Med Spa Consent Forms: Every Form You Need in 2026

Why Consent Forms Are Your First Line of Legal Defense

When a patient pursues a claim, the first thing their attorney requests is your consent forms. Not your credentials. Not your injection technique. Your paperwork. The same is true when a state board opens a complaint file: the investigator asks for the chart, and the chart is judged largely by whether the consent documentation is there, whether it is specific, and whether it was signed before the needle went in.

Informed consent is a legal doctrine in all fifty states. Before a medical procedure, a provider must disclose material risks, expected benefits, reasonable alternatives, and the consequences of doing nothing. The signed form is not itself the consent — the conversation is. The form is your evidence that the conversation happened, and two or three years later it is usually the only evidence that survives. Without a proper, procedure-specific form you cannot prove the patient was warned about the risk that actually occurred, and a dispute over what was disclosed resolves in the patient's favor far more often than not.

Which Consent Forms a Med Spa Needs, Treatment by Treatment

Most practices discover their gaps during an audit, a records request, or a complaint. The faster way is to inventory what you hold against what a fully documented med spa is expected to hold. Forms below are grouped by what they do, because the biggest mistake here is assuming one document can do the job of three.

Practice-level forms every patient signs once

• General consent to treat — establishes the treatment relationship and permits routine care, examination, and clinical photography for the record. It does not substitute for procedure-specific consent.
• Notice of Privacy Practices acknowledgment — confirms receipt of your HIPAA notice. An acknowledgment, not an authorization to use their information.
• Financial policy and cancellation acknowledgment — pricing, deposits, no-show terms, package and membership terms, refunds.
• Communication preferences — whether the patient agrees to text and email contact, a distinct question from marketing consent.

Forms tied to a specific treatment episode

• Procedure-specific informed consent — one per service line, signed at each treatment episode. The core of your library.
• Pre-treatment screening and contraindication attestation — pregnancy, anticoagulants, isotretinoin history, autoimmune conditions, active infection.
• Post-treatment instruction acknowledgment — confirms the patient received aftercare instructions and knows the escalation path.
• Off-label use disclosure — required in substance whenever a product is used outside its FDA-approved indication, which covers much of routine aesthetic practice.
• Compounded medication disclosure — where a compounded formulation is dispensed or administered, including many GLP-1 and hormone protocols.

Forms that exist for reasons other than treatment

• HIPAA authorization for marketing use of images — separate from clinical photography consent, and required before any identifiable image appears in advertising.
• Testimonial and endorsement release — for written or video testimonials, which raise both HIPAA and FTC obligations.
• Telehealth consent — where any portion of the encounter, including the good faith exam, occurs remotely.
• Minor treatment consent — signed by a parent or legal guardian, with the minor's assent documented alongside.
• Personal representative authorization — for adults who cannot consent for themselves, supported by the underlying legal document.
• Release of records authorization — for sending records to another practice at the patient's request.

That is six or seven practice-level documents plus one clinical consent per service line — so a med spa offering eight service lines maintains between fourteen and twenty distinct consent documents. If your current count is three, that gap is the project.

What Makes Informed Consent Legally Valid

Courts and boards evaluate consent against four elements. A form can be beautifully designed and still fail on any one of them, which is why "we have a form" and "we have valid consent" are different claims.

1. Capacity

The person signing must be legally and clinically able to make the decision — an adult who is not impaired at the time of signing. A patient who has already received oral sedation, or who arrived intoxicated, cannot give valid consent at that moment. Capture consent at the consultation or on arrival, not on the treatment table after numbing and anxiolysis.

2. Disclosure

The patient must be told what a reasonable patient would want to know. States apply either a "reasonable patient" or a "reasonable practitioner" standard, with the trend toward the former. Disclosure covers the nature of the procedure, the material risks — including rare ones that are severe — realistic benefits, the alternatives including doing nothing, and who will perform the treatment. Severity matters more than frequency: vascular occlusion after filler is rare, and its rarity is precisely why omitting it is indefensible.

