US REGULATORY CONTEXT
HIPAA starts with your circumstances.
HIPAA applies to covered entities and business associates in the United States. Whether it applies to a particular aesthetic practice depends on that practice’s activities and relationships.
Determine applicability
Identify whether your practice is a covered entity or business associate and which workflows involve protected health information. Other federal and state requirements may apply as well.
Review the agreements
Where required, review and execute appropriate agreements before processing protected health information. A subscription or a setting does not itself execute a BAA.
Review the deployment
Assess access permissions, encryption configuration, audit coverage, retention, recovery and each external processor for the workflows you plan to use.
Keep regional questions distinct
UK, Canadian and Australian requirements differ from HIPAA. Review the rules, agreements and local responsibilities that apply to your actual practice.