Med Spa Photo Consent: Marketing Authorization Checklist

Sources checked September 17, 2026 · Prepared by Prospyr. This is a review aid, not a patient-ready authorization form. No attorney review is claimed. Have a qualified reviewer adapt the workflow and documents to your practice and state.

Does treatment consent authorize before-and-after marketing photos?

Do not assume it does. Clinical documentation and public promotion serve different purposes. HHS explains that marketing uses of identifiable protected health information generally need an authorization, subject to exceptions. Determine whether HIPAA applies to the practice and the particular use, and assess applicable state privacy and publicity requirements separately. HHS marketing guidance.

The direct answer on patient-photo authorization explains the distinction and provides an example. Keep that answer available to staff before they prepare a post.

Build a review record for each proposed use

This operational worksheet complements the actual authorization. It does not replace the required language or a signature.

What should a qualified reviewer check in the authorization?

The federal rule describes core elements and required statements, including the information, authorized parties, purpose, expiration, signature, revocation and redisclosure. Have the reviewer apply the full rule and relevant exceptions to the actual document. 45 CFR 164.508.

What happens when permission is withdrawn?

Route a written request to the responsible privacy contact and assess its scope. The federal rule recognizes limits where action has already been taken in reliance on an authorization. Do not promise that every third-party copy can be erased or that a clinical record should automatically be deleted. Record decisions about future publication, controlled channels and record retention. Authorization rule.

Worked example: a clinical photo becomes a social post

A team member selects a treatment image for an Instagram campaign. The reviewer records the asset ID, proposed account, caption and authorization reference. If the permission is unclear, the image stays out of the campaign while the question is resolved. The team does not treat a facial crop or a generic consent checkbox as a completed review.

Put the workflow beside the media

Use the fillable records and inventory workbook for an annotated photo/testimonial release-review worksheet. It contains internal planning fields, not a patient signature form. Do not enter patient-identifiable information into this marketing-site download.

Prospyr's media archive connects media and consent tracking, while digital intake keeps forms with the chart inside the same aesthetic EMR. These tools support a process; they do not certify its legal sufficiency. See the workflow.