HIPAA Compliance for Medical Spas and Aesthetic Practices

The HIPAA compliance and security operating system for medical spas. Providing a medical service does not settle your HIPAA status, and before-and-after photos on a personal phone are the exposure that surfaces first. Patient Protect documents where your entity actually lands, governs the photography workflow, and runs the risk analysis, agreements, training, and evidence from one place.

Get your Patient Protect Score — free

Providing a medical service does not, by itself, complete the HIPAA classification. Map the legal entity, clinical components, management company, prescribers, billing activity, and vendor roles; determine whether an adopted transaction is conducted or Business Associate work is performed. Covered operations must complete the duties below, while state medical and consumer-health privacy rules may govern the rest.

HIPAA compliance is not optional for a covered medical spa.

If your practice is a HIPAA covered entity, it is required to maintain an active, documented compliance program — and if it performs covered functions as a Business Associate, it must implement the Security Rule and every other duty attaching to that role. The responsibility does not transfer to your EHR, IT company, consultant, insurance carrier, or software provider. Those partners can support the work; your practice remains responsible for completing it.

Watching one training video is not a compliance program. Downloading a policy template is not a compliance program. Signing one BAA is not a compliance program. HIPAA requires your practice to implement, maintain, and document the complete operating system behind each of those activities.

Your practice is required to do all of the following

The duty

What it requires

Where it is written

01Conduct and document a Security Risk Analysis
Identify every place electronic protected health information enters, moves through, or leaves the practice. Assess the systems, devices, people, vendors, locations, workflows, threats, and vulnerabilities that could compromise that information.
45 CFR §164.308(a)(1)(ii)(A)
02Manage the risks the analysis uncovers
Turn identified risks into a documented remediation plan. Assign responsibility, prioritize the work, implement safeguards, and preserve evidence showing how the practice responded.
45 CFR §164.308(a)(1)(ii)(B)
03Designate Privacy and Security Officials
Assign and document who is responsible for developing, maintaining, and enforcing the practice's privacy and security program. In a small practice, one person may perform both roles — but the responsibilities must still be assigned and documented.
45 CFR §164.530(a) · §164.308(a)(2)
04Maintain written policies and procedures
Document how the practice protects patient information, controls access, handles permitted disclosures, responds to incidents, enforces workforce accountability, and maintains required privacy and security safeguards.
45 CFR §164.316(a) · §164.530(i)
05Train the entire workforce
Train workforce members on the privacy policies relevant to their roles and maintain an ongoing security-awareness program. Preserve records showing who was trained, what the training covered, and when it was completed.
45 CFR §164.530(b) · §164.308(a)(5)
06Identify and govern every Business Associate
Determine which vendors and service providers create, receive, maintain, or transmit protected health information on the practice's behalf. Execute the required Business Associate Agreement before protected information flows and maintain the agreement as part of the practice's compliance record.
45 CFR §164.502(e) · §164.308(b) · §164.504(e)
07Implement administrative, physical, and technical safeguards
Control who can access patient information, secure the systems and locations where it is maintained, review activity, authenticate users, protect data integrity, and safeguard electronic transmission.
45 CFR §164.308 · §164.310 · §164.312
08Protect patient privacy rights
Maintain the required notices, authorization processes, complaint procedures, and workflows for responding to patient requests involving access, amendments, confidential communications, restrictions, and applicable disclosure accounting.
45 CFR §164.520 · §164.524 · §164.526 · §164.522 · §164.528
09Prepare for incidents, outages, and breaches
Maintain security-incident procedures, data backup, disaster recovery, emergency operations, mitigation, and breach-notification processes before an event occurs.
45 CFR §164.308(a)(6) · §164.308(a)(7) · Subpart D
10Preserve proof that the work was completed
Retain the assessments, risk decisions, policies, training records, official designations, BAAs, acknowledgments, incident records, and other documentation needed to demonstrate what the practice actually did.
45 CFR §164.316(b) · §164.530(j)

The Security Risk Analysis is where the work begins.

The Security Rule requires an accurate, thorough assessment of the risks and vulnerabilities affecting every form of electronic protected health information your practice creates, receives, maintains, or transmits. This is commonly called a Security Risk Analysis, or SRA.

The federal government publishes its own Security Risk Assessment Tool for small and medium-sized practices. You are not required to use that particular tool. You are required to perform and document the underlying analysis.

