Trust, Ethics & Regulation · established evidence
The Regulated Reputation: What the FTC, HIPAA, and State Medical Boards Each Govern in a Med-Spa's Reviews and Content
A med-spa's reputation is regulated by three separate authorities at once, and few practices realize all three apply simultaneously. The FTC governs how reviews and testimonials can be requested, displayed, and responded to. HIPAA governs what any public response can say about a specific patient, because acknowledging someone as a patient can itself be a disclosure. State medical boards govern what treatment claims a practice can make about its own results. Many practices respond to that pressure by going quiet, shipping thin pages, or ignoring reviews altogether. That is not compliant. It is just invisible, and it forfeits the review velocity that drives both local-pack ranking and AI-answer visibility. This piece sets out what each regulator actually requires and what a system that survives all three looks like.
The FTC: what you can and cannot do with a review
The Federal Trade Commission's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect October 21, 2024, and applies to every reviewed business, not just online platforms. It prohibits reviews from people who never used the service, including fabricated ones, reviews that are bought or procured from insiders without disclosure, incentives conditioned on a positive review, selectively suppressing or gating negative reviews while showcasing positive ones, and buying or selling fake social-media engagement. Penalties run up to $51,744 per violation, and the FTC's 2022 settlement with Fashion Nova for review-gating alone cost the company $4.2 million.
The rule also touches endorsements more broadly. The FTC's revised Guides Concerning the Use of Endorsements and Testimonials, 16 CFR Part 255, require any material connection between a practice and a reviewer, an influencer relationship, a discount for posting, a staff member's own review, to be clearly and conspicuously disclosed. For a med-spa running social content alongside its review program, both rules apply at once.
HIPAA: what a review response can never say
A med-spa is typically a HIPAA-covered entity or business associate for the treatments it performs, which means the federal Privacy Rule, 45 CFR Parts 160 and 164, governs how it can discuss any individual's care, including in a public review response. The risk is not hypothetical: confirming that someone is a patient at all, in a reply that says something like "thank you for coming in for your filler appointment," can itself be a disclosure of protected health information, because it confirms a treatment relationship the person may not have wanted made public.
The safe response strategy is narrower than most practices assume. A HIPAA-aware reply thanks the reviewer, acknowledges general feedback, and offers to continue the conversation offline, without confirming, denying, or describing any specific treatment, date, or outcome tied to that individual, regardless of what the reviewer themselves disclosed in their own post.
State medical boards: what a treatment claim can promise
Because injectables, lasers, and energy-based devices are legally the practice of medicine, treatment pages and marketing claims fall under state medical board advertising rules in addition to FTC and FDA oversight. Content that promises a specific result, before-and-after galleries posted without photo-specific consent, undisclosed practitioner qualifications, or off-label claims about a drug or device can each draw board scrutiny on their own, and the same page can violate more than one regulator at the same time.
Board rules also intersect with the ownership and supervision questions covered elsewhere in this series: physician-supervision requirements vary by state, and non-compliant "paper director" arrangements, where a physician lends a name without real oversight, are a documented 2026 enforcement focus for state boards and compliance firms alike.
Why silence is not the safe answer
Faced with three overlapping regulators, many practices respond by minimizing their public footprint: thin treatment pages, no review-response program, generic before-and-after galleries with vague captions. That instinct is understandable and it is wrong. A quiet practice does not become more compliant, it becomes invisible, and it forfeits the review velocity and content depth that classic local-pack ranking and AI-answer visibility both reward. Whitespark's 2026 practitioner survey estimates review signals at roughly 20% of local-pack ranking weight, and a steady flow of recent, real reviews is exactly what a compliant, non-gated system is built to produce.
The disclosed, real-patient-only method is what actually survives an audit from any of the three regulators, because it never depends on hiding anything. Requesting reviews from every real patient regardless of expected sentiment, responding without disclosing protected health information, and substantiating treatment claims with required qualifiers are not extra caution layered on top of a growth tactic. They are the only version of the tactic that is legal to run at all.
