General information for aesthetic practices, not legal advice. Confirm your own obligations with a HIPAA attorney or compliance officer.
Every medspa takes before-and-after photos. Almost none of them treat those photos with the same care as a chart note or an intake form — even though, under HIPAA, a before-and-after photo often carries more identifying detail than either one.
That gap between how photos are actually handled and how they're supposed to be handled is one of the most common, least discussed compliance risks in aesthetics. It's not usually intentional. It's a fast-paced consult room, a provider's personal phone, a quick text to a colleague for a second opinion — none of which feels like a HIPAA event in the moment. This is a plain-English walk-through of why that's a problem, where the risk actually lives, and a checklist you can run against your own practice in about five minutes.
Why Before-and-After Photos Count as PHI
The reasoning here is simpler than most practices assume. Under HIPAA, protected health information is any individually identifiable health information — and a photo of a patient's face, taken in connection with a treatment they received, is about as identifiable as health information gets.
The American Med Spa Association is direct about this: before-and-after photos are PHI "regardless of whether or not clients are using health insurance" to pay for treatment (americanmedspa.org). Cash-pay aesthetics doesn't create an exemption. If the photo is tied to a specific patient and a specific treatment, HIPAA applies the same way it would to a lab result or a surgical note.
It's also worth naming the assumption that trips practices up most: cropping out the eyes, or blurring part of the face, does not de-identify a photo. The image is still connected to that patient's record and that patient's identity the moment it's filed, texted, or posted next to their name — or even without a name, if the practice or the patient can be identified from context. Treat every treatment photo as PHI from the moment it's captured, not from the moment someone decides to use it publicly.
The Common Mistakes That Break Compliance
Most compliance gaps around patient photos come down to three habits, all of which are easy to fall into precisely because they're convenient.
Personal phones and cameras
A provider's own phone is the single most common place a before-and-after photo starts its life — and the least controlled. Once a photo lands in a personal camera roll, it inherits every backup, sharing setting, and screen-lock habit that phone already has, none of which were designed with PHI in mind.
iCloud and consumer cloud backup
Personal photos back up automatically to consumer cloud services by default on most phones. That's a feature for a vacation album and a liability for a patient photo, because consumer cloud storage isn't covered by a Business Associate Agreement. If the practice hasn't deliberately routed photos into a HIPAA-eligible system, they are very likely backing up somewhere that isn't.
Texting and email
Sending a photo to a colleague, a manager, or even between locations feels harmless — it's fast, and the intent is almost always clinical, not careless. But standard SMS and personal email are not encrypted to HIPAA's standard. RxPhoto's guidance on this is unambiguous: "emails are a big no-no" for PHI (rxphoto.com), and the same logic applies to a text message. Any electronic sharing of PHI needs to happen over an encrypted channel, full stop.
None of these habits come from carelessness about patients. They come from tools that were built for personal use being pressed into service for clinical work, because they're already open and already fast.
What Compliant Photo Handling Actually Looks Like
The fix isn't complicated, but it does require deliberately choosing tools built for this rather than defaulting to whatever's already on a provider's phone.
A compliant setup, in practice, means photos are captured directly into (or immediately uploaded to) a HIPAA-eligible platform rather than sitting in a personal camera roll — with mobile devices configured so photos don't persist locally once they've synced. It means any sharing of a photo, internally or with a patient, happens over an encrypted channel, not a text thread. It means a signed BAA is in place with every vendor whose product touches an identifiable patient photo, because that vendor is legally a business associate the moment it does. It means marketing use of any patient photo — a testimonial, a social post, a website gallery — requires specific written consent, separate from treatment consent, because obscuring a face is not the same as de-identifying a patient. And it means photos aren't kept indefinitely by default; a written retention and deletion policy governs how long they're held and what happens to them after.
Staff training closes the loop. Both the American Med Spa Association and RxPhoto note that basic HIPAA training runs in the range of $25 per employee through standard providers — a small, one-time cost against the risk of a team member not knowing why the "quick text" habit is a problem in the first place.