Patient Protect provides its own guided SRA. It walks the practice through the assessment in plain language, identifies what is missing, and carries those findings into risk management, remediation, policies, tasks, and documentation — so the assessment ends with the problem assigned and resolved, not merely named.

A five-minute readiness quiz is not an SRA. Reviewing only your EHR is not an SRA. Reusing an old checklist that no longer reflects your systems, vendors, workforce, or workflows is not an SRA.

That includes our own free tool. The Patient Protect Score is a free exposure scan and a starting point. It is not your completed Security Risk Analysis, and we will not tell you it is.

What a medical spa’s Security Risk Analysis must cover

Calling an operation a spa, studio, or wellness business does not answer whether HIPAA and state medical-privacy laws apply. The practice must document its medical services, legal entities, electronic transactions, clinical recordkeeping, workforce, and data relationships. When HIPAA applies, the medical spa carries the full compliance obligation.

The EHR or practice-management system, scheduling, intake, consent, payment, and patient-communication platforms
Clinical consultations, injectables, prescription services, IV therapy, weight-loss, hormone, laser, and other medically directed services
Before-and-after photographs and videos from capture through upload, storage, access, treatment use, marketing use, retention, and deletion
Personal phones, tablets, cameras, shared devices, automatic cloud synchronization, and social-media workflows
Telehealth, e-prescribing, laboratory, pharmacy, medical-director, referral, and clinical-support relationships
Marketing agencies, social-media managers, website forms, advertising platforms, influencers, affiliates, analytics, and lead-generation systems receiving health-related information
Access across physicians, advanced-practice clinicians, nurses, aestheticians, technicians, front-desk staff, marketers, contractors, and vendors

What the medical-spa compliance program must also address

A documented determination of which legal entities and workflows are subject to HIPAA and which additional state privacy laws govern the remaining health data
Separate consent and authorization for clinical photography and marketing use
Approved devices, storage, access, and deletion procedures for patient images
BAAs with organizations functioning as Business Associates in the medical operation
Role-based access separating clinical, administrative, aesthetic, and marketing functions
State medical-board, supervision, consent, recordkeeping, consumer-health privacy, and breach-notification requirements
Training for every clinical and nonclinical role that can access or influence patient information

The aesthetic setting does not make medical records, treatment images, prescriptions, or patient health information less protected.

The honest answer to the question med spas most often misclassify.

Most vendor content gives a marketing-flavored hedge. The page below answers the question directly, with primary-source references where they exist. This is the section that matters most if you’re trying to figure out whether your operation is actually a covered entity.

Covered entity status

A med spa is a covered entity under 45 CFR §160.103 when it conducts one of the standard transactions adopted under 45 CFR Part 162 — or has one conducted on its behalf. Those transactions are a defined list: health care claims (837), eligibility inquiry and response (270/271), prior authorization and referral certification (278), claim status (276/277), payment and remittance advice (835), enrollment, premium payment, coordination of benefits, and retail pharmacy drug claims under the NCPDP Telecommunication Standard. Ordinary prescriber-to-pharmacy e-prescribing under NCPDP SCRIPT is not on that list. The practical consequence runs opposite to how this is usually described: a medical director prescribing electronically, a referral to a dermatologist through the EHR, and an electronic lab order for pre-procedure bloodwork are not, individually, covered-entity-establishing events. What does establish coverage is billing — an electronic claim, eligibility check, or remittance for any service line — or performing covered work as a Business Associate for another entity. Providing a medical service does not complete the classification on its own, and neither does avoiding insurance. Map the legal entity and run the transaction test.

Business associate status

A med spa is usually the provider rather than the Business Associate, though a management company or an entity operating part of another practice's workflow can be a Business Associate and should classify itself accordingly. Running the question the standard direction: the EHR or practice management system, e-prescribing service, lab interface, payment processor where PHI flows, secure messaging tool, telehealth platform, and photo storage system generally perform functions on the practice's behalf, which makes them Business Associates requiring agreements under §164.308(b)(1). Labs and pharmacies acting as treating providers are the common exception. Photo storage held in an unmanaged personal account, with no agreement at all, is the routine gap.

