Are Med Spas Covered Entities Under HIPAA?

Not every med spa must follow HIPAA. It depends on the services the med spa provides and whether it sends certain electronic transactions to health insurance companies.

For example, a med spa that only accepts payments from patients and never sends covered electronic insurance transactions may not be a HIPAA covered entity.

But being cash-only does not automatically make a med spa exempt from HIPAA.

This guide explains how to check whether HIPAA applies to your med spa, which other privacy laws may apply and how to protect patient photos. It also explains what to consider when choosing a clinical photo management app.

Under 45 CFR 160.103, HIPAA applies to three types of covered entities:

1. Health plans, such as health insurance companies.
2. Health care clearinghouses, which process health care billing information.
3. Health care providers that send certain health information electronically.

A med spa may fall into the third group.

For a med spa to be a covered health care provider, both conditions must be met:

1. It provides health care. This includes treatments and services related to a person’s health or body.
2. It sends a covered electronic transaction. For example, an electronic insurance claim or an electronic insurance eligibility check.

A covered electronic transaction is a type of health care billing or administrative exchange for which HIPAA has established a standard.

If your med spa does not meet both conditions, it generally is not a HIPAA covered health care provider.

You can check this using the CMS Covered Entity Decision Tool.

Many med spas do.
HIPAA defines health care broadly. Under 45 CFR 160.103, it includes services that affect the structure or function of the body. Examples may include

• Botox and other medical injections.
• Laser treatments.
• Medical skin treatments.
• Prescription skin care.

The law also includes providing prescription medicines and certain medical devices. This means many med spas meet the first condition for being a covered health care provider.

The next question is whether the med spa sends covered electronic transactions.

HIPAA has specific rules for electronic billing and insurance transactions.

These rules appear in 45 CFR 160.103 and 45 CFR Part 162. Here are common examples:

You do not have to send these transactions yourself.

If a billing company or clearinghouse sends covered electronic transactions for your med spa, your med spa may still be a HIPAA covered entity.

A clearinghouse is a company that converts health care billing information into the standard format required for electronic transactions.

These activities alone do not make a med spa a HIPAA covered health care provider:

• Accepting credit or debit card payments from patients.
• Offering online appointment booking.
• Sending appointment reminders.
• Using software to manage patient records.

What about electronic prescriptions?

Sending an electronic prescription to a pharmacy does not, by itself, appear on HIPAA’s list of standard transactions that determine covered-entity status.

However, your prescribing software may also send insurance benefit or eligibility checks.

Ask your software provider whether it sends any HIPAA-standard electronic transactions on your behalf.

This post is general information. It is not legal advice. Before you start using your policy, ask your privacy officer or your lawyer to read it.

A policy often fails not because of its wording, but because staff cannot use it in their daily work.

• It is too long. Busy staff may not read a 12-page policy between patients. Keep the rules to 1 or 2 pages, and put the details in a separate step-by-step guide.
• No one is in charge of it. Name one person, usually the privacy officer, who answers questions and takes reports.
• It leaves out photos that patients send. Patients may text photos after treatment. The policy needs a clear answer for what staff do next.
• It says nothing about social media. Say plainly that no patient photo goes online without the patient’s signed permission (authorization).
• It has no consequences. HIPAA requires a practice to apply sanctions, which means consequences for staff who break the rules, and to keep a record of them.
• Staff are never trained again. Train new staff within a reasonable time after they join, and train staff again when the policy changes in an important way (45 CFR 164.530(b)(2)).

It may be, but you need to check.

A med spa that only accepts direct payments from patients and does not send any covered electronic transactions may fall outside HIPAA’s covered-entity definition.

Before deciding, ask these questions:

1. Do we send electronic insurance claims? Check every service, including treatments that are only occasionally billed to insurance.
2. Do we check insurance eligibility electronically? This includes checks made through billing software or an insurance company’s website.
3. Does another company send transactions for us? Ask your billing company, clearinghouse or software provider.
4. Are we part of another medical practice? If the med spa is owned or operated by a dermatology or plastic surgery practice, check whether both operate as the same legal covered entity or under another HIPAA arrangement.

Example: A med spa accepts only cash payments for cosmetic treatments. It does not bill insurance or check insurance eligibility electronically. It may not be a HIPAA covered entity.

But if that med spa later starts sending standard electronic insurance claims, its HIPAA status may change.

Yes, generally. Once a medical practice is a HIPAA covered entity, HIPAA protects the PHI it holds, including information about patients who pay cash.

PHI (protected health information) is identifiable information about a patient’s health, treatment or payment for care.

