Connecticut's medical spa law, C.G.S. § 19a-903c, requires every med spa to post the names and specialty areas of the physicians, physician assistants, APRNs and registered nurses who perform cosmetic medical procedures, both at the spa and on any website it maintains. Every advertisement must either include that information or state that it is on the spa's website and list the address. Around that core rule sit federal limits on before-and-after photos and reviews, plus Connecticut's health-data privacy law, which reaches many cash-pay spas regardless of size.
This guide is for owners and managers of med spas in Greenwich, Stamford, Westport and across Fairfield County who want a site that fills the schedule without creating a compliance problem. It explains what each rule means for the pages, forms and ads you publish. It isn't legal advice, so have your healthcare attorney confirm how each rule applies to your practice.
What Connecticut's med spa law requires
Section 19a-903c defines a medical spa as any establishment where cosmetic medical procedures are performed, other than a hospital or other licensed health care facility. The list of cosmetic medical procedures is broad: cosmetic injections, fillers and neurotoxins, laser hair removal, laser skin resurfacing, intense pulsed light, sclerotherapy, dermaplaning, dermarolling and dermastamping, chemical peels stronger than a stated threshold (above 30 percent concentration with a pH below 3.0) and class II devices designed to alter deep skin tissue, among others. The law was enacted as Public Act 14-119 in 2014 and amended in 2015.
A licensed clinician on staff or under contract
Every med spa must employ or contract with a Connecticut-licensed physician, physician assistant or APRN who actively practices in the state and has training and experience in cosmetic procedures.
Who may perform procedures
Only that physician, PA or APRN, or a Connecticut-licensed registered nurse.
An in-person assessment first
A physician, PA or APRN employed by or under contract with the spa must perform an initial in-person physical assessment of each client before the procedure.
Posted provider information
Names and specialty areas of everyone performing cosmetic procedures, posted conspicuously at the spa, on the website, in advertising and in a written notice given before each procedure.
The provider disclosure your website must show
The statute covers "any physician, physician assistant, advanced practice registered nurse or registered nurse performing cosmetic medical procedures." A team page featuring only the medical director doesn't meet that. Every injector and laser nurse belongs on the list, with their credentials and specialty areas, and the list has to change the day someone joins or leaves.
The reliable way to do this is a single provider list in the CMS. The providers page, the "performed by" line on each treatment page, the booking form and the pre-procedure notice all read from that one source, so updating one record updates everything. An "Our medical providers" link in the site footer puts the information one click from every page.
| Requirement | Source | Where it lives on the site |
|---|---|---|
| Names and specialty areas of every provider performing cosmetic procedures | C.G.S. § 19a-903c(d) | Providers page linked from every page; "performed by" on treatment pages |
| Provider info in every ad, or the website address where it's posted | § 19a-903c(d)(1) | Ad templates, social bios, email footers |
| Written notice before each procedure | § 19a-903c(d)(2) | Pre-visit forms generated from the same provider list |
| Initial in-person assessment by a physician, PA or APRN | § 19a-903c(c) | New-client booking starts with a consultation |
| Before-and-after photos that reflect typical results | FTC Endorsement Guides, 16 CFR 255.2 | Gallery captions and disclosures |
| No fake, bought or suppressed reviews | FTC rule, 16 CFR Part 465 | Review requests sent to every client |
| Consent before processing health data | CTDPA, C.G.S. §§ 42-520 and 42-526 | Booking and intake forms, tracking tags |
Treatment pages that convert and stay accurate
A treatment page earns bookings when it answers the questions clients actually ask: what it treats, how many sessions it takes, downtime, typical results, price range and who performs it. It stays compliant when the booking flow matches the law. Because an initial in-person assessment by a physician, PA or APRN has to come before the procedure, a new client's first booking should be a consultation, not "Book Botox now." Returning clients who have been assessed can book treatments directly.
Be precise about which services count as cosmetic medical procedures. A light facial peel and a peel above the statutory strength threshold belong on different pages with different booking rules, and your site should make that difference obvious.
Before-and-after photos: consent and typical results
Galleries sell treatments, and they are the most regulated content on the site. Under the FTC's Endorsement Guides (16 CFR 255.2), an ad featuring a customer's experience is likely to be read as showing what people generally achieve. If you can't substantiate that the result is typical, you must clearly and conspicuously disclose the results people can generally expect. Caption each set with the treatment, number of sessions and time since treatment, and don't retouch the result.
Get written permission from each client to use their photos in marketing, keep it with their record, and remove the photos promptly if they withdraw it. If your spa is a HIPAA covered entity, marketing use of patient photos generally requires a HIPAA-compliant authorization, so ask your attorney for the right form.
