How to Get Patient Consent for Before/After Photos (Without the Risk)

Before/after photos are the most powerful marketing tool an aesthetic practice has. They're also one of the areas where practices most commonly have gaps they don't know about.

The problem isn't usually carelessness. It's that the rules around patient photo consent aren't clearly explained anywhere in plain language. Most practices cobble together a process that feels reasonable without knowing whether it actually holds up.

Here's what proper consent looks like, where common mistakes happen, and how to build a process you can actually maintain.

Are your before/after photos considered PHI?

In most cases, yes. HIPAA defines Protected Health Information as any information that relates to an individual's health and could reasonably be used to identify them.

A before/after photo of a patient's face, combined with the name of your practice and the procedure performed, meets that standard easily. Body photos are more nuanced, but they can also qualify depending on context. Identifiable features like tattoos, birthmarks, or distinctive body characteristics can make a photo identifiable even without a face.

The safest assumption is that every patient photo you take is PHI until you've taken specific steps to handle it correctly.

What your consent form actually needs to say

A general treatment consent form does not cover photo use. These need to be separate, and the photo consent needs to be specific about what you're asking for.

At minimum, a solid consent form for before/after photos should cover who is giving consent and for which images, how those images will be used (website, social media, paid ads, and print marketing are all different authorizations), whether the patient's identity will be visible, and the patient's right to withdraw consent going forward.

Vague language is where practices get into trouble. "I consent to the use of my photos for marketing purposes" sounds sufficient until a patient objects to a specific use and you don't have documentation that they agreed to it.

Written consent is not optional

Verbal agreement doesn't protect you. You need documented consent that can be retrieved if you ever need to demonstrate it.

Digital consent forms work well here. They're easier to store, easier to search, and harder to misplace than paper. The key is that the signed record gets linked to the specific patient and stored somewhere retrievable, not just filed and forgotten.

Get consent at the right moment

Timing matters more than most practices realize. Asking a patient to sign a photo consent form while they're still in the pre-procedure mindset, before they've seen their results, often gets a reflexive response. Some will agree without fully reading it. Some will say no because they're anxious about the procedure going well.

Asking after a successful outcome, when the patient is genuinely happy with their results, tends to produce better informed agreement and a more positive consent experience. There's no single right answer here — it depends on your workflow — but the moment should never feel pressured or rushed.

Keep photo consent separate from treatment consent

Combining photo authorization into a general treatment consent form is one of the most common mistakes. It creates several problems.

Patients may sign the treatment consent without fully registering what they're agreeing to for photos. If a patient later disputes consent for a specific use, the combined form is harder to defend. And practically speaking, patients have a right to receive treatment regardless of whether they consent to photo use — combining the two implies otherwise.

Separate forms clarify expectations and reduce ambiguity on both sides.

How to handle social media specifically

Posting before/after content on Instagram, TikTok, or Facebook adds exposure beyond your website. Your consent form needs to address this explicitly — including the fact that once content is posted on a third-party platform, you have limited control over how it's shared or who sees it.

Patients who are comfortable with website use are sometimes not comfortable with social media. Giving them that distinction in your consent form and honoring it builds trust and reduces risk.

Storage and access controls

Consent is only part of the picture. Where you store the photos and who can access them matters just as much.

Photos should be stored in a system with access controls that limit who can view them, not in a shared Google Drive folder, not in a general-purpose Dropbox, and not in your website's media library unless that infrastructure has been specifically set up for HIPAA compliance. You should also have a clear process for what happens when a patient withdraws consent — how quickly can you remove their images from your website and any other places they appear?

A documented answer to that question is part of a credible compliance posture.

A practical starting point

If your current process is informal, start with these three things. Create a standalone photo consent form that's specific about use cases. Collect and store consent digitally so you can retrieve it by patient. Choose a gallery platform that logs consent confirmation as part of the upload process so there's always a record.

For more on where photo storage fits into the compliance picture, our post on why your plastic surgery website isn't converting covers the broader web presence side of things. And if you're figuring out how to actually display those photos once consent is documented, adding a before/after gallery to Squarespace or any other platform is covered in our setup guides.

---

Proova logs consent confirmation automatically for every case before it goes live. Need a BAA for a HIPAA-covered practice? Contact us. Start free.