3. Voluntariness

The decision must be free of pressure, and time pressure counts. Handing a patient a four-page form ninety seconds before injection, in a gown, with the provider waiting, is the fact pattern plaintiff attorneys build cases around. So is bundling consent into a promotional package that expires at the end of the appointment.

4. Documentation

The consent must be recorded in a way you can reproduce later — the right form, the right version, the right date, signed by the right people. If a patient was treated in March 2024 and you can only produce the template currently in your EMR, you have not proved what was disclosed that day.

A single blanket "I consent to all treatments at this practice" form does not satisfy this standard. Each procedure carries unique risks that must be disclosed specifically, and general consent forms have been rejected repeatedly in both malpractice and licensing contexts.

Treatment-Specific Consent: What Each Service Line Requires

Below are the required elements for each major treatment category, building on the universal elements above. The fastest audit is to open each existing form and check it against the matching list.

Neurotoxins: Botox, Dysport, Xeomin, Daxxify, Jeuveau

Version drift is the main risk here: when a practice adds a new toxin, the old form is often left in place with the new product injected under it. Our breakdown of Botox consent forms covers the neurotoxin form clause by clause.

Dermal Fillers: Hyaluronic Acid, Radiesse, Sculptra

Filler consent carries the heaviest disclosure burden in aesthetics, because the worst outcomes are vascular and can be permanent. How occlusion is recognized and treated belongs in your protocols, but the form must establish that the patient was told it can happen. Practices treating lips should also read our lip filler safety and consent guide.

Laser and IPL Treatments

Chemical Peels

Microneedling and RF Microneedling

GLP-1 and Weight Loss Injections

Hormone Therapy and Pellets

IV Therapy and Hydration

Before and After Photo Consent: What the Form Must Actually Say

This is where competent practices most often have a real compliance gap, because the paperwork looks finished when it is not. A single line inside the treatment consent reading "I consent to photographs" is doing the work of two completely different legal instruments, and it does neither adequately.

Clinical photography consent is not marketing authorization

Clinical photography is documentation. Images recording baseline appearance, planning treatment, and tracking outcomes are part of the medical record. Under HIPAA that is a use for treatment and health care operations, covered by your general consent to treat. Tell the patient it is happening and note it on the form, but you do not need a separate authorization to take a clinical photo and keep it in the chart.

Marketing use is different in kind. The moment an identifiable patient image promotes the practice — a website gallery, an Instagram post, a paid ad, a brochure, a comparison in an email campaign — you are using protected health information for marketing. Under 45 CFR § 164.508 that requires written authorization. It is not covered by consent to treat, not by the Notice of Privacy Practices, and not by a photographer's model release, which addresses publicity rights and does not satisfy HIPAA. The practical consequence: you need a standalone Before and After Photo Consent and marketing authorization, separate from the treatment consent, that the patient can decline without affecting their care.

What the photo authorization must contain

HIPAA specifies the core elements an authorization needs to be valid. Applied to a before-and-after photo, that means the following.

Two of these are most often missing. First, the authorization cannot be a condition of treatment. If a patient must sign the photo release to get the discounted package, you have conditioned care on a marketing authorization and compromised it. A genuine, separately disclosed incentive is different — but it must appear on the form, and it has downstream advertising consequences.

Second, an authorization with no expiration is defective. "Perpetual" is not a valid term. Pick a period — many practices use three or five years — and build a re-consent step for images you want to keep using beyond it.

Revocation, and what happens to images already published

Patients may revoke in writing at any time. Under § 164.508(b)(5) the revocation stops future use, with one narrow carve-out: it does not apply to the extent the practice has already acted in reliance on the authorization.

In practice, content you control — your website gallery, your own social posts, your ad sets — must come down promptly, and your SOP should define "promptly" as a specific number of business days. Material that has left your control is harder: a brochure already distributed, a post a third party reshared. The reliance exception is not a licence to keep using an image because takedown is inconvenient; it covers what genuinely cannot be recalled. Build the path before you need it — name the person responsible, list every channel where images live, and log each revocation with the date received and the date each channel was cleared.

