Med spa before and after photo rules: HIPAA, FTC and Meta in one checklist

By Benjamin Chua·Updated October 12, 2026·14 min read

A museum does not hang a painting because someone found it in the storeroom and liked it. Every piece is tagged, logged and signed off by a curator before it goes on the wall. Nothing goes under the lights without a record and a label.

Run your before-and-afters the same way. They are your highest-converting content and your fastest way to get fined, and the only thing separating the two is whether a record exists for the image before anyone opens Instagram. Every image passes three hard checks, in this order, before it goes live:

1. 1HIPAA. Is there a signed marketing photo authorization attached to this file?
2. 2FTC. Is this result typical, or did we clearly label it as an unusual case?
3. 3Platform. Does the image and caption pass Meta's no body shaming and no personal attribute rules?

If any answer is no or not sure, the photo does not get posted.

When a before-and-after becomes protected health information

If you are a covered entity under HIPAA, which most medical aesthetic practices are, a patient photo taken in the course of treatment is protected health information when it can identify the person. Full-face photographs and comparable images are one of the 18 identifiers listed in the HIPAA de-identification rule. A cropped image of an arm might not identify anyone. A face almost always does, and so can a tattoo or a distinctive birthmark.

What a real marketing consent form must include

Using protected health information in marketing requires the patient's written authorization, as HHS explains in its marketing guidance. A line buried in your treatment consent does not count. You want a separate one-page form that answers six things in writing:

• What you can use: the body areas and treatments covered, before, during and after.
• Who can use it: the practice and the marketing vendors working for the practice.
• Where it can appear: website, social accounts, printed material, paid ads, in-office screens.
• How long: "until I revoke in writing", or a fixed date.
• The patient's rights: revoke at any time, and care is never conditioned on signing.
• Signature and date, with a copy handed to the patient.

Any one of those missing and the image is not ready for marketing. Store the signed form with the photo record so anyone on your team can check it before posting. If you cannot pull the form in under 60 seconds, treat the image as no consent and don't post it.

The authorization, clause by clause (plain language, not legal advice)

This is the structure we hand to clients so their counsel has something concrete to mark up. Eleven clauses, in order. Sample wording is in quotes; replace the bracketed parts.

1. 1

   1. Title

   "Authorization to Use Clinical Photos and Video for Marketing". Keep the word marketing in the title so nobody confuses it with the treatment consent.

2. 2

   2. Grant

   "I, [patient full name], give [practice legal name] permission to take and use photographs and/or video of me."

3. 3

   3. What is covered

   "Images may include my face and/or body areas treated at [practice], including [areas], taken before, during and after treatment."

4. 4

   4. Purpose

   Marketing and educational use, to show examples of the services the practice offers.

5. 5

   5. Who may use the images

   The practice, its providers and staff, and outside marketing vendors working on the practice's behalf.

6. 6

   6. Where they may appear

   Website, social media accounts, printed materials, in-office displays, webinars, and online or offline advertising.

7. 7

   7. Term

   Until revoked in writing, or a fixed end date if you prefer one. State that images already published may continue to be used.

8. 8

   8. No impact on care

   "I do not have to sign this to receive treatment. My treatment, payment or insurance benefits will not be affected by my decision."

9. 9

   9. How to revoke

   A written request to [practice address or email]. Revocation stops future use and does not undo use that already happened.

10. 10

    10. Re-disclosure risk

    Once an image is posted it may be copied or shared by others, and privacy laws may no longer protect it.

11. 11

    11. Acknowledgment and signature

    A line confirming the patient has read and understood the form, then signature, printed name, date, and a witness or staff line.

Replying to reviews is where practices actually get fined

The HIPAA enforcement cases that hit small practices are rarely about photos. They are about replies. A Dallas dental practice paid a $10,000 settlement after responding to Yelp reviews with patient details (TechTarget). A psychiatric practice paid $23,000 in 2023 for doing the same on Google (Nixon Peabody). The rule of thumb: never confirm someone is a patient in a public reply, even to thank them.

Review replies that keep you out of OCR's inbox

Three rules cover every reply. Never confirm they are a patient. Never discuss a treatment, outcome or date. Move the conversation offline. Here are the three replies we give front desk teams to copy and paste.