The evidence
Key findings, with their sources
-
The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465), effective October 21, 2024, bans fake, bought, incentivized, suppressed, or gated reviews, with civil penalties up to $51,744 per violation.
established Federal Trade Commission, 16 CFR Part 465 (2024).
-
The FTC's 2022 settlement with Fashion Nova for review-gating alone cost the company $4.2 million.
established FTC v. Fashion Nova settlement, 2022.
-
Material connections between a business and a reviewer must be clearly and conspicuously disclosed under the FTC's revised endorsement guides.
established Federal Trade Commission, 16 CFR Part 255 (rev. 2023).
-
HIPAA's Privacy Rule restricts disclosure of protected health information, including the fact that an individual is a patient, without authorization, which applies directly to public review responses.
established US Department of Health and Human Services, HIPAA Privacy Rule, 45 CFR Parts 160 and 164.
-
Google Business Profile signals account for roughly 32% and review signals roughly 20% of local-pack ranking weight in a 2026 practitioner-consensus survey.
established Whitespark, Local Search Ranking Factors, 2026 edition.
-
Physician-supervision requirements for aesthetic procedures vary sharply by state, and non-compliant "paper director" arrangements are a documented 2026 enforcement focus.
established Quarles & Brady, Med Spa Compliance Series; ByrdAdatto, 123s of Medical Spa Supervision; AmSpa, Physician Supervision.
Reference
Glossary
- Review gating
- Selectively soliciting or displaying only positive reviews while suppressing negative ones, prohibited under the FTC's 16 CFR Part 465.
- Protected health information (PHI)
- Individually identifiable health information, including the fact that someone is a patient, that HIPAA restricts a covered entity from disclosing without authorization.
- Paper director
- A non-compliant arrangement where a physician lends their name as medical director without providing real oversight of a med-spa's practice.
Straight answers
Frequently asked questions
Can a med-spa ask patients to leave reviews?
Yes, and it should, as long as the request goes to every real patient regardless of expected sentiment, is never conditioned on a positive review, and is never limited to patients likely to respond favorably. What the FTC rule prohibits is buying, gating, or manufacturing reviews, not requesting them honestly.
Can I respond to a negative review about a specific treatment?
Carefully. A HIPAA-aware response thanks the reviewer and offers to continue the conversation privately, without confirming, denying, or describing any treatment, date, or outcome tied to that individual, because doing so can itself disclose protected health information regardless of what the reviewer wrote in their own post.
Are before-and-after photos allowed?
Yes, with photo-specific written consent, used representatively rather than cherry-picked, and paired with the qualifiers a real patient result requires. Posted without consent or with promised-outcome language, they risk both an FTC and a state medical board problem at once.
Does going quiet on reviews and content protect a med-spa from regulatory risk?
No. Silence does not make a practice compliant, it makes it invisible, and it forfeits the review velocity and content depth that local-pack ranking and AI-answer visibility both reward. The safer and more effective path is a disclosed, real-patient-only system built to survive an audit, not a strategy of saying nothing.
Provenance
Sources
- Federal Trade Commission, 16 CFR Part 465 (2024) and 16 CFR Part 255 (rev. 2023) (established)ecfr.gov
- FTC v. Fashion Nova settlement, 2022 (established)
- US Department of Health and Human Services, HIPAA Privacy Rule, 45 CFR Parts 160 and 164 (established)hhs.gov
- Whitespark, Local Search Ranking Factors, 2026 edition (established)
- Quarles & Brady, Med Spa Compliance Series (established)
- ByrdAdatto, 123s of Medical Spa Supervision (established)
- American Med Spa Association, Physician Supervision (established)
Every figure above is attributed to a real, dated source and tagged with its evidence tier. Where a claim could not be verified to a primary source, it is not stated as fact.