Before-and-After Photos: What Med Spas Can and Cannot Post

Med spa before-and-after photos are governed by three separate systems: patient privacy law at 45 CFR §164.508, the ad standards of the platform you post to, and the FTC's view of what a picture claims. A signed release answers the first of those, and only partly. This is an educational overview, not legal advice; your healthcare attorney and medical director own the final calls.

Three questions, not one

Owners tend to collapse this into "do we have permission?" It is really three questions with different answers. May you use this image at all, a privacy question answered by the authorization on file. Will this surface accept it, a platform question answered by ad standards that do not care what your patient signed. And does the picture claim more than a typical patient gets, which is the FTC's question.

A spa can be fully compliant on the first and still lose an ad account to the second, or clear both and fail the third.

What makes a photo PHI, and what cropping does not fix

A photo becomes protected health information when it can identify the patient. Full-face photographic images and any comparable images are one of the eighteen identifiers listed at 45 CFR §164.514(b)(2), so a face-forward before-and-after tied to a treatment is protected health information rather than just a picture.

Cropping is the workaround that looks safer than it is. Removing the face removes the listed identifier, but the safe harbor method also requires that you have no actual knowledge the remaining information could identify the person. A distinctive tattoo, jewelry she wears in every post, a caption naming the week and the treatment: any of those can put identity back into an image you thought was anonymous.

Treat cropping as risk reduction rather than a legal exemption, and get the authorization anyway. One signature ends the argument.

What a marketing authorization actually has to say

HIPAA requires a signed authorization before protected health information is used for marketing, and according to the text of 45 CFR §164.508(c), the rule lists the elements that document has to contain. A photo-release line in an intake packet usually fails here: not because releases are worthless, but because the required elements are missing.

Why a signed release is not the end of it

The signature starts an obligation rather than ending one. Four things go wrong after it, quietly, usually years later when nobody remembers the shoot.

• Revocation. She can revoke, so a revocation request needs a route to whoever controls the ad account, and a takedown that actually happens. You cannot un-distribute what already ran; you can stop everything forward, and that is the standard.
• Expiration. A release signed in 2023 with a three-year term does not cover a campaign built in 2027. Someone has to track dates, because the photo library outlives the paperwork.
• Scope creep. Authorization for "our website" is not authorization for a paid social ad, a printed event banner, or a partner's newsletter. New channel, check the form.
• Editing. Retouching, filters, or lighting that flatters the after and not the before turns a truthful photo into a deceptive one - a separate problem from consent, and the one the FTC cares about.

The platform layer: what the networks allow regardless of your paperwork

Platform ad standards are a second gate, and patient consent does not open it. According to Meta's Health and Wellness advertising standard, as of September 2026, cosmetic before-and-after transformations are allowed in ads targeted to people 18 or older, and a valid HIPAA authorization changes nothing about that rule.

Meta names dermal fillers, injectables, chemical peels, micro-needling and laser treatments in the policy text, and it still prohibits statements of inferiority about physical appearance and sensational or exaggerated claims; earlier versions of the policy barred before-and-after images outright. TikTok likewise treats cosmetic procedures as a restricted ad category with strict limits on body-image imagery. Both policies move, so read the current text at transparency.meta.com and in TikTok's advertising policies before planning creative around results photos, not after the account gets flagged.

Organic posts and paid ads run on different rulebooks on the same platform. Community guidelines are generally looser than ad standards, which is why a results carousel can sit on your grid for a year and get rejected the moment you boost it. So keep a second creative approach for the paid side: patient stories in words, provider-to-camera explanation, technique and facility footage.

The FTC layer: the photo is a claim

A before-and-after is an efficacy claim made in pictures, and the FTC treats it as one. According to the Endorsement Guides at 16 CFR Part 255, substantially revised in 2023, depicted results should be what a typical patient can expect, and a "results may vary" line does not rescue an atypical showcase.

Misrepresented testimonials carry their own exposure. The FTC's rule on consumer reviews and testimonials, 16 CFR Part 465, took effect in late 2024 and reaches stock imagery or a supplier's photo library presented as your own patients. And if a patient got free or discounted treatment for appearing in your marketing, that material connection has to be disclosed clearly.

Everyone else who touches the file

Anyone who creates, receives or maintains identifiable patient images on your behalf is a business associate. If your practice is a HIPAA covered entity, that includes the marketing agency, the photographer and the contractor who edits the files, and it requires a written contract under 45 CFR §164.502(e) and §164.308(b).

The photo is taken on a phone, sent somewhere, edited by someone and stored in a tool, and each step is a disclosure. Plainly: your agency should have signed a business associate agreement before it ever received a patient photo, and if the subject has never come up, that tells you something about the agency.

Underneath this sits a question owners are often given the wrong answer to. A cash-pay spa that does not conduct HIPAA-covered electronic transactions may not be a covered entity at all, which is not the green light it sounds like. The supervising physician's practice may be covered independently, state privacy and records law still applies, the FTC polices deception for everyone, and publishing a recognizable person's image without permission carries its own civil exposure regardless. Have counsel confirm your status in writing, then run one photo process that holds up either way.

A photo workflow that survives all three systems

1. 1Standardize capture: same camera, distance, angle, and lighting for both frames. Credible results, no editing temptation.
2. 2Sign the marketing authorization at the after visit, channels named and dated - not buried at intake.
3. 3Log every set: patient, treatment, date signed, expiration, channels approved, revoked yes/no.
4. 4Store files access-controlled, with a signed business associate agreement before any vendor touches them.
5. 5Choose the surface deliberately: results photos on your own site and in consult materials, other creative for paid social.
6. 6Post unretouched, with honest context - sessions, timeframe, and that individual results vary.
7. 7Review the log quarterly and pull anything lapsed or revoked.

What does the workflow look like when an agency runs it?

Mirastart builds the pieces that touch patient images: privacy controls on the digital forms, the CRM automations and the ad landing pages, and a business associate agreement signed where the work genuinely touches protected health information. Photos run on a signed authorization rather than an intake checkbox, and the practice stays the covered entity.