Med spa advertising is governed by three regulators at once: the FTC, the FDA, and your state medical board. HIPAA is the one owners name first, and it is often the one that does not apply. Whether HIPAA binds your clinic depends on how you bill, not on the fact that you handle medical information.
This is general information for marketers, not legal advice. Have a Florida health care attorney review your ads before they run.
Who actually regulates med spa advertising?
Four bodies, and they cover different ground. Most clinics prepare for one and get caught by another.
| Rule or regulator | What it covers | Applies to your clinic when |
|---|---|---|
| FTC Act, Section 5 | Truthful advertising, substantiated claims | Always |
| FTC Endorsement Guides (16 CFR Part 255) and Reviews Rule (16 CFR Part 465) | Testimonials, reviews, influencer posts | Always |
| HIPAA Privacy Rule | Use and disclosure of patient information | Only if you are a covered entity |
| FDA | How prescription drugs and regulated devices are promoted | Any ad naming injectables or energy devices |
| State medical board (Florida: Fla. Stat. 456.062) | Practitioner ads, credentials, who performs what | Always, in your state of operation |
Does HIPAA actually apply to your med spa?
Only if your clinic is a HIPAA covered entity, and a lot of cash-pay med spas are not. A covered entity is a health plan, a health care clearinghouse, or a provider who transmits health information electronically in connection with a HIPAA covered transaction. Billing insurance is the usual trigger.
A purely cash-pay aesthetic practice that never submits an electronic claim often sits outside HIPAA. The moment you bill any insurance, or your billing service does it on your behalf, you are in. Clinics with a physician medical director performing covered medical services are usually in as well.
That does not make privacy optional for everyone else. State privacy law still applies, the FTC still polices unfair practices, and a privacy complaint damages a clinic’s reputation whether or not the acronym fits.
The trap that catches clinics is the review reply. If HIPAA applies to you, confirming in a public reply that someone was a patient is itself a disclosure, before you say anything about their treatment. Federal regulators have settled cases with providers who argued back at reviewers in detail. The safe reply confirms nothing, discloses nothing, and moves the conversation offline. We covered the wording of those replies in our guide to responding to bad reviews.
What do the FTC rules say about reviews and testimonials?
You can use real testimonials from real patients, but you cannot buy them, script them, filter out the negative ones, or imply a result the average patient will not get.
The Endorsement Guides require that an endorsement reflect the honest opinion of the endorser, and that any material connection be disclosed clearly and conspicuously. A comped syringe of filler in exchange for a post is a material connection. So is a staff discount, a gift card, or an ongoing ambassador arrangement.
The FTC’s Rule on the Use of Consumer Reviews and Testimonials took effect in October 2024 and sharpened the teeth. It prohibits fake and AI-generated reviews, buying positive or negative reviews, undisclosed reviews written by employees, owners, or their relatives, and review suppression through legal threats. Violations can carry civil penalties, and the amounts adjust annually for inflation.
One more point that surprises people: a “results may vary” line does not rescue an ad built around an unrepresentative outcome. If a result is not what a typical patient gets, a generic disclaimer at the bottom of the page does not fix the claim at the top.
Can med spas still run before-and-after photos?
Yes, with conditions, and the conditions are where clinics slip.
- Get written authorization for marketing use. Where HIPAA applies, marketing use of patient information requires a specific authorization. Even outside HIPAA, use a signed photo release that names the channels the images may appear on.
- Keep the pair honest. Same lighting, same angle, same distance, same makeup, no retouching. Changing the lighting between the two shots is a claim, and a false one.
- Disclose what shaped the result. Number of sessions, treatments combined, time elapsed, and whether the person is a staff member.
- Do not present an outlier as the expected outcome.
- Keep consent on file and honor withdrawals promptly. Patients can change their mind, and a stale release is not a defense.
What can you say about Botox and fillers in an ad?
You can name the product you actually use, but you cannot promote it for uses the FDA has not cleared, and you cannot make the treatment sound risk-free.
Neurotoxins are prescription drugs. Dermal fillers are regulated devices. A provider may use a product off-label in clinical practice, but advertising it for an off-label indication is a separate question with real exposure. Brand names also carry manufacturer trademark requirements and, where co-op dollars are involved, contract terms that dictate how the mark appears.
Watch the vocabulary. “FDA-approved” and “FDA-cleared” mean different things and are not interchangeable. “No downtime, no risk” is the phrasing that draws letters.
What extra advertising rules apply to Florida med spas?
Florida regulates practitioner advertising directly under Fla. Stat. 456.062, and the Board of Medicine layers on rules about deceptive ads and scope of practice.
The statute requires that ads by health care practitioners not be fraudulent, false, deceptive, or misleading, and that the licensed practitioner be identified. Claiming a specialty or a board certification you do not hold from a recognized board is its own violation.
Scope of practice is the Florida-specific trap worth flagging. If your ad implies a physician performs the treatment, and an aesthetician or nurse actually performs it, that gap is a problem regardless of how good the result is.
Orlando is a dense med spa market, which pushes clinics toward comparison claims to stand out. “Best in Orlando” needs substantiation the same as any other claim. There are cleaner ways to differentiate, and we walk through several in our list of med spa marketing ideas. Compliance and positioning are the same problem viewed from two angles, which is why our healthcare and medical marketing work starts with what you are permitted to say.
Which mistakes get clinics in trouble most often?
- Replying to a bad review with clinical detail, or confirming the person was a patient at all.
- Reposting a patient’s own before-and-after from their social account without a signed release.
- Running influencer content with no disclosure of the comped treatment.
- Using manufacturer or stock before-and-after images as though they were your patients.
- Advertising a package price that quietly excludes a required add-on or a second session.
- Reaching for “permanent,” “guaranteed,” “risk-free,” or a loose “FDA-approved.”
- Deleting or hiding negative reviews, which the Reviews Rule now addresses directly.
Frequently asked questions
Is a med spa automatically a HIPAA covered entity?
No. Covered entity status depends on whether you transmit health information electronically in connection with a covered transaction, which for most clinics means billing insurance. A strictly cash-pay practice may fall outside HIPAA, though state privacy law still applies.
Do I need a signed release for before-and-after photos?
Yes. Where HIPAA applies, marketing use of patient information requires a specific written authorization. Outside HIPAA, a signed photo release naming the channels the images may run on protects both the patient and the clinic.
Can I offer a discount in exchange for a review?
Not safely. Conditioning any incentive on a positive review is prohibited, and an incentive offered for a review of any kind is a material connection that must be disclosed. The cleaner path is to ask every patient for a review and incentivize none of them.
Are “results may vary” disclaimers enough?
No. A generic disclaimer does not cure an ad whose central claim is an atypical result. If most patients will not get what the ad shows, the ad needs to change rather than gain a footnote.
Who enforces med spa advertising rules in Florida?
Enforcement is split. The FTC handles deceptive advertising and review practices, the FDA covers promotion of drugs and devices, and the Florida Department of Health and the Board of Medicine handle practitioner advertising and scope of practice under Fla. Stat. 456.062.
The takeaway: pull your last ninety days of ads, social posts, and review replies into one document this week, and check them against the five rows in the table above. Most clinics find two or three fixes, and all of them are cheaper to make now than after a complaint.
If you want a second set of eyes on what you are running, that is what a compliant campaign review from our advertising team covers. Upwynn Marketing is an Orlando-based, data-driven agency using 90+ data sources for targeting, with no long-term contracts and hands-on support.
