A med spa referral program rewards an existing patient for sending a friend, and in North Carolina that reward meets a referral-fee statute and a medical board position statement that ordinary retail referral schemes never touch. The first design question is not how large the reward should be. It is whether a reward may be given at all.
Why a med spa reward is not a retail reward
The difference is the license. A coffee shop giving a customer a free drink for a referral is running a promotion; a med spa doing the same thing is a health care provider paying someone for recommending a provider, which state referral-fee law and medical board ethics both address directly. The reward is identical; the regulator is not.
That classification follows from what is performed there and under whose license, not from how the spa describes itself. A program rewarding patient recruitment is the licensee's exposure, and the medical director answers for it.
What North Carolina says about paying for a recommendation
North Carolina addresses this directly. N.C. Gen. Stat. § 90-401 provides that a health care provider shall not financially compensate any person, firm or corporation for recommending or securing the provider's employment by a patient, or as a reward for having made a recommendation that resulted in it. As of September 2026.
The Medical Board says the same thing in its own voice. Position statement 10.1.1, Referral Fees and Fee Splitting, takes the position that it is unethical for licensees to offer financial incentives or other valuable considerations to patients in exchange for recruitment of other patients. Read that slowly: it names the refer-a-friend credit, not only the broker arrangement. The AMA Code of Medical Ethics states the same rule for physicians generally.
The statute does carve out advertising. Section 90-401 is not construed to prohibit a health care provider's purchase of advertising that does not entail direct personal contact or telephone contact of a potential patient. That one sentence is where almost every compliant alternative below comes from: buying reach is not the same act as paying for a recommendation.
Where the federal rules come in, and where they stop
The federal Anti-Kickback Statute is narrower than most practice owners assume. The American Med Spa Association describes it as barring remuneration in cash or in kind to induce a referral of business covered by a federal health care program, which leaves a cash-pay aesthetic practice largely outside it. State law is where the constraint actually lands.
AmSpa's guidance goes on to say that most states have their own version of an anti-kickback law and that those versions are often more restrictive. Texas, New York, Florida and California all prohibit remuneration to a person for referrals regardless of whether the patient pays cash or uses insurance, so a gift card for referring a friend carries state-law risk there. AmSpa recommends taking the question to a healthcare attorney in your state first, as of September 2026.
Four federal rules govern the mechanics, whatever the reward
Four federal rules constrain how a referral program runs even where the reward itself is lawful: HIPAA governs whether patient information may be used to market at all, the FTC's endorsement guides govern what a referring patient discloses publicly, the consumer reviews rule governs incentives attached to reviews, and the TCPA governs the text that reaches the friend.
| Rule | What it governs | What it means for the program |
|---|---|---|
| 45 CFR § 164.508 (HIPAA) | Using protected health information for marketing | A signed authorization is required, with exceptions for a face-to-face communication and a promotional gift of nominal value. Treatment may never be conditioned on signing one. |
| 16 CFR § 255.5 (FTC endorsement guides) | Disclosing a material connection | Where the referring patient posts publicly, the reward is a material connection and must be disclosed clearly and conspicuously, even if it is only a discounted procedure. |
| 16 CFR § 465.4 (FTC consumer reviews rule) | Incentives tied to reviews | Compensation conditioned on a review expressing a particular sentiment is a violation. A generalized ask made to every patient is not. |
| 47 CFR § 64.1200 (TCPA) | Texting the referred friend | A friend whose number a patient hands over has consented to nothing. Consent belongs to the called party, and a reply of stop is honored within ten business days. |
The reviews rule is the one most often broken by accident. 16 CFR § 465.4 makes it a violation for a business to provide "compensation or other incentives in exchange for, or conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment". A referral credit that doubles when the friend also leaves five stars is that rule in one sentence.
HIPAA's nominal-gift exception is narrower than it sounds too: it removes the authorization requirement for the gift itself, and does not make the gift lawful under a state referral-fee statute.
What still works when a cash reward is off the table
Three designs survive the referral-fee line, and each rests on the advertising carve-out or on treating every patient the same. Give the intro offer to the friend rather than a reward to the referrer; open the discount to every patient on identical terms; or buy advertising, which section 90-401 expressly does not prohibit.
- Friend-side offer: the new patient gets the first-visit price and the existing patient receives nothing of value. Nothing is compensated, so nothing is a referral fee, and the referrer's motive becomes the friend's benefit, which is usually what they were acting on anyway.
- Open discount: AmSpa names membership discount systems as an alternative that avoids the regulatory headache. A price available to every patient on the same terms is a price, not a payment for a recommendation.
