"Does a med spa need to follow HIPAA?" is one of the first questions a new med spa owner in the United States asks, and the honest answer is "it depends on how you bill". Many med spas are cash-pay businesses that never send a claim to an insurer. Others also run a medical practice that bills insurance, or use a billing service that does. HIPAA applies to a specific list of organisations, not to every business that handles health information, and getting this wrong in either direction is costly. This guide explains in plain language how federal law defines a covered entity, why cash-only clinics may fall outside it, where the grey areas are and what a med spa should do either way. It is general information, not legal advice. Clinics should confirm their position with a qualified healthcare attorney.
Key takeaways
- HIPAA's Privacy, Security and Breach Notification Rules apply to covered entities and their business associates, not to every business that handles health information.
- Under the regulation, a health care provider is a covered entity if it transmits health information in electronic form in connection with a standard HIPAA transaction, such as submitting a health care claim.
- A provider that never conducts those standard transactions electronically does not fit the definition, which is why many strictly cash-pay practices are not covered entities.
- Insurance billing, whether in-house or through a billing service or clearinghouse, changes the analysis, so mixed practices should get advice.
- State health and consumer privacy laws can apply even when HIPAA does not, and good privacy habits make sense either way.
How HIPAA defines a covered entity
The definitions are in 45 CFR 160.103. A covered entity is one of three things: a health plan, a health care clearinghouse or "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter". A health care provider includes any person or organisation that "furnishes, bills, or is paid for health care in the normal course of business", and health care means care, services or supplies related to the health of an individual. A med spa that provides injectables, laser treatments or similar procedures can therefore be a health care provider in the ordinary sense. The question is the final condition: does it conduct the covered transactions electronically?
The transactions that matter
The regulation describes a transaction as the transmission of information between two parties to carry out financial or administrative activities related to health care. The listed types include:
- Health care claims or equivalent encounter information
- Health care payment and remittance advice
- Coordination of benefits
- Health care claim status
- Enrollment and disenrollment in a health plan
- Eligibility for a health plan
- Health plan premium payments
- Referral certification and authorization
- First report of injury and health care claims attachments
The Centers for Medicare and Medicaid Services describe covered providers in similar terms: providers who submit HIPAA transactions, such as claims, electronically are covered. Clinics that take payment directly from patients by card or cash, and that never send claims, eligibility checks or similar transactions to insurers, do not conduct these transactions.
Why many cash-only med spas are not covered entities
If a med spa is not a health plan or a clearinghouse and never conducts a standard transaction electronically, it does not meet the third limb of the definition. That is the reasoning behind the widely held view that strictly cash-pay practices are outside HIPAA's covered entity rules. Note what this does and does not say:
- It is a conclusion from the definition, and it should be confirmed against the clinic's real billing practices.
- It does not mean patient information is unprotected by law. State laws, consumer protection rules and professional duties can still apply.
- It does not mean the clinic should ignore privacy. Patients expect their treatment details to be protected, and a breach would damage the business regardless of whether HIPAA applies.
Where med spas become covered
The clinic bills insurance for some services
Some med spas are part of, or share space with, a medical practice that bills insurers for certain visits. If that practice submits claims electronically, it is a covered entity. A common mistake is assuming that the med spa side is separate when it shares records, staff or systems.
A billing service or clearinghouse submits claims for the clinic
The regulation allows a covered entity to use a business associate, including a clearinghouse, to conduct transactions on its behalf. A clinic whose claims are sent electronically by a third party should assume it is conducting transactions and take advice before treating itself as outside HIPAA.
The clinic accepts programs that involve electronic transactions
Accepting certain plans or programs, or using eligibility checks, may involve covered transactions. Any such workflow needs review.
The clinic is a business associate of a covered entity
A business associate is a person who creates, receives, maintains or transmits protected health information on behalf of a covered entity for a function such as billing, practice management or data analysis, or who provides services such as consulting or administrative support involving disclosure of that information. A med spa that performs services for a covered entity, for example for a medical practice that sends it patients, should check whether it is one.
What if HIPAA does not apply?
Even when a med spa is not a covered entity, it still has good reasons to protect records:
- State laws. Some states have their own health privacy or consumer health data laws that can apply to cash-pay clinics. The details differ by state, so clinics should check the laws where they operate.
- Consumer protection rules. Marketing and data practices are subject to general rules on unfair or deceptive practices.
- Professional duties. Licensed providers owe patients confidentiality.
- Vendor and payment contracts. Some partners require privacy and security commitments.
- Trust. Photos and treatment details are sensitive, and patients notice how clinics handle them.
What a med spa should do either way
- Map your billing. Write down every way money and claims move, including any insurance, any billing service and any program that involves electronic transactions.
- Get a written opinion. A healthcare attorney can confirm whether the clinic is a covered entity or a business associate.
- Limit access. Give each staff member only the access their role needs, with unique logins.
- Protect photos and records. Keep them in controlled systems, not on personal phones or open chat groups.
- Review vendors. Ask software and messaging providers where data is stored, how it is protected and what agreements they offer.
- Prepare for incidents. Write down who is told and what happens if records are lost or exposed.
- Train staff and keep a short written privacy policy.
Business associate agreements and software
If a clinic is a covered entity, a software or cloud vendor that stores protected health information for it is generally a business associate, and the rules call for a written agreement. If the clinic is not a covered entity, HIPAA does not require such an agreement, but many clinics still ask vendors for clear data protection terms. Whatever the position, clinics should ask any vendor where data is stored, how access is controlled, whether data can be exported and what happens at the end of the contract.
An honest note about CareTrack
CareTrack by CreativeIn Tek is clinic management software with patient records, visit notes, attachments, treatment plans with numbered sessions, inventory, role-based access and WhatsApp reminders, built for cash-pay and session-based clinics. CreativeIn Tek does not currently offer US data hosting, a business associate agreement or insurance claims billing, and it does not claim that CareTrack is HIPAA compliant. US clinics that need those items should not treat CareTrack as a fit today, and any clinic should review a vendor's terms and hosting for itself. For general privacy habits that apply anywhere, see this guide to patient data privacy for clinics.
Sources
The definitions above come from the regulation text of 45 CFR 160.103 and 45 CFR 162.923, and the Centers for Medicare and Medicaid Services page Are You a Covered Entity?. The Department of Health and Human Services publishes further guidance on its HIPAA pages, which clinics should read directly.
Frequently asked questions
Is a cash-only med spa subject to HIPAA?
A provider that never conducts standard transactions electronically does not meet the covered entity definition. Confirm your own billing practices with an attorney.
Does using a billing company change the answer?
It can. A covered entity may use a business associate to conduct transactions, so a clinic whose claims are submitted electronically by a third party should take advice.
Do patients' photos need special protection if HIPAA does not apply?
Yes, as a matter of good practice, professional duty and possibly state law. Keep them in a controlled system with limited access.
Can a med spa choose to follow HIPAA voluntarily?
Yes. Many clinics adopt HIPAA-style safeguards because they are sensible, but voluntary practices should not be advertised as legal compliance without advice.
Last reviewed: 5 November 2026, against the federal regulation text and CMS guidance. This article is general information and not legal advice. To see how a clinic can keep tidy, access-controlled records, book a CareTrack demo.