A 5-star review that mentions their treatment

“Thank you for taking the time to share this feedback. We work hard to make every visit feel safe, clean, and well-explained, and it means a lot to hear that came through. If you ever have questions about your care, our team is available at [phone/email].”

A 2-star review that mentions a treatment or outcome

“Thank you for sharing this. We take all feedback seriously. Because we protect everyone's privacy, we can't discuss any details about visits or treatments here, but we do want to understand what happened. Please contact us at [direct line/email] and ask for [practice manager], so we can review this with you one-on-one.”

Someone who was never your patient but names you

“We're not able to confirm or discuss anyone's care in a public forum, but we do want to understand any concerns related to our practice. If this relates to [practice name], please contact us at [contact]; if it's a different office with a similar name, we hope they're able to address this quickly for you.”

FTC rules for results and testimonials

The FTC's Endorsement Guides were revised in 2023 (Federal Register). If a before-and-after or testimonial shows a result patients will not generally get, you have to clearly disclose what results are generally expected. The old "results not typical" line on its own does not cover it.

Since October 2024 the FTC also has a rule banning fake reviews and testimonials, including buying reviews, writing them yourself, or suppressing negative ones. Incentivised reviews need care: offering a discount in exchange for a positive review is the fastest way to break it.

A caption formula that passes the FTC test

Most captions fail because they describe the best result and leave the reader to assume it is normal. Build every before-and-after caption in four parts, in this order.

1. 1

   1. Who, and their starting point

   Generic. "Adult patient concerned about lower-face fullness." No name, no age, nothing that identifies them beyond the image they already agreed to.

2. 2

   2. What was done

   The category of treatment, not the recipe. Units, brands and exact protocols invite comparison shopping and claims you cannot substantiate.

3. 3

   3. What most patients get

   A conservative typicality statement you can back with your own records. If this result is better than most, say so plainly.

4. 4

   4. Variability and a consult

   One line that results vary, and that what is realistic for the reader gets decided in a consultation.

“Adult patient concerned about lower-face fullness. Treated with a combination of injectable sculpting and skin-tightening sessions over three months. Most of our patients who complete the full plan see a softer jawline and firmer skin in this time frame. Individual results vary; this is one person's outcome.”

“Patient looking for a smoother forehead without surgery. After a series of neuromodulator treatments and medical-grade skincare, she has fewer visible lines at rest. Some patients respond faster, some slower; we'll review what's realistic for you during a consult. Results vary.”

Platform rules: Instagram posts vs Meta ads

Meta's health and wellness policy allows before-and-after images for general cosmetic procedures in ads targeted to people 18 and over. What gets ads rejected is the copy around them: phrases like "fix your problem areas" or "hate your double chin?" count as attacking appearance.

Ad copy that passes Meta review

The same five-part shape gets through review for us across treatments. Headline states a neutral desire, with no pain-shaming. Body covers what the treatment is, who it is for, and how the process runs. One proof line uses facts like years in practice or volume of treatments, never a guarantee. Soft call to action. Audience set to 18 and over.

“Headline: Considering a smoother jawline? Body: Our medical aesthetics team in [city] focuses on subtle, natural-looking lower-face contouring for adults. Every plan starts with a one-on-one consult to review options, risks, and realistic outcomes based on your anatomy. Board-certified medical director, thousands of injectable treatments performed. If you'd like a professional opinion, tap Learn More to request a consult.”

Never use any of these, in the headline, the body or the creative:

• "Hate your double chin?" or any question that assumes the reader dislikes a body part
• "Fix your flaws", "problem areas", "finally feel confident"
• Guesses about the reader's age, weight, income or insecurities ("over 40?", "tired of looking tired?")
• Guarantees or implied guarantees ("permanent results", "works for everyone")
• Creative that pinches, circles or zooms on fat, wrinkles or skin texture

Injectables carry extra restrictions on top of this. Our guide to advertising Botox on Instagram and Facebook covers prescription-drug naming and what Meta's reviewers reject.

The photo workflow, by role

A good locksmith engraves every key and logs it against an owner. No owner on record, no key handed out. The signed authorization is your key log and the photo is the key. The workflow below exists so that nobody has to remember the rule, because the system will not hand over a photo without a record.

