The NC Med Spa Advertising Rules Nobody Reads (Until the Board Calls)

North Carolina med spa advertising rules are the requirements of four regulators: the NC Medical Board (Position Statement 10.1.2 on ownership), HIPAA (45 CFR 164.508 on patient photos), the FTC (16 CFR Part 255 on testimonials), and the FDA (approval labeling on injectables). Most marketing advice cites other blogs; this guide points at the regulations themselves. It is an educational overview, not legal advice; keep a healthcare attorney.

Four regulators, one ad

A single med spa Instagram ad can implicate the North Carolina Medical Board (who is allowed to practice and advertise medicine), HIPAA (whose photo and story that is), the FTC (what the testimonial claims), and the FDA (what the injectable is approved to treat). None of these agencies coordinates with the others, and compliance with one is not compliance with the rest.

The industry's own trade association attributes part of its compliance problem to rapid growth and operators who move too quickly. "There is an underbelly to it where there's folks that are doing things recklessly, fast without thinking about what they're doing and not necessarily understanding what the consequences might be," said Alex Thiersch, founder and CEO of the American Med Spa Association, speaking to 10 Investigates in a September 2026 story that AmSpa republished. The four sections below are those consequences, one regulator at a time.

North Carolina: the ownership question behind every med spa

The North Carolina Medical Board's position is that businesses practicing medicine in the state must be owned entirely by holders of active NC medical licenses, according to Position Statement 10.1.2 on the corporate practice of medicine, adopted in March 2016 and amended in September 2025. A med spa that provides medical treatments falls inside that rule.

NC med spas therefore operate through physician-owned professional entities, often with a management services organization (MSO) handling the business side, and a physician medical director who actually supervises treatments is not a formality. The statement says licensees providing medical services for a lay-owned business may face disciplinary action, that employee versus contractor status does not change that, and that the board may seek an injunction against the lay owners. The marketing consequence is that the medical side of the operation has to be real and visible: name the medical director on the website, and advertise only the services your clinicians are licensed to provide.

HIPAA: the before/after photo is not yours

A before-and-after photo connected to an identifiable person and their treatment is protected health information, and if the practice is a HIPAA covered entity, using it in marketing requires a signed authorization under 45 CFR 164.508(a)(3). A general photo consent buried in an intake packet does not meet that bar; the authorization has to be specific to the marketing use.

Before-and-after photos are the currency of aesthetics marketing and the most commonly mishandled asset in it. The regulation lists what a valid authorization contains: a specific description of the information, who may use it, who receives it, the purpose, an expiration date or event, and the patient's signature and date, in plain language, with a statement of the right to revoke. Keep the signed form on file for six years. Four habits keep the photo library out of trouble:

• Get a dedicated, signed marketing authorization for every identifiable photo - not an intake checkbox.
• Keep the signed forms; the retention obligation is measured in years, not campaigns.
• A patient posting their own results publicly does not authorize you to repost them with treatment details.
• The review-reply trap: responding to a Google review with treatment specifics - or even confirming the reviewer was a patient - is itself a disclosure. Reply warmly and generically.

FTC: your testimonial is your claim

A testimonial in your marketing is a claim the business is making under the FTC's Endorsement Guides (16 CFR Part 255, revised 2023). If the result it describes is more dramatic than a typical client can expect, the ad is likely deceptive, and the FTC's health products guidance states that a "results not typical" disclaimer does not cure it.

Health-related claims sit under a higher bar still. The same FTC guidance, issued December 2022, expects competent and reliable scientific evidence behind an efficacy claim, generally randomized, controlled human clinical testing, and says testimonials do not count as substantiation. Liability can reach the individuals who control the marketing, not only the entity. A results photo with a caption is a testimonial in pictures and gets the same test, and any free or discounted treatment given to the person in it is a material connection that has to be disclosed.

FDA: approved, off-label, and the ads that confuse them

FDA approval labeling is the limit on what an injectable can be advertised for. Botox Cosmetic's label, as published on DailyMed, covers four indications: glabellar lines, lateral canthal lines (crow's feet), forehead lines, and platysma bands. Anything else, including lip flips and jawline slimming, is off-label: legal for a licensed provider to perform in clinical judgment, never advertisable as FDA-approved.

Advertising an off-label use as FDA-approved is false advertising, and dramatic efficacy language ("clinically proven to erase wrinkles instantly") invites exactly the scrutiny a growing med spa does not need. The safe pattern is simple: describe off-label treatments honestly as what they are, keep FDA language attached only to what the label actually says, and read the current label rather than a supplier's sales sheet before the copy is written.

Which rule applies to which marketing asset?

Which rule applies depends on the asset, not the channel. A results photo answers to HIPAA and the FTC at once, a testimonial to the FTC, an injectable promotion to the FDA label, and the provider page to the medical board. The table below maps six common med spa assets to the check each needs before it ships.

What does marketing built on these rules look like when it runs?

Compliance-aware med spa marketing is a set of controls on the digital forms, CRM automations and ad landing pages: a photo authorization logged before creative ships, review replies written to disclose nothing, testimonial claims checked against the typical result, FDA language checked against the label, and a business associate agreement signed on request, with the practice as the covered entity.

Insist on that pattern from whoever runs your marketing, and ask to see the authorization log and the business associate agreement before the first photo moves. The booking and follow-up systems Mirastart builds behind med spa ads run under those same controls, which is the version of HIPAA compliance an agency can honestly claim: named controls and a signed agreement, never a blanket certification. None of it limits good marketing. It limits the shortcuts that turn into board complaints.