Yes—many med spas are required to comply with HIPAA, but not all of them. It depends on how the med spa is organized and how it handles healthcare information.
Here are the key scenarios:
-
If the med spa is a HIPAA-covered entity (for example, it's a healthcare provider that electronically transmits health information for certain standard transactions, such as insurance billing), then it must comply with HIPAA. That means your protected health information (PHI) must be safeguarded, and you generally have rights to access, amend, and receive an accounting of certain disclosures of your records.
-
If the med spa is not a HIPAA-covered entity, HIPAA may not apply. This can happen if the business only offers cash-pay cosmetic services and does not engage in the types of electronic healthcare transactions that make it a covered entity. However, state privacy laws, consumer protection laws, professional licensing rules, or contractual privacy policies may still require it to protect your information.
What this means for your records
Regardless of HIPAA status, a med spa will typically keep records such as:
- Medical history and intake forms
- Consent forms
- Treatment notes
- Before-and-after photographs (if taken)
- Payment information
If HIPAA applies, you generally have the right to:
- Request a copy of your medical records.
- Ask for corrections to inaccurate information.
- Receive a notice describing the business's privacy practices.
How to tell if a med spa is HIPAA-covered
You can ask questions such as:
- Do you provide a HIPAA Notice of Privacy Practices?
- How do you protect my medical records?
- How can I request a copy of my records?
- Do you bill insurance or conduct electronic healthcare transactions that make you a HIPAA-covered provider?
If you're dealing with a specific med spa, I can help you determine whether it is likely subject to HIPAA based on how it operates or where it's located.
