The Med Spa New-Patient Intake Process: Three Consents, Not One Signature

A med spa new patient intake process is the sequence that collects a patient's history, consents and contact permissions before the visit, delivers the file to whoever performs the pre-treatment examination, and sets up the second appointment. Three different consents live inside it, and each one answers to a different rulebook.

Almost every intake checklist treats that paperwork as one bundle to sign at the front desk and digitise. The three signatures have different legal tests, different expiry rules and different revocation paths, which is why bundling them is a structural mistake. Educational, not legal or medical advice, and current as of October 2026.

Three signatures, three different rulebooks

A med spa intake collects three consents that look like one form: the treatment consent the clinician needs, the marketing authorization required before protected health information promotes the practice, and the written permission allowing automated appointment and recall texts. Each is governed separately, and revoking one leaves the other two standing.

That independence is what a single bundled signature destroys. A patient who replies STOP to a reminder has withdrawn permission to be texted and nothing else. A patient who revokes a photo authorization still has an enforceable treatment consent on file. A practice that captured all three in one checkbox cannot show which one was given, or which one was taken back.

The marketing authorization cannot ride inside the treatment consent

Where a practice is a HIPAA covered entity, 45 CFR 164.508 requires an authorization before protected health information is used for marketing, and the same section forbids making treatment contingent on signing one. A combined form that gates the appointment on a marketing signature is therefore the wrong structure, not merely an aggressive one.

The rule's words are direct: a covered entity "may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization". A patient who declines the marketing use still gets the appointment, and the form has to make declining possible.

A valid authorization also carries elements a treatment consent does not: a specific and meaningful description of the information, who may disclose it, who may receive it, each purpose, an expiration date or event, the signature and date, and a statement of the right to revoke in writing.

Two limits matter. Whether a cash-pay med spa is a covered entity turns on the electronic transactions it runs, which 45 CFR 160.103 governs and this section does not decide. The rule also carves out face-to-face communication, which is why the consult room sits under different rules than the follow-up.

Automated texts need a consent the intake form rarely captures

An intake form that collects a mobile number has not collected permission to market to it. Under 47 CFR 64.1200 the FCC requires prior express written consent before a telemarketing call or text reaches a wireless number by autodialer, and defines that consent as a written agreement naming the number and authorizing the messages.

The FCC's consumer guide puts the mechanics plainly: written consent may be given on paper or through electronic means, including website forms or a telephone keypress, and autodialed texts to a mobile number are banned without consent. An intake form is a website form, so capturing it there is easy once it is a distinct field rather than an implication.

Revocation is where an automated recall usually fails. The rule treats stop, quit, end, revoke, opt out, cancel or unsubscribe sent in reply to a text as a reasonable means to revoke per se, and requires any revocation made in any reasonable manner to be honoured within ten business days. Telephone solicitation to a residential subscriber is confined to 8 a.m. through 9 p.m. local time.

Two things the rule leaves open: it does not use the phrase text message in its main prohibitions, which arrive by FCC interpretation, and whether a given platform is an automatic telephone dialing system has been unsettled since Facebook v. Duguid in 2021. The safe build collects the written consent either way.

The file has to reach the provider before the patient does

North Carolina's Medical Board takes the position that good medical practice requires each patient be examined by a physician, physician assistant or nurse practitioner before a first laser hair or tattoo removal treatment, and that the examination should include a history and a focused physical examination. The intake is what puts that history in front of that provider.

The consequence is a sequencing rule, not a paperwork one. Intake closes before the appointment rather than at it, so the booking flow has to tell a first visit from a repeat and hold the slot until the record is complete. A flow that sends a new patient straight to a laser slot has booked time against an order nobody has written.

Scope matters. That position statement, amended May 2021, addresses lasers and prescription light devices, not injectables, fillers or peels, and a position statement is the board's stated expectation rather than a statute. Which documents govern a given treatment menu is a question for a healthcare attorney.

Where the second booking is lost

Repeat patients are where a practice's economics live. Growth99's 2026 report, published by the American Med Spa Association, states that 73% of revenue is likely to come from repeat patients, against an average visit value of $527 and $132 to acquire a new one. The intake is the only moment a practice collects what the recall later needs.

Three fields decide whether that recall runs without a person remembering: the correct mobile number, the written permission to text it, and the treatment the interval counts from. A practice that captured the number but not the permission has a contact list it cannot automate against, which turns every second booking into a front-desk task.

What this looks like when it runs

HIPAA compliance across digital forms, CRM automations and ad landing pages is the buyer criterion an intake process lives or dies on, and the working version is a set of decisions made before the first form ships: each consent collected as its own timestamped record, submissions landing in a system the practice owns, and no patient information reaching an ad platform or a pixel.

Mirastart builds that layer. Booking systems that calculate genuine availability and send confirmations automatically, follow-up automation that chases what people forget, and reporting that counts booked chairs rather than clicks all run in production for Charlotte businesses today. For intake, the useful pieces are a pre-arrival flow that separates the three signatures, a booking step that holds a first visit until the record is complete, and a texting permission written where the recall can read it.

The controls are worth checking on any agency, ours included, and we sign a business associate agreement where an engagement genuinely touches protected health information. The practice stays the covered entity.