Not legal or tax advice. Rules differ by state and change over time. Ask an employment attorney, accountant or your state board before relying on this.
A med spa's records include treatment notes, injectable lots, medical photos and consents. That is health information, and it changes what your software must do.
The BAA Rule
Under 45 CFR 164.502(e), a covered entity may let a business associate create, receive, maintain or transmit protected health information on its behalf only after obtaining satisfactory assurance that it will safeguard the information. 45 CFR 164.504(e) sets out what that written contract must contain. In practice: no BAA, no patient data.
Software Built for Med Spas
- Aesthetic Record: from $15 per user a month plus $399 onboarding; ePrescribing from $31 per prescriber; ChartSmart AI from $30 a month.
- GlossGenius: Practice Essentials $168 and Practice Advanced $298 a month.
- Boulevard: Forms from $65 per location and ePrescribe at $45 per prescriber on top of plans from $143.
- Quote-based: Pabau, PatientNow, Zenoti and Meevo (MeevoMD).
Questions to Ask
- Will you sign our BAA, or provide yours?
- Where are photos stored, and who at your company can see them?
- Can a medical director review and sign charts?
- If AI drafts notes, who checks them before they are final?
Next Steps
Compare all options on the med spa software page.
Common Questions
Is Every Med Spa a HIPAA Covered Entity?
Not automatically. HIPAA covers health care providers that transmit health information electronically in connection with standard transactions, such as insurance claims. Many med spas are covered; check with a healthcare attorney.
Can I Use Regular Salon Software for a Med Spa?
For booking, possibly. For charts, photos and consents tied to medical treatments, use software that will sign a BAA and supports clinical records.
Sources
- 45 CFR § 164.502, uses and disclosures of PHI (Cornell LII)
- 45 CFR § 164.504, business associate contracts (Cornell LII)
- 45 CFR § 160.103, definitions (Cornell LII)
Basis: HIPAA Privacy Rule (45 CFR 164.502, 164.504); vendor pricing pages.