HIPAA & Your Esthetics Practice

Do estheticians have to follow HIPAA?

The short answer is: it depends. HIPAA (the Health Insurance Portability and Accountability Act) formally applies to "covered entities" — healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses — and their business associates.

Whether a licensed esthetician qualifies as a covered entity depends on how they operate. A solo esthetician who doesn't bill insurance and doesn't exchange health information with other healthcare providers typically falls outside the formal scope of HIPAA. An esthetician working within a medical spa, dermatology practice, or plastic surgery office is more likely to be subject to it.

However, HIPAA compliance is not the only relevant standard. State laws often impose their own privacy requirements, many of which apply broadly to businesses that handle health or personal information — regardless of whether the business qualifies as a healthcare entity under federal law. California's CPRA, Texas's DPSA, and Virginia's VCDPA, for example, all carry data protection obligations that may apply to your practice.

More fundamentally: your clients expect their health and skin information to be handled with care. That expectation is a professional obligation whether or not it's a legal one.

What client data are we talking about?

As an esthetician, you routinely collect information that is inherently sensitive:

• Medical history and current medications (especially those affecting skin sensitivity)
• Skin conditions including acne, rosacea, eczema, psoriasis, and others
• Known allergies and contraindications
• Photos of the client's face and skin
• Treatment history that may reflect underlying health conditions
• Contact details and personally identifying information

This is a meaningful set of data. A client who tells you they're on Accutane, managing rosacea, or recovering from a laser procedure is trusting you with information they may not share widely. How you store, use, and protect that information matters.

What does "HIPAA-conscious design" mean?

Not every esthetics app will be formally HIPAA-compliant (which requires BAAs, audit controls, and other specific technical and administrative safeguards). But "HIPAA-conscious" design means the software was built with those principles in mind — even if it doesn't carry a compliance certification.

Practically, look for software that:

• Encrypts client data at rest and in transit
• Requires secure authentication (strong passwords, session management)
• Logs access to client records — especially sensitive actions like record transfers
• Limits data access to the specific practitioner who owns that client relationship
• Has a clear privacy policy explaining how data is used, shared, and retained
• Supports client data deletion requests
• Does not sell or share client data with third parties for advertising purposes

Record transfers and privacy

One of the highest-risk moments for client data is when records are transferred between providers. Informal methods — emailing PDFs, texting photos, sharing through consumer apps — expose client information to interception, accidental disclosure, and a lack of any audit trail.

A privacy-conscious record transfer process should involve:

• A formal initiation mechanism (like a Transfer ID) that both parties must acknowledge
• Dual confirmation — the sending provider initiates, the receiving provider accepts
• A receipt or confirmation log showing when and to whom the transfer was completed
• No transfer occurring without explicit action from both parties

Photo storage and client images

Photos of clients' faces and skin are biometric data in some jurisdictions, and personal data in virtually all. How your practice software stores and handles these images deserves specific scrutiny:

• Are photos stored encrypted and accessible only to the authorized provider?
• Can photos be shared without the provider explicitly choosing to do so?
• Are photos included in any data export or transfer protocols — and is that transfer secure?
• What happens to photos if the provider closes their account?

What you should ask any esthetics software vendor

Before committing to a practice management platform, ask these questions directly:

• Where is client data stored, and is it encrypted at rest?
• Who within your company has access to client records?
• Do you share or sell client data for any purpose?
• How do you handle a data breach?
• What is your data retention policy when a provider cancels their account?
• Can you support a client's request to delete their data?

A vendor who can't answer these questions clearly is not a vendor you should trust with your clients' data.

Skindex's approach

Skindex is built with HIPAA-conscious principles throughout — from encrypted storage and access-controlled client records to the dual-approval record transfer system and full audit logging. We believe estheticians deserve software that takes client privacy as seriously as they do.

Join the waitlist to be among the first licensed estheticians to access the platform.

Note: This guide is for general informational purposes and does not constitute legal advice. Consult a qualified attorney for guidance specific to your practice and jurisdiction.