Where the gray zone lives

The med spa applicability question is genuinely contested for non-prescribing operations. A pure aesthetic practice with no medical director, no prescribing, no medical procedures, and no medical records is arguably outside HIPAA. The moment any of those conditions changes — a medical director joins, an injectable becomes part of the menu, photos are stored as treatment records, a lab order is placed — the compliance analysis flips. Most med spas operate above this line and have for years; many continue to behave as if HIPAA does not apply. The American Med Spa Association's endorsed compliance vendor (Compliancy Group) has historically not pushed hard on this analysis, leaving operators with a documentation-flavored compliance program that may not survive audit if the medical-component reality is examined.

State consumer-health law

State medical board rules layer heavily on med spa operations: which procedures require a medical director, what supervision is required for non-physician staff (RNs, PAs, NPs, aestheticians), what consent forms are required for specific procedures (laser, injectables, IV therapy), what record-keeping is required. State consumer-health privacy laws (Washington MHMDA, Nevada CHPA, Connecticut DPA, California CMIA/CPRA) apply to before/after photo storage and treatment records regardless of HIPAA status. Some states have explicit med-spa-targeted regulation; most regulate through general medical practice rules applied to the medical components of spa operations.

Operational events that move a medical spa from theoretical non-coverage into clearly-covered-entity territory.

Submitting an electronic health care claim for any service line (837), or having a billing service do it for the entity.
Conducting electronic eligibility or benefit verification against a health plan (270/271).
Requesting prior authorization electronically (278), or checking claim status (276/277).
Receiving electronic remittance advice (835) — common once a med spa adds an insurance-billed dermatology, hormone, or weight-loss line.
Performing a covered function as a Business Associate for a covered entity, such as operating part of another practice's workflow.
Restructuring so that a covered clinical entity and a non-covered retail entity share one legal entity, which raises the formal hybrid-entity designation question under §164.105.

What does not, by itself, make you a covered entity: sending an electronic prescription, submitting an electronic lab order, receiving an HL7 or FHIR result, running a patient portal, making an ordinary electronic referral, storing treatment photographs, hiring a medical director, or performing a medical service. None of these appear on CMS’s list of adopted standard transactions. They may still carry real security and state-law obligations — they just are not what decides HIPAA covered-entity status.

OCR has not published large-scale med-spa-specific enforcement actions, but FTC has been increasingly active in adjacent consumer-health and health-data territory, and state medical boards have driven the bulk of enforcement against med spas operating without proper medical-component oversight. The HIPAA enforcement gap reflects segment newness and operator obscurity rather than regulatory tolerance — when the first case lands it is likely to be against an operator with no compliance program documenting the medical-component analysis.

OCR enforcement record observation

Not legal advice. This page summarizes how HIPAA and related state consumer-health privacy laws apply to medical spas and aesthetic practices based on Patient Protect’s reading of the relevant CFR provisions and state statutes. Operators with applicability questions specific to their setup should consult a qualified HIPAA attorney. Patient Protect is a HIPAA compliance platform; we are not a law firm and do not provide legal advice.

Where medical spas and aesthetic practices are most exposed.

The 'we're a wellness business, not a medical practice' misclassification

Med spas commonly operate under wellness-business mental models and treat HIPAA as not applicable. The 45 CFR §160.103 covered-entity test does not turn on whether a medical director is on staff, whether injectables are on the menu, whether prescribing happens, or whether treatment records are stored. The test is whether the practice (or a service acting on its behalf) conducts a HIPAA standard transaction adopted under 45 CFR Part 162 — most commonly an 837 claim, 270/271 eligibility check, or 835 remittance. That is how classification is decided, and it decides differently for different service lines. State medical board rules, state consumer-health privacy laws (WA MHMDA, NV CHPA, CT DPA, CA CMIA/CPRA), FTC enforcement, and vendor recordkeeping obligations apply regardless of HIPAA status — so 'not a covered entity' does not mean 'not regulated.'

Before/after photos stored on consumer platforms

Before/after photos are part of the treatment record when they document patient response to medical procedures. Most med spas keep them in personal cloud accounts and staff camera rolls — no BAA, no configuration, no audit trail, and no way to revoke access when someone leaves. That is the highest-frequency exposure in the segment and the one most likely to surface in any incident response. The fix is not avoiding a brand name; it is moving images onto storage the practice actually governs.

Long-tail vendor BAAs missing across the med-spa-specific ecosystem

Beyond standard EHR/billing/lab BAAs, med spas have a long tail of partners that touch PHI: photo storage platforms, IV therapy suppliers when bundled, weight-loss compounding pharmacies when bundled, telehealth platforms for consultations, specialty laser equipment vendors with cloud-connected analytics. Each is a BA; most operators have unsigned templates or no BAA at all.

