Not every business handling health-adjacent information is a "HIPAA-covered entity"
HIPAA (the Health Insurance Portability and Accountability Act) applies to specific categories of entities — generally health care providers who conduct certain electronic transactions, health plans, and their business associates. Many med spas, depending on their specific structure and billing practices, may or may not meet this definition.
This is a genuinely nuanced legal question that depends on your specific business structure, billing practices, and services. Do not assume your business is or isn't HIPAA-covered based on general similarity to other businesses — consult a qualified healthcare attorney to determine your specific status and obligations.
Good privacy practices matter regardless of HIPAA status
Whether or not HIPAA technically applies, any business collecting health-adjacent client information (medical history relevant to a treatment, skin conditions, medications) should handle it with genuine care: limit access to staff who need it, store it securely, and don't share it without appropriate consent.
Consent for photos and records involving health information
If your intake process or before/after photos involve information that could be considered sensitive health information, apply extra care to consent and storage — see our Before-and-After Photo Consent Considerations guide for that specific context.
When in doubt about whether specific information is sensitive enough to warrant extra privacy precautions, err toward treating it carefully. The cost of extra caution is low; the cost of a privacy incident involving genuinely sensitive information is not.
Frequently asked questions
Is every med spa a HIPAA-covered entity? Not necessarily — this depends on specific factors like billing practices and business structure. Don't assume either way without qualified legal guidance for your specific business.
Does a standard esthetics or salon business need to worry about HIPAA? Generally less likely to be directly HIPAA-covered than a medical practice, but good privacy practices for any client information collected remain a good idea regardless of formal legal status.