Med Spa Photo Consent Form Requirements: What the Form Typically Needs

The problem: your med spa wants to post before-and-after photos, and the form clients signed says something like “I consent to photographs.” Does that cover the website, Instagram and ads? Often it does not. This page lays out what a med spa photo consent form typically needs, where the formal rules come from, and what to check with counsel. It is not legal advice and not a form to copy.

For the broader set of consent documents and where each lives, see GoHighLevel consent forms for med spas, part of our GoHighLevel setup for med spas guide.

Is a med spa photo release the same as a HIPAA authorization?

No. A photo release (sometimes called a model release) is a permission slip. A HIPAA authorization is a defined document with required contents. Whether you need the second depends on whether your med spa is a HIPAA covered entity.

Under 45 CFR 160.103, a provider is covered only if it transmits health information electronically in a standard transaction, such as an insurance claim. A purely cash-pay med spa may fall outside that, and some med spas are tied to practices that do bill insurance. Our page on whether med spas are covered by HIPAA goes through that test.

If you are covered, HHS says the Privacy Rule requires an individual’s written authorization before protected health information is used for marketing, and the rule’s text at 45 CFR 164.508(a)(3) generally requires authorization for marketing uses. One exception HHS names is a face-to-face communication, which is about talking to a patient in person and does not describe publishing their photo (HHS marketing guidance). If you are not covered, HIPAA does not set the form, but state law and the FTC still matter, and an authorization-grade form is a reasonable standard to aim for.

What are the HIPAA authorization elements for photos?

A valid authorization has six core elements and three required statements, from 45 CFR 164.508(c). The table maps each to a photo form.

Requirement (164.508(c))	What it means for a photo form
Description of the information, specific and meaningful	Which photos: treatment area, face, dates, before and after
Who is authorized to disclose	The med spa, by name
Who may receive or use it	Who may publish: the med spa, its marketing agency, named channels
Description of each purpose	Marketing on the website, social media, ads, each stated
Expiration date or event	A date, or an event such as end of a campaign
Signature and date	Client signs and dates; a representative’s authority described if one signs
Statement: right to revoke in writing, exceptions, how	Say how to withdraw and that published material may already be out
Statement: whether treatment can be conditioned	Say treatment does not depend on agreeing to marketing use
Statement: possible redisclosure	Say others who see published photos may share them

Other points from the same section, as summarized from the eCFR text we opened:

• The form must be written in plain language (164.508(c)(3)).
• If the practice asks for the authorization, the client gets a copy of the signed form (164.508(c)(4)).
• An authorization generally cannot be combined with other documents, with listed exceptions (164.508(b)(3)). That is why the photo form should stand alone.
• A covered entity generally cannot condition treatment on signing an authorization (164.508(b)(4)).
• Revocation must be in writing, except to the extent the practice has already relied on the authorization (164.508(b)(5)).
• If a third party pays for the marketing, the authorization must say remuneration is involved (164.508(a)(3)).

Why is cropping the face not enough?

HIPAA’s de-identification standard lists “Full face photographic images and any comparable images” as an identifier (45 CFR 164.514(b)(2)(i), item Q). That is the face. Whether a cropped image of a body area can identify someone is a judgment about tattoos, scars, jewelry, captions and metadata, and the de-identification test has other conditions besides the identifier list. Two software vendors, Pabau and GlossGenius, publish guides on this topic that surfaced in search results. We saw only their search snippets, not the full pages, so we do not rely on them for any specific claim. Both companies sell competing software, so treat anything they say as industry practice, not law.

Practical answer: get written permission for marketing use whatever you crop, then let counsel tell you if a narrower rule applies.

Should a med spa photo consent form be one choice or three?

Three, in practice. The common structure separates:

1. Medical record only. Photos taken to document the treatment.
2. Internal training. Showing staff or the medical director.
3. External marketing. Website, social media, ads, email.

The first can reasonably sit in the treatment consent, because it is part of care. The third should be its own signed, optional document. The HIPAA text supports the separation by barring conditioning and bundling for authorizations. Judgment: give the client a separate initial line per channel (website, social, ads) so you can drop one later without voiding the rest. Counsel decides the exact structure.

What do FTC rules add for before-and-after photos?

HIPAA is about permission to use the image. The FTC is about what the ad says. The FTC’s Endorsement Guides, 16 CFR Part 255, say:

• Endorsements must reflect the honest opinions or experience of the endorser (255.1(a)).
• Advertisers can be liable for misleading endorsements and undisclosed material connections (255.1(d)).
• A consumer endorsement describing results is likely to be read as typical; advertisers need substantiation or must clearly disclose what is generally expected (255.2(b)).
• A generic disclaimer such as “results not typical” does not cure a misleading net impression (255.2(e)(2)).
• Ads that present people as actual consumers should use actual consumers, or disclose otherwise (255.2(c)).

For a med spa, the checklist is: use only real clients, do not edit or retouch results, state a material connection if the client got a free or discounted treatment, and do not imply results the treatment cannot support. Our existing setup page also covers the FTC’s review rule for review requests, and the dedicated FTC rules for med spa before-and-after photos and testimonials page goes further.

What does state law change?

Rules vary by state. State privacy and publicity laws, medical board rules on advertising, and consent requirements for minors differ, and we did not open a state .gov source for this page. We will not guess a state’s rule. Ask a healthcare attorney licensed where you practice, and have the final form reviewed there.

How do you keep photo consent usable in GoHighLevel?

A consent form is only useful if marketing can check it before posting. In GoHighLevel, send the form as its own Documents & Contracts template, store the signed PDF on the contact, and keep a custom field for yes, no and the expiration date, then require that field in any workflow that touches marketing. Do not text or collect clinical photos through the conversation inbox. The full build is in send and store med spa consent forms in GoHighLevel. If you have HIPAA enabled, confirm with HighLevel support which stored items are covered; the HIPAA article we opened lists form and survey submissions but is silent on signed documents beyond the BAA.

If you want this plumbing built, see our GoHighLevel implementation service or contact us.

Founder’s note, Alpit Patel. I see one release signed for everything, and it causes problems later. Split the photo choices instead of using one release. The common structure separates the chart record, internal training and external marketing, and the form should be its own document. Do not assume a cropped face makes an image safe, because tattoos, scars, jewelry, captions and metadata can still identify someone. Have marketing check a yes, no and expiration field in GoHighLevel before anything gets posted. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit

Sources

All checked 2026-10-15.

• eCFR, 45 CFR 164.508: authorization elements, statements, plain language, copy, compound and conditioning limits, revocation, marketing.
• eCFR, 45 CFR 164.514: “Full face photographic images and any comparable images” in the identifier list.
• eCFR, 45 CFR 160.103: covered entity definition.
• HHS OCR, Marketing guidance: written authorization before use for marketing, face-to-face exception. Page shows 2009 and a revision note from 2003.
• eCFR, 16 CFR Part 255: Endorsement Guides, sections 255.1 and 255.2.
• HighLevel Support, HIPAA Compliance with HighLevel: covered data types.
• Industry context only, vendor blogs that sell competing software, not primary sources, and not used for any claim above: Pabau, before and after photo consent form requirements; GlossGenius, before and after photo consent form. Seen in search results only, not opened in full.