Med Spa Consent Forms: How Often Patients Need to Sign (October 2026)
How often do patients need to sign med spa consent forms? A practical schedule by treatment type, plus how to get forms done before check-in.
TL;DR
5 key points- 01No federal rule sets how often patients re-sign. The industry default is a new consent per new treatment or product, a renewal about once a year for repeat treatments, and a new form whenever health history or the plan changes.
- 02Consent is a conversation first and a signature second. The AMA describes informed consent as a process, so a signed form without the discussion proves very little.
- 03Keep photo consent for the chart and marketing authorization as two separate signed items, because HIPAA requires written authorization for marketing uses.
- 04Send forms at booking and again the evening before, then hold treatment and checkout until the consent is signed.
- 05Store each signature with who signed, when, and which version of the form they saw. That record is what an e-signature depends on in a dispute.
Is There a Legal Schedule for How Often Patients Must Sign Consent Forms?
No. There is no federal rule that says a med spa patient must re-sign every visit, every year or every treatment, so the schedule is a policy you set inside your state's medical practice rules and your malpractice carrier's expectations. Most template vendors and industry guides land in the same place: a new form for each new procedure, product or medication, a refresh for repeat procedures at least yearly, and a new form when the patient's health history changes.
The ethics standard sits behind all of that. The American Medical Association's Code of Medical Ethics Opinion 2.1.1 describes informed consent as a process in which a discussion between patient and clinician leads the patient to agree to a specific intervention. A signature is the record of that discussion. It is not a substitute for it.
Because the rules differ by state and by who is treating, treat the schedule in this guide as a starting point for your medical director, not a finished policy. State boards also set different expectations when a nurse practitioner, a physician assistant or a registered nurse under delegation performs the treatment.
What Should a Re-Signing Schedule Look Like by Treatment Type?
Tie the schedule to the risk of the treatment and to how often the patient's situation changes, not to a calendar alone. A hydrafacial and a testosterone program do not belong on the same renewal clock. The table below is a defensible starting point to review with your medical director.
| Treatment type | New consent when | Between consents |
|---|---|---|
| Neurotoxin and filler | First time for each product, each new treatment area, then yearly | Short check that medications, pregnancy status and allergies are unchanged |
| Energy devices and lasers | Each new course, or at least yearly | Skin and sun-exposure screening at every session |
| Chemical peels and microneedling | First time for each type, then yearly | Confirm recent treatments and active medications |
| Weight-loss injectables | Start of each program and on any dose or drug change | Regular check-ins documented in the note |
| Hormone therapy and peptides | Program start, any protocol change, and yearly | Lab review and symptom check at each follow-up |
| IV and vitamin infusions | First infusion, each new formulation, then yearly | Allergy and medication confirmation at each visit |
| Photos for the chart | First visit, then with the yearly renewal | Nothing, unless the patient withdraws |
| Photos for marketing | Separate signed authorization for each use | Honor withdrawals going forward |
Two principles make the table work. First, a change in the patient's health or in the plan resets the clock, whatever the date says. Second, write the rule once and apply it to everyone. The patients most likely to bring a complaint are the ones who were treated under a looser standard than their neighbor in the waiting room.
What Belongs in a Med Spa Consent Form?
A consent form should tell the patient what the treatment is, what could go wrong, what the alternatives are, what aftercare is expected, and what it costs, in words a first-time patient can follow. If the form fails the simple test of whether a stranger would know what they are agreeing to, it is not doing its job.
The common elements are consistent across the guides we reviewed:
- Treatment name, area and expected results, including limits
- Risks, side effects and downtime, specific to the treatment
- Contraindications and the patient's own disclosures, such as pregnancy, allergies and blood thinners
- Alternatives, including not treating
- Aftercare instructions and who to call
- Payment, cancellation and refund terms
- A statement that questions were answered, with the patient's signature and the provider's
Generic is the common failure. Clinics told us that the templates bundled with their software turned out to be other practices' general forms, which did not match the products they actually used. A neurotoxin form that never mentions the product you inject, or a lipolysis form that misses your protocol, leaves the patient agreeing to something other than what happens in the room. Build forms per service, review them with your medical director, and keep a version history.
How Do You Get Patients to Complete Forms Before They Arrive?
