Some do and some do not. A med spa must follow HIPAA when it is a health care provider that sends health information electronically for a standard insurance transaction. That can include a claim, eligibility check, or prior authorization. This is education, not legal advice.
Chuck is not an attorney and One Guy Consulting is not a law firm; take your own facts to a healthcare attorney before relying on any conclusion here.
Med spa, medi spa, aesthetic clinic, or the injector's suite at the back of a dermatology office: the HIPAA question is simple in theory and messy in practice. The answer is usually "sometimes".
That answer is not a dodge. A cash-only injection clinic and a med spa that bills insurance for migraine Botox can look alike and still be different under HIPAA. The test is about transactions, not branding.
What Makes a Med Spa a HIPAA Covered Entity
A med spa becomes a covered entity (an organization HIPAA regulates directly) only if it is a health care provider that transmits health information electronically in connection with a standard transaction. CMS asks the same two questions: is it a provider, and does it send standard transactions?
45 CFR 160.103 names three kinds of covered entity: a health plan, a health care clearinghouse, and a health care provider that transmits health information electronically in connection with a covered transaction. A med spa is usually not the first two, so the third is what matters.
The third category, word for word:
A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
Part one: a med spa is usually a health care provider
A provider is anyone who furnishes, bills, or is paid for health care in the normal course of business. Health care includes procedures that affect the body, and the sale or dispensing of a drug or device under a prescription.
Botulinum toxin is a prescription drug. The FDA calls dermal fillers medical device implants. Laser resurfacing changes the structure of the skin. A website saying “we are not medical” does not change the definition.
Part two: the transactions decide it
Being a provider is not enough. The provider has to send health information electronically for a standard transaction (an insurance transaction with a required electronic format under 45 CFR Part 162). Those include claims, eligibility, payment, prior authorization, referral certification, claims attachments, and related insurance transactions.
The test is about insurance plumbing, not how medical the treatment feels. Online booking, email, card payments, and a medical director do not decide it. A billing service can decide it, though, because HIPAA can apply when a third party sends the transactions on the provider's behalf.
Why Cash-Only Does Not Automatically Mean HIPAA-Free
Cash-only describes how patients pay. HIPAA asks whether anyone sends standard transactions for the business. Usually those are different questions, and sometimes they overlap.
-
The medical side gets billed. Botox for chronic migraine, a dermatology consult, or labs for a weight-loss program can trigger a claim.
-
Someone checks eligibility or requests prior authorization. Both are standard transactions.
-
A billing service sends the claim. That can make the provider covered even if the clinic itself never touches the transmission.
-
Paper can become electronic. If a billing service or clearinghouse converts the claim, the provider can still be covered.
What usually does not flip the switch: card payments, patient financing, and a superbill the patient files with their own insurer. If the patient handles the insurance transaction, that is different from the spa handling it.
Three Med Spa Scenarios
Real ownership and billing details change the answer. These scenarios show how the rule works in practice.
Scenario A: the independent cash-only injection clinic
An LLC owned by a nurse practitioner, with a contracted medical director, card payments only, and receipts that patients may file themselves. If nobody sends claims, eligibility checks, or prior authorizations electronically, it is very likely not a covered entity. State privacy, breach, and licensing duties can still apply.
Scenario B: the med spa with a billing service
Same clinic, plus medical weight loss, with a billing company submitting claims to commercial plans. That is a covered entity for every patient, not just the weight-loss ones. The billing company is a business associate (a vendor handling patient information for the spa) and needs a signed Business Associate Agreement (BAA, the required vendor contract) before it handles patient data.
A related internal resource is HIPAA for Business Associates.
Scenario C: the med spa inside or beside a covered practice
A dermatology or plastic surgery group that bills insurance may also run an aesthetics suite. If the suite is part of the same legal entity, it is covered. If it is separate, it is tested on its own facts. The practice still owes HIPAA for disclosures it makes to the spa.
If you cannot tell which structure you have, that is the first question for counsel.
Hybrid Entities, Affiliated Entities, and OHCAs
These terms are not interchangeable. They do not turn a non-covered spa into a covered one, or the reverse.
Hybrid entity
A hybrid entity (a covered entity where HIPAA applies only to its designated health care components) is one legal entity with both covered and non-covered functions that formally designates its health care components. Without that designation, the entity is subject in its entirety to the Privacy Rule.
Affiliated covered entity
Legally separate covered entities that are affiliated may designate themselves as a single covered entity when they share common ownership or control. Only covered entities can join.
Organized health care arrangement
An OHCA (organized health care arrangement) is a clinically integrated care setting, or a joint arrangement among covered entities for certain shared operations. It matters when a med spa shares space, patients, and quality review with a covered practice.
If none of these describes your business, ignore all three.
What HIPAA Requires for a Covered Med Spa
A covered med spa needs a privacy and security program, written policies, workforce training, vendor agreements, and a risk-based approach to security. The rules are broad, but the core obligations are consistent.
|
Vendor |
BAA needed for a covered med spa |
|---|---|
|
Aesthetic EHR, photo storage, billing service |
Yes |
|
Booking and point of sale |
Yes, if service names or notes sit next to client names; some salon platforms will not sign |
|
Text and email marketing |
Yes, if treatment details go in; otherwise keep it to names and contact details |
|
IT support, web host receiving forms, shredding |
Yes |
|
Card processor |
Not for card processing alone; keep procedure names off the charge |
|
Pharmacy filling a prescription |
No; that is a provider receiving information for treatment |
-
Security risk analysis. An accurate and thorough assessment of risks and vulnerabilities to electronic protected health information (ePHI, patient health information in electronic form), followed by risk management.
