A compliant workflow for a first-time Botox client needs four separate pieces, not one form: a medical history and screening questionnaire, a procedure-specific informed consent that names the drug and its specific risks, a standalone photo/video authorization for before-and-after documentation, and, if you are a covered entity, an acknowledgment of your HIPAA Notice of Privacy Practices. A general wellness intake, the kind built for a facial or a massage, covers none of the second, third, or fourth items on its own, and it needs to run through software that has signed a Business Associate Agreement with your practice, rather than a form builder that happens to have an SSL certificate.
Part of a bigger picture: see the Medspa Compliance Guide for the other decisions in this cluster.
This page is written for medspa owners and operators evaluating their booking and forms software, not as legal advice. Scope-of-practice rules, supervision requirements, and consent-form specifics vary by state and sometimes by county. Talk to your state medical board and a healthcare attorney or compliance consultant before finalizing your actual consent documents.
Why isn't a general wellness intake form enough for a Botox client?
A general wellness intake form isn't enough for a first-time Botox client because a Botox form collects medical history, medications, and a treatment plan for a specific procedure. If your medspa is a HIPAA covered entity, that information tied to a client's identity is protected health information. A Botox client also needs informed consent for a specific injectable, with risks that differ from a chemical peel or a HydraFacial.
A wellness intake for a facial asks about skin type and allergies in the loosest sense. A Botox form has to do more than confirm the client is over 18 and doesn't have a nut allergy. It has to establish consent for a specific drug, administered by a specific type of provider.
HIPAA applies if your medspa is a covered entity, which for a provider usually means it bills or checks coverage with insurers electronically. Many cash-pay medspas aren't, but state privacy laws can still apply, and HIPAA-grade handling is the safe default.
What needs to be in a first-time Botox consent packet?
A first-time Botox consent packet needs four separate documents: a medical history and screening questionnaire, a procedure-specific informed consent that names the drug and its neurotoxin risks (temporary bruising, asymmetry, eyelid ptosis, headache, and in rare cases spread of the toxin beyond the injection site), a standalone photo/video authorization with tiered opt-in, and, for covered entities, a signed acknowledgment of the HIPAA Notice of Privacy Practices.
The medical history and screening section needs an allergy and contraindication checklist (lidocaine sensitivity, latex allergies, prior adverse reactions) plus pregnancy and breastfeeding screening and a current medications list, since some medications affect bruising and bleeding risk. None of that is exotic; it's standard injectable practice. What trips up practices moving from paper to digital, or migrating between platforms, is treating this as one form when it's structurally four.
The photo authorization is its own document. Treat it that way.
Before-and-after images used for marketing require a separate written authorization that should not be bundled into the treatment consent, because marketing use falls outside the treatment relationship itself. A valid authorization under 45 CFR §164.508 needs six core elements plus three required statements. A checkbox at the bottom of an intake form doesn't clear that bar. Patient photos can also count as PHI even when they're not full-face shots; a distinctive tattoo, a piece of jewelry, or any other identifying detail in frame can be enough.
The cleanest structure practices use is a three-tier opt-in (medical record only, internal training use, external marketing use) with each tier initialed separately, so a client who's fine with her chart photo being used for staff training isn't automatically opted into an Instagram before-and-after. On timing: many practices avoid asking for marketing consent right before the procedure, when a client may feel pressure to agree. They ask during a follow-up visit instead, once the client is confident in the result and not mid-appointment.
Whatever your policy, HIPAA requires retaining a signed authorization for six years from when it was created or last in effect, whichever is later (your state may require longer), and every authorization needs to tell the client she can revoke it in writing, with the revocation honored going forward from that date.
Who is allowed to inject Botox, and how does that affect the consent workflow?
Consent covers what the client agreed to; state law decides who may hold the syringe. Across most states, a physician can delegate an injection to an RN, NP, or PA whose license permits it, within that state's supervision rules, which range from on-site oversight to remote availability, and some states set a maximum distance or response time. The consent workflow should put the delegating physician or medical director's name on record.
