Are med spas HIPAA compliant?

That depends on whether HIPAA applies to the spa at all. A covered med spa must follow the Privacy, Security and Breach Notification Rules. A spa that is not a covered entity has no HIPAA obligation to be compliant, though many choose HIPAA-style safeguards and state laws may still require protection of client health information.

Do med spas follow HIPAA even when they are not required to?

Many do, for three reasons: a medical director or partner practice that is covered, a state law with a broader reach, or a policy choice to treat treatment details as sensitive. Booking and charting vendors also tend to offer HIPAA features and business associate agreements, which spas adopt as a safeguard rather than a requirement.

Does billing through a medical director make my med spa a covered entity?

It can matter. Covered status attaches to the legal entity that transmits the transactions. If the medical director's separate practice bills insurance, that practice may be covered while the spa is not, or the two may be treated together depending on structure. Have an attorney review the contracts, who owns the records and who bills.

Are med spas under HIPAA if they offer telehealth consultations?

Telehealth alone does not decide it. A video visit is not a standard transaction. What matters is whether the provider bills a health plan electronically for any services, including a telehealth visit. Spas that bill insurance for telehealth, or whose supervising provider does, should assume covered status until counsel says otherwise.

What happens if a med spa is covered by HIPAA and ignores it?

A covered entity must follow the Privacy, Security and Breach Notification Rules, including business associate agreements with vendors that handle protected health information. Penalties and enforcement are set by HHS and are outside what this page verified, so read the HHS enforcement pages or ask counsel for current penalty tiers.

If a med spa is not covered by HIPAA, can it text clients about treatments freely?

No. HIPAA is only one layer. The FCC rule at 47 CFR 64.1200 requires prior express consent for automated texts and prior express written consent when a text includes or introduces an advertisement. Carrier registration and state law add further requirements.

By Alpit Patel and the aibrevo team · October 15, 2026 · 14 min read

Are Med Spas Covered by HIPAA? The Covered-Entity Test, Step by Step

Q: Are med spas covered by HIPAA?

Some are and some are not. HIPAA covers health plans, clearinghouses and health care providers that transmit health information electronically in connection with standard transactions such as insurance claims. A med spa that never conducts those transactions may fall outside HIPAA. One that bills insurance for any service probably does not. Confirm with a healthcare attorney.

Q: Do med spas have to be HIPAA compliant if they only take cash?

Not automatically. HHS's covered entity test does not turn on how the client pays. It turns on whether the provider transmits covered transactions electronically, either directly or through a billing service or clearinghouse acting for it. A spa that truly never does that is generally not a covered entity, but should check its structure and state law.

Are med spas covered by HIPAA? It depends. A med spa is covered only if it is a covered entity, and for a provider that means transmitting health information electronically in connection with a standard transaction such as an insurance claim. A cash-only spa that never does so may not be covered, but state privacy laws can still apply.

Part of the guide: GoHighLevel for med spas

Key takeaways

The answer is it depends. Under 45 CFR 160.103 a health care provider is a covered entity only if it transmits health information in electronic form in connection with a transaction covered by the rule, such as a claim to a health plan.
Cash-only is not the test. The test is whether the spa, or someone sending transactions on its behalf, conducts standard electronic transactions. HHS's decision tool asks two questions for a provider: do you furnish, bill or receive payment for health care, and do you electronically transmit any covered transactions.
A spa can be partly covered. If a spa or its medical director's practice bills insurance for some services, HIPAA defines a hybrid entity that designates which parts are the covered health care components. Whether your structure counts is a question for a healthcare attorney.
Not covered by HIPAA does not mean no privacy law. Texas defines covered entity far more broadly than HIPAA, and California's medical information law applies to licensed providers. Both are examples from state sites, not a full list.
Texting rules are separate from HIPAA. A spa that is not a covered entity still needs consent under the FCC rule in 47 CFR 64.1200 to send automated texts.

The problem this page solves: a med spa owner asks “are med spas covered by HIPAA?” and every vendor page gives a different answer. The honest answer is that it depends on a short legal test in the HIPAA rules, and this page walks through that test using the federal rule text and HHS’s own decision tool, opened on 2026-10-15. It is not legal advice. Whether your spa is a covered entity is a legal determination for a healthcare attorney who can see your billing, your contracts and your state.

Are med spas covered by HIPAA?

