Photo consent forms for before-and-after photos: what to include

When patient photos are protected health information

Photos taken during care are part of the patient's record. A before-and-after pair also shows that a person had a specific procedure. That makes it health information, and if the person can be identified, it's protected health information (PHI).

Identifiability is broader than a face. HIPAA's de-identification safe harbor, in 45 CFR 164.514(b) (opens in a new tab), lists "full face photographic images and any comparable images" among its identifiers, along with "any other unique identifying number, characteristic, or code." A tattoo, scar, birthmark or piece of jewelry can identify someone. The practice also must not have actual knowledge that the remaining image could identify the person. See the 18 HIPAA identifiers for the full list.

Marketing use needs an authorization. HIPAA defines marketing (opens in a new tab) as a communication that encourages people to buy or use a product or service. 45 CFR 164.508(a)(3) (opens in a new tab) requires a signed authorization for any use or disclosure of PHI for marketing, with narrow exceptions for face-to-face communication and promotional gifts of nominal value. A gallery, an Instagram post and a paid ad all fall inside the rule. More on the rule in HIPAA marketing authorization.

Ethics add a second layer. The ASPS Code of Ethics (opens in a new tab) (updated January 2025) says a member may not reveal "any observed characteristics of the patient" without consent, whether or not HIPAA's identifiers are present.

HIPAA authorization: the required elements

As checked on the eCFR on October 22, 2026, 45 CFR 164.508(c) (opens in a new tab) requires these core elements:

1. A description of the information to be used or disclosed that identifies it "in a specific and meaningful fashion."
2. The name or other specific identification of the person(s), or class of persons, authorized to make the use or disclosure.
3. The name or other specific identification of the person(s), or class of persons, to whom the disclosure may be made.
4. A description of each purpose of the use or disclosure.
5. An expiration date or an expiration event that relates to the individual or the purpose.
6. The individual's signature and date; if a personal representative signs, a description of that person's authority.

It also requires statements that put the patient on notice of:

• The right to revoke in writing, with the exceptions and how to revoke (or a reference to your Notice of Privacy Practices if it covers this).
• Whether treatment can be conditioned on signing. For a cosmetic surgery practice, the statement is that it can't.
• The potential for the information to be redisclosed by the recipient and no longer protected.

And three process rules: the form must be in plain language, the patient gets a copy of the signed form, and if a third party pays the practice for the marketing (an implant manufacturer funding a campaign, for example), the authorization must say that remuneration is involved.

Keep it separate from surgical consent. Section 164.508(b)(3) bars combining an authorization with other documents to create a compound authorization, apart from listed exceptions. A photo release buried in the surgical consent packet is the most common failure.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Scope: website, social media, ads, print and education

Patients often agree to a website gallery but not to an Instagram ad. Give each channel its own checkbox so the "purpose" element is specific:

ASPS commentary on social media notes that many surgeons get a separate consent for posting images online, because online images can be altered and spread more widely (ASPS, 2019 (opens in a new tab)). For posting habits, see plastic surgery Instagram; for gallery layout, see plastic surgery galleries.

Revocation, expiration and storage

Revocation. Under 164.508(b)(5), a patient may revoke an authorization at any time, in writing, except to the extent the practice has already acted in reliance on it. In practice:

• Remove the images from your website, social accounts and active ads promptly.
• Tell any vendor that holds copies.
• Log the date and what was removed.
• Explain on the form that printed materials already distributed and copies others have made can't be recalled.

Expiration. Each authorization needs a date or an event, such as "five years from signing" or "when I submit a written revocation." An open-ended form with no expiration is defective under 164.508(b)(2).

Storage. Retain signed authorizations for six years from creation or the date last in effect, whichever is later, under 45 CFR 164.530(j) (opens in a new tab). Link each image file to its authorization by case number, not patient name, and strip metadata before publishing.

Canadian clinics. The Office of the Privacy Commissioner's meaningful consent guidelines (opens in a new tab) say health information is generally sensitive and usually needs express consent, and that people may withdraw consent. Provincial health privacy laws may add requirements.

Minors and personal representatives

Under 45 CFR 164.502(g) (opens in a new tab), a parent or guardian with authority to make health care decisions for an unemancipated minor generally acts as the minor's personal representative and signs the authorization. There are exceptions where state law lets the minor consent to the care. When a representative signs, the form must describe their authority.

