Before-and-After Photos: What Med Spas Can and Cannot Post

Med spa before-and-after photos are governed by three separate systems - patient privacy law, the ad standards of the platform you post to, and the FTC's view of what a picture claims - and a signed release only answers the first, and only partly. This is an educational overview, not legal advice; your healthcare attorney and medical director own the final calls.

Two questions, not one

Owners tend to collapse this into "do we have permission?" It is really two questions with different answers. May you use this image at all - a privacy question, answered by the authorization on file. And will this surface accept it - a platform question, answered by ad standards that do not care what your patient signed. A spa can be fully compliant on the first and still lose an ad account to the second.

What makes a photo PHI, and what cropping does not fix

Under HIPAA's de-identification standard, full-face photographic images and any comparable images are one of the eighteen identifiers listed at 45 CFR §164.514(b)(2) - which is why a face-forward before-and-after tied to a treatment is protected health information rather than just a picture. That is also what makes the common workaround shakier than it looks. Cropping to the treated area removes the listed identifier, but the safe harbor method also requires that you have no actual knowledge the remaining information could identify the person. A distinctive tattoo, jewelry she wears in every post, a caption naming the week and the treatment - any of those can put identity back into an image you thought was anonymous.

Treat cropping as risk reduction rather than a legal exemption, and get the authorization anyway. One signature ends the argument.

What a marketing authorization actually has to say

HIPAA requires a signed authorization for marketing uses of protected health information (45 CFR §164.508(a)(3)), and the regulation is specific about what that document contains. This is why a photo-release line in an intake packet usually fails - not because releases are worthless, but because the required elements are missing. Below is the checklist for your attorney.

Why a signed release is not the end of it

The signature starts an obligation rather than ending one. Four things go wrong after it, quietly, usually years later when nobody remembers the shoot.

• Revocation. She can revoke, so a revocation request needs a route to whoever controls the ad account, and a takedown that actually happens. You cannot un-distribute what already ran; you can stop everything forward, and that is the standard.
• Expiration. A release signed in 2023 with a three-year term does not cover a campaign built in 2027. Someone has to track dates, because the photo library outlives the paperwork.
• Scope creep. Authorization for "our website" is not authorization for a paid social ad, a printed event banner, or a partner's newsletter. New channel, check the form.
• Editing. Retouching, filters, or lighting that flatters the after and not the before turns a truthful photo into a deceptive one - a separate problem from consent, and the one the FTC cares about.

The platform layer: what the networks allow regardless of your paperwork

This is where most spas are genuinely surprised. Meta's Health and Wellness advertising standard, as of September 2026, permits before-and-after transformations for cosmetic products, procedures, and surgeries - dermal fillers, injectables, chemical peels, micro-needling, and laser treatments are all named - only in ads targeted to people 18 or older, and it still prohibits statements of inferiority about physical appearance and sensational or exaggerated claims; earlier versions of the policy barred before-and-after images outright. A valid HIPAA authorization changes nothing there - it is Meta's rule about its own inventory. TikTok likewise treats cosmetic procedures as a restricted ad category with strict limits on body-image imagery. Both policies move, so read the current text at transparency.meta.com and in TikTok's advertising policies before planning creative around results photos, not after the account gets flagged.

The operational distinction: organic posts and paid ads run on different rulebooks on the same platform. Community guidelines are generally looser than ad standards, which is why a results carousel can sit on your grid for a year and get rejected the moment you boost it - boosting converts an organic post into an ad. So keep a second creative approach for the paid side: patient stories in words, provider-to-camera explanation, technique and facility footage.

The FTC layer: the photo is a claim

A before-and-after is an efficacy claim made in pictures, and the FTC treats it as one. Under the Endorsement Guides at 16 CFR Part 255 (substantially revised in 2023), depicted results should be what a typical patient can expect, and a "results may vary" line does not rescue an atypical showcase. The FTC's separate rule on consumer reviews and testimonials, 16 CFR Part 465, took effect in late 2024 and attaches civil penalties to fake or misrepresented testimonials - which matters the moment stock imagery or a supplier's photo library gets presented as your own patients. And if a patient got free or discounted treatment for appearing in your marketing, that material connection has to be disclosed clearly.

Everyone else who touches the file

The photo is taken on a phone, sent somewhere, edited by someone, and stored in a tool. Each step is a disclosure. If your practice is a HIPAA covered entity, a marketing agency, photographer, or contractor that creates, receives, or maintains identifiable patient images on your behalf is a business associate, and that requires a written contract under 45 CFR §164.502(e) and §164.308(b). Plainly: your agency should have signed a business associate agreement before it ever received a patient photo, and if the subject has never come up, that tells you something about the agency.

Underneath this sits a question owners are often given the wrong answer to. A cash-pay spa that does not conduct HIPAA-covered electronic transactions may not be a covered entity at all - which is not the green light it sounds like. Many spas transmit in ways that pull them in, the supervising physician's practice may be covered independently, state privacy and records law still applies, the FTC polices deception for everyone, and publishing a recognizable person's image without permission carries its own civil exposure regardless. Have counsel confirm your status in writing, then run one photo process that holds up either way.

A photo workflow that survives all three systems

1. 1Standardize capture: same camera, distance, angle, and lighting for both frames. Credible results, no editing temptation.
2. 2Sign the marketing authorization at the after visit, channels named and dated - not buried at intake.
3. 3Log every set: patient, treatment, date signed, expiration, channels approved, revoked yes/no.
4. 4Store files access-controlled, with a signed business associate agreement before any vendor touches them.
5. 5Choose the surface deliberately: results photos on your own site and in consult materials, other creative for paid social.
6. 6Post unretouched, with honest context - sessions, timeframe, and that individual results vary.
7. 7Review the log quarterly and pull anything lapsed or revoked.