Med Spa Consent Per Session: What You Must Collect

A client who got Botox from you six months ago walks in for a filler appointment today. Your front desk hands her the same consent form she signed last time. She skims it, signs it, and heads back. Everything feels fine — until something goes wrong and your attorney asks why there's no current documentation of her medical history, her medications, or her acknowledgment of risks specific to the procedure she had that day.

This is where a lot of med spas find out, the hard way, that one signed consent form is not a record. It's a starting point.

Consent per session isn't just a compliance checkbox. It's the operational habit that protects your providers, your practice, and your clients — every single visit, regardless of how many times that person has walked through your door.

Why "They Already Signed" Doesn't Hold Up

Most med spas collect intake paperwork when a new client comes in and never revisit it. That approach works fine for a haircut. It does not work for injections, laser treatments, chemical peels, or anything else that carries real clinical risk.

Here's the problem with a one-time consent:

• Medical history changes. A client who was healthy at her first appointment may now be pregnant, on blood thinners, or immunocompromised. None of that shows up in your file unless you ask.
• Procedures change. A consent for a lip filler appointment does not cover cheek filler done during the same visit as an upsell, even if it's the same injector.
• Products and concentrations change. If your practice has switched to a different neurotoxin brand, the risks a client consented to previously may not reflect the product being used today.
• Regulations change. Several states updated their med spa consent requirements between 2023 and 2026. A form that was compliant when you created it may not be now.

The standard of care in medical aesthetics — and increasingly, the expectation of state medical boards — is that informed consent is obtained before each procedure, not before the client relationship begins.

What Per-Session Consent Actually Covers

Consent per session means collecting a new, procedure-specific acknowledgment at every appointment where a clinical service is performed. That does not mean re-collecting your entire intake form. It means having a system that captures the right things at the right time.

A solid per-session consent document typically includes:

1. The specific procedure being performed — named explicitly, not described generically as "injections" or "laser treatment."
2. The product or device being used — brand name, formulation, or device model, depending on the treatment.
3. A current health history update — not a full intake, but a short checklist: new medications, recent surgeries, pregnancy status, changes since last visit.
4. Procedure-specific risks and alternatives — written in plain language the client can actually understand.
5. Post-care acknowledgment — confirmation that aftercare instructions were reviewed.
6. Client signature with date and time — not just date. Time matters if a dispute ever involves the sequence of events.
7. Provider name — who performed the service, documented at consent, not reconstructed later.

If you offer same-day add-ons — a common upsell scenario at many practices — you need a separate consent for each additional procedure, signed before it's performed. A client who books a HydraFacial and agrees to a lip flip while she's there needs to sign for the lip flip before the needle touches her face.

Building the Workflow Without Slowing Down Your Front Desk

The reason per-session consent breaks down at most practices isn't intentional — it's operational. Your front desk is checking someone out, answering a call, and trying to get the next client roomed all at the same time. Paper forms get stacked. Digital tablets get handed to the wrong person. Providers walk into a room and start treating before anyone has confirmed the consent was signed.

A consent workflow that actually holds up has three characteristics: it's triggered automatically by the appointment, it's completed before the client reaches the treatment room, and it's stored where the provider can see it.

Here's a practical flow that works:

• Send a pre-appointment consent link 24 hours before the visit. The client completes it on her phone before she arrives. When she checks in, the form is already in her file.
• Flag incomplete consents at check-in. Your front desk software should surface a visible alert — not a buried status field — if consent hasn't been completed for that day's procedure.
• Never let a provider enter the room without a signed, date-stamped consent in the chart. This is a policy decision, not just a software feature. It has to be enforced.
• For walk-ins or same-day add-ons, have a tablet at the front desk loaded with the relevant form. Completion happens in the waiting area, not the treatment room.

This is also an area where med spa front desk and client management operations benefit directly from having digital intake and consent tied to the booking record — rather than living in a paper folder that never syncs with anything.

How Your CRM Fits Into the Consent Workflow

If you're running on Vagaro, Mindbody, or Boulevard, you have options — but none of them handle per-session consent out of the box the way a purpose-built clinical workflow would. Here's what's realistic with each:

Vagaro has a customizable intake form builder and allows you to attach forms to specific services. If you configure a unique form per service type, Vagaro can send that form automatically when a client books. The catch: if a client adds a service at checkout or during the visit, the form assignment doesn't auto-trigger. Someone has to catch it manually.

