Consent, Privacy and Recording Rules for Virtual Skin Consultations

Clients share photos of their face, medications and health history with you. Treat that information with the same care a clinic would. It protects your clients, and it protects your business.

Does HIPAA apply to estheticians?

HIPAA applies to "covered entities": health plans, healthcare clearinghouses and healthcare providers that send health information electronically in standard transactions such as insurance billing. Most independent estheticians who don't bill insurance aren't covered entities. Medical spas that provide medical treatments often are. Even when HIPAA doesn't apply, follow its spirit: collect only what you need, store it securely and never share it without permission.

State health-data privacy laws

Some states now protect "consumer health data" outside HIPAA. Washington's My Health My Data Act is the broadest. It covers businesses that collect health-related data from Washington consumers, and law firms have flagged beauty businesses that collect information about skin conditions, allergies and sensitivities as potentially in scope. It requires consent before collecting that data and a consumer health data privacy policy, and it lets consumers sue. If you serve clients in Washington, review it with a lawyer.

What your consent form should cover

• The service is educational skincare guidance, not medical diagnosis or treatment
• The limits of assessing skin on video
• The client agrees to provide accurate health and medication information
• How photos and notes are stored, who can see them and how long you keep them
• Whether sessions are recorded
• Payment, cancellation and no-show policies
• When you'll refer them to a physician

Recording sessions

Several states require every party's consent to record a conversation, including California, Florida, Illinois, Maryland, Michigan, New Hampshire, Pennsylvania and Washington. The simplest policy is: don't record. If you do, get clear consent in writing and say so out loud at the start of the call.

Photo best practices

• Ask permission before saving screenshots or client photos
• Get separate written permission before using any photo in marketing
• Store photos in your booking or client-record system, not your phone's camera roll
• Delete what you no longer need

Frequently asked questions

Do I need a HIPAA-compliant video platform?

If you're not a covered entity, HIPAA doesn't require it. A secure platform with access controls is still the professional standard, and it's required for many medical spas.

Can I post a client's before-and-after photos?

Only with the client's specific written permission for marketing use. Consent for a consultation is not consent for advertising.

This guide is general education, not legal advice. Esthetics rules are set state by state and change. Check with your state board of cosmetology or esthetics, and a licensed attorney, before making decisions for your business.

Get started on The Providers HQ

The Providers HQ is the free, verified home base for licensed estheticians and beauty pros: community, treatment rooms, jobs and gigs, education and paid virtual consultations in one place. Join free and upgrade to a Virtual Esthetician plan when you're ready to take paid video consultations.