Minors and before-and-after images

Photographs of a minor require the parent or legal guardian's authorization, and the same elements apply. Document the minor's own assent — a teenager who does not want their face in an advertisement should not be in one, regardless of what the guardian signed. And the authorization does not automatically survive the patient reaching adulthood: the conservative practice is to stop using minor images at the age of majority unless the now-adult patient signs a fresh authorization in their own name.

Storing and securing the images themselves

The photographs are protected health information, exactly like the chart.

• Photograph on a practice-owned device. If a personal phone is unavoidable, enrol it in mobile device management, route images straight to the EMR, and clear the camera roll.
• Disable automatic sync to consumer photo services — the most common way med spa images leak, and it usually happens without anyone noticing.
• Store images inside the medical record system, not a shared drive, marketing folder, or messaging thread.
• Keep the marketing-approved set separate from the clinical set, so only images with a current, unexpired authorization are reachable by whoever runs your marketing.
• Log which images have authorizations, when each expires, and when each was revoked — and get a business associate agreement in place before any agency touches them.

Where the advertising rules take over

HIPAA answers whether you may use the image. It says nothing about whether the advertisement built around it is truthful, and that is a separate body of law. The FTC's Endorsement Guides at 16 CFR Part 255, revised in 2023, govern testimonials, material connections, and results claims — including whether a before-and-after image implies a typical result, and how incentivized patient, staff, and influencer posts must be disclosed. Getting the authorization right and the advertising claim wrong still produces a violation, just from a different regulator.

Those rules are covered in full in our guide to the FTC before-and-after photo rules for med spas, and the overlap between HIPAA and FTC obligations for patient stories is covered in our testimonial marketing and consent guide. This page stops at the consent document; those pick up at the advertisement.

HIPAA-Compliant Storage and Retention of Signed Consent Forms

Signed consent forms are protected health information. Where they live, who can reach them, and how long you keep them are regulated questions, and they are among the easiest things for an investigator to check.

Two retention clocks, not one

Practices routinely quote a single retention number, and that is where the error starts. Several requirements apply at once.

HIPAA does not set a retention period for medical records generally — that is state law's job. It sets a six-year floor for the compliance documentation it does govern, which explicitly includes signed authorizations such as your photo release. When the clocks disagree, the longer one controls.

The workable policy for most med spas is a single floor clearing every applicable requirement: ten years for adult records, and for minors until the patient turns twenty-eight. Then add the rule that matters most: never destroy a record connected to an open complaint, claim, or investigation, whatever the schedule says. Destroying records after notice of a claim is a far worse problem than the claim itself. Our medical records retention guide covers the state-by-state picture.

What compliant storage actually requires

The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Translated into a med spa's day-to-day reality:

• Access control. Every user has their own login, scoped to what their role actually needs. No shared front-desk account.
• Audit logging. The system records who opened which record and when, and someone reviews those logs on a schedule.
• Encryption. ePHI encrypted at rest and in transit. Encryption is currently an addressable specification, but in a med spa there is no defensible reason not to encrypt.
• Business associate agreements. Signed with your EMR, e-signature platform, cloud storage, backup provider, and any agency touching patient images. No BAA, no PHI — most often missed with e-signature vendors.
• Backup and recovery. Backed up, tested, documented. An untested backup is a hypothesis.
• Physical safeguards. Paper in locked cabinets in non-public rooms, screens angled away from patient sightlines.
• Disposal. Cross-cut shredding for paper, verified sanitization for drives. Retired e-signature tablets are a commonly forgotten exposure.
• Version retrieval. You must be able to produce the exact version a patient signed on a given date, not the current template. Most practices fail this one.

Storage failures also tend to become public. A misconfigured cloud folder of before-and-after images is a breach, carrying notification obligations to patients, to HHS, and in larger incidents to the media. Our HIPAA compliance guide for med spas covers breach response in detail.

