Before-and-After Content for Med Spas and Salons: What’s Legal (and What Isn’t)

A med spa posts a Botox before-and-after. Great engagement, exactly what the algorithm wants to see, exactly what a prospective client wants to see before booking. It’s also, if the paperwork isn’t in place first, a HIPAA violation with a fine structure that starts in the tens of thousands per incident and doesn’t have a friendly ceiling.

The confusion is understandable. A haircut result and a filler result look like the same category of content — same phone, same lighting, same before/after format. But one comes from a barbershop and the other comes from a licensed medical procedure, and the law treats those two photos completely differently the moment a treatment involves a needle, a prescription, or a provider’s medical license.

Why medical-adjacent content is a different category

Under HIPAA, a photo tied to a diagnosis, a treatment, or an outcome from a licensed medical procedure counts as protected health information — the same legal category as a chart note or a lab result. Injectables, laser treatments administered by a nurse injector, and anything requiring a physician’s oversight all fall inside that line. A general aesthetician doing a facial, a barber doing a fade, a nail tech doing acrylics — none of that is a medical procedure, so none of it triggers HIPAA at all.

That distinction is why the same content rules can’t apply across the beauty and wellness industry. A day spa and a med spa can sit next door to each other and operate under entirely different consent standards for the exact same camera and the exact same Instagram account.

What actually has to be in place before posting

• Written, specific consent. A general “you agree to photos” line buried in an intake form doesn’t cover social media use — the consent needs to name the platform, the purpose, and ideally have an expiration or revocation option, signed before the photo is taken.
• De-identification isn’t automatic. Cropping out the face doesn’t fully solve it if a tattoo, a distinctive mole, office decor, or even a caption with the client’s first name makes the person identifiable to anyone who knows them.
• Consent can be withdrawn. A signed release at the time of treatment doesn’t mean the post stays up forever — a client can request removal later, and the practice needs a real process for finding and taking it down.
• Staff need to know the line themselves. The person snapping the “after” photo on their personal phone in the treatment room is usually not the person who understands consent law, which is exactly how these leaks happen — not through malice, just through someone grabbing a quick photo to post before shift change.

What it actually costs to get wrong

The financial exposure here isn’t hypothetical or trivial. HIPAA penalty tiers scale with how preventable the violation was, and a single unauthorized disclosure — even one photo, one post, one client — can land in the tens of thousands of dollars per violation, with willful or repeated violations able to climb into the hundreds of thousands, and in the most severe multi-violation enforcement actions, settlements have reached into the millions. That’s before accounting for the separate civil liability a patient can pursue directly, or what a public enforcement action does to a med spa’s reputation in a market where trust is most of what’s being sold.

A salon posting a color correction doesn’t carry any of this. Non-medical beauty businesses still need a basic model release — a simple written “yes, you can post this” — because using someone’s likeness for marketing without permission is its own separate legal issue, just a far smaller one, closer to an awkward conversation than a regulatory filing. It’s worth reading more broadly on what makes content work for beauty and wellness businesses generally, since the creative side of before-and-afters is identical across both categories — it’s only the paperwork underneath that changes.

The real fix isn’t legal, it’s procedural

None of this means med spas should avoid before-and-after content — it’s still some of the strongest proof-of-work marketing they have. It means the consent form has to exist before the camera comes out, not after the photo is already sitting in someone’s camera roll waiting to be posted. The businesses that get this right treat photo consent as part of the treatment paperwork, not as an afterthought handled by whoever happens to be managing the social account that week.