Reviews: what the FTC's 2024 rule changed
The FTC's Consumer Reviews and Testimonials Rule took effect on October 21, 2024. It prohibits fake reviews and testimonials, paying or discounting for reviews that express a particular sentiment, undisclosed reviews by staff or their families, company-controlled review sites posing as independent, suppressing negative reviews through threats or false accusations, and fake social media followers. Courts can impose civil penalties for knowing violations.
Asking every client for a review is fine; the FTC's guidance treats a general request to all customers as acceptable. Asking only the clients you think are happy isn't banned by the rule itself, but the FTC warns it could still violate the FTC Act. Send the same post-visit review request to everyone and never tie a discount to a five-star rating.
Health data: HIPAA, Connecticut's privacy law and your booking form
HIPAA covers health care providers that conduct certain transactions electronically, such as billing health plans. A cash-pay med spa may not be a HIPAA covered entity at all, and that doesn't leave its data unregulated. Connecticut's consumer health data rules (C.G.S. § 42-526) apply to any business operating in the state, whatever its size, and "consumer health data" means personal data used to identify a consumer's physical or mental health condition or diagnosis. From July 1, 2026, the Connecticut Data Privacy Act also covers any business that processes sensitive data, including health information, regardless of how many consumers it serves.
For the website, that means asking for consent before an intake or booking form collects health details (medications, pregnancy, skin conditions), limiting staff and vendor access, and keeping advertising pixels off booking and intake pages so a client's interest in a specific treatment isn't shared with ad platforms. Our Connecticut Data Privacy Act guide covers the privacy notice and opt-out requirements in detail. If your spa is a HIPAA covered entity, HIPAA applies instead, and any form or scheduling vendor that receives patient information needs a business associate agreement.
Connecticut med spa website checklist
Providers page
Every physician, PA, APRN and RN who performs cosmetic procedures, with specialty areas, linked from every page and updated the day staff changes.
Treatment pages
Who performs each treatment, sessions, downtime, typical results and price range, with consultation-first booking for new clients.
Ad line
A standard "medical providers" line with your website address in every ad, bio and email footer, pointing to a URL that never moves.
Galleries
Written consent on file, typical-results captions and no retouching of results.
Reviews
One review request for every client, no incentives tied to ratings and no staff-written reviews.
Forms
Consent before collecting health details, and a form vendor that signs a business associate agreement if you are a HIPAA covered entity.
Tracking
No advertising pixels on booking, intake or treatment-inquiry pages.
Privacy notice
Linked from the homepage and updated for the July 2026 Connecticut amendments.
Building a med spa website in Fairfield County
We design and build med spa websites for Greenwich and Fairfield County practices and can build the provider list, consent-aware forms and tracking rules above into the site from the start. Full sites start at $2,500, and a single-treatment landing page for a seasonal campaign starts at $699 (see our pricing). If local search is the goal, our SEO service and our Fairfield County local SEO guide explain how med spas show up in the map results.
Frequently asked questions
What does Connecticut require med spas to post on their website?
Under C.G.S. § 19a-903c, a medical spa must post the names and any specialty areas of every physician, physician assistant, advanced practice registered nurse or registered nurse who performs cosmetic medical procedures. The information must be posted conspicuously at the spa and on any website the spa maintains, included in ads (or the ad must point to the website address where it's posted), and given in writing before each procedure.
Who can perform Botox or fillers at a Connecticut med spa?
Cosmetic medical procedures at a Connecticut med spa, including injections and fillers, may only be performed by a Connecticut-licensed physician, physician assistant or APRN employed by or under contract with the spa, or by a Connecticut-licensed registered nurse. A physician, PA or APRN must also perform an initial in-person physical assessment of each client before the procedure.
Do Connecticut med spa ads need to list the providers?
Each advertisement must either contain the provider names and specialty areas or state that the information can be found on the med spa's website and list the website address. Most spas use a short standard line with a link to a providers page, and keep that URL stable so older ads stay compliant.
Can a med spa offer a discount for a five-star review?
No. The FTC's Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, prohibits giving compensation or incentives conditioned on a review expressing a particular sentiment. You can ask every client for an honest review; the FTC warns that asking only satisfied clients could still violate the FTC Act.
Does HIPAA apply to my med spa's website forms?
Only if your spa is a HIPAA covered entity, which generally means it conducts standard electronic transactions such as billing health plans. Many cash-pay spas are not. They are still covered by Connecticut's consumer health data rules, which apply regardless of business size and require consent before processing health information. Ask your attorney to confirm which regime applies to you.
Make the law part of the design
Most med spa compliance problems on the web come from drift: a provider who left but is still listed, an ad that lost its provider line, a new pixel on the booking page. When the provider list, consent language and tracking rules are built into the site's structure, the site stays compliant as the team and the treatment menu change.
If you run a med spa in Greenwich, Stamford or anywhere in Fairfield County, send us your current site and we'll return a fixed-scope quote within 24 hours.