Mindbody supports custom intake forms but the per-service assignment is less granular. Most practices using Mindbody build one comprehensive consent that covers all procedures and send it at every visit, which is a reasonable workaround — but it does mean clients are signing for things they may not be receiving that day.

Boulevard has a more refined intake and forms experience, including the ability to assign forms to specific service categories. Automated form delivery prior to appointments is available and works well for pre-visit consent collection. For multi-service appointments, verify that each service category triggers its own form.

Regardless of which platform you're on, the principle is the same: consent should be attached to the appointment, not just to the client profile. A client profile with one signed consent from 18 months ago is not documentation. An appointment record with a signed, dated consent specific to today's procedure is.

For more on how staff scheduling and front desk workflows connect to client records, the operational logic translates directly — what gets built into the process is what gets done consistently.

Handling Refusals and Incomplete Forms

A client who refuses to sign a consent form before a clinical procedure should not receive that procedure. This is non-negotiable — not because you want to be difficult, but because performing a treatment without documented informed consent exposes your practice to liability that insurance may not cover.

Train your front desk and providers to handle this without apologizing for the policy:

• Explain why it's required, not just that it is. "This form makes sure we know about any changes to your health since your last visit — it protects you as much as it protects us."
• Give them time. Sometimes a refusal is really a client who feels rushed. If she has five minutes to sit and read it, she'll often sign.
• Document the refusal. If a client declines to sign and the appointment is cancelled as a result, note it in the client record with the date, time, and reason. Don't leave it blank.

For clients who regularly push back on paperwork, consider shortening the form. A consent document that takes ten minutes to read is a consent document that won't get read — or signed. Work with your medical director to identify the essential elements and trim everything else.

Retention and Access: Where Forms Live After They're Signed

Signing the form is only half of it. The other half is being able to produce it — quickly, cleanly, and without a 45-minute search through a filing cabinet — if a client complaint or regulatory audit ever requires it.

Best practices for consent retention:

• Store digitally, linked to the appointment record — not just to the client profile. If a client had twelve appointments, you should be able to pull the consent for appointment seven in under a minute.
• Retain for the period required by your state — this varies, but seven years is a common baseline for medical records. Check with your medical director or legal counsel for your specific jurisdiction.
• Back up offsite. A practice management platform that stores records only locally is a single point of failure. Cloud-based storage with redundancy is the standard.
• Restrict editing after signing. A consent form that can be modified after it's signed is not a consent form — it's a liability. Your platform should lock the document once the client's signature is captured.

If your current setup has client records scattered across disconnected systems, the consent storage problem compounds fast. A centralized record that ties intake, consent, appointment notes, and payment history to a single client file is what makes this manageable at scale.

And if you're wondering how this connects to the front desk chaos that makes consistent consent collection so hard in the first place — the phone handling and check-in bottlenecks that pile up at busy practices are often the root cause. When your front desk is underwater, consent gets treated as optional. It isn't.

FAQ

Do I need a new consent form every visit, even for existing clients?

Yes, for any clinical procedure. A prior signature covers what a client consented to at a prior appointment — it does not cover what you're doing today. Health status, medications, and procedures change. So should your documentation.

Can I use a single general consent form that covers all procedures?

A general form is better than nothing, but procedure-specific consent is the stronger standard. If your general form clearly names the procedure being performed that day and includes current health history confirmation, it can satisfy the core requirement — but it needs to be signed at each visit, not carried forward from intake.

What happens if a client refuses to sign before a clinical treatment?

Do not perform the treatment. Document the refusal in the client record with date and time. Offer to reschedule if the client wants time to review the form. A signed consent protects both the client and the practice — it's not a hurdle, it's a safeguard.

How long do I need to keep signed consent forms?

Minimum seven years is a common baseline for medical records in most states, but requirements vary. Consult your medical director and legal counsel for the rules that apply to your jurisdiction and license type. Store digitally, linked to the specific appointment, and backed up offsite.