When HIPAA Applies to Medical Spas and How to Protect Client Data

Medical spas collect a lot of sensitive information: health histories, medication lists, allergies, treatment notes and before-and-after photos. A common assumption is that having a medical director or offering injectables automatically puts a med spa under HIPAA. That is not how the law works, and getting the question wrong cuts both ways. Some spas carry HIPAA obligations they don't realize they have. Others assume that being outside HIPAA means no health privacy rules apply, which is also wrong.

This guide covers how the coverage test actually works, what applies if HIPAA does not, and the safeguards that make sense either way.

The HIPAA coverage test

HIPAA's Privacy and Security Rules apply to "covered entities" and their business associates. Under 45 CFR 160.103, a health care provider is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction. Those transactions include:

Health care claims or equivalent encounter information
Eligibility checks with a health plan
Claim status inquiries
Payment and remittance advice
Referral certification and authorization

So the question is not whether a physician supervises the spa, whether staff take health histories, or whether treatments are medical. Those facts make a med spa a health care provider. They don't make it a HIPAA covered entity. What matters is whether the spa, or a billing company acting for it, conducts these transactions electronically.

In practice:

A med spa that bills insurance electronically for any service is very likely a covered entity. Once covered, HIPAA applies to the protected health information it holds, not only to insured patients' records.
A cash-only med spa that never conducts standard electronic transactions is generally not a HIPAA covered entity, even with a medical director, injectables and lasers.
A spa owned by or operating inside a covered medical practice may fall under that practice's HIPAA program. Ownership and billing arrangements matter here, so have counsel review the structure.

Coverage questions are fact-specific. If your spa bills any payer, uses a clearinghouse, or shares ownership with a practice that does, talk to a healthcare attorney before concluding HIPAA doesn't apply.

If HIPAA applies

Covered med spas take on the same obligations as any medical practice. The main ones:

Notice of Privacy Practices given to patients.
Authorization for marketing. HIPAA generally requires written authorization before using PHI for marketing. That includes identifiable before-and-after photos used in ads or on social media. Full-face photos are one of the identifiers listed in the de-identification standard.
A written risk analysis under the Security Rule (45 CFR 164.308(a)(1)), updated as systems change.
Business associate agreements with vendors that create, receive, maintain or transmit PHI for you, such as EHR and booking software, cloud storage, billing services and answering services.
Workforce training within a reasonable period after someone joins, and when policies change.
Breach notification to patients within 60 days of discovery, and to HHS on the timelines in the Breach Notification Rule.

Penalties. HIPAA civil penalties are tiered by culpability. Under HHS's 2025 inflation adjustment, published January 28, 2026, they range from $145 per violation at the lowest tier to $2,190,294 at the highest, with a calendar-year cap of $2,190,294 for identical violations. HHS made no adjustment for 2026, so those figures are current. HHS's 2019 Notice of Enforcement Discretion also sets lower annual caps for the three lower tiers: $25,000, $100,000 and $250,000 before inflation adjustment.

Tier	Per violation (2025 figures)
Did not know	$145 to $73,011
Reasonable cause	$1,461 to $73,011
Willful neglect, corrected within 30 days	$14,602 to $73,011
Willful neglect, not corrected	$73,011 to $2,190,294

If HIPAA does not apply

Being outside HIPAA does not mean health data is unregulated. Cash-pay med spas should look at three layers.

1. The FTC Act. Section 5 prohibits deceptive and unfair practices, and the FTC applies it to health data held by businesses outside HIPAA. A privacy policy that says "we never share your health information" while the website sends booking details to ad platforms through tracking pixels is the kind of mismatch that draws attention. In its first Health Breach Notification Rule case, announced February 1, 2023, the FTC said GoodRx shared users' health information with advertisers. GoodRx agreed to a $1.5 million civil penalty.

2. The FTC Health Breach Notification Rule. This rule covers vendors of personal health records and related entities that are not covered by HIPAA. Amendments that took effect in July 2024 made clear it reaches health apps and similar products. A typical med spa is not a personal health record vendor. But a spa that offers its own app or portal where clients track treatments, weight or other health data drawn from more than one source (for example, synced from a wearable) should check whether it qualifies. According to the FTC's compliance guide, a business covered by the rule must notify affected people and the FTC after a breach, and the rule counts unauthorized disclosures, not only hacks. Violations can carry civil penalties of up to $53,088 per violation. That is the 2025 inflation-adjusted figure in 16 CFR 1.98, and the FTC kept 2025 levels for 2026.

3. State consumer health data laws. Washington's My Health My Data Act was written specifically for health data that falls outside HIPAA. According to the Washington Attorney General, most regulated entities had to comply with its main sections by March 31, 2024, and small businesses by June 30, 2024. It applies to businesses that operate in Washington or target Washington consumers. Key points for med spas:

It requires a separate consumer health data privacy policy, linked prominently from the homepage.
It generally requires consent to collect or share consumer health data beyond what is needed to provide the service the consumer asked for, and signed authorization before selling it.
Consumers can ask to have their data deleted.
A violation is treated as a violation of the state Consumer Protection Act, enforced by the Attorney General and through private lawsuits.

Nevada passed a narrower consumer health data law, SB 370, which also took effect March 31, 2024 and is enforced by the state Attorney General. Connecticut also added consumer health data provisions to its general privacy law in 2023. If you operate in several states, ask counsel which apply.

Safeguards that make sense either way

Whether or not HIPAA applies, these practices reduce risk and are common across well-run clinics:

Front desk and treatment rooms

Position screens and intake paperwork away from the waiting area.
Hold health history discussions in private rooms.
Lock paper records and shred what you no longer need.

Software and accounts

Give every staff member their own login, with access limited to what their role needs.
Turn on multi-factor authentication for email, booking, EHR and payment systems.
Encrypt laptops, tablets and phones that hold client data, and turn on automatic screen lock.
Keep audit logs turned on in your EHR or charting system and review them.
Back up client data and test that you can restore it.

Marketing and photos

Get written consent before using any identifiable photo or testimonial, and record where it will appear.
Review what your website's tracking pixels and chat widgets send to third parties, especially on booking and intake pages.
Make your privacy policy match what you actually do.

Vendors

Ask each vendor that touches client data how they secure it, and whether they will sign a BAA if you are a covered entity.
Remove vendor access when you stop using a tool.

Incidents

Write down who does what if a device is lost, an account is compromised or data is sent to the wrong person.
Check HIPAA, FTC and state breach notification rules early, since the deadlines can be short.

Where NutriCove fits

NutriCove builds AI automation for med spas: an AI receptionist, missed-call text back, follow-up messages, online booking and review requests. These tools handle client names, phone numbers and appointment details, so it helps to know your spa's HIPAA status and state privacy obligations before deciding what data goes into them. To see what the systems do, read about our med spa automation.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.