Med Spa Photo Consent Form: Free HIPAA Checklist

A med spa photo consent form is a signed, written authorization, separate from your treatment consent, that names the exact photos, where they will run, how long consent lasts, and the patient's right to revoke it. HIPAA requires one before any before-and-after photo goes into marketing. Below is the checklist your authorization form needs, followed by the FTC rules that apply once you start posting.

The HIPAA photo consent checklist: what your authorization form needs

Your standard treatment consent does not cover marketing use of a photo. You need a second, specific, written authorization, and per 45 CFR § 164.508(c), it has to include:

• A description of the information disclosed. Name the exact photos: "photographs of treatment areas taken before and after [treatment type]"
• Who is authorized to make the disclosure. Name the practice, and anyone at the practice, cleared to release the photos. This is a separate line from who receives them
• The purpose of the disclosure. State exactly how the photos will be used: website gallery, social media, paid advertising, email marketing, printed materials
• Who will receive the information. Your marketing agency and the specific advertising platforms involved
• An expiration date or event. Never open-ended. Set a time period (e.g., 3 years) or a condition (e.g., until revoked in writing)
• The patient's right to revoke. State that consent can be withdrawn at any time in writing, and say how
• A conditioning statement. Say plainly that treatment, payment, enrollment, or eligibility for benefits is never conditioned on signing this authorization. For a marketing photo release, HIPAA does not allow you to make care conditional on it
• A re-disclosure statement. Note that once shared, the photo may no longer be protected by HIPAA if it is re-shared by someone outside your practice
• The patient's signature and date

That is the federal floor. In practice, a single blanket checkbox is not enough, because "yes, use my photo" means different things to different patients. Build the form around three separate opt-ins, each with its own checkbox and initials line:

1. Medical record only. The photo stays in the patient's clinical file for their care team. No marketing use of any kind.
2. Internal training. The photo can be used to train staff or document technique inside the practice. Still not public-facing.
3. External marketing. The photo can be used publicly: website, social media, paid ads, print. This is the only tier that clears a photo for anything in the rest of this guide.

A patient who initials tier one has not agreed to tier three. Collapsing all three into one checkbox is the most common gap we find when we audit a practice's consent paperwork, and it is the gap that turns a "the patient said yes" defense into no defense at all.

One thing the federal form will not flag: a handful of states layer their own biometric or likeness-privacy rules on top of HIPAA, and whether those reach ordinary marketing photography varies by state and keeps shifting. If your practice operates in more than one state, or you are not sure whether your state has one of these laws, have your healthcare attorney confirm what else applies. This checklist is the HIPAA baseline, not a substitute for that call.

Have patients sign the authorization on the day of treatment, ideally before the procedure when they are not groggy or uncomfortable. Keep the signed form in the patient's record and flag the associated photos as "consent obtained, tier 3" (or whichever tier applies) in your image management system. For how HIPAA applies to every other marketing channel beyond photos, see our HIPAA-compliant med spa advertising guide.

FTC rules for before-and-after marketing

HIPAA governs the patient's consent. The FTC's Health Products Compliance Guidance governs what you are allowed to claim once that consent is in hand, and the two are not the same checklist. The guidance was written for health products and supplements, but med spas are held to the same general FTC Act truthful-advertising standard, and this is the clearest statement of how that standard applies to before-and-after results.

The FTC requires that before-and-after photos represent results a typical patient can expect. Posting only your most dramatic transformations, with no disclosure that results vary, counts as misleading, because you are implying every patient gets that outcome. The guidance is explicit that a line like "results not typical" does not cure that on its own, you have to disclose what a typical patient can expect.

Practical compliance means:

• Do not cherry-pick only exceptional results. Show a range of outcomes that represents the typical patient experience
• Do not digitally alter photos beyond standard color correction and cropping. No smoothing skin, no adjusting proportions, no filters
• Include context. State the treatment performed, the number of sessions, and any relevant disclaimer about individual variation
• If the results shown are atypical, say so clearly. "Individual results may vary" alone no longer satisfies the FTC. Specify what a typical patient can expect instead

Why these photos are worth the paperwork

In our own campaigns, before-and-after photos consistently outperform stock photography on Meta, because they answer the one question every prospective patient has: "What will my results look like?" That lift shows up everywhere you use them, not just social: Google Ads landing pages convert better with real results above the fold, email campaigns with treatment galleries get more clicks, and service pages hold visitors longer when the results are real instead of borrowed stock imagery.

Written claims do not close that gap. A patient reading "our Botox results look natural" is skeptical by default. A patient looking at 15 consistent, properly consented before-and-after photos of natural-looking Botox results is a different conversation. Once the consent and FTC pieces above are handled, the only thing standing between you and that library is a repeatable way to shoot the photos.

Photography standards that make your results look professional

Consistent lighting, a neutral background, and standardized angles matter more than camera quality. Use two softbox lights at 45-degree angles, a solid gray or blue background, and marked floor positions for repeatable patient placement. Lock exposure and white balance between the before and after shots. Consistency, not equipment, is the difference between a photo that books treatments and one that gets scrolled past.

Lighting. Use the same setup for every photo. Two softbox lights at 45-degree angles eliminate harsh shadows and give even, flattering illumination. Natural window light changes throughout the day and creates inconsistency. Avoid it for clinical photography.

Background. Use a solid, neutral background for every shot. Light gray or pale blue works well. A clean treatment-room wall works if nothing else is visible. Never shoot against a background with furniture, equipment, or other patients visible.