Send the forms automatically when the appointment is booked, send a reminder the evening before, and make completion visible to the front desk. Forms that wait until check-in create the fifteen-minute clipboard queue that every owner we talk to wants gone, and they are the usual reason the first appointment of the day starts late.
Front desks describe the same friction repeatedly: forms that are missing or still pending when the patient walks in. A few habits cut that down:
- Trigger on booking, not on a person. If someone has to remember to send the link, some patients will not get it.
- Keep forms short and mobile-friendly. One nurse practitioner told us a clunky form on a large platform cost her patients, particularly for telehealth visits where the patient is filling it out alone on a phone.
- Pre-fill what you know. Name, date of birth and the service being booked should never be typed twice.
- Ask once. Let a patient initial a repeated acknowledgment one time instead of at every section.
- Show status on the schedule. A pending-forms list with a one-click resend turns a morning scramble into a five-minute task.
- Remind at a sensible hour. Evening before, not midnight.
This is the same discipline that cuts missed appointments. Our guide to reducing med spa no-shows covers the reminder timing in detail, and the booking setup mistakes post covers the confirmation messages that go out alongside the forms.
What Happens If the Forms Are Not Done at Check-In?
Hold the treatment until the consent is signed, and decide in advance who is allowed to do what while the patient finishes. The usual rule is that the patient completes forms on a tablet or phone at the desk, the provider can start the conversation and review the chart, and nobody treats or checks the patient out until the signature is on file.
Several clinics asked us for a version of the same thing: block checkout until consents are signed, but let the provider open the note early so the visit does not stall. Whether that is possible depends on your software, so ask a vendor to show it rather than describe it. If your system cannot enforce it, make it a written desk rule with a named person responsible, and audit it weekly.
Never proceed on a verbal agreement. If the patient will not or cannot sign, the treatment waits. A late signature added after the fact weakens the record more than an honest delay does.
How Often Should Consent Be Renewed for Patients With Several Services?
Track consent per service, not per patient. A patient who is current for toxin and has never signed for a laser has no valid consent for the laser, even though the system shows a signed form on file. The record needs to say which treatment each signature covers.
Multi-location clinics add a second layer. Some forms carry location-specific language, such as different cancellation terms or a different supervising physician, and a consent signed at one site may not describe what happens at another. Clinics running more than one location told us they wanted site-specific consents that attach to the right site automatically. If you run two brands or two sites, build the forms per location and name the physician or practice entity accurately on each.
The sequence for a new service on an existing patient is short: confirm the history is current, have the patient sign the service-specific consent, and document the conversation in the note. Ambient documentation can capture that conversation. Our post on AI scribes and dispute protection explains how a recorded visit note backs up the signature if a patient later disputes what was explained.
Are Electronic Signatures Valid on Consent Forms?
In most cases yes. The federal ESIGN Act provides that, for transactions in or affecting interstate commerce, a signature or record may not be denied legal effect solely because it is in electronic form. Most states have a parallel statute, and some medical boards publish their own expectations for clinical documents.
The law protects the format. It does not protect a weak record. In a dispute, you will be asked to show who signed, when, on what device, and which version of the form they saw. A scan of a clipboard page has less of that than a digital signature with a timestamp. Choose a system where every form, consent and good faith exam carries a timestamped, signer-identified trail, and store the signed document inside the patient record.
Identity matters for the same reason. For treatments that carry real risk, ask for a photo ID at check-in and keep an image of it. Some clinics count the ID upload as part of the check-in step so it never gets skipped.
Why Photo Consent and Marketing Authorization Must Be Separate
Photos taken for the chart are part of treatment. Using the same photos on Instagram or a website is marketing, and HIPAA's authorization rule at 45 CFR 164.508 requires a written authorization before protected health information is used or disclosed for marketing, with only narrow exceptions such as face-to-face communication.
That is why one blended checkbox fails. A patient who agrees to chart photos has not agreed to a billboard. Give marketing its own signed item, state where the images may appear, and let patients decline without any effect on their care. Our detailed guide to before-and-after photo consent, HIPAA and FTC rules walks through the full workflow, including how to record a withdrawal.
How Long Should You Keep Signed Consent Forms?