Practical steps for aesthetic practices:

• Keep minors' images out of paid ads; Meta requires cosmetic surgery ads to target adults.
• For a minor's gallery case, collect the parent's authorization and the minor's own agreement, and consider asking again at 18.
• Check your state's rules on who may consent for minors.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Platform rules on before-and-after images

HIPAA governs whether you may use the image; the platforms govern where it may appear. As checked on October 22, 2026:

Meta ads. The Health and Wellness standard (opens in a new tab) (change log last dated July 22, 2026) allows ads for cosmetic procedures and surgeries "depicting before and after transformation" when targeted to people 18 or older, and bans statements of inferiority about appearance. Meta's ad nudity standard (opens in a new tab) (last dated May 14, 2025) bars nudity, including nudity covered only by a digital overlay, and requires 18+ targeting for imagery focused on breasts, buttocks or groin.

Instagram and Facebook posts. Meta's Community Standards (opens in a new tab) allow female nipples only in specific contexts such as health contexts including mastectomy, and may label or age-restrict that content. Cover or crop accordingly.

Google ads. Google's sexual content policy (opens in a new tab) lists visible female breasts and buttocks as nudity and bars sexual content from image ads and YouTube. Its YouTube and Discover requirements (opens in a new tab) prohibit misleading before-and-after images.

Template: photo consent and authorization form

Use these fields in this order. Write in plain language and have your attorney review the final form before use.

1. Practice name and address: who is authorized to use and disclose the images.
2. Patient name and date of birth: for your records only; never published.
3. Description of images: procedure, body areas, photo and/or video, and the time span (for example, pre-operative visit through 12 months after surgery).
4. Identifiability: checkboxes for face shown, face cropped, tattoos or marks blurred.
5. Name and words: whether first name, initials, age or a quote may appear with the images.
6. Purposes and channels: separate checkboxes for website gallery, named social accounts, paid ads on named platforms, print, professional education and media.
7. Recipients: the public through the selected channels, and the vendors who host or place them.
8. Remuneration statement: include only if a third party pays the practice for the marketing.
9. Compensation to the patient: any discount or payment for participating, so it can be disclosed where ads require it.
10. Expiration: a date or event.
11. Right to revoke: in writing, how to do it, and that prior reliance and distributed print can't be undone.
12. No conditioning: "My treatment does not depend on signing this form."
13. Redisclosure: published images may be copied by others and lose HIPAA protection.
14. Signature and date, plus personal representative's name and authority if applicable.
15. Copy provided: date the patient received a copy.
16. Office use: case number, date filed, revocation log.

Use it: copy the fields onto your letterhead, and have your attorney review the final wording before patients sign it.

Where Medfy fits. Medfy rebuilds practice websites with HIPAA-compliant forms whose submissions are stored in separate, encrypted HIPAA databases, under a BAA with your practice. Medfy does not collect signatures or store your signed authorizations; keep those in your EHR or document system. Read how Medfy protects patient data, or run a free marketing audit to check your gallery and forms.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Do you need patient consent to post before-and-after photos?

Yes. Posting a patient's photos on your website, social media or ads is a use of protected health information for marketing, and HIPAA requires a signed written authorization for that under 45 CFR 164.508. A general line in the surgical consent form is not enough. The ASPS Code of Ethics separately bars revealing a patient's observed characteristics without consent.

What should a photo consent form include?

A specific description of the images, who may use them, who may receive them, each purpose and channel, an expiration date or event, the patient's signature and date, and statements about the right to revoke in writing, that treatment is not conditioned on signing, and that published images may be redisclosed. Write it in plain language, keep it separate from surgical consent, and give the patient a copy.

Can a patient revoke consent for their photos?

Yes. Under HIPAA a patient may revoke an authorization at any time in writing, except to the extent the practice already acted in reliance on it. In practice, remove the images from your website, social accounts and active ads promptly, stop new uses, and log the revocation. Printed materials already handed out cannot be recalled, which is why the form should say so.

Are cropped photos without faces still protected health information?

Often, yes. HIPAA's safe harbor treats full-face photos and comparable images as identifiers, along with any unique characteristic such as a tattoo or birthmark, and the practice must not know of a way the image could identify the patient. Patients and people close to them recognize bodies. Treat every marketing image as protected and get a signed authorization first.