Med spa photo consent forms: what HIPAA requires, with a free template
Updated July 31, 2026. Sources at the end. General information, not legal advice.
The short version: if your practice is a HIPAA covered entity, you need the patient's written authorization before using identifiable photos for marketing, and that authorization has required elements: what is used, by whom, for what, until when, signed and dated, with the right to revoke stated. A checkbox inside the treatment consent does not qualify.
Below: the requirements in plain language, a free template you can adapt with your attorney, and the part most practices miss, which is that a signed form only works if something enforces it at the moment of posting.
What the Privacy Rule actually requires
For covered entities, using or disclosing protected health information for marketing requires the patient's prior written authorization [1]. An identifiable before and after photo on your Instagram is exactly that. A valid authorization must contain, per 45 CFR 164.508(c) [2]:
- A specific description of the information to be used: which photos, of what.
- Who may use or disclose them: your practice, by name.
- Who may receive them: for social media, effectively the public.
- The purpose: marketing, social media, website, in-office displays, each named.
- An expiration date or event.
- Signature and date.
- Three required statements: the patient may revoke in writing; you cannot condition treatment on signing; and once disclosed, photos may be redisclosed by recipients and no longer protected.
Not every med spa is a covered entity; many cash-pay practices are not. But state privacy and publicity laws apply regardless, and the same form protects you either way. When in doubt, ask your attorney whether you are covered, not whether you can skip the form.
Free template: med spa photo consent and authorization
A plain-language starting point. Copy it, then have your attorney adapt it to your state and practice before use.
Patient photo consent and authorization
I, [patient name], authorize [practice name] to take clinical photographs of me ([treatment areas]) before, during, and after my treatment.
I agree to the following uses (each is my separate choice):
- [ ] My clinical record only. My photos stay inside my chart.
- [ ] Marketing where I am not identifiable (face cropped or masked): website, social media, in-office displays.
- [ ] Marketing where I may be identifiable, including [practice name]'s website and social media accounts ([list accounts]).
I understand that:
- Once a photo is published, people outside [practice name] can copy or reshare it, and it is no longer protected by privacy law.
- I may revoke this authorization at any time by written notice to [practice name]. Revocation stops future use but cannot undo uses that already happened.
- My treatment does not depend on signing this form, and I will not be paid for the use of my photos.
- This authorization expires [date / event, e.g. two years from signing] unless I revoke it earlier.
Patient signature ______________________ Date ____________
Patient name (print) ______________________ Witness ______________________
The gap a signed form does not close
Per data cited from AmSpa's 2025 legal compliance guidance, about 62% of med spas have a photo consent gap: no photo-specific form, verbal-only consent, or a clause buried in the treatment paperwork [3]. Fixing the form is step one. The remaining failure is operational: the form lives in a drawer or a form builder, the photos live on a phone, and the person about to post checks neither.
Completion is also a workflow problem. Digital consent captured at the moment of the visit reaches about 94% completion versus 61% for paper, per the same AmSpa-cited figures [3]. The form works when it is signed in the room, on the device that took the photos, and checked by software at export time.
How Medspa Photos puts this form to work
You bring your own consent language, reviewed by your counsel; the app supplies the rest. The patient signs on the clinic device and picks their scope, each choice recorded separately, versioned and time-stamped, stored with the photos it covers. When staff export, the server checks the consent: clinical record only means no social export, and a revocation blocks future exports immediately and pulls existing exports the same minute. The form above stops being paperwork and becomes a rule the system enforces.
Turn this template into an enforced rule. 14 days free, set up the same day, no sales call.
Start your 14-day free trial$99 per month per location after the trial. Card required, cancel anytime. Or see how the consent gate works on the photo consent app page.
Common questions
Does HIPAA require a photo consent form?
For covered entities, marketing use of identifiable photos requires a written authorization with specific elements. Many cash-pay med spas are not covered entities, but state law and defensibility point to the same form. General information, not legal advice.
What must the authorization contain?
What is used, who uses it, who receives it, the purpose, an expiration, and a signed date, plus the right to revoke, no conditioning of treatment, and the redisclosure warning. The template above covers each element.
Is a clause in the treatment consent enough?
No. A marketing authorization must be specific and standalone, and consent to be treated is not consent to be published. About 62% of med spas have a gap of exactly this kind, per AmSpa-cited data.
Can a patient revoke later?
Yes, in writing, at any time, and the form must say so. Revocation stops future use; it cannot undo what already happened. Your system should enforce it the moment it is recorded.
Is this template legal advice?
No. It is a starting point covering the required elements in plain language. Have your attorney adapt it to your state and practice before use.
Sources
- HIPAA Privacy Rule, marketing authorization requirement, 45 CFR 164.508(a)(3), hhs.gov, accessed July 31, 2026.
- Core elements and required statements of a valid authorization, 45 CFR 164.508(c), hhs.gov, accessed July 31, 2026.
- Photo-consent gap (~62%) and digital vs. paper completion rates (94% vs. 61%) as cited from AmSpa 2025 legal compliance guidance in industry coverage, accessed July 31, 2026.
This page is general information, not legal advice. If any of it is out of date, tell us at [email protected] and we will correct it.