Three separate rulebooks govern what a medical spa can put in its marketing, and most practices worry about the wrong one. HIPAA governs the patient’s information. The FTC governs whether your claim is true. Your state medical board adds requirements neither of them covers.
- HIPAA rarely stops you describing your own services. Its definition of “marketing” mostly bites when a third party pays you to promote their product. The real constraint is using an identifiable patient
- A photo taken for the chart is not a photo you can post. Marketing use needs its own written authorization — it cannot be bundled into intake paperwork or made a condition of treatment
- Patients can revoke that permission in writing at any time
- The FTC is the regime aesthetics actually trips. Results claims need competent and reliable scientific evidence, and a “results not typical” disclaimer does not fix an atypical before-and-after
- Comped treatment must be disclosed in every influencer post — and since October 2024, review violations can carry civil penalties under a binding FTC rule, not just guidance
- Your state board is the third layer. Texas makes you keep every ad for two years; California mandates specific before-and-after disclaimer wording
What are the HIPAA and FTC rules for aesthetic marketing? HIPAA restricts using a patient’s identifiable information — including their photograph — in promotional material without a specific written authorization that meets the requirements of 45 CFR 164.508. The FTC governs the truthfulness of what you claim: results-based advertising requires competent and reliable scientific evidence, and any material connection between you and someone endorsing you must be disclosed. A third layer, your state medical board, imposes profession-specific advertising rules that frequently go further than either federal regime. A valid HIPAA authorization does not protect you from the FTC, and complying with both does not satisfy your state board.
Ask most practice owners what worries them about marketing compliance and they will say HIPAA. It is the acronym everyone knows, and the one every vendor invokes. It is also, in aesthetics, the regime least likely to be the source of an actual problem.
The pattern in the enforcement record is fairly consistent. Practices get into difficulty for saying things they cannot substantiate, for before-and-after images that overstate what a typical patient can expect, for review practices that quietly exclude unhappy patients, and for posting an identifiable patient without the right paperwork. Only the last of those is primarily a HIPAA problem.
The Three Rulebooks, and Which One You Are Actually Breaking
| Regime | What it governs | Who enforces | Typical aesthetic exposure |
|---|---|---|---|
| HIPAA | Use and disclosure of identifiable patient information, including photographs | HHS Office for Civil Rights | Posting a patient without a valid authorization; replying to a review with clinical detail |
| FTC | Truthfulness and substantiation of advertising claims; endorsements and reviews | Federal Trade Commission | Results claims you cannot support; undisclosed comped influencers; review gating |
| State medical board | Profession-specific advertising rules for licensees | State board, sometimes the state AG | Missing disclaimers, unsubstantiated superiority claims, ad retention failures |
The practical consequence is that compliance questions rarely have one answer. “Can I post this before-and-after?” runs through all three: HIPAA asks whether you have permission to use this person’s image, the FTC asks whether the image fairly represents what a typical patient gets, and your state board may ask whether you have included specific disclaimer language and kept a copy of the ad on file.
What HIPAA Actually Says About Marketing
Does HIPAA stop a med spa advertising its services? Generally no. Under 45 CFR 164.501, “marketing” means a communication about a product or service that encourages the recipient to purchase or use it — but the definition carves out communications describing “a health-related product or service… that is provided by… the covered entity making the communication.” Describing your own treatments to your own patients generally is not HIPAA “marketing.” That exception disappears the moment a third party pays you to promote their product, which the rule calls financial remuneration.1
This is the most commonly misunderstood point in aesthetic marketing compliance, and getting it right removes a lot of unnecessary fear. A medical spa emailing its patient list about a new laser is not doing something HIPAA prohibits. Posting an educational reel about how filler works is not a HIPAA problem. The rule was not written to stop practices describing what they do.
HIPAA’s marketing rule is not what stops you describing your own services. What it governs is the use of an identifiable patient — and that is a disclosure question, not a marketing one.
Where it does bite, in practice, is narrower and more specific:
- Using an identifiable patient in promotional material. A photograph, a video, a named testimonial, a story specific enough to identify someone. This needs a written authorization.
- Third-party paid promotion. If a device or injectable manufacturer pays you — directly or indirectly — to promote their product to your patients, the exception no longer applies and you are squarely inside the marketing rule.1
- Replying publicly to a review in a way that confirms someone was a patient or references their treatment. This is where several enforcement actions have landed.