1. 1

   Injector, before any photo is taken

   Has the marketing conversation and gets the authorization signed first. If the patient hesitates, photos are internal-only and that is the end of it.

2. 2

   MA or injector, during the visit

   Takes standardized photos. Same light, angle and background every time, labelled patient ID, date and area. The raw file is never overwritten.

3. 3

   Front desk, same day

   Scans the signed authorization, uploads it to the EMR or shared drive, and adds a row to the Photo Log with status INTERNAL-ONLY by default.

4. 4

   Photo lead, weekly

   Confirms the authorization is present, the photos match what the form covers, the result is representative rather than an outlier, and identifying marks are acceptable. Only then flips the row to APPROVED-MKT and copies the files into the APPROVED-MKT folder.

5. 5

   Photo lead, monthly

   Runs a consent-age check against the threshold your counsel set. Anything past it goes to CONSENT-EXPIRED and moves to the archive folder.

6. 6

   Medical director, monthly

   Spot-checks a sample of APPROVED-MKT images against their forms and captions, and initials the log.

The posting rule is one sentence. Social only pulls from the APPROVED-MKT folder, and no one posts from a camera roll. Not the injector, not the owner, not the agency.

Print it and tape it above the posting monitor. The social lead initials and dates one sheet per batch. If a regulator ever asks what your process is, you hand over a stack of signed sheets instead of a description.

When to use before-and-afters and when not to

Use before-and-afters to close, not to introduce. A stranger scrolling past a jawline photo has no reason to trust it and no context for it. Someone who already watched your injector explain downtime for ten minutes is a different viewer; for them, the photo answers the last question.

So the proof lives on the website gallery and in Instagram highlights, for people already searching your name, and in retargeting ads shown to people who watched the educational videos. Top of funnel is the injector on camera talking about risks, downtime and who is not a candidate.

Our flagship client, a Melbourne plastic surgeon working under some of the strictest advertising rules anywhere, grew from 12,043 to 36,236 followers in ten weeks with mostly educational videos. Her biggest reel, played 987,251 times, was about the rules themselves. See the full case study.

Turn the rules into content patients trust

Aesthetics is a low-trust market. Everyone has glossy photos and almost nobody shows their guardrails. That makes your compliance process a selling point in its own right. A patient choosing a practice is weighing the risk of becoming a horror story, and showing them the systems that stop that is the same principle as a guarantee removing a buyer's risk (Hormozi, $100M Offers, p. 124). Proof includes process: how seriously you treat the rules counts alongside the results, and being open about a mistake builds more trust than pretending you never made one (Acquisition.com Proof Checklist, p. 25 and p. 14).

Five videos any injector can film in an afternoon:

1. 1"Why we make you sign two forms before photos." Treatment consent versus marketing authorization, and why they are separate.
2. 2"How we decide which before-and-afters are fair to show." Typical versus outlier, and why the wild results stay in the training folder.
3. 3"Why we almost never answer treatment questions in reviews." Read a made-up 2-star review on camera, then show the safe reply.
4. 4"Our 3 photo safety checks before anything hits Instagram." Filmed at the screen, walking through the Photo Log.
5. 5"We show our mistakes." An ad that got flagged, what the reviewer objected to, and what changed.

Where this comes from

• HIPAA: HHS guidance on marketing and the Privacy Rule, and 45 CFR 164.514 for the identifiers that make a photo protected health information.
• Enforcement: the OCR settlements with a Dallas dental practice (Yelp replies) and a psychiatric practice (Google replies), as reported by TechTarget and Nixon Peabody.
• FTC: 16 CFR Part 255 (Endorsement Guides, 2023 revision) and the 2024 final rule banning fake reviews and testimonials.
• Meta: the Health and wellness advertising standard, checked 12 October 2026.
• Hormozi: $100M Offers, p. 124 on guarantees as risk reversal; Acquisition.com Proof Checklist, p. 25 (proof includes process) and p. 14 (transparency about mistakes).
• The authorization structure, Photo Log, reply scripts and caption formula are the operating templates we use with clients. Have your counsel review them before use. They are not legal advice.

Questions owners ask

Written by Benjamin Chua

Founder of Trueframe and Med Spa Launch. Nine years building video systems for founders and clinics, including a Melbourne plastic surgeon whose account went from 12,043 to 36,236 followers in ten weeks.