How AfterVue Sidesteps the Storage Question Entirely
Every recommendation above is about managing photos correctly once you have them. AfterVue's before/after preview app takes a different approach to the same problem: it minimizes what there is to manage.
A patient's photo is used to generate their preview and is never written to storage. There's no camera roll, no cloud backup, no photo sitting in a folder waiting to be handled correctly or incorrectly. The practice's consult app keeps a short summary of the visit — treatments a patient previewed, timestamps, a record of consent — but no photo is saved in that record. Photos are used for the preview only — never sold, never used to train AI — and the practice remains the covered entity throughout. Every preview is also clearly labeled as an illustrative simulation, not a clinical guarantee, which keeps the tool's purpose honest at the same time as it keeps the data footprint small.
This doesn't replace the checklist above — a practice still needs a compliant answer for its clinical documentation photos, taken by the provider as part of the medical record. But for the specific job of letting a curious patient see a possible result on their own face, before they've committed to anything, the safest photo is the one that never needed a place to live in the first place.
A Five-Minute Self-Audit
Run through this against your current process. Each row is a real, common failure point — not a hypothetical one.
| Check | Compliant practice | Risk if this is missing |
|---|---|---|
| Where photos land first | Uploaded directly into a HIPAA-eligible platform; not stored on a personal device | Personal camera roll becomes the unofficial system of record |
| Cloud backup | Deliberately routed to a BAA-covered cloud service | Consumer iCloud/Google Photos backup happens by default, with no BAA in place |
| Internal sharing | Encrypted, HIPAA-eligible messaging or platform | Text message or personal email between staff or locations |
| Vendor agreements | Signed BAA with every vendor that touches an identifiable photo | A photo, consult, or preview app in use with no BAA on file |
| Marketing use | Specific written consent, separate from treatment consent | Assuming blurring a face is enough, or reusing consent from intake |
| Retention | Written policy on how long photos are kept and when they're deleted | Photos kept indefinitely by default, with no policy at all |
| Staff training | Documented HIPAA training on photo handling specifically | General HIPAA training that never mentions photos or phones |
If more than one or two rows describe your current process in the right-hand column, that's not a reason to panic — it's a reason to fix the highest-risk one first, which is almost always internal texting, and work down the list from there.
Where This Leaves Your Practice
None of this requires an overhaul of how your practice does consults. It requires knowing which photos are clinical documentation that needs a compliant home, and which patient-facing moments — like showing someone a possible result before they've booked anything — can be designed to avoid the storage question altogether.
AfterVue is built around that second category: a patient takes a selfie, sees a photoreal, illustrative preview of a possible result, and is sent to your own booking link when they're ready — with no photo left behind to manage, retain, or worry about later. To see how that works on your own site or in your own consult room, book a live demo and bring your questions about how the photo handling and consent flow actually work.
Frequently Asked Questions
Are before-and-after photos considered protected health information (PHI) under HIPAA? Yes. According to the American Med Spa Association, before-and-after photos are PHI regardless of whether the patient paid with insurance, because the image is tied to a specific patient's identity and treatment record. Blurring or cropping a face doesn't change that classification — the photo is still linked to that patient's file.
Do medspas need a Business Associate Agreement (BAA) for a photo, consult, or preview app? If a vendor's app or platform handles identifiable patient photos or information on the practice's behalf, that vendor is a business associate under HIPAA and should sign a BAA with the practice before any patient data touches the product. The practice stays the covered entity either way; the BAA defines the vendor's safeguards and responsibilities.
Is it a HIPAA violation to text or email a patient's before-and-after photo? Standard SMS and personal email aren't encrypted to HIPAA's standard, so sending a patient photo that way creates real compliance risk. The American Med Spa Association and RxPhoto both flag email in particular — RxPhoto's guidance puts it bluntly: emails are a big no-no for PHI. Practices should route photos through encrypted, HIPAA-eligible channels instead.
Sources
- "5 Tips for Managing Patient Photos to Keep Your Medical Spa HIPAA Compliant." American Med Spa Association, July 25, 2019.
- "Keep Your Med Spa HIPAA Compliant with These 5 Tips on Managing Patient Photos." RxPhoto, March 19, 2024.