- Advertising: the Medical Board's position statement treats voucher advertising as neither unethical fee-splitting nor a prohibited referral fee, provided the fee negotiated with the voucher company is reasonable compensation for the cost of advertising and the ad clearly discloses the discounted price against the actual cost of services. As of September 2026.
What actually makes a patient refer
Referrals follow a visible result and a timely ask, not a reward. The reward is the part a program can measure, which is why it collects all the design attention, but the patient who sends three friends is usually the one who saw a change they like and was asked while they were still looking at it.
Timing is the lever a program actually controls. The ask lands at the post-treatment check-in rather than in a monthly newsletter, it is one tap that sends the friend a booking link rather than a code the patient has to explain, and that appointment is bookable in the moment, because a referral dies in the gap between wanting to book and finding a time.
Measure it as a count rather than a code. Ask every new patient how they heard about the practice, record the answer in the same field every time, and the referral rate becomes a number you can act on.
What a compliant referral system looks like when it runs
Med spa owners ask about HIPAA compliance across forms, CRM automations and ad landing pages before they ask about anything else, and a referral program touches all three at once. The answer is controls rather than a claim: the share form collects the minimum it needs, and patient data stays in a system the practice owns.
Mirastart builds that layer: booking systems that calculate genuine availability so a referred friend can take a real slot the moment they are interested, follow-up automation that sends the ask at the post-treatment interval rather than on the calendar month, loyalty and membership software running in production for Charlotte businesses today, and reporting that shows referral counts beside the paid channels. A business associate agreement is signed where an engagement genuinely touches protected health information, and the practice stays the covered entity.
Sources
- N.C. Gen. Stat. § 90-401 - Referral fees and payment for certain solicitations prohibited (North Carolina General Assembly) - A health care provider shall not financially compensate any person, firm or corporation for recommending or securing the provider's employment by a patient, or as a reward for a recommendation that resulted in it; a provider who refers a patient may not take compensation primarily for the referral. The section is not construed to prohibit the purchase of advertising that does not entail direct personal or telephone contact of a potential patient.
- Position Statement 10.1.1: Referral Fees and Fee Splitting (North Carolina Medical Board) - Payment by or to a licensee solely for the referral of a patient is unethical and in most instances inconsistent with state law; it is unethical for licensees to offer financial incentives or other valuable considerations to patients in exchange for recruitment of other patients; voucher advertising is not unethical fee-splitting or a prohibited referral fee where the negotiated fee is reasonable compensation for the cost of advertising and the stated disclosures appear clearly and conspicuously.
- Can I Reward My Medical Spa Patients for Referring a Friend? (American Med Spa Association) - The federal Anti-Kickback Statute bars remuneration in cash or in kind to induce a referral of business covered by a federal health care program, which cash-based aesthetic practices may fall outside; state anti-kickback laws are often more restrictive, and Texas, New York, Florida and California prohibit remuneration for referrals regardless of payer. AmSpa names membership discount systems as an alternative and recommends consulting a healthcare attorney first.
- Incentives to Patients for Referrals (AMA Code of Medical Ethics) - Physicians must not offer financial incentives or other valuable incentives to current patients in exchange for recruitment of other patients; such incentives can distort the information patients provide and skew the expectations of prospective patients.
- 45 CFR § 164.508 - Uses and disclosures for which an authorization is required (HIPAA Privacy Rule) - A covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except a face-to-face communication or a promotional gift of nominal value; treatment may not be conditioned on providing an authorization. Cornell LII mirror of the eCFR; official text at ecfr.gov.
- 16 CFR § 465.4 - Buying positive or negative consumer reviews (Federal Trade Commission) - It is a violation to provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, consumer reviews expressing a particular sentiment. Generalized solicitations to purchasers are carved out elsewhere in the part. Cornell LII mirror of the eCFR.
- 16 CFR § 255.5 - Disclosure of material connections (FTC Endorsement Guides) - A connection between endorser and seller that might materially affect the weight of the endorsement and is not reasonably expected by the audience must be disclosed clearly and conspicuously, including where the only benefit is a free or significantly discounted procedure. Cornell LII mirror of the eCFR.
- 47 CFR § 64.1200 - Delivery restrictions (FCC rules implementing the TCPA) - Prior express consent is required from the called party for autodialed or artificial-voice calls, and consent may be revoked by any reasonable method, with stop, cancel and unsubscribe in reply to a text a reasonable means per se, honored within ten business days. Cornell LII mirror of the eCFR.