A med spa intake form does three jobs a dermatology or primary care form doesn't: it records aesthetic goals and past treatments, it hands the screening questions to your medical director, and it sets up separate permission for before-and-after photos. Med spas also ask a question other practices rarely do: does HIPAA even apply to us? This guide answers that with sources and gives you a template to copy. Search demand for "med spa intake form" is small, about 20 searches a month in the US at $25.26 a click (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026), so most med spas build their own.
What a med spa intake form should cover
- Client details: contact information, emergency contact, how they heard about you (optional)
- Goals: what they want to change and which treatments they're curious about
- Treatment history: what they've had before, where and roughly when
- Medical screening: set by your medical director
- Policies and acknowledgments: cancellations, deposits, privacy notice, communication preferences
Keep photo consent and treatment-specific consents out of this form. They need their own documents, and combining a HIPAA authorization with other paperwork can invalidate it.
Treatment history and goals
The history section helps your injector or provider plan the consultation:
- Treatments interested in today (checklist of your services)
- What would you like to improve? (free text)
- Previous aesthetic treatments: type, approximate date, where performed
- Any treatment you were unhappy with, and why (optional)
- Upcoming events or timing considerations (optional)
Use plain categories that match your menu. A client who ticks "lines and wrinkles" and "skin texture" gives the provider more to work with than one forced to pick product names.
Medical screening questions (set by your medical director)
This section must come from your medical director's protocols, including which conditions, medications, pregnancy status, allergies and recent procedures require a provider review before treatment. We don't supply screening or contraindication criteria, and staff shouldn't copy them from another clinic's form or a product brochure.
What the form can standardize is the structure:
- Medications and supplements, with doses
- Allergies, with reactions
- A yes/no list your medical director writes, each "yes" flagged for provider review
- "Anything else your provider should know?"
- A statement that the client will update the provider if anything changes before a later appointment
Decide in advance who reviews flagged answers, and that treatment waits until they have.
Photo consent for before-and-after images
Clinical photos and marketing photos are different uses. A photo taken to document treatment can live in the chart; posting it on Instagram is marketing.
If HIPAA applies to your med spa, an identifiable photo is protected health information, and "full-face photographs and any comparable images" appear on HIPAA's list of identifiers (45 CFR 164.514(b)(2) (opens in a new tab)). Using it in marketing requires a signed authorization under 45 CFR 164.508(a)(3) (opens in a new tab), and an authorization "may not be combined with any other document" except in limited cases. That's why the photo release belongs on its own page, offered after treatment.
If HIPAA doesn't apply, get written permission anyway, with the same level of detail: which photos, which platforms, whether the face shows, and for how long. Our guide to the HIPAA authorization for marketing lists every element, and our guide to photo consent forms covers the aesthetic specifics.
Treatment-specific consent forms
Each procedure category you offer (neurotoxins, fillers, lasers, peels, microneedling or others) typically has its own consent: what the treatment involves, expected results, risks your medical director lists, aftercare and alternatives. Those documents come from your medical director and attorney, often informed by the product manufacturer's labeling.
The intake form's role is to route the client to the right consent, not to replace it. A simple line works: "You'll review and sign a consent form for each treatment before it begins."
Does HIPAA apply to your med spa?
HIPAA applies to "covered entities," and for providers the test is specific. A covered entity includes "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" (45 CFR 160.103 (opens in a new tab)). A transaction means "the transmission of information between two parties to carry out financial or administrative activities related to health care."
CMS puts it in one line: "Providers who submit HIPAA transactions, like claims, electronically are covered" (CMS (opens in a new tab)). Its Covered Entity Decision Tool (opens in a new tab) asks two questions: does the business furnish, bill or receive payment for health care, and does it transmit any covered transactions electronically? The covered transactions include health care claims and health plan eligibility inquiries. If a billing company or clearinghouse sends them for you, you are still "considered to be conducting the transaction in electronic form."
In practice:
| Your med spa | Likely HIPAA status |
|---|---|
| Bills any health plan electronically, directly or through a biller | Covered entity |
| Checks insurance eligibility electronically | Covered entity |
| Cash-only, never bills or checks insurance electronically | May not be a covered entity |
| Part of a physician practice that bills insurance | Usually covered through the practice |
Two cautions. First, status can change: adding one insurance-billed service can make the whole business a covered entity. Second, state law applies either way. Washington's My Health My Data Act, for example, protects "consumer health data," which includes data about surgeries and other health-related procedures, held by businesses HIPAA doesn't cover (RCW 19.373.010 (opens in a new tab)). If your status could change, running HIPAA-level safeguards from the start is the simpler path. More on the definitions in who HIPAA applies to.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Free med spa intake form template
Copy this into your booking system, intake tool or word processor. It is a starting point: your medical director must write the screening section, and your attorney should review the policies and acknowledgments.
Section 1: Client details
- Legal name; preferred name; date of birth
- Mobile phone; email; address
- Emergency contact: name, relationship, phone
- How did you hear about us? (optional)
Section 2: Goals and history
- Treatments you're interested in: [your service checklist]
- What would you like to improve?
- Previous aesthetic treatments (type, approximate date, where)
- Upcoming events or timing we should plan around (optional)
Section 3: Medical screening (written by your medical director)
- Medications and supplements (name, dose)
- Allergies and reactions
- [Medical director's yes/no screening list; each "yes" reviewed by a provider]
- Anything else your provider should know?
- I'll tell my provider if anything above changes before future treatments
Section 4: Policies and acknowledgments
- I have read the cancellation and deposit policy
- I received the privacy notice
- I understand I'll sign a separate consent for each treatment
- OK to text appointment reminders
- OK to email (email may not be encrypted)
- Signature; printed name; date
Photo release: separate document, offered after treatment.
Where Medfy fits. Medfy provides HIPAA-compliant website forms: submissions go to an access-controlled patient CRM and inbox, patient information is stored in separate, encrypted HIPAA databases in the US or Canada, and Medfy signs a BAA with each practice. Medfy does not offer e-signatures, insurance-card capture or full digital intake packets; for signed treatment consents and photo releases, use a dedicated intake tool that signs a BAA. For the rest of intake, see our patient intake form templates; for growing bookings, see med spa marketing or run a free marketing audit.
Frequently asked questions
What should a med spa intake form include?
Contact details and an emergency contact, the client's goals and the treatments they're interested in, past aesthetic treatments with approximate dates, a medical screening section written by your medical director, communication preferences, and acknowledgments of your policies and privacy notice, with a signature and date. Photo consent for marketing and treatment-specific consents should be separate documents, not boxes buried in the intake form.
Do med spas have to follow HIPAA?
Only if the med spa is a covered entity, which for a provider means it transmits health information electronically in connection with a standard transaction, such as billing a health plan or checking eligibility, directly or through a billing company. Many cash-only med spas may not be. State health-privacy and consumer-privacy laws can apply either way, so confirm your status with an attorney.
Do I need separate consent to use client photos in marketing?
Yes. A clinical photo taken for the chart doesn't give you permission to post it. If HIPAA applies, using an identifiable photo in marketing requires a signed authorization with specific elements, kept separate from other forms. If it doesn't, get written permission anyway, specifying where the photo will appear and for how long. Have your attorney review the form before you use it.