Eaglizer ITHIPAA for med spas and aesthetics practices
Med spas sit between health care and retail. Whether HIPAA applies depends on how the practice bills, but the patient information you hold is sensitive either way.
Free preview before you pay. Editable Word files. 14 day refund.
Does HIPAA apply to your med spa?
HIPAA applies to a health care provider that sends health information electronically in connection with a standard transaction, such as an insurance claim or eligibility check. A med spa that never does that may fall outside HIPAA, but state privacy laws such as California's CMIA can still apply, and many practices adopt HIPAA level policies anyway because supervising physicians and partners expect them. Confirm your status with counsel.
Where med spas differ
- Before and after photos. Identifiable photos are health information. Using them on your website or in ads is marketing and needs a written authorization.
- Cash pay patients. Most treatments are self paid. Patients can ask you not to share those services with a health plan.
- Medical supervision. Sharing relevant history with the supervising physician is treatment.
- Booking and marketing tools. Scheduling, texting, and email platforms that hold client health details need agreements.
What the kit writes for a med spa
Your privacy notice uses aesthetics treatment examples, and the policies cover marketing authorizations, photo use, self pay restrictions, and vendor agreements.
Questions
Are before and after photos protected?
If they identify the patient and the practice is covered by HIPAA, yes. Using them for marketing requires a written authorization.
Full HIPAA Policy Kit, $129
- Notice of Privacy Practices, updated for the 2026 rules, plus the acknowledgment form
- 22 Privacy policies and procedures
- 19 Security policies mapped to the Security Rule
- Breach Notification policy with a risk assessment form and log
- Business Associate Agreement for your vendors
- Workforce confidentiality agreement, training log, and access checklist
- Security Risk Analysis worksheet, pre filled from your answers
- Patient request forms, plus a California addendum for California practices
More guides
- HIPAA compliance for dental offices: what auditors actually check
- HIPAA compliance checklist for small medical practices in California
- The HIPAA security risk assessment, explained for small practices
- Notice of Privacy Practices template, updated for 2026
- HIPAA policies for chiropractic offices
- HIPAA policies for physical therapy practices
- HIPAA policies for mental health and behavioral health practices
- HIPAA policies for optometry practices
- HIPAA policies and procedures for small medical practices
Templates, not legal advice. Eaglizer IT is not a law firm and does not certify HIPAA compliance. Using templates does not by itself make a practice compliant; follow the policies, train your staff, and keep records.