Hybrid-entity status is a formal designation, not a description of your service menu

A single legal entity that performs both covered and non-covered functions may designate itself a hybrid entity under §164.105 — but the designation is a formal act, not an assertion. The entity must document which of its components are health care components, and those designated components then carry the full HIPAA obligation, including safeguards against the non-designated side of the business. Operators who never make the designation, or who make it without documenting the components, cannot defend the boundary and are treated as covered throughout.

Built for medical spas and aesthetic practices, not hospital systems.

Hybrid-status analysis modeled for med-spa operations

Patient Protect's policy generation produces the §164.105 documentation a hybrid designation actually requires: the designation itself, which components are designated as health care components, and how the boundary is maintained operationally. The version most operators default to — asserting a boundary that was never formally designated — is the version that fails under scrutiny.

Photo storage compliance with BAA-covered infrastructure

The platform handles before/after photo storage on HIPAA-compliant infrastructure with audit logging, role-based access, and patient-by-patient retention controls. Replaces the Dropbox/iCloud pattern that creates the highest-frequency compliance gap in this segment.

BAA tracking for the med-spa-specific vendor ecosystem

Vendor Risk Scanner pre-loads the long-tail med-spa partner ecosystem: photo storage, IV therapy suppliers, weight-loss compounding pharmacies, specialty laser equipment vendors with cloud analytics, telehealth consultation platforms. Surfaces the BAA gaps generic vendors miss because they don't model the med-spa hybrid operating pattern.

State medical board and consumer-health law overlay

Policy generation reflects state-specific rules on medical-component supervision, procedure consent forms, record-keeping requirements, and the consumer-health privacy law layer (WA MHMDA, NV CHPA, CT DPA, CA CMIA/CPRA). Updated per operating jurisdiction as state rules evolve.

Patient consent and intake calibrated for hybrid operations

Consent flows that distinguish medical-component services from pure aesthetic services with appropriate disclosures for each. HIPAA Notice of Privacy Practices covering medical operations, separate consent infrastructure for non-PHI aesthetic services, photo-storage authorization separate from general treatment consent.

Continuous compliance scoring with med-spa overlay

Real-time compliance state as the service menu evolves — adding injectables, weight-loss services, IV therapy, hormone services each changes the compliance surface. The platform tracks the changes and updates risk and policy state rather than requiring an annual reset.

HIPAA already requires the work. Patient Protect starts at $39 a month.

For a covered practice, HIPAA does not ask whether the organization has the budget, internal expertise, or spare time to build a compliance program. The obligation already exists. The only real question is whether you run it through spreadsheets, generic templates, disconnected training and scattered agreements — or keep the whole program in one place.

Guided Security Risk Analysis
Risk-management and remediation workflows
48 customizable policies and procedures
HIPAA Foundations workforce training
Completion tracking and verifiable training certificates
Workforce and vendor management
Business Associate Agreement tracking and documentation
Compliance scoring and centralized audit evidence

Start your 14-day free trial

$39 per office per month · Up to 25personnel · No long-term contract

State-specific HIPAA rules for medical spas and aesthetic practices.

HIPAA is federal. What a state adds on top of it varies more than most compliance guidance admits — some states impose their own notification deadline and regulator notice, and others exclude HIPAA covered entities from their breach statute entirely. Select your state to see which of those is true where you practice.

Select your state

Browse all 50 states and DC

Each jurisdiction sets its own notification window, regulator threshold, and adjacent privacy rules — and its own answer to whether those reach a HIPAA covered entity at all. Open a state page for the medical spas reference summary.

What happens after the paperwork is done.

Every major compliance platform covers risk assessments and policy templates. This is the part that differs.

What to ask

Patient Protect

Risk analysis structured to §164.308(a)(1)(ii)(A)

A readiness quiz is not a risk analysis.

Full SRA wizard mapped to NIST CSF with live scoring

Auto-generated policies with workforce acknowledgment

HIPAA requires documented proof your staff reviewed them.

48 policies from your risk profile, versioned acknowledgment

Staff training with delivery tracking

§164.308(a)(5) — sending a PDF is not sufficient.

HIPAA Foundations — 19 modules, 95 assessment questions, verifiable certificates

Full BAA lifecycle management

Expired BAAs are a top enforcement target.

