Before-and-After Photo Consent: Medical Spa Requirements

Key takeaways

• A treatment consent form and a photo marketing authorization form are two different documents and require separate permissions from the patient
• Even without a visible face, before-and-after photos still count as protected health information (PHI)
• Clients can revoke photo consent at any time, but documentation must still be kept at least six years past date of creation or last effective date

What is a before-and-after photo consent form?

A before-and-after photo consent form for medical spas is a written authorization that gives a practice explicit permission to capture, store, and use a specific client's treatment photos for a stated purpose, such as marketing, education, or internal clinical documentation. It's a distinct document from the client intake form and the general treatment consent a client signs before a procedure, and requires its own signature. 

When does a photo become PHI?

A photo becomes PHI when it contains direct or indirect identifiers of a patient related to their medical treatment. Direct identifiers include elements like the person’s face, birthmarks/moles/scars, jewelry, or even a reflection in a mirror. 

Indirect identifiers include information like treatment location and/or date, a medical record number, or photo metadata. 

HIPAA guidelines provide a de-identification standard list to help practitioners properly remove any identifying features of photos and ensure they maintain compliance in their usage.

Federal rules mandate a general six-year document retention period for administrative compliance documentation, which include photo consent authorization forms. 

[CTA_MODULE]

Why a treatment consent form isn't enough

A treatment consent form gives a provider permission to perform a procedure. It covers risks, benefits, and alternatives, and lets the practice use PHI for treatment, payment, and healthcare operations. 

It does not authorize using a client's photo for marketing (websites, social media, promotion, external education, or other marketing materials). Using PHI to promote a practice is a separate use case under HIPAA, and needs its own signed authorization.

What a before and after photo consent form should include

Photo and media release consent rules vary by state in terms of a right of privacy and a right of publicity, generally protecting individuals against actions like unauthorized commercial use of their name and likeness, and public disclosure of private facts. 

However, HIPAA has more specific rules tied to before-and-after photo consent forms when it concerns medical information. The following information can help providers tailor their forms to ensure compliance.*

Specific description of the images and information covered

The before-and-after photo consent form for your med spa should name the treatment area, treatment type, and photo format. For example, “before and after Botox pics” will likely not qualify as proper authorization, but “front and side facial photos before and after Botox treatment” provides more specific information and understanding for the patient. 

Stated purpose of the use or disclosure

Each intended use of the person’s photos should be named explicitly, not implied. Whether you’re using the photos for marketing, social media promotion, website display, patient education, or even internal clinical records, list each use clearly to remove any ambiguity. 

Name where photos will appear

List where the photos can actually appear, such as your practice website, social media channels, print brochures, or paid ads. Avoid using a generalized term like “marketing purposes” to ensure the patient understands exactly where their photos will be used. 

An expiration date or event

Every photo authorization needs a defined end point, whether that's a calendar date or a triggering event. For example, "valid for 3 years from signature date" or “expires upon termination of the client relationship”.  Without an authorization end date, a consent form is not considered valid under HIPAA laws. 

A clear statement of the right to revoke

Your photo consent form must inform the client that they can revoke consent at any time and explain the process for doing so in writing. This detail should be stated in plain language and can't be buried in fine print.

Language reaffirming care

Include language that informs the client that their treatment, care, or payments do not depend on whether they sign a photo authorization. Under §164.508(b)(4), a covered entity generally cannot refuse to treat a client, refuse payment, or deny enrollment/eligibility because the client won't sign a photo marketing authorization. Treatment and photo consent have to be legally and practically separated.

The client's dated signature

A signature confirms the client reviewed and agreed to the terms listed in your consent form, and the date establishes when the authorization took effect. An unsigned authorization is not valid, offers no protection, and cannot be upheld under the law. 

What to exclude from a photo consent form 

There are a few overreaching clauses providers should not include in their consent forms as they may invalidate the agreement. 

For example, a blanket copyright assignment of the images, or perpetual and unlimited use of the photos would not be considered reasonable for the client. Avoid language that removes the individual’s right to revoke consent or that forces the individual to agree to penalties if they revoke consent. 

You also can’t include a waiver of the right to review an ad before it runs, or waiver of legal claims including attorney's fees. 

[CTA_MODULE]

How GlossGenius helps med spas manage before-and-after photo consent

GlossGenius Gold, Platinum, Practice Essentials, and Practice Advanced plans allow med spa providers to manage consent with their included Forms & Waivers feature, plus HIPAA-compliant EMR Charting. 

• Forms & Waivers. This feature lets med spas collect a signed, dated, electronic photo consent authorization at booking or checkout, stored directly on the client's profile rather than on paper or a personal device. With customizable templates for liability and releases. 
• Medical Charting. GlossGenius’ Charting for med spas ties before-and-after photos (with markup and annotation) to the client's record alongside SOAP notes, with medical director sign-off and a full audit trail. 
• HIPAA protection. Eligible businesses can add a Business Associate Agreement (BAA) at no additional cost, supporting HIPAA-compliant storage and handling of the photos themselves.
• Multi-location controls. Practice Essential and Practice Advanced plans support running multiple locations on one connected system, so intake templates and requirements stay consistent across sites. 

GlossGenius Standard plans start at $24/month, but Practice Essentials and Practice Advanced plans offer med spas the ultimate support:

‍

Grow your medical spa and protect client data with GlossGenius

Photo authorization is necessary for medical spas who want to collect and use client before-and-after photos while staying HIPAA-compliant. With GlossGenius Forms & Waivers, you automatically collect signed, dated photo authorizations right at checkout, while Client Profiles keep every signature and SOAP note securely tied to the right client. 

GlossGenius also handles Online Booking, Payments, and Marketing all from one platform. No separate apps, and no separate browsers. Plus, Photo Markup and EMR Charting for Practice Essentials and Practice Advanced plans. 

Try GlossGenius today and get 14 days free!

Before-and-after photo consent form: medical spa requirements FAQ

Do I need a separate consent form for every before-and-after photo?

You need a valid, signed marketing authorization on file before using any specific client's photo for marketing. One signed authorization can cover multiple photos from the same treatment series if its description and stated purpose are written broadly enough to include them, but it doesn't automatically extend to a future, unrelated treatment.

Can I use before-and-after photos in paid ads (Google/Meta)?

Yes, once a valid authorization is in place that names that channel. Because paid ad platforms are a distinct distribution channel from a website or organic social post, the authorization should specifically list advertising or paid media among the permitted uses rather than relying on a generic "marketing" term. 

What happens if I post a patient photo without authorization?

It's a HIPAA violation, since identifiable PHI is being disclosed without valid authorization. Penalties range from a few hundred dollars for minor infractions up to hundreds of thousands of dollars for serious or willful violations, and a client may also be able to pursue a separate civil claim.

Is a photo release form the same as a HIPAA authorization?

A generic photo release used by photographers or non-medical businesses is built to protect the business's right to use an image, and typically doesn't include HIPAA's specific required elements, such as a defined expiration date, an explicit revocation right, or a description of the covered PHI. A med spa needs a release that satisfies §164.508, not a standard model-release template borrowed from a different industry.

How should before-and-after photos be stored to stay HIPAA compliant?

HIPAA compliance requires an encrypted system tied to the client's record, with access limited under a minimum-necessary standard to staff who actually need it, and never on unsecured personal devices or general-purpose cloud photo storage. Images should be transferred off the capture device and onto the secure system as soon as possible after the appointment, then deleted from the device.

‍

*This website and any information provided on or through it is for general information only and presented without any representation or warranty whatsoever, including as to the accuracy or completeness of the information. You may not rely on this website or its contents for legal, medical, or other professional advice.

‍