-
A privacy official and a security official. In a small spa, one person may serve in both roles if named in writing.
-
Written policies and procedures. Keep them and keep them current.
-
Training for the workforce. That includes injectors, estheticians, and front desk staff.
-
Access and audit controls. Use unique user IDs, review activity, and protect systems with reasonable safeguards.
-
Business Associate Agreements. Use them with every vendor that handles patient information.
-
Incident response and breach notification. Have a plan before something goes wrong.
-
Patient access and a Notice of Privacy Practices. Patients still have rights to their records.
Two of my anonymized client cases (neither is a med spa) show the pattern. In Case 05, a single-location practice had several vendors handling PHI with no BAA; it ended with every missing BAA signed and a repeatable vendor review. In Case 01, a Florida mental health franchise office with policies never written and a state auditor due in days was audit-ready in under a week and passed its state audit.
“Addressable” does not mean optional. It means you assess the control, implement it if reasonable and appropriate, or document why you chose an equivalent alternative.
The Security Rule overhaul that would make encryption and multifactor authentication mandatory is still a proposal. It is not law, and it is not being enforced as final rule text.
Where med spas usually slip
Before-and-after photos, online reviews, booking software, and personal phones are common trouble spots. A promotional photo is marketing, so a covered med spa needs valid authorization before using it. A response to a bad review can also disclose patient information. A booking app or phone that stores treatment details can contain protected health information.
If HIPAA Does Not Apply to Your Med Spa
Not being a covered entity does not mean no privacy rules apply. State breach laws, licensing rules, patient-record rules, and the FTC Act can still reach a med spa.
What still applies, and when
For a New York med spa, the main issues include breach notification, data security, professional licensing, patient access, and the FTC Act. Other states use different laws, but the categories are similar.
-
Breach notification. New York's breach law covers computerized private information, including medical and health insurance information.
-
Data security. New York's SHIELD Act requires reasonable safeguards.
-
Professional licensing. State licensing rules can treat unauthorized disclosure as misconduct.
-
Patient access. State medical-record laws can give patients access rights even when HIPAA does not apply.
-
The FTC Act. The FTC can act against unfair or deceptive privacy practices.
What to do about it
Run the same safeguards anyway: risk analysis, vendor contracts, photo consent, access controls, and training. Patients do not see your legal status from the waiting room.
If you market as “HIPAA compliant,” be ready to support that claim. If you are not covered, that phrase can create its own problem.
HIPAA Enforcement Against Cosmetic Practices
OCR settlements show that cosmetic and dermatology practices can face real enforcement. The cases below were settlements under resolution agreements, not civil money penalties.
-
Village Plastic Surgery, Ridgewood, New Jersey: $30,000. OCR's eighteenth Right of Access Initiative settlement.
-
Plastic Surgery Associates of South Dakota: $500,000. OCR cited ransomware and risk analysis failures.
-
New England Dermatology and Laser Center, Massachusetts: $300,640. Specimen containers with patient information went into an outside dumpster.
-
Adult & Pediatric Dermatology, Concord, Massachusetts: $150,000. A stolen unencrypted thumb drive held about 2,200 people's information.
I could not find an OCR action against a business that calls itself a med spa. That is not a clean bill of health. OCR investigates complaints, and enforcement often starts with a patient issue.
Frequently Asked Questions
Do med spas need to be HIPAA compliant?
Only if the med spa is a health care provider that sends a standard transaction electronically to a health plan, itself or through a billing service.
Does cash-only mean HIPAA does not apply?
No. Cash-only payment does not automatically remove HIPAA duties if the business still sends claims, eligibility checks, or prior authorizations electronically.
What if a billing company submits claims for us?
A billing company can trigger HIPAA coverage for the spa because it may send standard transactions on the spa's behalf.
What should a covered med spa have in place?
A covered med spa should have privacy and security policies, workforce training, vendor agreements, access controls, and a risk-based security program.
What if HIPAA does not apply to my med spa?
State privacy, breach, licensing, and patient-record rules can still apply, so it is still worth using strong safeguards.
Do estheticians have to follow HIPAA?
An esthetician in a covered med spa is part of the workforce and must follow the spa's policies. An independent esthetician who never bills a health plan is generally not a covered entity.
Has a med spa ever been fined for a HIPAA violation?
I could not find an OCR action against a business that calls itself a med spa. Cosmetic practices have been settled, though.
Can a med spa post before-and-after photos on Instagram?
A covered med spa needs valid authorization for that use. A non-covered spa should still get written consent.
The Short Version
Whether your med spa is a covered entity is a yes-or-no question with a documented answer. If the answer is yes, One Guy Consulting's Full-Scope plan includes a Security Risk Assessment tool, policy templates, staff training, vendor management with digital BAAs, and one-on-one implementation calls with Chuck. Start with a free 30-minute intro call.
One Guy Consulting in 37 seconds
Sources
Regulations and statutes
Agency guidance
Enforcement
Related Reading
Try three One Guy Consulting 3D staff training courses free →