The pattern that shows up across most states: delegation can't expand scope of practice. A physician can delegate an injection to someone whose license already permits it, often a registered nurse, nurse practitioner, or physician assistant, but only within that state's supervision rules. Those rules differ on who may inject, how much physician involvement is required, and whether the supervising physician must be on site; some states set a maximum distance or response time for the supervising physician. AmSpa's state-by-state summaries list each state's current rule.
None of that is legal advice for your specific state, and the rules shift often enough that citing a specific state's requirement here would be stale within a year. What's worth doing operationally: put the delegating physician or medical director's name on record as part of your consent workflow, confirmed against your current state board rule, not copied from another practice's paperwork.
How do Boulevard, Mangomint, GlossGenius, Vagaro, and Zenoti handle digital consent?
Boulevard includes medical consent forms, charting, and photo markup on every Aesthetics (medspa) plan. Mangomint includes Forms & Charting for every customer, with HIPAA enabled after you sign its BAA. GlossGenius puts photo markup and MD sign-off on its two Practice plans. Vagaro offers Dual Signature forms with a timestamp on every signature. Zenoti sends consent forms by SMS or email and charts injectables with lot, dosage, and provider as discrete fields.
Boulevard's Aesthetics plans
Boulevard sells medspas a separate plan family, Aesthetics, and every tier includes forms and charting, photo markup and sign-off, and HIPAA compliance, starting at $199/month ($179 billed annually) for up to 3 providers. Its Salon & Spa plans differ: there, forms are a $65/month per-location add-on on Essentials and Premier. On an Aesthetics plan, the form builder supports customizable online forms with consent checkboxes, cancellation policies, and legal acknowledgments, image markup to indicate treatment points, and routing forms and charts to a designated reviewer for approval, which fits the physician sign-off layer described above. Before you rely on it, confirm you're on an Aesthetics plan and that the BAA is executed on your account, not only available.
Mangomint
Mangomint includes Forms & Charting in its plan for every customer: customizable intake forms, charting, and image markup. HIPAA compliance is opt-in: you sign Mangomint's BAA and support enables it, and Mangomint lists no extra fee for it. The base plan and the compliant version cost the same; the difference is a signed agreement and a support request.
GlossGenius
GlossGenius markets itself with deeper clinical feature depth out of the gate: photo markup, MD sign-off workflows, patient e-signatures, digital intake, and secure PHI storage positioned as core to its medspa offering rather than a bolt-on. Charting, photo markup, and MD sign-off sit on its two Practice plans ($168 and $298/month); its free HIPAA/BAA add-on starts at the Gold plan. Take vendor-vs-vendor claims about "feature depth" with the appropriate grain of salt regardless of which platform is making them; the practical test is whether the specific consent and sign-off structure your practice needs is actually configurable, not how a comparison blog ranks it.
Vagaro
Vagaro's relevant feature is Dual Signature forms (Forms is a $10/month add-on; SOAP notes come in every plan): both provider and client sign, with a timestamp generated on every signature and password protection on the record. That dual-signature structure maps reasonably well onto a physician or medical-director countersignature requirement, which is useful if your state's supervision pattern calls for documented sign-off rather than just on-call availability.
Zenoti
Zenoti's digital consent form builder sends forms by SMS or email ahead of the appointment, captures e-signature on a tablet or via link, and feeds responses directly into the client record, with templates customizable by treatment type. Its charting is structured specifically for injectables, capturing product, dosage per site, lot number, expiry, and administering provider as discrete fields, which is closer to what a medical-record audit actually wants to see than a single free-text note.
Across all five, the shared thread is that "HIPAA compliant" as a platform-level claim usually means encrypted storage, access controls, and a BAA. It does not mean the specific consent language, risk disclosures, or photo-authorization tiers are legally sufficient for your state and your procedure out of the box. The software gives you the container. The content of the consent is still yours to get right, ideally with input from whoever is medically directing the practice.
