Med Spa Cyber Liability: Patient Photos, Booking Systems, and Health Data Privacy

Does HIPAA apply to a med spa?

HIPAA applies to a med spa if the practice is a covered entity, which for a health care provider means it transmits health information electronically in connection with standard transactions such as billing health plans, and many cash-only med spas fall outside that definition. If your practice bills insurance electronically for any service, even occasionally, HIPAA likely applies to the whole practice. Falling outside HIPAA does not mean falling outside privacy law. Every state has a data breach notification law, several states have health or consumer privacy laws that reach health-related data regardless of HIPAA, and card brands require payment security standards for stored cards. Rules vary by state, so confirm which apply to you.

• HIPAA covered entity status turns on electronic standard transactions, such as claims to health plans.
• State breach notification laws apply to med spas whether or not HIPAA applies.
• Some states have health data privacy laws that reach cash-pay practices.
• Payment card industry standards apply to any med spa that takes cards.

Can a med spa post patient before-and-after photos on social media?

A med spa should post patient before-and-after photos on social media only with the patient's specific written consent, because unauthorized posting can lead to privacy claims, regulatory complaints and, for HIPAA covered entities, violations of rules on using health information for marketing. A general treatment consent is usually not enough; the consent should name the photos, the platforms and how long you may use them. Full-face photos are among the most identifying pieces of health information a practice holds. A photo that reveals a procedure, posted without consent, can create a claim even if no hacker was involved.

• Use a separate, signed photo release that names platforms and duration.
• Let patients withdraw consent and remove photos promptly when they do.
• Keep patient photos off personal phones and personal social accounts.
• Train staff that tagging or geotagging can identify a patient.

What happens if ransomware locks a med spa's booking or EMR system?

If ransomware locks a med spa's booking or EMR system, the practice may be unable to see appointments, treatment notes or consent forms, and it can lose days of revenue while also facing breach notification if patient data was accessed. Cyber insurance with business interruption coverage can pay lost income and extra expenses during that outage. Many med spas use cloud-based scheduling and EMR platforms. If the vendor is attacked rather than you, standard business interruption may not apply. Ask whether your policy includes dependent business interruption, which covers income lost when a technology provider you rely on goes down.

What does a cyber liability policy cover for a med spa?

A cyber liability policy for a med spa typically covers breach response costs, patient notification, forensic investigation, regulatory defense and fines where insurable, cyber extortion, business interruption and liability claims from patients whose data was exposed. It fills a gap left by general liability and malpractice policies, which generally do not cover data breaches. Some med spas assume their professional liability or business owner's policy includes cyber. Some include a small cyber endorsement, but those sublimits are frequently too low for a breach involving thousands of patient records.

• Breach response: legal guidance, forensics, notification and credit monitoring.
• Regulatory defense and fines or penalties where insurable by law.
• Cyber extortion and ransomware response.
• Business interruption, including dependent business interruption for vendor outages.
• Privacy and network security liability for patient lawsuits.

What cybersecurity controls help a med spa qualify for cyber insurance?

Cybersecurity controls that help a med spa qualify for cyber insurance include multi-factor authentication on email and practice software, regular offline or cloud backups, staff phishing training, and encryption of devices that store patient data. Underwriters ask about these controls on applications, and missing them can raise premiums or reduce available coverage. Many incidents at small practices start with a phished email login or a lost phone full of client photos. Simple controls close most of those doors.

• Turn on multi-factor authentication for email, EMR and booking platforms.
• Store photos in the EMR or a secure practice system, not on personal devices.
• Back up data regularly and confirm you can restore it.
• Get written privacy and security commitments from software vendors.
• Use a verified payment processor so card numbers are not stored locally.

Ready to review your med spa cyber coverage?

If you want to know how your practice's photos, booking systems and patient data would be covered after a breach, we would be glad to review it with you. Schedule a conversation at calendly.com/grandbayfinancial.