One area worth separating out: tracking technologies. Pixels and analytics on a healthcare site raise a related but distinct set of questions, and the exposure there has shifted considerably since 2024 — we cover the current position, and what actually changed, in tracking marketing ROI for cosmetic clinics. For vertical-specific guidance, see HIPAA-compliant digital marketing for surgeons and complying with medical marketing guidelines online.
One note on sources. HHS publishes a plain-English explainer of the marketing rule, and it is useful — but its content was last reviewed in July 2013,3 and it presents the “what is not marketing” categories without the financial-remuneration qualifier that governs the current regulatory text. Where the two differ, the eCFR text is the one that controls.1
What a Valid Marketing Authorization Has to Contain
This is general marketing guidance, not legal advice, and it has not been reviewed by an attorney. What follows is a plain-language summary of what the regulation itself says, with the regulation linked so you can read the operative text rather than take our word for it.
Privacy obligations vary by state and by how your practice is structured, and a summary cannot account for your specific facts. Have your counsel or compliance officer review any consent form or authorization you actually adopt.
The required elements
| Requirement | What it means in practice |
|---|---|
| Specific description of the information | “Photographs taken on [date] of the treated area” — not “my information” |
| Who may use or disclose it | Your practice, named |
| To whom it may be disclosed | Where it will actually appear — and this is where “website” and “paid social” are different answers |
| Each purpose | Marketing use, stated as such |
| An expiration date or event | Permission cannot be open-ended and undefined |
| Signature and date | Plus the authority, if signed by a personal representative |
| Right to revoke | Stated, with the exceptions and how to do it |
| Re-disclosure warning | That once disclosed, the information may be re-disclosed and no longer protected |
| Plain language | An explicit requirement of the rule, not a style preference |
| A copy for the patient | You must give them one |
Summarised from 45 CFR 164.508(c).2
The three that practices get wrong
It cannot be bundled into your intake paperwork. The rule prohibits combining an authorization with other documents to create a compound authorization, subject to narrow exceptions.2 A photo-marketing consent buried as clause fourteen of a new-patient packet is the single most common defect we see.
It cannot be a condition of treatment. A practice generally may not condition treatment, payment or eligibility on someone signing an authorization.2 That means “sign the photo release to get the promotional price” is a problem — and it is also, separately, an FTC problem, for reasons covered below.
It is revocable. A patient may revoke in writing at any time, except to the extent the practice has already taken action in reliance on it.2 Practically: you generally must stop future use, but the rule does not by itself unwind a brochure already printed and distributed.
Before-and-After Photos: The Questions Everyone Gets Wrong
Can I post before-and-after photos of my patients? Yes, with specific written permission for marketing use — which is a different thing from the consent that let you take the photo for the clinical record. The permission has to name where the images may appear, it cannot be bundled into intake paperwork or made a condition of treatment, and the patient can withdraw it. Separately, the images themselves must fairly represent what a typical patient can expect, and several states mandate specific disclaimer wording.
Before-and-after images are the most persuasive asset an aesthetic practice owns and the most commonly mishandled. Not one of the pages currently ranking for HIPAA marketing guidance addresses them at all — which tells you those pages were written for hospitals and primary care, not for a practice whose entire marketing case is visual.
A treatment-record photo is not a marketing photo
The photograph you took to document a treatment was captured for clinical purposes. Using it in an ad is a separate act with separate permission requirements. These are two documents, not one, and the second cannot be assumed from the first.
Cropping the face does not de-identify
Identifiability is broader than faces. Tattoos, scars, birthmarks, jewellery, distinctive clothing and recognisable backgrounds can all identify a person — and in a small market, so can the combination of a treatment and a timeframe. Merely confirming that someone is your patient is itself a disclosure.
Cropping out the face does not make an image anonymous. Tattoos, scars, jewellery and backgrounds identify people — and in a small market, so does the treatment itself.
Permission for your website is not permission for a paid ad
The authorization has to specify where the image may appear. A patient who agreed to your gallery has not agreed to a boosted Instagram post that will be served to their neighbours. Write the venues into the form, and if you later want a new venue, go back and ask.
