By Alpit Patel and the aibrevo team · October 15, 2026 · 8 min read
Med Spa Aftercare Text Sequences and Follow-Ups Without PHI in the Message
A med spa aftercare text sequence should carry timing, a callback route and a pointer to your portal or paper instructions, not the treatment, dose, reaction or result. HHS guidance says to limit what goes in an unencrypted message, and no HHS FAQ we found addresses SMS directly, so treat the email guidance as the closest rule.
Part of the guide: Patient reactivation in GoHighLevel
Key takeaways
- HHS's FAQ on provider-patient email says the Privacy Rule allows electronic communication with reasonable safeguards, does not prohibit unencrypted email for treatment communications, and says to limit the amount or type of information in it. We found no HHS FAQ that addresses SMS directly, so that email guidance is the closest official statement.
- A text that names a person, a treatment and a reaction or result links an identifiable person to their care. If your med spa is a HIPAA covered entity, that is protected health information. Send timing, a callback route and a portal pointer instead.
- Aftercare instructions, photos, symptom questions and anything a client may answer with a health detail belong in a secure portal or a phone call, not in an SMS thread.
- A client can ask to be contacted by another means. HHS says a provider should accommodate reasonable requests for confidential communications (45 CFR 164.522(b)), including offering more secure methods if unencrypted email is unacceptable.
- Keep care messages and promotions in separate workflows. Care check-ins are informational; a rebooking offer is promotional and needs documented consent, STOP handling and lawful send hours.
The problem this page solves: med spa aftercare text sequences should check in on clients automatically, but a text is a poor place for treatment details, and clients will reply with symptoms. This page gives a sequence that works inside those limits and a clear line for what moves to a portal. The reactivation side of the same system is on patient reactivation in GoHighLevel, part of our GoHighLevel expert for med spas guide. For a library of generic texts, see med spa text messages without PHI.
Checked on October 15, 2026 against HHS FAQs, eCFR text and a current product label. This is operations guidance, not legal or medical advice. Whether your med spa is a HIPAA covered entity is a question for counsel (45 CFR 160.103).
What does HHS say about texting patients?
HHS has not published an SMS-specific FAQ that we could find. The closest official statements are its FAQs on email and on appointment reminders, which set a pattern: communicate with reasonable safeguards and limit what you disclose.
| HHS statement | What it says | What it means for a text |
|---|---|---|
| FAQ on email (published 2009) | The Privacy Rule allows covered providers to communicate electronically with patients, such as by email, provided they apply reasonable safeguards (45 CFR 164.530(c)) | Texting is not banned, but safeguards are expected |
| Same FAQ | The Privacy Rule does not prohibit unencrypted email for treatment-related communications, but other safeguards apply, such as limiting the amount or type of information disclosed | Keep detail out of the message |
| Same FAQ | Covered entities should ensure electronic PHI transmissions comply with the Security Rule (45 CFR Part 164, Subpart C) | Check how your messaging tool is configured |
| Same FAQ | If unencrypted email is unacceptable to a patient who requests confidential communications, offer more secure electronic methods, mail or telephone | Offer a portal or a call |
| FAQ on messages and reminders | Appointment reminders are permitted; covered entities should limit information on an answering machine, for example name, number and only what is needed to confirm an appointment | Same minimum-necessary habit for SMS |
| 45 CFR 164.522(b) | A covered provider must accommodate reasonable requests to receive communications by alternative means or at alternative locations | Honor channel preferences |
Treat this as an inference by analogy, not as HHS saying SMS is acceptable. If your spa is covered, ask counsel how your text content and your HighLevel setup meet the Security Rule. Our HIPAA answer and setup steps cover the platform side.
What counts as PHI in an aftercare text?
Information is individually identifiable health information when it is created or received by a provider, relates to the provision of health care to a person, and identifies them (45 CFR 160.103). If your spa is a covered entity, a text naming a client, a treatment and an outcome fits that description.
| Safer in a text | Keep out of a text |
|---|---|
| First name, spa name | Treatment or product name |
| A callback number | Dose, units, areas treated |
| That your instructions are in the portal or were given at your visit | The instructions themselves |
| A booking link | Any reaction, symptom or result |
| The next-visit window in general terms | A health condition, medication or allergy |
| A reminder that texts are not monitored for urgent concerns | Photos of the client |
A purely cash-pay spa may or may not be covered, and state privacy laws can apply either way. Using the safer column is low cost whatever the answer.
What do med spa aftercare text sequences look like?
Three messages over about two weeks, with clinical timing set by your provider. The days below are assumptions. Product labels show why timing varies by treatment: the Botox Cosmetic label says the initial doses induce chemical denervation of the injected muscles one to two days after injection, increasing in intensity during the first week. That is one product. Your protocol should set each service line’s check-in day.
| Step | Suggested timing (assumption) | Message | Why |
|---|---|---|---|
| 1. Thank you | Same day | “Thanks for visiting {{spa name}}, {{first name}}. Your care instructions are in your portal or were handed to you today. Questions? Call {{number}}. Texts aren’t monitored for urgent concerns. Reply STOP to opt out.” | Pointer, not instructions |
| 2. Check-in | Day set by provider, for example 2 to 3 | “Hi {{first name}}, checking in from {{spa name}}. Please call {{number}} if you have any concerns. Reply STOP to opt out.” | Opens a call, not a thread |
| 3. Follow-up | Day set by provider, for example 14 | “Hi {{first name}}, it’s {{spa name}}. We’d like to hear how things are going. Book a follow-up here: {{link}}. Reply STOP to opt out.” | Separates care from promotion |
Notice what is absent: no treatment, no “your results”, no discount. A rebooking offer belongs in a reactivation workflow with its own consent check.
