A before-and-after gallery is usually the most persuasive thing on a med spa website. It is also the single easiest place to create a compliance problem, because a patient photo is health information, a patient photo is an advertisement, and those two facts are governed by two different sets of rules. The short version: you need a signed, marketing-specific authorization before the photo goes online, and the way you present the result matters as much as the permission to use it.
The short answer
Before a single before-and-after image goes on your site, you want four things in hand. Most clinics have one or two of them and assume that covers it.
- A written authorization that specifically permits marketing use — not a general treatment consent, and not a line buried in your intake paperwork.
- A record of what the patient agreed to: which photos, which channels (website, Instagram, paid ads), and for how long.
- An honest framing of the result, so a prospective patient is not led to expect an outcome that is unusual.
- A disclosure if the patient received anything in exchange for the photo or the testimonial that came with it.
Why a before-and-after is protected health information
Clinicians sometimes assume a photo is only PHI if a name is attached. Under HIPAA it is the other way around. When the U.S. Department of Health and Human Services defined the Safe Harbor method for de-identifying health information, it listed eighteen identifiers that all have to be removed — and "full face photographic images and any comparable images" is one of them (45 CFR §164.514(b)(2)). A recognisable face is an identifier in its own right.
That matters because the image also reveals that the person received a specific treatment at your clinic. Identity plus treatment is exactly what PHI means. So a before-and-after of an identifiable patient is health information you are publishing to the open internet, which is why the permission has to be explicit rather than assumed.
Treatment consent is not marketing authorization
This is the most common gap we see. A clinic has a thorough consent form covering the procedure, risks and aftercare, and treats it as covering photography too. HIPAA handles marketing separately: using PHI for marketing generally requires a specific written authorization from the patient (45 CFR §164.508(a)(3)). A consent to be treated is not a consent to be advertised.
A workable authorization is specific about the things a patient would actually want to control:
- What is being used — clinical photos of a named treatment area, not "images" in the abstract.
- Where it will appear — your website, your Instagram, paid social, print. Listing channels individually is better than a catch-all, because "any medium" is the clause patients later say they did not understand.
- Whether the face is included, and whether the images may be cropped or not.
- How long the permission lasts, and that the patient may revoke it in writing.
- What happens on revocation — you stop future use, and you remove what you reasonably can, while being honest that a printed brochure already mailed cannot be recalled.
- That treatment is not conditioned on agreeing. A patient who says no still gets the same care.
Cropping the eyes is not de-identification
A black bar across the eyes feels like it solves the problem. It usually does not. Safe Harbor de-identification requires removing all eighteen identifiers, not making the person harder to recognise — and a cropped clinical photo often still carries plenty: a distinctive tattoo, jewellery, a visible scar, the treatment date in the file name, or a caption naming the town your single-location clinic serves.
There is also a practical point that has nothing to do with regulators. Cropped, anonymised photos convert worse. The reason a before-and-after persuades is that a real person is standing behind it. If your compliance answer is to strip the humanity out of the image, you have kept the legal risk of publishing clinical photos and thrown away most of the benefit. Getting a proper authorization and showing the full result is both safer and more effective.
“The clinics with the best galleries are not the ones with the loosest rules. They are the ones who ask properly, so they can show the whole result.”
The FTC rules most clinics miss
Permission covers whether you may publish the image. It says nothing about whether your presentation of it is honest — and that is the Federal Trade Commission's territory. The FTC's Endorsement Guides (16 CFR Part 255, substantially revised in 2023) apply to before-and-afters and testimonials on your own website, not only to paid advertising.
- Do not present an exceptional result as a representative one. If your gallery is your best twelve outcomes from four hundred treatments, a visitor reasonably reads it as what to expect.
- A vague disclaimer does not fix a misleading impression. The FTC has been explicit that boilerplate along the lines of "results not typical" is generally not enough to cure a claim that implies typical results. If you can describe the generally expected outcome, do that instead.
- Disclose material connections. If a patient received a free or discounted treatment, a gift card, or payment in exchange for the photo or the words next to it, that relationship has to be disclosed clearly and near the testimonial — not in a footer.
- Do not edit the result. Changed lighting, a different angle, retouching, or a smoothing filter on the "after" turns a truthful photo into a deceptive one.
- Keep your substantiation. If you say a treatment typically produces a given result, you should be able to show why you believe that.
Consistency helps you here. Same lighting, same angle, same distance, no makeup change between the two shots. It is better evidence, it is more persuasive, and it removes the argument that the improvement came from the photography.
What your state may add on top
HIPAA and the FTC are the floor, not the ceiling. Medical and nursing boards regulate advertising by their licensees, and the specifics genuinely differ from state to state — some address before-and-after imagery directly, some govern how a supervising physician must be identified, some restrict superlatives like "best" or "safest" in clinical advertising. Because a med spa is a medical practice in most states, those rules reach your website.
We are not going to guess at your state's language, and you should be sceptical of any web agency that does. The correct move is to read your own board's advertising rules once, and have your authorization form and gallery captions reviewed against them. It is a single afternoon that protects the licence the whole business runs on.
A pre-publish checklist
Before any new before-and-after goes live, walk this list. It takes about two minutes per image once the habit is set.
- Signed marketing authorization on file, covering this treatment area and this channel.
- The file name and any metadata carry no patient name, initials or date of birth.
- Before and after shot under matching lighting, angle and distance, with no retouching or filters.
- The caption describes the treatment and, where you can, the generally expected result — not just the best case.
- Any compensation or free treatment behind the photo is disclosed next to it.
- The image is logged against the patient so you can honour a revocation later.
Once that is in place, the gallery itself has to actually work — fast loading, filterable by treatment, with a booking path right next to the proof. We covered that side of it in our guide to building a med spa before-and-after gallery that books patients, and the wider handling of patient data in HIPAA-compliant med spa websites.
If you are not sure what is currently live on your own site — which images, with what captions, and whether anyone still has the paperwork — that is worth finding out before someone else does. Our free website audit includes a look at how your gallery is built and presented, and we can flag the obvious gaps in writing, with no call required.