Before & After Content for Med Spas: A Plain-English Compliance Guide

Before-and-after content is the most persuasive thing a med spa can post. It's also the most regulated. A single side-by-side that shows real, dramatic results can do more to fill a consultation calendar than a month of treatment explainers — which is exactly why three different rulebooks govern how you're allowed to use it.

The good news: none of these rules say "don't post results." They say "post them honestly, with permission, and without overpromising." Once you understand the three overlapping systems, compliant before-and-after content is a workflow, not a minefield. Here's the plain-English version. (One caveat up front, repeated at the end: this is general information, not legal advice — your attorney and your state's medical board have the final word.)

Three rulebooks, not one

When people ask "are before-and-afters allowed?" they're usually thinking about a single rule. In reality, three separate authorities each have a say, and a post can satisfy one while violating another:

• HIPAA governs whether you're allowed to use the patient's image at all.
• The FTC governs what you're allowed to claim about the results.
• Platform policy (Instagram/Meta) governs how the content can appear, and treats organic posts very differently from paid ads.

Clear each one and you're in good shape. Skip one and the other two won't save you.

Rulebook 1: HIPAA — the permission layer

This is the one most practices underestimate. Before-and-after photos and treatment videos of identifiable patients are considered protected health information (PHI) under HIPAA — and that's true whether or not insurance was involved, which it usually isn't for aesthetics. The fact that a patient walked in voluntarily for an elective treatment doesn't strip the image of its protected status.

The practical consequence: a general consent form signed at intake is widely regarded as insufficient for marketing use. The standard guidance for medical practices is to obtain a separate written HIPAA authorization specifically for marketing that names social media use, identifies the platforms it covers, and makes clear the patient can revoke consent at any time. If a patient later withdraws permission, the expectation is that you pull the content from every location promptly.

A few practical habits that follow from this:

• Store patient photos on encrypted, password-protected devices — not the camera roll of a personal phone that syncs to who-knows-where.
• Even if a patient publicly tags your practice in their own post, don't confirm or repost it as "their results" without authorization — acknowledging treatment is itself a disclosure.
• Blurring a face does not automatically make an image non-identifiable, so consent still matters even for cropped or anonymized shots.

HIPAA penalties scale with culpability and run from modest per-incident amounts for unknowing violations up into the millions per year for willful neglect. The number that matters isn't the maximum fine, though — it's that the entire risk is avoidable with a one-page authorization form.

Rulebook 2: The FTC — the honesty layer

The FTC doesn't care whose face is in the photo; it cares about what you imply the results mean. Its core principle for any health-related claim is that you need competent and reliable evidence to back it up, and that a claim made through a testimonial or a before-and-after is held to the same standard as a claim you'd make directly.

For results content, that translates into a few concrete do's and don'ts. Show what was actually done and let the image speak; describe the treatment, the number of sessions, and a realistic timeline. Avoid implying that everyone will get the same outcome — results that aren't typical generally need to be disclosed as such rather than presented as the default. Steer clear of absolute language ("guaranteed," "permanent," "no downtime") unless it's literally true for the treatment.

The newer wrinkle is synthetic content. The FTC's rule on fake and AI-generated reviews and testimonials took effect October 21, 2024, and it prohibits testimonials that misrepresent the reviewer's identity, experience, or existence. Real results from real, consenting patients are completely fine. Fabricating a glowing patient quote, or generating a fake "patient" to deliver one, is now squarely prohibited and carries meaningful civil penalties per violation.

Rulebook 3: Platform policy — organic vs. paid

This is the distinction that trips up the most practices, because the rules genuinely differ depending on how the content is distributed.

Meta's strictest before-and-after restrictions apply primarily to paid advertising, not to organic posts. In its ad policies, Meta limits before-and-after body-transformation comparisons and prohibits creative that promotes a product by generating "negative self-perception." Certain categories — anti-aging and skin treatments like injectables — get some latitude for close-up imagery in ads, but side-by-side comparisons are restricted, and the depictions are expected to reflect realistic outcomes.

Organic content — your regular feed posts, Reels, and Stories — is not governed by those ad rules in the same way, which is why practices can and do post before-and-afters organically. That doesn't make it a free-for-all: the platform's general community standards still apply, and HIPAA and FTC obligations don't disappear just because you didn't pay to boost the post. But it does mean the most common worry ("Instagram banned before-and-afters") is really an ad-policy issue, not an organic-posting one.

A simple pre-post checklist

Before any results content goes live, run it through five questions:

1. Permission: Is there a signed, marketing-specific authorization that names social media for this exact patient?
2. Accuracy: Does the caption state what was actually done — treatment, sessions, timeline — without exaggeration?
3. Typicality: If these results are unusually strong, is that disclosed rather than implied to be standard?
4. Authenticity: Is every testimonial from a real, identified person, with nothing AI-fabricated about the patient or the outcome?
5. Channel: If you plan to run it as a paid ad, does it also clear Meta's stricter ad rules (no side-by-side body comparisons, no negative self-perception framing)?

Build that checklist into your content workflow once and it becomes background noise — a thirty-second pass before scheduling, not a legal review every time.

This is, frankly, one of the reasons practices hand their content pipeline to a partner: a good process bakes consent tracking and claim discipline into production so nothing risky reaches the calendar by accident. That's how we run things at Gold Hour Studio — results content only goes out with documented consent and accurate, non-overpromising captions. If you'd like to see what compliant, on-brand content looks like for your practice, we'll make you a free sample.

This article is general information for marketing purposes and is not legal or compliance advice. Rules under HIPAA, the FTC, and platform policies change and are applied to specific facts. Consult a qualified attorney and your state medical board before establishing your own before-and-after content practices.