How do you build it in GoHighLevel?
Keep it to a handful of actions, all documented in HighLevel’s help center.
- At Automation, Workflows, + Create Workflow, use the Appointment Status trigger, filtered to the completed or showed status. Confirm the exact status name in your account.
- If/Else on a Service line custom field, so each line can have its own check-in day. Every If/Else needs a None branch.
- Send SMS with message 1.
- Wait with A set period of time. HighLevel’s Wait article says the period can be Dynamic, reading a custom variable, so a per-service day count can sit in one field. Turn on Advance Window so the next message resumes only on chosen days and between chosen hours.
- Send SMS with message 2, then Wait with The contact to reply and a timeout.
- If/Else on reply. On a reply, run Send Internal Notification and Assign to User, add a note with Add Note, and end the automation for that contact so no scripted text follows a concerning reply.
- Send SMS with message 3 only after a final Wait, and tag the contact so it is not sent twice.
Judgment: build the reply branch before the messages, because an aftercare sequence without one will eventually answer a symptom with a scripted text. Why escalate instead of replying by text: a client may answer with a symptom, a photo or a medication. At that point the thread holds health detail. Move it to a call and your portal.
What belongs in a secure portal instead of a text?
Anything you would not say on a voicemail. HHS’s answering-machine guidance, which suggests limiting a message to name, number and what is needed to confirm an appointment, is a useful test for SMS too.
| Put in a portal or deliver by phone | Why |
|---|---|
| Detailed aftercare instructions for the specific treatment | Names the treatment and care |
| Intake, medical history, consent and photo consent | See consent forms for med spas |
| Clinical photos | Identifiable images tied to care |
| Symptom questions and replies | Health detail in a two-way thread |
| Records, receipts with treatment detail | Linked to care and payment |
A portal needs a business associate agreement with the vendor if your spa is covered. Your booking software or EMR may include one; see EMR vs CRM for med spas. HighLevel’s own HIPAA article says its HIPAA add-on covers objects that can store PHI including contacts, SMS and MMS, form and survey submissions and email bodies, but it is account-wide, costs $297 a month and cannot be disabled once purchased. That is a decision for counsel, not a default.
What consent and send-hour rules apply?
Care check-ins and promotions are different messages, so keep them in different workflows. Any promotion, including a rebooking offer, needs documented written consent, STOP handling and lawful hours. See the TCPA setup guide for consent capture and quiet hours, and what DND is in GoHighLevel for how STOP turns off SMS. The federal rule at 47 CFR 64.1200(c) bars telephone solicitation before 8 a.m. or after 9 p.m. at the called party’s location. Whether a given care message is a solicitation is a legal question, so use the same send window for all of them.
What goes wrong most often?
| Symptom | Cause | Fix |
|---|---|---|
| A text names the treatment | Merge field pulling service name | Remove the field from SMS templates; keep it in the portal |
| Client replies with a symptom and gets a scripted text | No reply branch | Add a reply branch and escalation |
| Aftercare text arrives at night | No send window | Advance Window and Time Window; see wrong time zone reminders |
| Client texted after replying STOP | Workflow path ignores DND | Check DND; see TCPA setup |
| Promotion in a care text | Offer added to message 3 | Move the offer to a consented reactivation workflow |
Founder’s note, Alpit Patel. I see aftercare texts that say far too much. Build the reply branch before the messages. An aftercare sequence without one can answer a symptom with a scripted text. Keep treatment names, doses and reactions out of every SMS, and point to the portal or a phone number instead. Keep care check-ins and rebooking offers in separate workflows, so only the offer needs promotional consent. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit
Sources
All checked 2026-10-15.
- HHS, Does the HIPAA Privacy Rule permit health care providers to use e-mail to discuss health issues and treatment with their patients? (FAQ 570, published 2009): safeguards, unencrypted email, alternative means. No HHS FAQ written for SMS was found.
- HHS, May providers leave messages for patients at their homes to remind them of appointments? (FAQ 198): limit information in messages, confidential communications.
- eCFR, 45 CFR 160.103 and 45 CFR 164.522: covered entity, individually identifiable health information, confidential communications (data through 2026-10-13).
- eCFR, 47 CFR 64.1200: calling hours.
- NIH DailyMed, Botox Cosmetic label (Allergan, version published Jan 8, 2026): onset one to two days after injection, increasing during the first week.
- HighLevel Support, HIPAA Compliance With HighLevel: add-on price, permanence, objects covered.
- HighLevel Support, Wait action, If/Else action and workflow actions list: action names and options.