It depends on whether the spa is a covered entity. HIPAA applies to covered entities and their business associates, and the federal definition at 45 CFR 160.103 lists three kinds: a health plan, a health care clearinghouse, and “a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”

A med spa is not a health plan or a clearinghouse, so the question is whether it is a covered health care provider. Two things must both be true:

It is a health care provider, meaning an organization “who furnishes, bills, or is paid for health care in the normal course of business.” Health care includes care that “affects the structure or function of the body,” which is broad enough that you should not assume a cosmetic label takes injectables or laser work out of the definition.
It transmits health information electronically in a covered transaction. The covered transactions are the ones in the rule’s definition of transaction: health care claims, payment and remittance advice, coordination of benefits, claim status, plan enrollment, eligibility checks, premium payments, referral authorization, first report of injury, and claim attachments.

If either is false, the provider is not a covered entity. HHS says the same on its covered entities page (content last reviewed August 21, 2024): providers such as doctors and clinics are covered “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard.”

2 questionsin HHS's decision tool for a provider

12 typesof transaction in the 160.103 definition, including claims and eligibility

0mentions of cash-pay status in the covered-entity test

Counts from 45 CFR 160.103 and the CMS-hosted Covered Entity Decision Tool, checked 2026-10-15. The twelfth type is the catch-all for other transactions the Secretary may prescribe.

Do med spas have to be HIPAA compliant if they only take cash?

Not automatically, and not because they take cash. Payment method is not in the test. The test is whether the provider conducts covered transactions electronically. A spa whose clients all pay by card at the front desk, and which never sends a claim, eligibility request or other covered transaction to a health plan, is not a covered health care provider under the decision tool’s logic.

The catch is in the tool’s own endnote. It says that if a provider “uses another entity (such as a clearinghouse) to conduct covered transactions in electronic form on its behalf, the health care provider is considered to be conducting the transaction in electronic form.” A spa that hands superbills or claims to an outside biller who files them electronically has not escaped the test just because it never touched the transmission.

Vendor pages tell a more confident story in both directions. In a search for this question on 2026-10-15, compliance vendors split: some say any injectable makes a spa a covered entity, others say cosmetic services usually do not trigger HIPAA. Neither claim is in the rule. Most of those sources sell HIPAA products, so treat their certainty as marketing and go back to the two-part test.

What does HHS’s covered-entity decision tool ask a med spa?

For a provider, the tool asks two questions in order. The tool is a PDF that HHS links from its covered entities page and CMS hosts; the version opened here is dated June 2016 in its file name.

Step	Question the tool asks	If yes	If no
1	Does the person, business or agency furnish, bill, or receive payment for health care in the normal course of business?	Go to step 2	Not a covered health care provider, not a covered entity
2	Does it transmit (send) any covered transactions electronically?	Covered health care provider, therefore a covered entity	Not a covered health care provider, not a covered entity

Step 1 is almost always yes for a spa that injects, treats skin conditions or removes hair with a medical device, so step 2 does the work. To answer step 2, list what your business electronically sends to anyone outside the spa.

Which transactions make a med spa a covered entity?

The ones named in 45 CFR Part 162, which sets the standard transactions. The claims transaction, defined at 45 CFR 162.1101, is “a request to obtain payment, and the necessary accompanying information from a health care provider to a health plan, for health care.” If your spa submits one electronically, directly or through a biller or clearinghouse, it is conducting a standard transaction.

Once a provider is a covered entity, 45 CFR 162.923 requires it to conduct those transactions as standard transactions, and to require any business associate it uses to comply as well.

Everyday med spa activity maps like this:

What the spa does electronically	Standard transaction?	Pushes toward covered?
Charges a card at checkout for a Botox visit	No, a payment between you and the client	No
Emails a client a receipt	No	No
Sends a claim for a medically necessary service to a health plan	Yes, a health care claim	Yes
Checks a client’s insurance eligibility online	Yes, an eligibility inquiry	Yes
Hands claims to an outside biller who files them	Yes, conducted on your behalf	Yes
Books online and texts reminders	No	No
Uses a booking or charting system that stores records	No, storage is not a transaction	No, but the vendor may be a business associate if you are covered

The table is a reading aid built from the rule text, not a legal opinion. HIPAA’s covered-entity status comes from the transactions, not from the software.

The honest answer: it depends, and here is the decision flow

It depends on who sends standard transactions, and a med spa lands in one of five situations. Use the table as a conversation starter with your attorney: read from the top and stop at the first row that applies.

