HIPAA compliant marketing for med spas
Updated October 6, 2026
Med spa marketing runs on before-and-after photos, reviews, memberships and retargeting. Whether HIPAA applies depends on how the practice operates, but the FTC's rules on advertising, reviews and health data apply either way.
Where the risk shows up
- Before-and-after photos and testimonials without written patient authorization
- Reviews collected with incentives or posted by staff without disclosure
- Retargeting pixels on treatment, consultation and booking pages
- Promotional texts and emails to clients who only agreed to appointment messages
- Membership and loyalty tools that hold client treatment history
What the record shows
HIPAA applies to covered entities, which include health care providers that conduct certain transactions electronically, such as billing health plans (HHS). A cash-pay med spa can fall outside that definition.
Falling outside HIPAA is not a free pass. The FTC has acted against health businesses over sharing health data for advertising, including BetterHelp and GoodRx (Arnold & Porter).
The FTC's consumer reviews and testimonials rule, effective October 21, 2024, allows penalties of up to $51,744 per violation for practices like fake testimonials, paying for positive reviews and undisclosed insider reviews (Morgan Lewis).
Under the same rule, a business can be liable for fake reviews it "should have known" about, not only ones it knowingly posted (Wilson Sonsini).
How Rook helps
Rook reviews your practice's marketing from the outside, then installs the safeguards and systems your team runs. Start with a free Marketing Risk Report, or see programs and pricing.
Make cash-pay care easier to say yes to.
Most med spa treatments are paid out of pocket, and price is often the last thing between a consultation and a booking. Financing turns a one-time decision into a monthly one.
RepeatMD + Affirm gives your patients flexible financing with a soft credit check, plus memberships and rewards in your own branded app. RepeatMD reports approval rates above 80%.
Explore RepeatMDOpens RepeatMD’s site in a new tab. Rook Consulting is a RepeatMD referral partner and may be compensated when practices sign up through this link.
This page is general information about published regulations, enforcement actions and studies. It is not legal advice.