What happens when a patient revokes
Take it down promptly across every venue you control, and keep a record of when you did. Note the practical limit: revocation generally stops future use, but it does not retroactively unwind uses already made in reliance on the permission.2 This is exactly why an authorization that names specific venues is easier to honour than a vague one — you know where to look.
Editing a before-and-after is where privacy becomes fraud
This is the line that turns a compliance problem into a consumer-protection case. In July 2024, Washington’s Attorney General announced a $5 million resolution with a plastic surgery practice and its owner — about $1.5 million of it in restitution to roughly 21,000 consumers. Among the conduct at issue: editing before-and-after photographs to misrepresent results, alongside fabricated reviews and agreements barring patients from posting reviews below four stars. The action spanned the state consumer protection act, the federal Consumer Review Fairness Act, and HIPAA.11
One practice, one case, and it touches nearly every theme on this page. If you retouch, relight, or change the framing between the before and the after, you are no longer showing a result — you are making a claim you cannot support.
The SEO and conversion side of using imagery well is covered in how reviews and before-and-after photos impact SEO for medspas.
The FTC Layer, Which Is Where Aesthetics Actually Gets Caught
The FTC defines its substantiation standard as “tests, analyses, research, or studies that (1) have been conducted and evaluated in an objective manner by experts in the relevant disease, condition, or function… and (2) are generally accepted in the profession to yield accurate and reliable results.”4 For health-benefit claims it treats randomised controlled human trials as the form of evidence experts would generally require.
The “typical results” rule
This is the point most aesthetic marketing gets wrong, and it is worth stating precisely. If you feature a result more dramatic than consumers can generally expect, the advertisement must make clear what the generally expected result actually is. A disclaimer saying results are not typical does not fix the problem — the guidance is explicit that the ad has to disclose what typical results are.4
A valid HIPAA authorization does not protect you from the FTC. They govern different things — one the patient’s privacy, the other the truthfulness of the claim.
The FTC has said this overlap directly: its business guidance notes that the FTC Act’s obligations apply to HIPAA-covered entities as well as to companies outside HIPAA, and warns that a deceptive authorization process is itself an FTC Act violation — for instance, implying that a patient must agree to have their data used for advertising in order to receive treatment.7
None of this means your copy has to be timid. It means the claim and the evidence have to travel together — which is a writing problem as much as a legal one. Our guides to writing treatment pages that convert and building patient trust through transparency and visuals cover how to be persuasive without overclaiming.
Endorsements, influencers and comped treatment
The Endorsement Guides were revised in July 2023.5 The operative principle: a connection between you and an endorser that consumers would not expect, and that would affect how they weigh the endorsement, must be disclosed clearly and conspicuously. In aesthetics that means:
- Comped or discounted treatment is a material connection. Free tox in exchange for a post requires disclosure — every time, in the post itself.
- Your own staff must disclose too. Employees endorsing their employer need to disclose the relationship in each post; a mention on their profile is not enough, because people reading a single post will not see it.5
- Disclosures must be unavoidable. Not fine print, not behind a “more” link, not in the comments.
- The endorsement must be honest and must reflect experience the endorser actually had.
If you work with influencers or run a referral programme, the practical implication is that your brief to them is part of your compliance posture. What they post is your exposure.
Review Gating Is Now a Federal Violation, Not Just Bad Manners
The rule prohibits, among other things: fake or false reviews and testimonials, including disseminating ones you knew or should have known were false; buying reviews conditioned on a particular sentiment; undisclosed insider reviews, with disclosures that must be clear, conspicuous and unavoidable; suppressing reviews through false accusations, unfounded legal threats or intimidation; and fake indicators of social media influence.6
Read that list against common aesthetic-practice habits and several things stop being grey areas. Asking only your happy patients for reviews. Offering a discount “for a five-star review.” Having staff post as patients. An NDA that discourages negative feedback — which is precisely the conduct at the centre of the Washington case.11
Used properly, testimonials remain one of the strongest assets you have — leveraging patient testimonials for SEO covers placing them well, and reputation management for dermatologists goes deeper for that vertical.
The operational side of earning reviews legitimately — including how to respond without disclosing anything — is covered in online reputation management for doctors.