Order	Situation	Likely status	What it means in practice
1	The spa or a biller acting for it sends insurance claims, eligibility checks or other standard transactions electronically for any service	Likely a covered entity	Full HIPAA program: risk analysis, policies, training, BAAs with vendors that touch PHI
2	The spa does not bill insurance, but the medical director or a partner practice that supplies the supervising provider does, and records or staff are shared	Unclear	Ask counsel whether the spa and the practice are one legal entity, an organized arrangement, or separate. HIPAA defines a hybrid entity: one legal entity that is covered, has both covered and non-covered functions, and designates its health care components
3	The spa runs a telehealth service and bills a plan for any visit	Likely covered for those services	Treat the telehealth workflow as covered, including its messaging and records
4	The spa never conducts standard transactions, directly or through a biller, and no affiliated billing entity touches its records	Possibly not a covered entity	HIPAA may not apply, but state law and professional rules still can
5	The spa plans to start billing insurance later, for example for a medical-necessity service	Becomes covered when it starts	Build the program before the first claim

“It depends” is the right answer here, and a spa that picks row 4 should write down why and revisit the decision whenever its billing changes. Judgment, not a rule: the expensive mistake is not choosing the wrong row today, it is adding insurance billing, a billing service or a telehealth line later without anyone rechecking the decision. Put the covered-entity question on the checklist for any new service or vendor, and ask the Office for Civil Rights (OCR) pages on HHS.gov, not a software vendor, how enforcement works.

What about a medical director or telehealth billing?

Status attaches to the legal entity that transmits the transactions, so who bills matters more than who supervises. Many spas operate under a physician or a management structure in which the medical practice and the spa are separate entities. If the practice bills insurance for its own services, it may be a covered entity while the spa is not, or the arrangement may put the spa’s clinical functions inside the covered practice. The rule text does not settle that for a given contract, so this is the row where legal advice is worth paying for.

Telehealth is similar. A video consult is not a standard transaction by itself. The transaction is the claim. Cosmetic telehealth consults paid in cash raise no claim; a visit billed to insurance does. HHS’s decision tool has no telehealth branch, which is a reason to answer step 2 factually rather than by service type.

Do med spas follow HIPAA even when it may not apply?

Many do, and there are legitimate reasons. A covered medical director may require it. A booking or charting vendor may make its HIPAA features and business associate agreement part of its standard offer. A spa may decide that treatment histories are sensitive and handle them under HIPAA-style safeguards as a policy choice. That is a risk decision, not a legal requirement. HHS states that if an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules (covered entities page, reviewed August 21, 2024).

If you are covered, the practical work is on the vendor side. Each tool that handles protected health information for you becomes a business associate and needs a BAA. For GoHighLevel that means the add-on, the agreement and the per-location switch described in Is GoHighLevel HIPAA compliant? and the order of work in GoHighLevel HIPAA setup: steps, BAA and what is still on you. This page does not repeat them. If you are not covered, buying a permanent add-on is a business choice to make after you have the opinion, not before.

What if HIPAA does not apply: do state privacy laws?

They can. HIPAA is a floor for covered entities, not the only privacy law. Two examples from official state sources, both opened on 2026-10-15. They are examples of how differently states draw the line, not a map of your state.

Texas. The Texas Medical Records Privacy Act is in Texas Health and Safety Code chapter 181. It defines covered entity as any person who, “for commercial, financial, or professional gain, monetary fees, or dues” engages “in whole or in part” in “assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information,” and the definition includes a “clinic” and a “health care provider.” The wording has no standard-transactions condition. Section 181.101 requires each covered entity to train employees on state and federal law on protected health information, within 90 days of hire, and to keep a signed completion statement for six years. Section 181.152 requires clear and unambiguous written or electronic permission before using protected health information for marketing, with listed exceptions. The Texas Attorney General’s patient privacy page says HIPAA and the Texas act together protect personal health information. Whether a particular Texas spa is a covered entity under that statute is a question for counsel, but the text is far wider than the federal test.

California. The Confidentiality of Medical Information Act, Civil Code section 56.05, defines a provider of health care by licensure: a person “licensed or certified pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code,” or a clinic or health facility licensed under the Health and Safety Code, among others. “Medical information” means individually identifiable information “in possession of or derived from a provider of health care” about a patient’s “medical history, mental or physical condition, or treatment.” Billing electronically is not part of that definition. A licensed practitioner at a California spa should ask counsel how the act applies to their records and messages.

