Instagram and TikTok Rules for Med Spas: Before and After Photos, Patient Consent, and HIPAA

The short answer: med spas can post before and after photos and patient stories on Instagram, and in more limited ways on TikTok, but only with the patient's signed, written authorization, accurate images, and captions that make clear results vary. If you are a HIPAA covered entity, HHS says you generally need a patient's written authorization before using their information in marketing, and that includes social media. Boosted posts must also follow Meta's ad rules, such as targeting adults 18 and older for cosmetic procedures, and TikTok's guidelines limit marketing of needle-based treatments to eligible verified business accounts and bar paid creator content for cosmetic clinics. Build a consent process, a review step, and a privacy-safe reply policy, and your feed can stay both compliant and effective.

Social media is where many patients first meet your med spa, so it is also where most compliance questions come up. This guide covers the rules owners ask me about most. It is general information, not legal advice, so confirm your final policies with your counsel and medical director.

The three rulebooks that apply to your feed

Every med spa post is shaped by three sets of rules at once:

1. Privacy law. HIPAA, if your practice is a covered entity, plus any state privacy laws.
2. Advertising law. The FTC's rules on endorsements, testimonials, and reviews.
3. Platform rules. Meta's and TikTok's community guidelines, ad policies, and branded content policies.

A post can satisfy one and still break another, so check all three.

HIPAA: authorization comes first

HHS explains that, with limited exceptions, the HIPAA Privacy Rule requires an individual's written authorization before their protected health information is used or disclosed for marketing (HHS). A patient's photo next to a treatment name is health information about that person.

HHS has enforced this on testimonials. A Los Angeles physical therapy practice paid $25,000 and agreed to a corrective action plan after posting patient testimonials with full names and full-face photos on its website without valid HIPAA authorizations. In announcing it, OCR said covered entities need authorization policies and a valid authorization form, "including for posting on a website and/or social media pages" (HHS).

What a valid authorization includes

The federal rule lists core elements a valid authorization must contain, including a specific description of the information to be used, who may use it and receive it, the purpose, an expiration date or event, and the patient's signature and date (45 CFR 164.508). HHS also says the authorization must be in plain language (HHS).

For a med spa, a practical photo and testimonial authorization usually spells out:

• Exactly which photos, videos, or quotes you will use.
• Where they may appear: your website, Instagram, TikTok, Facebook, paid ads, or print.
• Whether the patient's face, name, or tagged account will be shown.
• How long the permission lasts and how to revoke it.

Keep signed forms on file and link each one to the content it covers.

Comments and DMs count too

Never confirm in a public comment that someone is your patient, and never discuss their treatment in public, even if they posted about it first. HHS settled with a dental practice that disclosed patient information while replying to online reviews; it paid $23,000 and agreed to a corrective action plan (HHS). Move clinical questions to a private, appropriate channel handled by your team.

Before and after photos: how to post them responsibly

Before and after images are some of the most persuasive content a med spa has, and also the most sensitive. A responsible standard:

• Authorization first. Signed and specific, as above.
• Honest images. Same lighting, angle, and framing. No filters or retouching on the treated area.
• Context in the caption. Name the treatment, note that it was performed by a licensed provider, and say that individual results vary.
• No promises. Avoid "guaranteed," "permanent," or timelines that imply everyone gets the same result.
• Respectful framing. Do not describe the "before" as a flaw to be fixed.

Meta: organic posts vs boosted posts

Organic posts on Instagram and Facebook follow Meta's Community Standards. The moment you boost a post or run it as an ad, Meta's advertising standards apply too.

• Age targeting. Meta's health and wellness policy restricts ads promoting cosmetic procedures from targeting people under 18. Its list of cosmetic procedures includes injectable treatments, dermal fillers, chemical peels, microneedling, and laser treatments (Meta).
• No attacks on appearance. The same policy bars ads with negative statements that attack a person's appearance, body parts, or hygiene (Meta).
• No implied personal attributes. Meta does not allow ads that assert or imply a viewer's physical or mental health, including medical conditions (Meta). "Tired of your wrinkles?" is the classic mistake. "Meet our injectors" is safer.
• Prescription drugs. Ads promoting prescription drugs must meet specific requirements under Meta's Drugs and Pharmaceuticals policy (Meta).

For a deeper look at paid rules, see Meta's 2026 ad rules for med spas.

Want a second set of eyes on your feed? On a free 30-minute strategy call, I will review your recent posts, your consent process, and your reply habits, and point out anything that could get flagged. Book your call here.

TikTok: stricter in some places

TikTok's rules for medical aesthetics are worth reading closely, because in some areas they are tighter than Meta's.

• Marketing treatments that use needles. TikTok's Community Guidelines define invasive cosmetic procedures as procedures or treatments that involve cutting the skin or using needles to modify appearance, and list marketing or providing access to them as not allowed. The exception: in some regions, verified business accounts that meet TikTok's eligibility standards may market invasive cosmetic procedures and restricted medical services (TikTok). Injectables fall squarely in this category, so confirm your account's eligibility before promoting them.
• Cosmetic surgery content. The guidelines make content that shows or promotes invasive cosmetic surgery, or talks about cosmetic surgery without explaining the risks, ineligible for the For You feed and age-restricted (TikTok).
• Paid creator content. TikTok's Branded Content Policy says creators must not post branded content that promotes or reviews products or services from prohibited industries. That list includes medical institutions and treatments, and cosmetic clinics, including laser hair removal services (TikTok). Before you pay a creator to promote your med spa on TikTok, read the current policy.
• Disclosure. When creators post branded content, TikTok requires them to turn on the commercial content disclosure toggle (TikTok).

A safer approach for most med spas is to use TikTok for education, provider personality, skin care tips, and behind-the-scenes content, and keep treatment promotion and clinical imagery for channels where the rules allow it and you control the context, like your website.

Creator, influencer, and staff posts

If you give anyone free or discounted treatments, payment, or other perks in exchange for content, the FTC's Endorsement Guides apply. They say a material connection that the audience would not expect, including free or discounted products, must be disclosed clearly and conspicuously (16 CFR 255.5). They also say endorsements must reflect the endorser's honest experience, and that advertisers can be liable for misleading endorsements (16 CFR 255.1).

On Instagram, Meta's branded content policies require creators to use the paid partnership label and tag the brand (Instagram). Staff posts about your med spa should also disclose that they work there.

A simple compliance workflow for med spa social

1. Consent at intake. Offer the photo and testimonial authorization separately from treatment consent, and never make treatment depend on signing it.
2. Content log. Track every patient image with its signed form and permitted uses.
3. Review step. Your medical director reviews clinical claims and patient content before it is published.
4. Boost check. Re-check anything you plan to boost against current ad policies.
5. Reply policy. A written guide for comments and DMs that keeps patient details private.
6. Quarterly refresh. Platforms update policies often, so review your rules every quarter.

For the bigger picture, see what compliance-safe med spa marketing looks like and what med spas should post on social media.

How AC Partners helps

AC Partners is a Miami marketing and PR agency specializing in beauty, wellness, and medical aesthetics brands. Our social media management for med spas and beauty brands is built around this kind of workflow: consent tracking, a review step for clinical content, platform-specific checks before anything is boosted, and community management that keeps patient details private. We work with med spas in Miami, New York City, Chicago, and nationwide.

Book a call with AC Partners

If you want a social presence that builds trust without creating risk, let's talk. Book a free 30-minute strategy call, or email laurenbarrett@ardormarketing.com.

FAQ