entries for Meta and Google Ads. A BAA is the contract HIPAA requires before a covered entity lets a vendor handle PHI on its behalf (45 CFR 164.502(e)), so PHI has to stay out of what those platforms receive. Curve Compliance signs one on every plan and removes PHI before anything is sent to an ad platform.

Can a med spa say it is HIPAA compliant on its website?

Only if it is true. The FTC tells businesses not to "make false or misleading claims" that they are HIPAA compliant (FTC guidance).

Talk to Curve Compliance

Book a call. Curve's team will review what your med spa's website sends to Meta, Google and TikTok with you and set up server-side conversions under a BAA on every plan. Most customers are live in about a week. Book a call with Curve.