Keep them for as long as your state requires you to keep the medical record, which varies by state and by patient type, and confirm the period with your state board or attorney. Many clinics keep adult records for several years past the last visit, and longer for minors. Do not guess, and do not let a former employee's inbox be the only home for a signed form.
HIPAA adds its own clock for HIPAA paperwork. Under 45 CFR 164.530(j), a covered entity keeps required documentation for six years from the date it was created or last in effect, whichever is later. Storing consents inside the patient chart means one retention rule covers both the form and the visit.
What Do High-Risk Programs Add to the Consent Picture?
Programs built around prescriptions add screening before the consent, not just a signature. A GLP-1, testosterone or peptide patient should answer condition-specific questions first, and the consent should reflect the answers. Our guide to screening GLP-1, TRT and peptide patients online covers the question sets and what routes a patient to a no-treat decision.
When an adverse event happens, the consent is the first document anyone reads. The adverse event reporting process for med spas explains what to document and who to notify, and a consent that names the specific risk makes that conversation shorter.
If a nurse or aesthetician is treating under delegated authority, the good faith exam and the consent have to line up in time and scope. Clinics that use a telehealth exam partner should confirm how the exam is completed before the patient arrives. The good faith exam workflow from Decoda Health supports the partner exams that many states expect.
How Decoda Health Handles Intake Forms and Consent
Decoda Health sends intake forms automatically when a patient books, builds forms in a visual editor with conditional logic, e-signature fields, photo uploads and consent sections, and shows which patients have forms pending with a resend option. Progress saves automatically on the patient's phone, and completed answers flow into the patient record without retyping.
The digital intake forms and e-signatures feature sits next to check-in, so the front desk sees completion status when the patient arrives. Every form, consent and good faith exam carries a timestamped, signer-identified audit trail. Your medical director still decides the wording and the renewal schedule, and Decoda Health holds the record.
Final Thoughts on Setting a Med Spa Consent Schedule
Write the schedule down in one page: a new consent for each new treatment, a yearly renewal for repeat services, a reset whenever health or the plan changes, and a separate signed authorization for marketing photos. Then pick the single weak spot, usually forms still pending at check-in, and fix that first by sending forms at booking. This week, pull ten charts and check whether the consent on file matches the treatment that was actually performed.
If you want to see how Decoda Health handles forms, consent and check-in in one workflow, you can book a demo here.
Frequently Asked Questions
How often do med spa patients need to sign consent forms?
No federal rule sets a signing schedule, so the interval is your policy within your state's rules. A workable default is a new consent for every new treatment type or product, a fresh signature for repeat treatments about once a year, and a new form any time the patient's health history, medications or the treatment plan changes. Ask your medical director and attorney to confirm it for your state.
Do patients need a new consent form for every visit?
Not usually. A patient who comes in every twelve weeks for the same neurotoxin treatment can sign once and renew annually, provided nothing has changed in their history. The visit still needs a documented check, such as a short confirmation that medications, pregnancy status and allergies are unchanged. Higher-risk or series treatments, such as energy devices or weight-loss injectables, are more often re-consented at each new course.
Are electronic signatures valid on med spa consent forms?
Yes in most cases. The federal ESIGN Act says a signature or record cannot be denied legal effect only because it is electronic, and most states have their own version of the law. What makes an e-signature hold up is the record around it: who signed, when, from which device, and exactly which version of the form they saw. Store those details with the signed form.
Should photo consent be a separate form?
Yes. Consent to photograph a patient for their chart is a clinical matter, while using those photos in marketing needs a separate written authorization under HIPAA. If both sit inside one checkbox, a patient who agrees to the first has not agreed to the second. Keep them as separate signed items so you can honor a refusal for marketing without losing the chart photos.
What should a med spa do when a patient arrives without signing their forms?
Decide the rule before it happens. Most clinics let the patient complete forms on a tablet or phone in the waiting room, let the provider begin the conversation, and hold treatment and checkout until the consent is signed. Never treat on a verbal yes. If forms are late more than occasionally, move the send time earlier and add a reminder the evening before.
How long should med spas keep signed consent forms?
Retention is set by state law, usually as part of medical record retention, and the periods vary widely, so confirm yours with your state medical board or attorney. HIPAA separately requires covered entities to keep required HIPAA documentation for six years. Keep consents with the patient record, not in a separate folder, so they are retained and produced together.