The Third Layer: Your State Medical Board
Texas
The Texas Medical Board’s advertising rules make the physician responsible for the form and content of every advertisement, require that patients consent before any use of photographs in advertising, and require the practice to keep a copy of any advertisement for two years from its last use.12
The deceptive-advertising provisions go further still: testimonials must carry a disclaimer or warning as to the credentials of the person giving them and a disclosure of any compensation provided in exchange; models or actors must be explicitly identified as such rather than implied to be patients; and claims of unique or exclusive skill require substantiation.12
California
California’s Business and Professions Code §651 is the strongest example for before-and-after imagery specifically. Altered or inaccurate imagery is prohibited; model photographs require prominent disclosure; patient photographs must specify which procedures were performed; and before-and-after views must be comparable and include a statement that the same before and after results may not occur for all patients.13
Claims of professional superiority require substantiation with objective scientific evidence. Violations are a misdemeanour, and administrative fines can run to $10,000 per event.13
Why we are not publishing a state-by-state directory
You will find sites offering a page per state on med spa advertising rules. We have deliberately not built one, because a set of near-identical pages with the state name swapped is exactly the pattern search engines have spent two years demoting — and because advertising rules change often enough that a fifty-page network is out of date the week after it is published.
Check your own board, and check it this year. If you operate across state lines, the strictest applicable rule is the safe default for shared creative.
Requirements also differ by what you offer and who delivers it. We work through the vertical-specific picture in dermatology digital marketing and men’s clinic marketing.
What Has Actually Been Enforced
| Case | Amount | What happened |
|---|---|---|
| Cadia Healthcare September 2025 | $182,000 | 150 patients’ information posted in public-facing website “success story” content without valid written authorizations, including one patient’s name, photograph and medical information8 |
| Complete P.T. February 2016 | $25,000 | Patient photographs and names posted in the testimonial section of the practice website without compliant authorizations9 |
| New Vision Dental December 2022 | $23,000 | Patient information disclosed in Yelp review responses on multiple occasions, including naming a reviewer who had used a pseudonym10 |
The Cadia matter is the most directly on point for anyone running testimonial marketing. Announcing it, the OCR Director stated that generally, a valid written HIPAA authorization is necessary before a covered entity can post an individual’s protected health information in a website testimonial or a social media campaign.8
On the FTC side, we were unable to find an enforcement action against a medical spa or cosmetic practice for deceptive aesthetic-results advertising, and we are not going to imply one exists. What does exist in the adjacent space is instructive — the FTC’s first action against an IV therapy marketer concerned disease-treatment claims the company could not substantiate, and the Commission’s stated position there was simply that health claims must be supported by competent and reliable scientific evidence.
The strongest aesthetics-specific enforcement story is a state action rather than a federal one, and it is the Washington matter described above.11
The Pre-Publish Checklist
| Check | Why |
|---|---|
| Is any patient identifiable — including by tattoo, scar, jewellery or background? | Identifiability is broader than faces |
| Do you hold a signed marketing authorization covering this venue? | Website permission is not paid-social permission |
| Was that authorization a standalone document, not part of intake? | Compound authorizations are prohibited2 |
| Was anything conditioned on signing it? | Conditioning treatment or pricing on an authorization is prohibited2 |
| Has the patient revoked? | Check before re-using older assets |
| Are the images unedited, comparably lit, framed and posed? | Editing turns a result into an unsupported claim |
| Is the result typical — and if not, does the ad say what typical looks like? | A “results not typical” disclaimer does not fix it4 |
| Can you substantiate every efficacy claim in the copy? | Competent and reliable scientific evidence is the standard4 |
| Is any material connection disclosed, in the post itself? | Comped treatment and staff endorsements both count5 |
| Does your review process include unhappy patients? | Selective solicitation and gating are covered by the 2024 rule6 |
| Does the creative meet your state board’s rules, including any required wording? | The strictest layer, and the one most often missed |
| Have you kept a copy of the ad? | Texas requires two years; other states vary12 |
“Almost nobody gets into trouble for the thing they were worried about. They worry about HIPAA and then post a retouched before-and-after with a claim they can’t back up. The privacy paperwork was fine. The picture wasn’t.”Gladys Inting, Founder, Skinspire · 20-year medical aesthetics veteran
The Skinspire Take
Compliance in aesthetic marketing is usually framed as a set of things you cannot do, which is why most practices respond by doing less — fewer photos, fewer testimonials, less of the material that actually converts. That is an expensive way to manage a risk you have misidentified.
