SMS, HIPAA and Ad Rules: A Checklist for MedSpa Marketing

A campaign that fills your calendar can also create legal exposure or get your ad account restricted. Use this as a checklist to bring to your counsel, not as legal advice.

Text messages and the TCPA

The Telephone Consumer Protection Act and FCC rules govern many marketing calls and texts.

• Check your consent. Automated marketing texts generally require prior express written consent. A patient giving you a phone number when booking isn't automatically consent to marketing texts.
• Know that the rules changed. The FCC's 2024 "one-to-one" consent rule was vacated by the Eleventh Circuit and removed in 2025. The earlier written-consent requirement still stands, and court decisions can differ by circuit.
• Respect quiet hours. Federal rules limit telephone solicitations to between 8 a.m. and 9 p.m. in the recipient's local time. Some states are stricter.
• Honor opt-outs quickly. Make stopping easy, and keep records.
• Check your state. Several states have their own telemarketing laws.

Patient data and HIPAA

If your clinic is a HIPAA-covered entity, or a vendor handles patient data on its behalf, marketing rules may apply. Clinics that only take cash payments may not be covered, so ask counsel to confirm your status, and check state privacy laws too.

• Marketing generally needs written authorization. The stated exceptions are face-to-face communications and promotional gifts of nominal value.
• Treatment communications are narrower than they look. Some communications about a patient's own treatment are not treated as marketing, but a payment from a third party can change the answer.
• Sign the right contracts. Vendors handling protected health information on your behalf generally need a business associate agreement.
• Watch your website. Be careful about tracking tools on booking and health-related pages.

Meta ads

Meta's Advertising Standards say ads can't assert or imply personal attributes, including physical or mental health and medical conditions. Meta's own example shows the line: "New diabetes treatment available" is allowed, while "Do you have diabetes?" isn't.

So avoiding drug names isn't enough on its own. Copy that speaks directly to someone's body or recent weight loss can raise the same issue.

Those examples are for discussion, not pre-approved copy. Meta also restricts asking for health information on lead forms without permission, and has separate requirements for prescription drug ads. Check current rules on Meta's Transparency Center before launching, as they change.

Before you launch

1. Document the consent source for every contact.
2. Have counsel confirm your HIPAA status and marketing authorizations.
3. Sign vendor agreements.
4. Have your medical director approve clinical claims.
5. Review all ads against current platform policies.
6. Test opt-outs and quiet-hour settings.
7. Keep records of what was sent, to whom and when.