Most answers to this question online say "yes, they offer a BAA" and leave it there. That's technically accurate and practically incomplete. Mindbody does offer a Business Associate Agreement. But per Mindbody's support documentation, the BAA covers its HIPAA-enabled SOAP and progress notes, not the whole platform, and it never covers how your practice uses the software day to day. The gap between those two things is where medspa owners tend to have real risk. For the bigger picture on medspas and Grove, start here.
Mindbody signs a BAA, which a HIPAA covered entity needs from any vendor that stores PHI for it. Per Mindbody's support documentation, that BAA covers its HIPAA-enabled SOAP and progress notes, not the whole platform. A BAA also doesn't make your workflow compliant. The risk for most medspas is in how treatment information, before/after photos, and patient communications move through the practice day to day.
Mindbody offers a Business Associate Agreement (BAA) to covered entities. HIPAA applies to your medspa if it is a covered entity, which for a provider usually means it bills or checks coverage with insurers electronically. Many cash-pay medspas aren't, but state privacy laws can still apply, and HIPAA-grade handling is the safe default.
What Mindbody's BAA covers, per its Terms of Service and support documentation:
The BAA is real and it matters. Confirm its current scope with Mindbody in writing before you sign, because it's only part of the picture.
Mindbody's BAA covers its HIPAA-enabled SOAP and progress notes. It doesn't cover your practice's handling of PHI in workflows that run alongside or outside those features. Three gaps matter most for medspas: charting, because in our assessment Mindbody has no medspa charting (injection mapping, photo markup, provider sign-off); before/after photos stored outside the covered notes; and patient texts and emails sent through channels outside Mindbody.
Mindbody has SOAP and progress notes, but in our assessment no medspa charting (injection mapping, photo markup, provider sign-off). If your NPs and APRNs are documenting treatments, patient histories, medication records, and consent notes outside those notes: where do those records live? If the answer is a Word document, a Google Form, or a separate app that you set up yourself without a BAA in place, the Mindbody BAA doesn't cover that.
Photos kept outside Mindbody's HIPAA-enabled notes fall outside its BAA. Most medspas store before/after photos on staff iPhones, share them via text message, and keep them in iCloud or Google Drive. None of those channels are HIPAA-compliant without specific configuration and covered agreements. The photo itself can contain PHI (patient identity, treatment area, date taken), and the transmission channel matters as much as the storage location.
Text messages and emails sent through platforms outside Mindbody need their own HIPAA analysis. Texting treatment details from a personal phone creates risk: the message sits on an unmanaged device, and HIPAA only allows unencrypted texts to patients who've been warned of the risk and agreed. Your Mindbody BAA doesn't change that.
The highest HIPAA risk in the average medspa using Mindbody sits in the gap between Mindbody's scheduling system and the clinical documentation systems the practice has built around it, such as Aesthetic Record, Google Workspace, or a shared Dropbox. Each system may have its own agreement in place, but the PHI moving between them through texts, personal email, and exported spreadsheets has no consistent oversight.
The pattern we see most often: a medspa uses Mindbody for scheduling and a separate platform for treatment notes and photos, and staff move patient information between the two by hand.
The scenarios that create real exposure:
None of these scenarios are covered by the Mindbody BAA. All of them happen routinely in practices that believe they're compliant because they signed the BAA.
Yes, when a covered entity holds them. Identifiable photos in a patient's record are PHI, and full-face photos are a listed HIPAA identifier. They also show the treatment date, the area treated, and sometimes the treatment given. Keeping these photos on personal staff iPhones, in personal texts, or in personal iCloud, Google Drive, or Dropbox accounts without a BAA is hard to defend in an audit.
What common practices actually look like from a compliance standpoint:
What compliant photo management looks like:
Boulevard addresses the before/after photo problem directly. Every Aesthetics (medspa) plan includes photo markup and sign-off tied to the client record. Photos live in the platform, attached to the appointment and the patient record, accessible to authorized providers without leaving the covered system. NPs and APRNs who reviewed the platform specifically named the photo gallery as the feature that eliminated the iPhone workflow entirely.
On charting: every Boulevard Aesthetics plan includes forms and charting, photo markup and sign-off, and HIPAA compliance, starting at $199/month ($179 billed annually) for up to 3 providers. Charting isn't a paid add-on on these plans. For medspas currently running Mindbody alongside a separate charting app, this collapses the two-system gap into one covered system and removes the daily data transfer that creates exposure in between.
A medspa on Boulevard can document a treatment, photograph the result, capture the patient's digital consent, and get MD sign-off, all within one platform under one BAA. The PHI never leaves the covered environment for standard clinical workflows. That's the difference from Mindbody plus a separate EMR plus a shared photo folder.
This doesn't mean Boulevard is the only compliant option. Aesthetic Record, PatientNow, and Jane App all offer HIPAA-compliant clinical documentation with their own BAAs. The difference with Boulevard is that it handles scheduling and clinical documentation in one platform, which eliminates the data-transfer gap that creates the most common compliance risk. See the full cost and feature comparison or the five-platform alternatives roundup for how these options stack up beyond HIPAA specifically.
Whether a medspa stays on Mindbody or switches, four steps cover the gaps a Mindbody BAA leaves open: audit every place PHI lives, including texts, personal email, and shared folders; get a BAA with every vendor that touches PHI before PHI enters the system; set a before/after photo protocol; and confirm that data moving between the scheduling and charting systems travels by a covered method.
If your question is what happens to five years of patient records once you commit to a switch, that's separate from HIPAA. The medspa owner FAQ walks through it directly.
Not just in your software. In how your team communicates about patients day to day. Text messages, personal email, shared folders, phone apps. Map every place a patient's name, photo, or treatment information appears, and check whether each channel has a covered agreement.
Not just your booking platform: your email provider if it carries PHI, your cloud storage platform, your photo management tool, your text messaging service if it's used for clinical communication. The BAA must exist before PHI enters the system, not after.
Either move to a platform with a native, compliant photo gallery (Boulevard, Aesthetic Record), or implement a formal MDM policy for staff devices and a covered storage system. The current workaround (personal iPhones, personal text, personal cloud storage) needs to stop before the next audit, not after.
If you're using Mindbody with a separate clinical documentation platform, confirm that both platforms have BAAs and that the method of data transfer between them is covered. A CSV export dropped into your email is not a covered transfer method, even if both endpoints are covered systems.
The HIPAA question is usually part of a larger evaluation: what platform handles the clinical side, what it costs to get there, and whether the switch makes sense for your specific practice. Answer 8 questions and the free assessment below walks through your specific setup in about two minutes. Our medspa FAQ covers the other questions owners ask most before switching.
Grove only gets paid when a business switches through us to Boulevard. If that's not the right platform for your practice (because another platform handles your clinical needs better, or because the timing doesn't make sense), we'll tell you that.
No email required. Results appear on the page in about 30 seconds.
Want to talk it through instead? Start with the assessment and you'll see the option to book a 20-min call after.