Electronic Signatures and Consent Inside an EMR

Electronic consent is legally valid in every U.S. state. The federal E-SIGN Act and state adoptions of the Uniform Electronic Transactions Act give an electronic signature the same effect as ink, provided the signer intended to sign and the signature can be attributed to them. The question is never whether e-signature is allowed — it is whether your implementation would survive a challenge.

What a defensible e-consent implementation looks like

• Attribution. The system verifies who is signing — at minimum by confirming identifying details before capture, ideally through an authenticated portal session.
• Intent. The interface makes clear the action is a signature, not dismissal of a pop-up.
• Full disclosure of content. The patient must be able to read the entire document before signing. A signature panel presented without the form text is the most common defect in aesthetic e-consent, and it is fatal to the "informed" half of informed consent.
• Audit trail. Timestamp, device identifier, sequence of actions, and how long the document was open. Time-on-page is unexpectedly useful evidence when voluntariness is questioned.
• Immutable, version-bound record. Once signed the document locks, and the stored record holds the full text the patient saw rather than a pointer to a template that may change.
• Retrieval. You can export a complete signed copy with its audit trail, without vendor assistance.
• Business associate agreement. Executed with the e-signature vendor before any patient data flows.
• Patient copy. The patient receives one, and you can prove it.

Where e-consent goes wrong in practice

Three failure patterns account for most of the trouble. The tablet handed over on the treatment table, pre-scrolled to the signature line — technically an electronic signature, practically no consent. The template updated in place, so last year's patients appear to have signed this year's language. And vendor lock-in: a practice changes EMR and the old system's signed consents exist only as an inaccessible export. Migrate signed documents as retrievable PDFs with audit trails attached, and verify a sample after any platform change.

Paper still has a legitimate place. It does not depend on vendor uptime and for a small practice can be entirely adequate — provided the content meets the same standard and storage meets HIPAA's physical safeguards.

Who May Obtain Consent, and Why the Good Faith Exam Comes First

Informed consent is the treating provider's duty — the physician, nurse practitioner, or physician assistant responsible for the treatment decision, within the scope their state allows. Support staff can distribute forms, explain logistics, and collect signatures. What they cannot do is conduct the risk-and-alternatives discussion that makes consent informed.

An esthetician or medical assistant who hands over a filler consent, answers "what are the risks?" themselves, and takes the signature has not obtained informed consent, and the resulting form may be worth very little. The fix is procedural rather than expensive: the provider has the conversation, the provider signs the attestation line, and the chart shows both.

Consent and the good faith exam are different documents

The good faith exam is a clinical evaluation establishing that this treatment is medically appropriate for this patient. It requires a licensed provider — physician, NP, or PA depending on state supervision and collaboration rules — to review history, examine the patient, and make a treatment decision. Registered nurses, medical assistants, and estheticians cannot perform it. Whether it may be done via telehealth, and how often it must be repeated, varies significantly by state.

The informed consent documents that the patient, told the risks, benefits, and alternatives, agreed to proceed. It comes after the exam, because you cannot meaningfully consent to a treatment plan not yet determined to be appropriate.

The correct sequence is exam, treatment plan, consent, treatment. A practice collecting signed consents at the front desk before any provider has evaluated the patient has inverted that order and weakened both documents — one of the most common findings in med spa board investigations. Our guide to medical director duties covers the exam and delegation rules in depth.

Minors, and Patients Who Cannot Consent for Themselves

Some patients cannot give legally valid consent. The rules differ depending on why.

Minor patients

Minors generally lack the legal capacity to consent to elective aesthetic treatment, so a parent or legal guardian must sign. Beyond that baseline:

• Verify guardianship. An accompanying adult is not automatically a legal guardian. Divorced-parent and step-parent situations need documentation, not assumption.
• Document the minor's assent. A minor's refusal should end the discussion even where a guardian consents.
• Check state restrictions. Several states restrict or prohibit specific cosmetic procedures for minors outright, independent of parental consent. Verify before you schedule.
• Address off-label status. FDA labeling for most neurotoxins and dermal fillers covers patients eighteen and older, so use in a minor is off-label and must be disclosed on the form.
• Document clinical rationale where treatment is appropriate — a port-wine stain, significant acne scarring — and extend retention, since the limitations clock generally does not start until majority.