The workable version is narrower. Get a real authorization, separate from intake, that names where the image will appear. Show results you can defend as typical, unedited. Disclose anything you paid for. Ask every patient for a review, not just the happy ones. Keep a copy of what you published. Do those five things and you can market aggressively without the exposure — which is the opposite of what “compliance” usually means in practice.
“Practices ask us what they’re allowed to say, and the honest answer is: more than you think, as long as it’s true and you have the paperwork. The constraint isn’t the privacy rule. It’s whether the claim survives contact with evidence.”Thomas Conroy, SEO & Digital Marketing Lead, Skinspire
The Bottom Line on Aesthetic Marketing Compliance
Three regimes, and the one everyone fears is rarely the one that bites. HIPAA governs the patient’s information — get a standalone written authorization that names the venue, honour revocations, and keep clinical detail out of public replies. The FTC governs the truth of your claim — show typical results, substantiate what you assert, disclose what you paid for, and stop filtering your reviews. Your state board adds a third set of rules that frequently goes further than either, and it is the layer most practices have never read. None of this stops you marketing well. It stops you marketing carelessly, which is a different thing, and considerably cheaper than the alternative.
Aesthetic Marketing Compliance: Common Questions.
Does HIPAA apply to a medical spa?
General marketing guidance, not legal advice. It applies if the practice is a covered entity — broadly, a healthcare provider that transmits health information electronically in connection with certain standard transactions, such as billing insurance. Many cash-pay medical spas fall outside that definition, which surprises people. But two things follow: whether or not HIPAA binds you, state privacy law, the FTC Act and your medical board still do, and if a physician or nurse practitioner is providing services under their license, patient information is protected by professional confidentiality obligations regardless. Confirm your own status with counsel rather than assuming either way.
Can I post before-and-after photos of my patients?
Yes, with specific written permission for marketing use, which is separate from the consent that let you take the photo for the clinical record. The permission should name where the images may appear — permission for your website is not permission for a paid social ad — and it cannot be bundled into intake paperwork or made a condition of treatment. Remember that identifiability extends beyond faces to tattoos, scars, jewellery and recognisable backgrounds, and that several states require specific disclaimer language alongside the images.
Do I need a separate consent form for marketing photos?
Yes. Under 45 CFR 164.508 an authorization generally may not be combined with other documents to create a compound authorization, so a photo-marketing clause buried in a new-patient packet is a defect. It also has to contain specific required elements: a specific description of the information, who may use and receive it, each purpose, an expiration date or event, the right to revoke, and a warning that information disclosed may be re-disclosed and no longer protected. It must be in plain language, and the patient gets a copy.
Can a patient make me take down a photo they already agreed to?
Generally yes. A patient may revoke an authorization in writing at any time, except to the extent the practice has already acted in reliance on it. Practically, that means you must stop using the image going forward but the rule does not by itself unwind uses already made — a printed brochure already distributed, for example. Take it down promptly everywhere you control, and keep a record of when you did. This is one reason an authorization naming specific venues is easier to honour than a vague one: you know where to look.
Can I offer a discount in exchange for a review or a photo?
Not in the way most practices mean it. HIPAA prohibits conditioning treatment, payment or eligibility on someone signing an authorization, so “sign the photo release for the promotional price” is a problem. Separately, the FTC’s rule on consumer reviews prohibits buying reviews conditioned on a particular sentiment, and its endorsement guidance is explicit that you cannot condition an incentive on a review being positive. You may generally ask every patient for an honest review; what you cannot do is pay for a favourable one or filter who gets asked.
What claims can I legally make about a treatment’s results?
Claims need what the FTC calls competent and reliable scientific evidence — tests, analyses or studies conducted and evaluated objectively by relevant experts and generally accepted in the profession as reliable. For health-benefit claims the FTC treats randomised controlled human trials as the standard experts would generally require. The most common failure in aesthetics is not an outrageous claim but an atypical one: featuring an exceptional result without disclosing what a typical patient can expect. A “results not typical” disclaimer does not fix this.
Do influencers have to disclose that I comped their treatment?
