Before and After Photo Consent Form: Med Spa Template

Before-and-after photos are some of the most persuasive marketing a med spa has, and the signed consent form is what makes using them legitimate. Our guide on before/after photo compliance covers the broad rules. This one covers the form itself: what it needs to say, the federal rules that shape it, and a free template you can adapt.

Marketing consent is not the same as treatment consent

A patient who signs a treatment consent form has agreed to the procedure. That is not agreement to appear on your Instagram feed, your website or a paid ad. Use two forms: one for the treatment, and a separate, specific one for marketing use of the photos. It is a common gap, and a simple one to fix.

What a before-and-after photo consent form needs to include

• The exact images covered: which treatment, which body area, which dates. Avoid blanket wording like "any photos we ever take of you."
• The purpose, in plain words, such as showing examples of results in your marketing.
• Who may use and receive the images, including outside parties such as your marketing agency, web developer or ad platforms.
• Each place the images may appear, named and initialed separately: website, social media, paid ads, Google Business Profile, email, printed materials.
• How the patient may be identified: full face, cropped or hidden face, first name or no name.
• What editing is and is not allowed. Retouching that changes the result shown should be ruled out.
• Any payment, discount or free treatment the patient gets for the photos, and any payment your practice gets from a third party, such as a product manufacturer, for the marketing.
• When consent ends: a date or an event.
• How the patient can revoke consent, and what happens to images already published.
• That signing is voluntary and treatment does not depend on it.
• A signature and date, the authority of anyone signing for the patient (such as a parent or guardian), and a copy given to the patient.

If HIPAA applies to your med spa

HIPAA does not automatically apply to every med spa. Under federal rules, a health care provider is a covered entity if it transmits health information electronically in connection with certain standard transactions, such as electronic insurance billing (45 CFR 160.103). Whether that describes your practice depends on how you operate, so ask your lawyer. We are a marketing company, not a law firm.

If you are a covered entity, three rules matter here. First, HIPAA's list of identifiers includes "full face photographic images and any comparable images" (45 CFR 164.514(b)(2)(i)(Q)), so patient photos can be protected health information. Second, you must get a written authorization to use or disclose protected health information for marketing, with narrow exceptions for face-to-face communication and promotional gifts of nominal value (45 CFR 164.508(a)(3)). Third, that authorization must contain specific elements to be valid.

• Core elements (45 CFR 164.508(c)(1)): a specific description of the information; who may make the disclosure; who may receive it; each purpose; an expiration date or event; and the signature and date, plus a description of a personal representative's authority if one signs.
• Required statements (45 CFR 164.508(c)(2)): the right to revoke in writing and how to do it; whether treatment can be conditioned on signing; and that information disclosed may be redisclosed by the recipient and no longer protected.
• If the marketing involves financial payment to your practice from a third party, the authorization must say so (45 CFR 164.508(a)(3)(ii)).
• It must be in plain language, and the patient must get a copy of the signed authorization (45 CFR 164.508(c)(3) and (c)(4)).

Our template includes a section for each of these elements. If HIPAA does not apply to you, they are still a sensible standard for a clear, fair consent form. That is our recommendation, not a legal requirement.

FTC rules once a photo appears in your marketing

The FTC's Endorsement Guides (16 CFR Part 255, revised in 2023) define an endorsement to include depictions of a person's likeness (16 CFR 255.0(b)). A patient's before-and-after photo in your marketing can therefore work as a consumer endorsement. That has three practical consequences.

• Show honest results. Endorsements must reflect the endorser's honest experience (16 CFR 255.1(a)). Do not edit photos in a way that changes the result shown.
• Be careful with standout results. If you cannot substantiate that a patient's result is what people will generally get, the ad should clearly and conspicuously disclose the generally expected results, and that disclosure must actually change the overall impression of the ad (16 CFR 255.2(b)).
• Disclose perks. A discount or free treatment given in exchange for photos is a material connection that should be disclosed clearly and conspicuously (16 CFR 255.5). This is why the template records any payment or benefit.

The FTC notes that the Guides themselves do not have the force of law and that its guidance is not a safe harbor. Treat them as the baseline, not the ceiling.

State rules and ad platform policies

On top of federal rules, your state medical board or other licensing board may have its own rules on patient images and advertising, and those rules vary by state and sometimes by treatment. Ad platforms also set their own policies on before-and-after images in paid ads. We have not listed state-by-state rules here, because they vary and change. Check your state board and each platform's current ad policy, and ask your lawyer to adapt the form for your state.

Revocation is the part most forms skip

Give patients a clear, easy way to withdraw consent, and have a real process for pulling images down everywhere they appear, not just on your website. If HIPAA applies to you, the authorization must tell the patient they can revoke it in writing and how. Be honest in the form about the limits: removing a post does not remove screenshots or reposts made by other people.

Keep each signed form tied to its images

Store the signed form alongside, or clearly linked to, the specific image files it covers, not in a general folder. If a patient or a regulator asks what was agreed, you should be able to produce the exact form for the exact images in minutes. The template's "office use only" section records file names, storage location, the expiration reminder and any revocation.

How to use the template

1. 01Download the Word file and add your practice name, address and the contact for revocation requests.
2. 02Delete the options that do not apply to your practice, and add any channels you use that are missing.
3. 03Have a lawyer licensed in your state review it, including whether HIPAA applies to you.
4. 04Ask patients to sign it at the photo session, as a separate form from treatment consent.
5. 05Give the patient a copy, and record the image file names in the office-use section.
6. 06Set a reminder before the consent expires, and follow your revocation process when a request comes in.