Adults who cannot consent

Where an adult lacks decision-making capacity, consent comes from a legally authorized representative — a healthcare power of attorney, a court-appointed guardian, or whoever your state's surrogate statute designates. Keep a copy of the underlying legal document rather than relying on a verbal claim of authority, and involve the patient to the extent they are able. Where capacity is genuinely uncertain and the treatment is elective, decline and refer.

Language and comprehension

Consent obtained in a language the patient does not read is not informed. Use a professionally translated form or a qualified interpreter, and document which. Family members — particularly minor children — are not appropriate interpreters for a risk discussion. The same applies to comprehension generally: a form written at a graduate reading level, signed by a patient who could not follow it, is weak evidence. Plain language is a legal asset, not a stylistic preference.

Revocation and Withdrawal of Consent

Treatment consent can be withdrawn at any time, including mid-procedure. If a patient says stop during a filler appointment, you stop as soon as it is safe to do so. Document what was completed, what was not, the stated reason, what you advised about the partially completed state, and the follow-up offered. Continuing after a clear withdrawal is not a documentation problem — it is potentially battery.

Marketing authorization can be revoked in writing, subject to the reliance exception above. Your form must tell the patient how to revoke and to whom, and your SOP must define what happens when one arrives: who receives it, which channels are checked, the takedown deadline, and where the action is logged.

Consent does not roll forward indefinitely. A form signed eighteen months ago does not cover today's session, particularly if the product, provider, dose, or treatment area has changed. Re-consent at each treatment episode. For a defined series — a six-session laser package — a series consent works, provided it names the number of sessions and you re-confirm at each visit that nothing material has changed.

How Consent Forms Are Used in a Board Complaint or Malpractice Claim

Understanding what actually happens to these documents changes how you build them.

In a state board complaint

A board investigation opens with a records request, and the consent documentation is examined for a specific set of things: was there a procedure-specific consent, was it signed before treatment, did a qualified provider obtain it, does it disclose the risk relevant to what happened, and was a good faith exam documented first. A board can find a consent violation even where the clinical outcome was fine — failure to obtain or document informed consent is independently actionable in most states and does not require an injured patient. Boards also read the shape of the paperwork: no version number, blank fields, a patient signature with no provider signature, or a signature dated after treatment all signal that consent is being treated as a formality.

In a malpractice claim

Consent forms do two jobs in litigation. They establish what was disclosed, which determines whether a separate lack-of-informed-consent claim can stand alongside the negligence claim. And they establish the standard the practice held itself to — a form describing a monitoring protocol you did not follow becomes evidence against you. A form promising more than you deliver is worse than one that promises less: if your consent says the provider will follow up at 48 hours and no one called, you have handed the other side a documented deviation from your own stated standard. Write what you do, then do it.

What examiners look for, in order

1. Does a signed consent exist for this specific procedure and this specific date?
2. Is the signature dated before the treatment, not after?
3. Does the form name the actual product and the actual provider used?
4. Is the risk that materialized disclosed on the form?
5. Did a qualified provider sign the attestation?
6. Can the practice produce the version of the form in effect on that date?
7. Is there a documented good faith exam preceding it?
8. Is the photography authorization separate, current, and unexpired?

A practice that can answer all eight quickly is in a fundamentally different position from one that cannot — and the difference is almost entirely how the forms were built and stored, not how the treatment was performed.

Template or Custom: An Honest Comparison

We sell consent form templates, so treat what follows with appropriate skepticism — but the honest version is more useful than the flattering one.

What templates do well. A good template gets the structure right: required elements present, risk lists clinically complete, language plain, versioning and signature architecture already built. That is the part practices most often get wrong from a blank page. Templates are also fast — three inadequate forms to a full library in days rather than months — and consistent across service lines, which matters when staff move between them.

