Do Med Spas Need to Be HIPAA Compliant?

Some do and some do not. A med spa must follow HIPAA when it is a health care provider that sends health information electronically for a standard insurance transaction, such as a claim, an eligibility check or a prior authorization, itself or through a billing service. Botox, a medical director and an EHR do not decide it. The transactions do.

Research current as of October 20, 2026. This is education, not legal advice. Chuck is not an attorney and One Guy Consulting is not a law firm; take your own facts to a healthcare attorney before relying on any conclusion here.

Med spa, medi spa, aesthetic clinic, the injector's suite at the back of a dermatology office: whatever you call it, the HIPAA question is six in one hand and half a dozen in the other. The official answer is... drum roll... sometimes.

"Wouldn't you always say they need HIPAA? Since you, like, run a compliance company?" No. I would be wrong, and if there is one thing compliance people hate more than an unsigned BAA, it is being wrong. A cash-only injection clinic and a med spa that bills insurance for migraine Botox can share a lobby playlist and still be different businesses under the law. "Sometimes" has a test. Here it is.

What Makes a Med Spa a HIPAA Covered Entity

45 CFR 160.103 names three kinds of covered entity: a health plan, a health care clearinghouse, and "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter." A med spa is neither of the first two, so everything rides on the third, which has two parts. CMS's own covered entity decision tool asks the same two questions in the same order.

Part one: a med spa is almost always a health care provider

Section 160.103 defines health care to include any "procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body," and the "sale or dispensing of a drug, device, equipment, or other item in accordance with a prescription." A provider is anyone "who furnishes, bills, or is paid for health care in the normal course of business."

Botulinum toxin is a prescription drug. The FDA calls dermal fillers "medical device implants." Laser resurfacing changes the structure of the skin. A GLP-1 is a prescription. "We are not medical" looks lovely on a website. It does not survive the definition. (A day spa doing only facials and waxing is a harder fit, and a different conversation.)

Part two: the transactions decide it

Being a provider is not enough. The provider has to send health information electronically for a standard transaction. Section 160.103 lists them: claims or encounter information, payment and remittance advice, coordination of benefits, claim status, enrollment, eligibility, premium payments, referral certification and authorization, first report of injury, claims attachments, and health care electronic funds transfers.

Every item on that list is a conversation with a health plan. The test is about insurance plumbing, not about how medical the treatment feels. Even the software vendors draw the line there: Prospyr's FAQ on choosing med spa software opens with "It depends on how your practice runs," then notes that "practices that bill insurance heavily need claims tools as well."

So none of these makes a med spa covered on its own: a physician medical director, a nurse injector, an EHR, a medication question on the intake form, online booking, or email. HHS: "Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction." Card payments sit outside HIPAA too. Section 1179 of the statute exempts payment processing by financial institutions, including payment "by any means, including a credit, debit, or other payment card."

Why Cash-Only Does Not Automatically Mean HIPAA-Free

"Cash only" describes how patients pay you. HIPAA asks whether anyone exchanges standard transactions with a health plan for you. Usually the two line up. Here is where they come apart:

• The medical side gets billed. Botox for chronic migraine, a dermatology consult, labs for a weight-loss program. One electronic claim makes the business a covered entity.
• Someone checks eligibility or requests a prior authorization electronically, including through a clearinghouse. Both are standard transactions.
• A billing service presses the button. HHS: the Privacy Rule "covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf."
• Your paper becomes their electronic. Paper claims sent straight to a plan do not make you covered, but CMS says a provider "would be a covered entity if their paper claims were submitted to a health care clearinghouse or a billing service" that converted them to electronic transactions on its behalf.

What generally does not flip it: card payments, patient financing, and a paid receipt or superbill the patient files with their own insurer. There the patient deals with the plan. File it for them electronically and the transaction is yours.