E-signature, renewal alerts, Vendor Risk Scanner

Yes on all 9. Now run the checklist on the rest.

From $39/mo · No long-term contracts.

Start free trial See pricing

Enterprise-grade compliance. Independent-practice pricing.

No contracts · No setup fees · Cancel anytime

Basic

$39/mo

Risk assessments, policies, BAA management, training, compliance scoring, secure messaging, and standard PIPAA usage.

Start 14-day free trial

Recommended

Pro

$99/mo

Everything in Basic, plus the patient-facing workflows. Patient Management and Digital Forms, expanded PIPAA usage, and up to 50 personnel.

Start 14-day free trial

See full feature comparison →

Common questions about HIPAA compliance for medical spas and aesthetic practices.

Does HIPAA apply to a med spa that doesn't bill insurance?

The HIPAA covered-entity test at 45 CFR §160.103 turns on whether the practice (or a service acting on its behalf) conducts a HIPAA standard transaction adopted under 45 CFR Part 162 — most commonly an 837 health care claim, 270/271 eligibility, or 835 remittance. Having a medical director, offering injectables, prescribing electronically, ordering labs, or storing treatment photos does not, individually, establish covered-entity status. Cash-pay status does not settle the question in either direction. What most often pulls a med spa in is one insurance-billed service line, a billing/membership vendor transacting on the practice's behalf, or performing covered work as a Business Associate for another entity. Even where HIPAA does not apply, state consumer-health privacy laws (WA MHMDA, NV CHPA, CT DPA, CA CMIA/CPRA), state medical board rules, FTC Health Breach Notification Rule enforcement, and vendor recordkeeping obligations still impose substantial exposure. Run the transaction test for the legal entity and document the conclusion.

Are before/after photos PHI?

When stored as part of a treatment record documenting patient response to a medical procedure (injectables, laser treatment, fillers, weight-loss progress with hormone or GLP-1 therapy), yes. Photos linked to patient identity and treatment are ePHI and require storage covered by a BAA, encrypted, access-controlled, and audit-logged. A personal Dropbox, Google Drive, or iCloud account, or a staff member's device, fails that test — not because of the brand, but because there is no agreement, no configuration, and no control. The same vendor's business offering under a BAA, configured correctly, is a different matter.

Can our med spa be a hybrid entity — covered for some operations, not for others?

Possibly — but not by simply declaring it. Section 164.105 permits a single legal entity that performs both covered and non-covered functions to designate itself a hybrid entity. The designation is formal: the entity must document which of its components are health care components, and those components then carry the full HIPAA obligation, including safeguards against the rest of the business. It is not a matter of asserting that the medical services are covered and the aesthetic services are not. And if the clinical operation sits in a separate legal entity, hybrid designation is not the right analysis at all — that entity's own transaction status decides its coverage. Without a documented designation, there is no boundary to defend.

Do we need a BAA with our photo storage platform?

Yes, if photos are linked to patient identity and treatment. Photo storage providers receiving ePHI on the practice's behalf are business associates under §160.103 and require a written BAA. This is one of the most commonly missed BAAs in the med-spa segment because consumer cloud storage is the default pattern. Compliant photo storage requires either a HIPAA-tier subscription on a major cloud platform with a BAA or a purpose-built clinical photo platform.

Our med spa offers GLP-1 weight loss and IV therapy — does that change our HIPAA status?

Yes — meaningfully. Adding GLP-1 weight loss adds e-prescribing, compounding pharmacy partnerships, and lab orders to the operation; each is a covered transaction or PHI flow that establishes CE status. Adding IV therapy adds prescribing, administration records, and supplier relationships. Either addition pushes a previously-ambiguous med spa firmly into CE territory and adds significant BAA, risk-analysis, and training requirements.

How should we evaluate HIPAA compliance vendors for a med spa?

Start from your own threat model rather than from a brand or an endorsement. A med spa's highest-frequency exposures are clinical photography stored outside the practice's control, social engineering aimed at patient financial information, and vendor relationships that were never classified. Ask any vendor you evaluate the same four questions: does it produce a documented Security Risk Analysis and the remediation record behind it, does it govern the photography workflow specifically, does it track which vendors are Business Associates and hold the agreements, and does it preserve the evidence you would need to show what you actually did? A documentation package is a necessary foundation. The question worth asking is whether it is the whole program for your operation.