What templates cannot do. A template does not know your state. Consent statutes, witness requirements, retention periods, minor restrictions, and delegation rules vary, and no national template encodes all fifty variations correctly. It does not know your protocols — if your aftercare differs, the template is now wrong about your practice — nor your product mix, staffing model, or the language your malpractice carrier wants to see. A template is a starting point, not a compliance outcome. A form used unmodified, carrying another practice's assumptions, can be worse than a shorter one that accurately describes what you actually do.

The approach that works. Start from a professionally built template so the structure and clinical content are right. Customize it — your name, your medical director, your products, your aftercare, your escalation path. Have a healthcare attorney licensed in your state review the set once; reviewing a complete library costs far less than commissioning one. Then own the maintenance.

Consent Form Mistakes That Create Liability

These are the failures that turn a manageable complication into a claim, or a routine inspection into a finding.

• One form for all treatments. Generic consent cannot cover procedure-specific risks and is consistently found inadequate.
• Omitting the rare, severe risks. Vascular occlusion, blindness, anaphylaxis, thyroid C-cell warnings. If it is catastrophic and it can happen, it goes on the form however unlikely.
• Consent obtained by staff who cannot obtain it. The risk discussion is a provider duty, and delegating it invalidates the "informed" element.
• Consent signed once at intake, or signed after treatment. Both break the sequence, and a signature timed after the procedure documents the failure for you.
• Photography consent buried in treatment consent. Marketing use requires a separate, revocable authorization the patient can decline without affecting care.
• Authorizations with no expiration. Not valid under HIPAA, and they leave you using images you no longer have permission for.
• No version control. If you cannot produce the version signed on a given date, you cannot prove what was disclosed.
• Forms that outlive the protocol. A 2021 form describing a product or aftercare you no longer use is an active liability.
• Missing provider signature. A patient signature alone does not show a qualified provider had the discussion.
• Consent stored where it cannot be found. A form you cannot retrieve on demand is, evidentially, a form that does not exist.

Consent, Acknowledgment, and Authorization Are Different Documents

Many practices use these terms interchangeably. Merging them weakens all of them.

• Patient intake form: collects history, medications, and allergies. A screening tool — not a consent document.
• Acknowledgment form: confirms the patient received something, such as your privacy notice. Administrative, and it authorizes nothing.
• Informed consent form: documents that risks, benefits, and alternatives were disclosed and the patient voluntarily agreed to proceed.
• HIPAA authorization: permits a use or disclosure the Privacy Rule would not otherwise allow — marketing use of images being the case that matters here.

You need all four, separately. Combining them produces a document nobody reads carefully, and a board may conclude the consent buried inside was never truly informed. Separate documents also let a patient decline one thing without declining everything.

Building and Maintaining Your Consent Library

A consent library is a living system, not a one-time project.

1. Inventory. List every clinical service you offer and every form you hold. The gap is your work queue.
2. Build or adopt. Fill the gaps from a structurally sound base rather than a blank page.
3. Localize. Apply your state's witness rules, retention periods, minor restrictions, and mandated language.
4. Review once, properly. A single attorney review of the complete set, not piecemeal as problems surface.
5. Version everything. Number and date every form, and lock signed copies against later edits.
6. Train the workflow. Who obtains consent, when in the visit, what happens on refusal, how the attestation is captured.
7. Audit quarterly. Pull ten random charts and run the eight examiner questions above — under an hour, and it finds problems while they are still cheap.
8. Review on change. New service, new product, new provider type, new regulation, new carrier requirement.

Consent documentation sits inside your broader operational system, alongside intake protocols, delegation structure, and records policies. Our complete SOP guide for med spas maps how those pieces fit together, and the state rules behind several requirements above are collected in our med spa regulations by state reference.

None of this is glamorous work. It is also the difference between a complication that gets managed and a complication that ends a practice.