"If a client has a complication and you can't produce timestamped consent forms with the specific treatment risks disclosed, you're exposed." Common guidance across medspa compliance resources
How do you set up a Botox consent workflow step by step?
To set up a first-time Botox consent workflow, split the paperwork into four documents, name the specific neurotoxin and its risks in the consent, build the photo authorization as a standalone three-tier opt-in, capture everything through software with an executed BAA, collect signatures and timestamps before the appointment, record the supervising physician's name, and retain signed authorizations for six years from creation or last effect, whichever is later.
- Split your first-time-client paperwork into four distinct documents: medical history, procedure-specific informed consent, photo/video authorization, and privacy notice acknowledgment.
- Name the specific neurotoxin (Botox, Dysport, Xeomin, etc.) in the consent language and disclose the risks specific to that drug class. Don't reuse a generic aesthetic-procedure template.
- Build the photo authorization as a standalone form with a three-tier opt-in (medical record, internal training, external marketing), each initialed separately.
- Capture all four documents through software with a signed, active BAA. Confirm it's executed on your account, not just listed as available on a features page.
- Require signatures and timestamps before the appointment, not verbally in the treatment room.
- If an NP, RN, or PA is administering the injection, confirm your current state's supervision or delegation requirement with your state board and put the supervising physician's name on record.
- Set a retention policy of at least six years for signed consent and photo authorizations, and check whether your state's medical-record law requires longer.
- Don't ask for marketing photo consent in the same conversation as the procedure consent. Build a separate follow-up touchpoint for it.
Is a general liability waiver enough for a first-time Botox client?
No. A liability waiver protects the business from a slip-and-fall claim, not from a client alleging she wasn't told about eyelid ptosis or toxin spread before a neurotoxin injection. Injectables require a procedure-specific informed consent that names the drug and discloses its specific risks (asymmetry, bruising, headache, ptosis, and rare spread beyond the injection site), separate from any general wellness or studio waiver.
Do medspas need a Business Associate Agreement with their booking or forms software?
Yes, if your practice is a HIPAA covered entity and the software stores or transmits protected health information, which a Botox consent, medical history questionnaire, or before/after photo almost always is. HHS's own guidance on covered entities and business associates lays out when that agreement is required. Free form builders aren't covered by a BAA. Google Forms is covered only on a paid Google Workspace account with Google's BAA accepted, and Typeform signs BAAs only on Enterprise plans. Mangomint and GlossGenius publish that they sign BAAs, and Boulevard lists HIPAA compliance on every Aesthetics (medspa) plan; ask Vagaro and Zenoti directly. Confirm the BAA is executed on your account rather than offered in theory.
How long do medspas have to keep signed consent and photo authorization records?
HIPAA requires covered entities to retain a signed authorization for six years from when it was created or last in effect, whichever is later. Many states layer their own medical-record retention rules on top of that federal floor, and some run longer. Check your state medical board's requirement rather than assuming six years is the ceiling everywhere.
Can marketing consent for before-and-after photos be bundled into the treatment consent form?
It shouldn't be. Marketing use of a patient photo falls outside the treatment relationship, so it needs its own written authorization with its own signature, not a checkbox buried inside the procedure consent. Best practice is a three-tier opt-in (medical record only, internal training, external marketing) with each tier initialed separately, and many practices wait until a follow-up visit, when the client is confident in the result, rather than asking right before the injection.
Does an NP, RN, or PA doing the injecting need a physician's name on the consent form?
In most states, yes in substance even if not on the form itself. A common pattern is that RNs, NPs, and PAs can inject under a supervising physician or medical director's delegation, with requirements ranging from on-site oversight to remote availability, and some states set a maximum distance or response time for the supervising physician. A handful of states allow more independent scope for certain license types. This varies significantly by state and by license type, so confirm your specific state board's current rule rather than copying another practice's policy.