HIPAA Email Med Spas: Secure Websites & Email for Med Spa Practices

Whether HIPAA applies to you at all is the first question, not the last

A med spa is not automatically a HIPAA covered entity. The rule generally reaches providers who transmit certain transactions electronically — typically insurance claims. A purely cash-pay aesthetic practice may fall outside it, while one with a medical director billing any insurance, or one performing services that generate medical records, may well fall inside. The answer is specific to how your practice is set up, and it is worth getting from counsel rather than assuming either way.

It also matters less than people expect, because the information you hold is sensitive regardless of which statute names it. Before-and-after photographs, treatment histories, consent forms, consultation notes about a client’s body: state law, consumer protection rules and plain client expectation all apply even where HIPAA does not. Deciding to handle it to the higher standard is simpler than working out exactly where the line falls.

Photographs deserve their own policy, because they are the thing most likely to cause a problem. Where they are stored, who can see them, whether consent to treat is separate from consent to publish, and what happens when a client withdraws that consent after you have used an image in advertising. Get consent in writing and keep the two permissions apart.

On the systems: mailboxes on your own domain, multi-factor authentication everywhere, a tested backup, and — if you do turn out to be a covered entity — a signed Business Associate Agreement with anyone touching client information. Ask for the BAA up front; a provider who hesitates has answered a different question.