MedSpa Marketing Compliance: Before-and-After Photos, Claims, and Consent

Before-and-after photos are the highest-converting thing a medspa can publish. They are also the fastest route to a complaint, a board inquiry, or a HIPAA problem. That tension sits at the center of aesthetics marketing and most practices manage it on instinct.

The rules are not actually that mysterious. They come from four directions, and once you can see the four, building a compliant marketing program stops feeling like guesswork.

This is a marketing guide, not legal advice. Aesthetics regulation varies significantly by state and changes often. Have counsel who works in healthcare review your forms and your ad language.

The four layers

HIPAA governs patient information, including photographs.
The FTC governs whether your advertising claims are truthful and substantiated.
The FDA governs what you can say about the drugs and devices you use.
Your state medical board governs who can perform what, what you can call yourself, and what your advertising may imply.

Most practices are reasonably aware of the first and almost none have thought carefully about the fourth.

Layer one: photos and HIPAA

Start with the part practices most often get wrong. A before-and-after photo tied to a treatment is protected health information. The image itself reveals that a specific person received a specific medical treatment at your facility, and that is true whether or not you include a name.

The consequence: your treatment consent form does not cover marketing use. Informed consent for a chemical peel says nothing about that photo appearing on Instagram. Marketing use of PHI requires its own written authorization under the HIPAA Privacy Rule, and that authorization has specific required contents. The HHS Privacy Rule materials lay out the standard.

A compliant marketing authorization needs to describe specifically what will be used, name the purpose, identify who may use and receive it, carry an expiration date or event, state that the patient may revoke it in writing and explain how, state that treatment is not conditioned on signing it, and warn that information disclosed may no longer be protected once re-disclosed.

Practical notes that save practices trouble:

• Separate the permissions. Clinical record, internal training, and external marketing are three different uses. Let the patient opt into each one individually rather than bundling them.
• Never condition treatment on it. Beyond being required, bundling it into the intake packet as a prerequisite is exactly what draws scrutiny.
• Identifiers are broader than faces. Tattoos, scars, distinctive jewelry, a reflection in a mirror, the treatment date, or photo metadata can all identify a patient. Cropping to the treatment area helps but does not automatically de-identify an image.
• Store the authorization with the images it covers. When a question comes up eighteen months later, you need to produce the specific signed form for that specific photo. Retain authorizations for at least six years, and longer where state medical records law requires it.
• Honor revocations going forward. A patient can withdraw consent. That means you need to know every place an image has been published so you can actually pull it.
• Get a BAA from every vendor touching PHI. Practice management software, cloud storage, email platform, scheduling tool, and yes, an agency with access to your patient photos. A missing business associate agreement is a violation on its own.
• Watch comments and DMs. Replying publicly to a patient in a way that confirms they are a patient is a disclosure. “So glad you loved your results!” on a public comment is a HIPAA problem wearing a friendly face.

Layer two: claims and the FTC

The FTC’s central rule is simple to state and hard to live by: you need substantiation for your claims before you make them, and you cannot say through a patient testimonial anything you could not say directly. The Health Products Compliance Guidance is the reference document, and it applies to social media the same way it applies to television.

Three areas cause most of the trouble in aesthetics.

Typical versus exceptional results

The old approach of running a spectacular result alongside a small “results may vary” disclaimer no longer holds. Under the revised Endorsement Guides, if you feature an outcome that is not representative, you need to disclose what a typical patient can generally expect. A generic disclaimer does not cure a misleading impression.

This is uncomfortable, because your best result is your most persuasive asset. The workable answer is to publish a range rather than only the ceiling. Show a genuinely average outcome alongside the standout one. It is more honest, it sets better expectations, and it produces fewer unhappy patients on the back end.

Material connections

If a patient received a discount, a free treatment, a gift card, or anything else in exchange for a testimonial or a post, that relationship has to be clearly disclosed. Same for influencers, and same for employees and their family members reviewing the practice. The FTC’s endorsement resources are explicit that the disclosure has to be clear and conspicuous, not buried in a hashtag block.

Reviews

Fake reviews are not a gray area. Employee reviews, owner reviews, reviews written for patients, purchased reviews, and AI-generated reviews all carry real exposure, and the FTC has moved aggressively in this area in recent years. Suppressing negative reviews selectively is also a problem. Ask broadly, respond to everything, and let the average be what it is.

Layer three: the FDA and what you say about products

Neurotoxins, fillers, lasers, and compounded medications are regulated products with approved indications. Promoting a use outside those indications is off-label promotion, and it is one of the sharpest lines in this space.

In practice that means the marketing copy needs to stay inside the approved labeling. It also means being careful with disease-treatment language. Describing an aesthetic service as treating, curing, or preventing a medical condition changes the regulatory character of the claim.

Compounded weight-loss medications deserve particular care right now. That category draws more complaints than almost anything else in aesthetics, and marketing copy is usually what triggers them. If you offer these services, get the language reviewed rather than adapting a competitor’s page.

Layer four: your state medical board

This is the layer that gets skipped, and it is the one with a license attached to it.

State boards govern scope of practice and delegation: who may inject, what level of physician supervision is required, and what a medical director actually has to do. They also govern how you present yourself. Titles like “cosmetic surgeon,” “specialist,” or “expert” can imply board certification you may not hold. Marketing that presents a medical practice as a non-medical spa is its own problem.

State boards also generally prohibit false or misleading advertising independently of the FTC, which means a cherry-picked before-and-after can be a board issue as well as a federal one.

In Oklahoma, the relevant oversight sits with the State Board of Medical Licensure and Supervision along with the nursing board for delegated procedures. Rules differ meaningfully from state to state, so do not borrow an advertising approach from a practice in another state without checking.

A compliance file you can actually maintain

When something is questioned, the practices that come through it easily are the ones with documentation. Keep:

1. A signed marketing authorization for every published patient image, stored with that image, dated and scoped.
2. A substantiation file for every outcome claim, comparative claim, or statistic you publish, with the source and date.
3. An archive of every ad you have run, including platform, dates, and creative.
4. Written agreements with every influencer or brand ambassador covering disclosure obligations and approval rights.
5. Signed BAAs with every vendor that touches patient information.
6. A log of where each patient image has been published, so a revocation can be honored completely.

None of this is difficult. It is just work that nobody assigns until there is a problem.

What good looks like inside these limits

The constraints push you toward better marketing, which is the same pattern we see in every regulated category we work in.

Lead with the provider. Credentials, training, and the person holding the syringe are unrestricted and they are what patients are genuinely anxious about.

Publish education rather than promotion. What a treatment is, what recovery looks like, who is a poor candidate. Honest content about who should not get a procedure builds more trust than any promotional offer.

Invest in the space and the brand. Interior photography, staff portraits, and facility video are fully unrestricted and they do real persuasive work when your outcome imagery is limited by consent.

Build the consent habit into intake so your photo library grows legitimately over time instead of leaving you scrambling for permission on the one image you want to use.

We handle medspa marketing and SEO, including the photography and social media side, and we work inside these constraints rather than around them. If you want a second set of eyes on your current site and social before something gets flagged, get in touch.