For example, a treatment photo linked to a patient’s name can be PHI. There may be special rules for some organizations with separate health care and non-health care activities. Ask your compliance adviser if your med spa is part of a larger business.

A med spa outside HIPAA may still have legal duties to protect patient information. Here are some important US laws to check.

The Federal Trade Commission (FTC) is the US agency that protects consumers from unfair or misleading business practices. Under Section 5 of the FTC Act, businesses must not make misleading claims about privacy or security. For example, if your med spa tells patients that their photos are stored securely, your actual practices must support that claim.

This law can apply even when HIPAA does not.

Washington’s My Health My Data Act (RCW 19.373) protects certain consumer health information. It can apply to businesses operating in Washington or offering products or services targeted to Washington consumers, if they meet the law’s requirements. Consumer health data can include information about health conditions, treatments and certain biometric information. For example, a photo used to create a facial identification template may raise biometric privacy issues. Not every patient photo is automatically biometric data under this law.

The Act also has exceptions, including for certain information already protected by other laws.

California has a law called the Confidentiality of Medical Information Act (CMIA).It is found in California Civil Code section 56 and following. The law protects medical information handled by certain health care providers and other covered organizations.

If your med spa operates in California, check whether CMIA applies to its services and patient records.

States may also have rules about:

• Who can perform medical procedures.
• Who can supervise a med spa.
• How patient records must be protected.
• When patient photos can be used for advertising.

Check the rules issued by your state medical board and any other licensing authority that oversees your services.

The FTC Health Breach Notification Rule (16 CFR Part 318) applies to certain personal health record providers, related businesses and their service providers that are not covered by HIPAA.

It may require them to report certain breaches of health information.

The rule does not automatically apply to every med spa or every patient photo app.

If your med spa offers its own patient-controlled health record app, or works with a business that does, check whether this rule applies.

HIPAA is a US law. Clinics in other countries have their own privacy and health data rules. These rules generally do not use HIPAA’s electronic insurance transaction test.

Under UK GDPR Article 9, health information is special category data. Clinics must identify a lawful basis under Article 6 and a separate Article 9 condition before processing this information. The Data Protection Act 2018 adds requirements for certain types of processing. The regulator is the Information Commissioner’s Office (ICO).

Federal Law No. 2 of 2019 sets rules for the use of information and communication technology in health fields. The UAE also has rules concerning the storage and transfer of health information. The exact requirements can depend on the clinic’s location and regulator, such as the Dubai Health Authority (DHA) or Abu Dhabi Department of Health (DoH).

Under the Privacy Act 1988, a private business that provides health services and holds health information is generally covered even if it is small. This means a qualifying small med spa cannot rely on the usual small-business exemption simply because it has low revenue. The regulator is the Office of the Australian Information Commissioner (OAIC).

Saudi Arabia’s Personal Data Protection Law (PDPL) treats health data as sensitive personal data. Med spas handling identifiable patient health information must follow the applicable data protection requirements. The regulator is the Saudi Data and Artificial Intelligence Authority (SDAIA).

Under the General Data Protection Regulation (GDPR), health information receives special protection. Clinics must have a lawful basis under Article 6 and meet an Article 9 condition when handling identifiable health information. Each EU country has a data protection authority that oversees these rules.

Med spas take photos to record treatment, track progress and compare before-and-after results. These photos may show a patient’s face, skin condition, treatment area or other identifying details. If your med spa is a HIPAA covered entity, identifiable treatment photos connected to patient care can be protected health information (PHI).

Read our guide on Are Patient Photos PHI? to understand when a photo identifies a patient.

Yes. Even if HIPAA does not apply, patient photos still deserve strong privacy protection. Your clinic should:

• Store patient photos in an approved clinical system rather than staff members’ personal galleries.
• Give each staff member an individual login.
• Limit access to people who need the photos for their work.
• Keep records of who accesses, downloads or shares photos, where your system supports this.
• Use appropriate device security and encryption.
• Get the required patient permission before using identifiable photos for marketing.
• Check which privacy laws apply to your clinic.

These are recommended security practices. They do not automatically make a clinic HIPAA compliant.

Use this checklist to find out whether HIPAA applies to your clinic.

Whether HIPAA applies to your clinic or not, patient photos should be stored securely in a clinical photo management app rather than a personal phone gallery. CureCast supports HIPAA-compliant workflows and offers a Business Associate Agreement (BAA) for US practices. Your clinic remains responsible for meeting HIPAA requirements.

See how CureCast protects patient photos.

This article provides general information, not legal advice. Check your clinic’s situation with a qualified legal or compliance professional.