# Can a med spa post before-and-after photos with treatment consent?

Canonical: https://prospyrmed.com/resources/practice-answers/patient-photo-marketing-authorization
Sources reviewed: 2026-09-16 · Prepared by Prospyr

Treatment consent is not automatically permission to publish patient photos. For HIPAA-regulated practices, marketing uses or disclosures of identifiable protected health information generally require a valid written authorization, subject to limited exceptions. Confirm the intended channels and applicable state requirements before publishing.

## Separate clinical photography from advertising

HHS explains that most marketing uses of PHI need authorization. A photo used in the care record serves a different purpose from an Instagram post, website gallery or paid advertisement. Do not assume cropping a face removes all identifying information.

Source: [HHS: Marketing under the HIPAA Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html) — HIPAA covered entities and business associates

## Maintain a permission review workflow

As an operational safeguard, record the approved images, purpose, channels, scope and authorization version. Check restrictions and any revocation before each new use. A generic checkbox or a signed treatment form may not satisfy the required authorization elements; have the actual form reviewed.

Source: [HHS: Marketing under the HIPAA Privacy Rule](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/marketing/index.html) — HIPAA covered entities and business associates

## Practical checklist

1. Identify whether the image is PHI and which privacy rules apply.
2. Separate treatment consent from marketing authorization.
3. Verify the intended use falls within the valid authorization.
4. Retain the authorization and recheck before reuse or a new campaign.

## Worked example

A patient agrees to clinical photos during treatment. Months later, the marketing team wants to use them in a paid ad. The original clinical consent is not enough to assume advertising permission; review a valid authorization for that use.

## Mistakes to avoid

- Assuming a smile or verbal agreement is written authorization.
- Treating a face crop as guaranteed de-identification.
- Using photos outside the authorization’s scope.

## Related questions

- [Are treatment consent, an ABN and a good faith estimate interchangeable?](https://prospyrmed.com/resources/practice-answers/consent-versus-financial-notices)
- [Does HIPAA require keeping every medical record for six years?](https://prospyrmed.com/resources/practice-answers/medical-record-retention)
- [Can a practice withhold patient records because a bill is unpaid?](https://prospyrmed.com/resources/practice-answers/patient-record-access)

Prepared by Prospyr from the cited primary sources. These are educational workflow resources, not individualized clinical, coding, legal or tax advice. No clinician, certified-coder or attorney review is claimed. Confirm current code instructions, payer terms and applicable law for the actual service and date. CPT is a registered trademark of the American Medical Association; this is not a substitute for a licensed current code set.