Coverage also attaches to the business, not the treatment. Once a med spa is covered, HHS says the Privacy Rule protects all individually identifiable health information it holds "in any form or media, whether electronic, paper, or oral." The cosmetic chart and the photo on the injector's phone are in. Nobody is a covered entity only on the days a claim goes out.

Three Med Spa Scenarios

Simplified on purpose. Real ownership and billing details change answers, which is the point.

Scenario A: the independent cash-only injection clinic

An LLC owned by a nurse practitioner, with a contracted medical director, card payments only, an aesthetic EHR, and receipts patients may file themselves. Nobody, including any vendor, sends claims, eligibility checks or prior authorizations. On those facts it is very likely not a covered entity, though state privacy, breach and licensing duties still apply. One electronic claim or one billing service arrangement changes the answer, so write the analysis down, date it, and redo it whenever billing or ownership changes.

Scenario B: the med spa with a billing service

Same clinic, plus medical weight loss, with a billing company submitting visit and lab claims to commercial plans. It is a covered entity for every patient, not only the weight-loss ones; the Botox chart is protected health information now too. The billing company is a business associate (160.103 names "billing" in the definition; more in HIPAA for medical billing companies) and needs a signed Business Associate Agreement before it touches patient data.

Scenario C: the med spa inside or beside a covered practice

A dermatology or plastic surgery group that bills insurance also runs an aesthetics suite. Legal structure decides, not signage. If the suite is part of the same legal entity, it is covered, full stop. If it is a separate entity that sends no standard transactions, it is tested on its own facts, and the practice still owes HIPAA for anything it discloses to the spa. If both are covered entities under common control, the next section applies. If you cannot say which describes your business, that is the first question for your attorney.

Hybrid Entities, Affiliated Entities and OHCAs, Untangled

These get used interchangeably online. They are not interchangeable, and none of them turns a non-covered spa into a covered one or the reverse.

Hybrid entity (45 CFR 164.103 and 164.105(a)). One legal entity that is covered, "whose business activities include both covered and non-covered functions," and that formally designates its health care components. Without that designation, HHS says the entity "is subject in its entirety to the Privacy Rule." It cannot wall off cosmetic treatment, because cosmetic treatment is health care, which is a covered function.

Affiliated covered entity (164.105(b)). "Legally separate covered entities that are affiliated may designate themselves as a single covered entity" when they share common ownership (5 percent or more, per 164.103) or control. Only covered entities can join. Useful for a group with several covered locations that wants one program and one privacy notice.

Organized health care arrangement, or OHCA (160.103). Either "a clinically integrated care setting in which individuals typically receive health care from more than one health care provider," or covered entities that hold themselves out as a joint arrangement and share utilization review, quality work or financial risk. It lets participating covered entities share information for joint operations and use a joint privacy notice (164.520(d)). It matters when a med spa shares space, patients and quality review with a covered practice.

If none of these describes your business, ignore all three. That is allowed.

What HIPAA Compliance Requires for a Covered Med Spa

What the rules say

• Security Risk Analysis: "an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI, then risk management. Both Required, 164.308(a)(1)(ii).
• A privacy official and a security official, 164.530(a)(1) and 164.308(a)(2). Often one person in a small spa, named in writing.
• Written policies and procedures, kept six years, 164.316 and 164.530(i) and (j).
• Training for "all members of its workforce," 164.530(b)(1): injectors, estheticians, front desk.
• Access and audit controls, 164.312(a) and (b): unique user IDs (Required), automatic logoff and encryption (Addressable), and regular review of activity records (Required, 164.308(a)(1)(ii)(D)).
• Business Associate Agreements with every vendor handling patient information for the spa, 164.502(e).
• Incident response, 164.308(a)(6)(ii) (Required).
• Breach notification: individuals "without unreasonable delay and in no case later than 60 calendar days after discovery" (164.404), HHS (164.408), and prominent media when "more than 500 residents of a State" are affected (164.406).
• Patient access to records "no later than 30 days after receipt," with one extension of up to 30 days if the patient gets a written reason, 164.524(b)(2).
• A Notice of Privacy Practices, 164.520.