Medical boards and nursing boards regulate who may perform and supervise cosmetic procedures in each state, and those rules sometimes carry confidentiality duties of their own. That is another reason the federal answer is only half the picture.

Does HIPAA apply to the texts a med spa sends?

Only if the spa is a covered entity and the text contains protected health information. HHS’s guidance on provider communications is short. Its FAQ on leaving messages for patients says covered entities “should take care to limit the amount of information disclosed” and suggests leaving “only its name and number and other information necessary to confirm an appointment.” Its email FAQ says providers may communicate electronically with patients “provided they apply reasonable safeguards,” and that a patient’s reasonable request for an alternative means of contact must be accommodated. A third FAQ says appointment reminders are part of treatment and can be sent without authorization (content last reviewed December 28, 2022). HHS pages found for this research do not address text messages by name, so applying the same limit-the-detail principle to texts is an inference, not an HHS statement.

Marketing is where covered status bites. Under the current rule text at 45 CFR 164.501, marketing means a communication that encourages recipients to purchase or use a product or service, and communications for treatment or to describe the covered entity’s own health-related services are carved out unless the entity receives financial remuneration for sending them. A covered spa should have counsel draw the line between a rebooking reminder and a promotion.

Separately from HIPAA, texts need consent. The FCC rule at 47 CFR 64.1200 requires prior express consent for autodialed calls and texts to wireless numbers and prior express written consent when the message includes or introduces an advertisement or constitutes telemarketing. A carve-out for a “health care” message sent by a covered entity or its business associate exists in that rule, which is one more reason to know your status. The consent mechanics are in GoHighLevel TCPA setup, and ready-to-adapt wording that keeps health detail out of messages is in med spa text message templates without PHI.

How do you get a definitive answer for your med spa?

Collect these facts first, then book an hour with a healthcare attorney who works with aesthetics practices in your state:

Whether any service, including telehealth, is billed to a health plan, by you or by anyone on your behalf.
The corporate structure: who owns the spa, who employs the injectors, and who owns the medical practice that supervises them.
Which software holds client records, and whether each vendor offers a BAA.
Your state’s medical privacy statute and its definition of covered entity or provider.
What your texts, forms and photos contain.

Then write the conclusion down. If the answer is covered, set up HIPAA in GoHighLevel in the right order. If the answer is not covered, record the reasoning and the billing facts it depends on. Either way, GoHighLevel for med spas shows where the platform fits next to booking and charting software, and consent forms for med spas covers the paperwork that sits beside the privacy question. If you want the account built around the decision, see the GoHighLevel setup for med spas page, or talk to aibrevo about GoHighLevel.

Founder’s note, Alpit Patel. I get this HIPAA question from med spa owners every week. I’d settle covered-entity status before picking any HIPAA tooling. The test is whether the provider electronically conducts standard transactions such as claims, not whether clients pay cash. Check who bills, because status attaches to the legal entity that transmits, and a medical director’s practice can differ from the spa. Collect those facts, then take them to a healthcare attorney, since state privacy laws can apply either way. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit

Sources

All opened and checked on 2026-10-15.

eCFR, 45 CFR 160.103: definitions of covered entity, health care provider, health care and transaction (current through 2026-10-13).
eCFR, 45 CFR 164.103: definition of hybrid entity.
eCFR, 45 CFR 162.1101 and 162.923: claims transaction and the requirement to conduct standard transactions.
eCFR, 45 CFR 164.501: definition of marketing and treatment exceptions.
HHS, Covered Entities and Business Associates, content last reviewed August 21, 2024: three covered-entity types, transaction condition, link to the decision tool, non-covered entities need not comply.
Covered Entity Decision Tool (PDF, hosted by CMS): the provider questions and the endnote on transactions conducted through a clearinghouse. CMS covered entities page (last modified 2026-03-16 per the page) links it.
HHS FAQ 198, leaving messages, FAQ 570, email with patients (published 2009-02-06) and FAQ 286, appointment reminders (content last reviewed December 28, 2022).
Texas Health and Safety Code chapter 181: covered entity definition, training, marketing permission. Texas Attorney General, patient privacy.
California Civil Code 56.05: definitions of provider of health care and medical information.
eCFR, 47 CFR 64.1200: consent requirements for automated calls and texts, health care message carve-out.

Not verified: enforcement penalty amounts (not opened), how any state treats a cosmetic-only practice (no state site opened addresses med spas by name), and the effect of any pending state bill. The covered-entity status of any individual spa is a legal question this page does not answer.

More guides