Yes. Free or discounted treatment is a material connection, and the FTC’s Endorsement Guides require that connections consumers would not expect — and that would affect how they weigh the endorsement — be disclosed clearly and conspicuously in the post itself. Not in a profile bio, not behind a “more” link, not in the comments. The same applies to your own staff: employees endorsing their employer should disclose the relationship in each post, because someone reading a single post will not otherwise know.
What happens if I only ask happy patients for reviews?
Since October 21, 2024 this sits under a binding FTC trade regulation rule rather than interpretive guidance, and knowing violations can carry civil penalties. The rule addresses fake reviews, undisclosed insider reviews, incentives conditioned on sentiment, and review suppression through false accusations, unfounded legal threats or intimidation. A Washington plastic surgery practice paid $5 million in 2024 in a matter that included agreements barring patients from posting reviews below four stars. Ask everyone, and respond to what you get.
Neither author is an attorney or a compliance officer, and nothing on this page is legal advice. Every regulatory statement here is sourced to a primary document — the eCFR, HHS, the FTC, or state code — and linked below so you can read the operative text rather than rely on our summary of it.
Obligations vary by state, by whether your practice is a HIPAA covered entity, and by how your services are structured and delegated. Have your own counsel or compliance officer review any consent form, authorization, advertising policy or review process before you adopt it, and take advice on anything involving a specific patient complaint or a regulator’s inquiry rather than acting on a general guide.
Sources & References
- 45 CFR 164.501 — definition of “marketing” and its exceptions, including the financial-remuneration qualifier and the definition of financial remuneration. View source
- 45 CFR 164.508 — authorization requirements: core elements and required statements (c)(1)–(c)(2), plain language (c)(3), copy to the individual (c)(4), prohibition on compound authorizations (b)(3), prohibition on conditioning treatment (b)(4), and the right to revoke (b)(5). View source
- HHS Office for Civil Rights — Marketing guidance. Useful plain-English explainer; note its content was last reviewed July 26, 2013, and the eCFR text controls where they differ. View source
- Federal Trade Commission — Health Products Compliance Guidance, December 2022: the “competent and reliable scientific evidence” standard, the treatment of testimonials, before-and-after imagery, and why “results not typical” disclaimers do not fix atypical results. View source
- Federal Trade Commission — Endorsement Guides, 16 CFR Part 255 (revision published July 2023), and the companion business guidance “The FTC’s Endorsement Guides: What People Are Asking,” covering material connections, incentivised endorsements and employee disclosures. View source
- Federal Trade Commission — Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, effective October 21, 2024. A binding trade regulation rule; knowing violations can carry civil penalties. View source
- Federal Trade Commission — “Sharing Consumer Health Information? Look to HIPAA and the FTC Act”: the FTC Act applies to HIPAA-covered entities, and a deceptive authorization process is itself an FTC Act violation. View source
- HHS — OCR settlement with Cadia Healthcare Facilities, announced September 30, 2025: $182,000 and a two-year corrective action plan over 150 patients’ PHI in public-facing website success stories. View source
- HHS — OCR settlement with Complete P.T., Pool & Land Physical Therapy, announced February 2016: $25,000 over patient photographs and names in website testimonials without compliant authorizations. View source
- HHS — OCR settlement with B. Brandon Au, DDS d/b/a New Vision Dental, December 2022: $23,000 over PHI disclosed in Yelp review responses. View source
- Washington State Attorney General — resolution with Allure Esthetic and Dr. Javad Sajan, announced July 2, 2024: $5 million including roughly $1.5 million in restitution to about 21,000 consumers, covering review-restricting agreements, fabricated reviews, edited before-and-after photographs and HIPAA violations. View source
- Texas Administrative Code, 22 TAC §164.2 and §164.3 — physician responsibility for advertising content, patient consent before use of photographs, two-year advertisement retention, testimonial credential disclaimers and compensation disclosure, and identification of models. View source
- California Business and Professions Code §651 — prohibition on altered or inaccurate imagery, model disclosure, procedure identification, the required statement that the same before and after results may not occur for all patients, substantiation of superiority claims, and penalties. View source
Compliance shouldn’t mean marketing less.
A free 30-minute audit of your current marketing against all three layers — HIPAA, the FTC and your state board — covering your consent workflow, before-and-after practices, claims language and review process. You get a prioritised list of what to fix. No sales pressure. Territory-exclusive: we take one clinic per protected market.