"Addressable" does not mean optional. Under 164.306(d)(3) you assess each one, implement it if reasonable and appropriate, and otherwise document why and adopt an equivalent alternative where reasonable. It means "show your work."

The Security Rule overhaul that would make encryption and multifactor authentication mandatory is still a proposal (90 FR 898, January 6, 2025). The current Unified Agenda lists it as a long-term action with a final action date of July 2027 (background in the 2027 delay). It is not law, and OCR is not enforcing it.

Where med spas usually slip

• Before-and-after photos. A promotional photo is marketing, and 164.508(a)(3) requires an authorization for "any use or disclosure of protected health information for marketing." A full-face photo is an identifier under 164.514(b)(2)(i) (see the 18 HIPAA identifiers), and 164.508(b)(4) bars conditioning treatment on signing. "No photo release, no filler" is itself a violation. Form elements: HIPAA authorization requirements.
• Replying to reviews. Manasa Health Center in New Jersey paid OCR $30,000 in 2023 after its responses to negative online reviews disclosed patient information. More in HIPAA front desk rules.
• Salon software and personal phones. A booking app holding "neurotoxin, 40 units" next to a name holds protected health information. Photos on an injector's own phone sync to personal clouds. See the vendor table.

If HIPAA Does Not Apply to Your Med Spa

What still applies, and when

A non-covered med spa still holds medical records, and other laws reach them. For a New York med spa:

• Breach notification, General Business Law 899-aa. Covers any business holding New York residents' computerized private information. Since amendments signed in December 2024, that includes medical and health insurance information, and notice is due "within thirty days after the breach has been discovered."
• Data security, GBL 899-bb (the SHIELD Act). New York details: HIPAA compliance in New York. Reasonable safeguards for the same information. A business "subject to, and in compliance with" HIPAA is treated as compliant; a non-covered spa meets it on its own.
• Professional licensing. Revealing patient information "without the prior consent of the patient" is misconduct for physicians (Education Law 6530(23)) and for nurses, PAs and other licensees (8 NYCRR 29.1(b)(8)). Records must be kept "for at least six years" (8 NYCRR 29.2(a)(3)).
• Patient access, Public Health Law 18. Reaches licensed practitioners whether or not HIPAA does: inspection "within ten days," copies at no more than "seventy-five cents per page."
• The FTC Act. Section 5 bans "unfair or deceptive acts or practices," and the FTC and HHS say it applies to HIPAA-covered entities "as well as to companies that collect, use, or share health information that aren't required to comply with HIPAA." A privacy policy promising more than the spa delivers is the obvious exposure. It does not reach most nonprofits.
• The FTC Health Breach Notification Rule (16 CFR Part 318) covers vendors of personal health records, meaning records that can "draw information from multiple sources" and are managed for the individual, and "does not apply to HIPAA-covered entities." A typical med spa is not one. A spa launching a consumer app that pulls in wearable data should check.

Outside New York the categories are the same under different names: your state's breach law, its licensing and medical records rules, and the FTC Act everywhere.

What to do about it

Run the same safeguards anyway: risk analysis, vendor contracts, photo consent, access controls, training. Patients cannot see your covered entity status from the waiting room, and New York's breach law does not ask about it. And skip "HIPAA compliant" in your marketing unless you can back it up; the claim invites exactly the question you are not ready for.

HIPAA Enforcement Against Cosmetic Practices

All four of these were settlements under resolution agreements, not civil money penalties.