Angles. Standardize your angles per treatment type. Facial treatments typically need front, left profile, right profile, and a 45-degree oblique. Body treatments need the same angle and distance in both shots. Mark floor positions with tape so every patient stands in the same spot.

Camera settings. On a phone, lock exposure and white balance so they stay consistent between the before and after shots. On a DSLR, use manual mode with identical settings for both images.

Patient preparation. Remove jewelry, pull hair back the same way, use the same (ideally zero) makeup. The goal is to isolate the treatment result from every other variable.

Timing. Shoot the "before" photo immediately before treatment. Shoot the "after" at the point of optimal results, which varies by treatment: Botox around 10 to 14 days, filler same-day once swelling subsides, laser treatments 4 to 6 weeks out.

Organizing and tagging your photo library

A disorganized photo library costs you the same as having no photos at all. When your marketing team needs a filler before-and-after for a Meta Ads campaign and spends 30 minutes digging through a phone camera roll, that is a system failure.

Build a structured library from day one. Tag every image with:

• Patient consent status: which of the three opt-in tiers above was signed
• Treatment type: Botox, filler, CoolSculpting, laser resurfacing, etc.
• Treatment area: full face, lips, jawline, abdomen, etc.
• Photo type: before or after
• Date captured and photographer/provider
• Approved usage channels: website, social organic, paid ads, email, print

Store photos in an encrypted, HIPAA-compliant system with access controls. Google Drive or Dropbox with proper security configurations works for small practices. Larger operations should look at dedicated medical photography platforms that integrate with your EMR, or a CRM with built-in image management.

Never store patient photos on personal devices. A lost phone with unencrypted patient images is a reportable HIPAA breach.

Using before-and-after photos across every marketing channel

Your photo library is a marketing asset once consent and FTC compliance are handled. Deploy it across every channel where prospective patients interact with your practice.

¶Website galleries

Dedicate a results page to your best before-and-after photos, organized by treatment type, with the treatment performed, number of sessions, and timeframe. Leave out patient names. Each treatment's service page should also feature 3 to 5 relevant photo sets inline.

¶Organic social media

Before-and-after carousels consistently outperform other post types on Instagram and Facebook. Post 2 to 3 sets per week with the treatment name, session count, and a call to action in the caption. Use relevant hashtags, but never tag or identify the patient.

¶Email campaigns

Run a "Results Spotlight" in your monthly newsletter featuring one standout set, linked to your full gallery. Treatment-specific emails promoting Botox or filler should always include at least one relevant photo set.

¶Google Ads

Google Ads landing pages convert better with real patient results above the fold. Use your strongest sets for the treatments you are advertising, and make sure the landing page images match the treatment named in the ad copy.

¶Meta Ads

Meta's ad policies are stricter than Google's on before-and-after comparisons in paid placements, and may reject ads implying negative self-perception. After-only images or "results showcase" formats tend to clear review better. Test creative approaches and track approval rates. Organic posts on your Facebook and Instagram pages face fewer restrictions.

¶Printed materials

Brochures, treatment menus, and in-office displays benefit from your best sets. Make sure your consent authorization specifically lists printed materials among the approved channels.

Common mistakes that undermine your photo marketing

After 23+ years in digital marketing, including 20+ years in medical aesthetics, these are the mistakes we see most often.

Over-editing photos. Filters, smoothing tools, and color manipulation destroy credibility. Patients can tell when a photo has been enhanced, and it makes them question whether the results are real. Stick to basic exposure correction and cropping.

Inconsistent shooting conditions. Different lighting, angles, distances, or backgrounds between the before and after shots make the comparison meaningless. The only difference between the two photos should be the treatment result.

Missing or incomplete consent. Verbal consent is not consent under HIPAA, and a general treatment consent form is not a photo marketing authorization. Every photo you publish needs a signed, specific, written authorization on file, at the right tier.

Posting identifiable information. Even with consent, avoid elements that make a patient identifiable to people who know them: distinctive tattoos, jewelry, or a background that reveals location. Crop tightly to the treatment area.

Neglecting the photo library. Great photos sitting on a camera roll are worthless. Build the workflow so photos move from capture to organized storage to marketing deployment on a defined cadence.

Using the same photos for years. Fresh results signal an active, thriving practice. If your newest before-and-after is from 2024, prospective patients notice. Make photography a routine part of the treatment workflow.

Building photography into your daily workflow

The best photo libraries come from practices that made photography, and the consent step in front of it, a non-negotiable part of every treatment visit.

1. At check-in: confirm photo consent status. If the patient has not signed a marketing authorization, present one. No pressure, just make it available.
2. Before treatment: capture standardized before photos using your defined angles, lighting, and background. Takes 2 to 3 minutes.
3. After treatment (or at follow-up): capture after photos under identical conditions.
4. Same day: upload to your organized library with proper tags, including consent tier.
5. Weekly: your marketing team reviews new photos and selects the strongest sets for upcoming campaigns.

That adds fewer than 5 minutes per patient visit. Over a month with 200+ patients, it builds a library that fuels every channel in this guide.

Once your consent workflow is in place, the next step is putting that photo library to work on the channel patients actually check before booking. The free GBP checklist walks through exactly where compliant before-and-afters belong on your Google Business Profile. If you want a marketing partner to build the full workflow, reputation system, and campaigns around your real patient results, schedule a Practice Growth Session with Pronk MedSpa Marketing. No commitment required. No credit card.