What state laws apply to med spas beyond HIPAA?

State medical board rules govern medical-component supervision (which procedures require a medical director, what supervision RNs/PAs/NPs/aestheticians require) and procedure-specific consent and record-keeping requirements. State consumer-health privacy laws (Washington MHMDA, Nevada CHPA, Connecticut DPA, California CMIA/CPRA) apply to before/after photos and treatment records regardless of HIPAA status. Multi-state med spa operators face a state-by-state matrix.

Does a medical spa have to complete a HIPAA Security Risk Analysis?

Where the entity is covered, yes — and that determination has to be made and documented first, because providing a medical service does not by itself complete the classification. Where HIPAA applies, the med spa must conduct and document an accurate, thorough assessment of the risks affecting all its ePHI: the EHR or practice-management system, scheduling, intake and consent, clinical consultation and prescribing records, before-and-after photographs from capture through deletion, personal phones and shared devices with automatic cloud sync, telehealth and laboratory workflows, and the marketing, advertising, and lead-generation systems receiving health-related information. Where HIPAA does not apply, state medical-privacy and consumer-health law still governs the same records.

Which of our med spa vendors need Business Associate Agreements?

Any organization performing a function involving PHI on the covered entity's behalf: the EHR or practice-management system, scheduling and intake tools, photo storage and photo-management platforms, telehealth platform, secure messaging, payment processors where PHI flows, cloud backup, IT support, and any marketing agency, web form, analytics, or lead-generation vendor receiving identifiable health information. That last group is the one most often missed, because marketing vendors are not thought of as handling patient data until someone traces where the intake form posts. Laboratories running pre-procedure bloodwork and pharmacies dispensing to patients are generally treating providers rather than business associates.

Our medical director is an independent contractor. Does that change who holds the compliance obligation?

It changes who the workforce is, not whether the obligation exists. HIPAA's definition of workforce reaches people whose conduct is under the direct control of the entity whether or not they are paid by it, so a contracted medical director performing supervised clinical work is generally inside the workforce for training, sanction, and access purposes rather than being a business associate. What the arrangement does not do is move the obligation off the entity. If the med spa's legal entity is covered, it owns the risk analysis, the policies, the training records, and the breach response regardless of how the physician is engaged. Practices sometimes assume the medical director's own credentials or malpractice coverage carry the compliance program with them. They do not.

Is the government's Security Risk Assessment Tool mandatory?

No. The government's SRA Tool is one method designed to help small and medium-sized organizations perform the required analysis. HIPAA requires the underlying risk analysis — not the use of one particular tool. Patient Protect provides its own guided SRA and connects the findings directly to remediation, policies, tasks, and documentation.

Does our EHR make the practice HIPAA compliant?

No. An EHR may provide important safeguards for the records it maintains, but it does not conduct the practice's complete SRA, remediate every identified risk, train the workforce, manage all policies, identify every Business Associate, prepare the practice for incidents, or preserve the full body of compliance evidence.

How much does Patient Protect cost for a medical spa?

Patient Protect Basic costs $39 per office per month and includes up to 25 personnel. It includes the guided Security Risk Analysis, risk management, policies, workforce training, workforce and vendor management, BAA tracking, compliance scoring, and centralized documentation needed to operate the practice's core HIPAA compliance program.

See all FAQs →

Corrections & Updates

Healthcare security data changes as investigations progress, vendors update systems, and laws and guidance evolve. If you see something outdated, incomplete, or incorrect — or have newer source material — we’d appreciate hearing from you.

Submit a correction →

“

Patient Protect is intuitive, proactive, and affordable — exactly what small clinics like ours need to keep patient data safe and stay on the right side of HIPAA.

Dr. Thomas E Murray, D.D.S.Patient Protect Member Since 2017

Also built for

Dentists Therapists Chiropractors Optometrists Physical Therapists Medical Practices Telehealth Dermatology Pediatrics Psychiatry Urgent Care DPC Practices GLP-1 Clinics HRT / TRT Clinics Concierge Practices

Compliance built for the medical-component reality of modern med spa operations.

$39/month for Basic, $99/month for Pro. Hybrid-status documentation, photo-storage compliance, long-tail BAA tracking, state law overlay. Free 14-day trial.

Get your Patient Protect Score — free See pricing

Or explore the full HIPAA compliance software comparison — or all HIPAA compliance solutions