• Village Plastic Surgery, Ridgewood, New Jersey: $30,000 (March 26, 2021). OCR's eighteenth Right of Access Initiative settlement. HHS describes the practice as providing "cosmetic plastic surgery services." A patient complained in 2019 about getting their records late. Two years of monitoring, and the agreement states it "is not an admission of liability." Plastic surgery practice, not a med spa.
• Plastic Surgery Associates of South Dakota: $500,000 (announced October 31, 2024). Ransomware hit 10,229 people's information, the practice paid "two bitcoin ransom payments in the sum of $27,399.97," and OCR's findings include risk analysis failures. Also no admission of liability.
• New England Dermatology and Laser Center, Massachusetts: $300,640 (2022). Specimen containers labeled with patient information went into an outside dumpster. (Dermatology practices get their own guide: HIPAA compliance for dermatology.)
• Adult & Pediatric Dermatology, Concord, Massachusetts: $150,000 (December 2013). A stolen, unencrypted thumb drive held about 2,200 people's information. HHS called it the first settlement for lacking breach notification policies.

I could not find an OCR action against a business that calls itself a med spa, or a New York Attorney General action against one. That is not a clean bill of health. OCR investigates complaints (45 CFR 160.306), and Village Plastic Surgery started with one patient asking for their own records.

Frequently Asked Questions

Do med spas need to be HIPAA compliant?

Only if the med spa is a health care provider that sends a standard transaction, such as a claim, an eligibility check or a prior authorization, to a health plan electronically, itself or through a billing service (45 CFR 160.103). Most med spas are providers; the transactions decide coverage.

Does a cash-only med spa have to follow HIPAA?

Not if nobody ever sends a standard transaction electronically for it. One electronic claim changes that for every patient. State breach, privacy and licensing rules apply either way.

Do estheticians have to follow HIPAA?

An esthetician in a covered med spa is workforce and must be trained on and follow its policies (164.530(b)). An independent esthetician who never bills a health plan is generally not a covered entity, though state rules still apply.

Has a med spa ever been fined for a HIPAA violation?

I could not find an OCR action against a business that calls itself a med spa. The closest is Village Plastic Surgery, a New Jersey cosmetic plastic surgery practice that settled for $30,000 in 2021 over a patient's right of access.

Can a med spa post before-and-after photos on Instagram?

A covered med spa needs a valid authorization under 164.508 from each patient, and cannot make treatment conditional on it. A non-covered spa should still get written consent.

The Short Version

Whether your med spa is a covered entity is a yes-or-no question with a documented answer, and everything else follows from it. If the answer is yes, One Guy Consulting's Full-Scope plan includes a Security Risk Assessment tool, policy and procedure templates, staff training, vendor management with digital BAAs, and 1:1 implementation calls with Chuck. Start with a free 30-minute intro call. No obligation, no pressure.

Sources

Regulations and statutes

• 45 CFR 160.103, definitions
• 45 CFR 164.103 and 164.105, hybrid and affiliated entities
• 45 CFR Part 162, standard transactions
• 45 CFR Part 164 Subpart C, Security Rule
• 45 CFR Part 164 Subpart D, breach notification
• 45 CFR Part 164 Subpart E, Privacy Rule (164.508, 164.514, 164.520, 164.524, 164.530)
• HIPAA section 1179, 42 U.S.C. 1320d-8
• 16 CFR Part 318, FTC Health Breach Notification Rule
• 15 U.S.C. 45, FTC Act Section 5
• NY General Business Law 899-aa
• NY General Business Law 899-bb
• NY Public Health Law 18
• NY Education Law 6530
• 8 NYCRR Part 29

Agency guidance

• HHS, Summary of the HIPAA Privacy Rule
• CMS, Are You a Covered Entity
• CMS, Covered Entity Decision Tool
• CMS, HIPAA standards FAQs
• FTC, Collecting, Using, or Sharing Consumer Health Information
• FDA, Dermal Fillers
• Unified Agenda, RIN 0945-AA22
• Prospyr, med spa software FAQ

Enforcement

• Village Plastic Surgery
• Plastic Surgery Associates of South Dakota
• New England Dermatology and Laser Center
• Adult & Pediatric Dermatology
• Manasa Health Center

---

Related Reading

• What is a covered entity under HIPAA
• HIPAA patient photos and testimonials
• HIPAA and social media: staff mistakes to avoid
• HIPAA compliance in New York: SHIELD Act guide