{"id":175161,"date":"2026-08-10T13:28:21","date_gmt":"2026-08-10T13:28:21","guid":{"rendered":"https:\/\/pabau.com\/?p=175161"},"modified":"2026-08-18T13:34:12","modified_gmt":"2026-08-18T13:34:12","slug":"before-and-after-photo-consent-form-medical-spa-requirements","status":"publish","type":"post","link":"https:\/\/pabau.com\/es\/blog\/before-and-after-photo-consent-form-medical-spa-requirements\/","title":{"rendered":"Before and after photo consent form: Medical spa requirements for HIPAA"},"content":{"rendered":"
\n
\n \"Key\n

Key takeaways<\/h3>\n <\/div>\n
\n
\n
\n \n \n <\/svg>\n <\/div>\n

A general treatment consent form does not cover marketing use of a patient’s photos \u2014 that needs a separate HIPAA authorization.<\/p>\n <\/div>\n

\n
\n \n \n <\/svg>\n <\/div>\n

A valid authorization under 45 CFR \u00a7164.508 contains six core elements plus three required statements.<\/p>\n <\/div>\n

\n
\n \n \n <\/svg>\n <\/div>\n

Use a three-tier opt-in: medical record only, internal training, or external marketing, each initialed separately.<\/p>\n <\/div>\n

\n
\n \n \n <\/svg>\n <\/div>\n

The published med spa forms we reviewed omit an expiration date, a written revocation procedure, and a not-conditioned-on-treatment statement.<\/p>\n <\/div>\n

\n
\n \n \n <\/svg>\n <\/div>\n

State law can add requirements on top of HIPAA, so have the form reviewed in the state where you practice.<\/p>\n <\/div>\n

\n
\n \n \n <\/svg>\n <\/div>\n

Store the signed form with the photos it authorizes, so you can prove consent for any image months later.<\/p>\n <\/div>\n <\/div>\n <\/div>\n \n\n\n

\n

Download your free before and after photo consent form<\/h2>\n

A clause-by-clause photo and video consent form covering the six HIPAA core elements, the three required statements, a named-channel list, and a three-tier initialed opt-in. It includes the expiration, revocation, and guardian-signature blocks that published forms leave out. Have a healthcare attorney in your state review it before use.<\/p>\nDownload template<\/a>\n<\/div>\n\n\n\n

The photo consent form most med spas use is a photo release, and a photo release is not a HIPAA authorization. That distinction decides whether your before-and-after gallery is lawful. A compliant form must contain six core elements, three required statements, and separate opt-ins for each purpose a photo can serve.<\/p>\n\n\n\n

We checked the photo consent forms med spas publish on their own websites against that standard. Clauses were missing on every form we reviewed. This guide lists every before and after photo consent form medical spa requirements checklist item, clause by clause. It also gives you a copy-ready template built from the standard those forms fall short of.<\/p>\n\n\n\n

Practice management software like Pabau can collect and store these authorizations digitally, but the form itself has to be right first. That is what the rest of this article covers.<\/p>\n\n\n\n