Skip to content
Podcast

EP 490: You May Have Already Made a HIPAA Mistake With AI — Here’s How to Know

Please note: Addo Aesthetics is not a law firm and nothing in this post or episode constitutes legal advice. This is a starting framework, not a legal opinion. For guidance specific to your practice and your state, please consult a qualified healthcare attorney.

Last month I sat down for a routine annual physical and my doctor paused before we even started talking. There was a small recorder on her computer screen. She explained what it was, told me how it worked, and asked if she could use it.

That exchange took 30 seconds. And it told me everything about what responsible AI use looks like in a clinical setting.

Most spa and medspa owners I talk to haven’t had that 30-second conversation with their clients. Not because they don’t care, but because nobody handed them a framework for what it should look like, and the landscape is moving faster than anyone expected. AI compliance is not a solved problem. The law is behind the technology. Your insurance carrier may be behind the technology. And if you’re somewhere in the middle of all of that, trying to run your business, this episode is the conversation you didn’t know you needed to have.

The HIPAA Piece Most Spa Owners Get Wrong

If you run a medspa, injectable practice, or any practice where clinical care is happening, HIPAA already governs your world. But the question I keep hearing is: does that mean I can’t use AI at all?

It doesn’t. What it means is that you need to understand what actually counts as protected health information before you involve AI in any task that touches client data.

HIPAA’s 18 protected identifiers include the obvious ones: names, phone numbers, addresses. But they also include appointment dates, geographic data, and photographs. That last one matters in our industry, because a before-and-after photo where your patient’s face is visible is protected health information.

The practical test: before involving AI in any task, ask yourself two questions. Does this include information that could identify a specific patient? And does it connect to their health or their care? If both answers are yes, you are in protected territory and standard consumer AI tools are not the right tool for that task.

The misconception I see most often is spa owners assuming that because they didn’t mention a patient’s diagnosis, they’re fine. That is not how HIPAA works. Typing your patient’s name alongside an appointment date at your medspa, even in a routine workflow prompt, may have just created PHI.

The safer approach is simple: remove the identifier entirely. “Help me write a follow-up message for a patient coming in for a neurotoxin touch-up” creates no protected health information. The prompt does the same job. The risk disappears.

What Every Spa Needs (Not Just Medspas)

Even if your practice doesn’t touch clinical data, AI governance still matters. Your clients’ trust, your intellectual property, and whether your insurance will cover you if something goes wrong are all in play.

Three things worth knowing before you assume you’re covered: your current liability policy may not extend to AI-related incidents. A Business Associate Agreement does not transfer your compliance responsibility away from you. And AI governance documentation is now something some insurance carriers are starting to ask about at underwriting.

The simplest version of governance is four written documents: a client-facing AI disclosure, an internal privacy and IP policy, an approved tools list for your team, and an output review policy that keeps a human in the loop before anything AI-generated reaches a client.

If that feels like a lot, start with one paragraph. Define what your team cannot enter into AI prompts, share it at your next staff meeting, and build from there. That paragraph is your starting point, and Daniela gives you the exact language in the episode.

The spas and medspas using AI most effectively in the years ahead are not the ones waiting for perfect regulatory clarity before they start. They are the ones building responsible habits now, with a clear understanding of what they’re accountable for and why. That is exactly what Growth Factor® Implementation helps our clients build — the systems and disciplines that make a practice run correctly, not just fast.

Listen to EP 490 to hear the 30-second physician story that started this conversation, the exact prompt language that creates PHI without meaning to, and the four documents Daniela built inside Addo Aesthetics last month that you can model for your own practice.

Resources Mentioned

Blog post: “Your Patients’ Data, Your Business Information, and AI: What Every Spa and Medspa Owner Needs to Know About Governing AI in 2026” 

Frier Levitt AI, EMRs and Liability Webinar 

Want to break past $25K–$35K months without adding more treatment hours?

Watch The Systems Shift and learn how 600+ spa owners are scaling into their Spa CEO role (without sacrificing family time or sanity).

Subscribe to Our Newsletter

Stay up-to-date with our email newsletter to receive important updates, news, and offers!

This field is for validation purposes and should be left unchanged.
Name(Required)

IG / @addoaesthetics

WEB / addoaesthetics.com

YOUTUBE / @addoaesthetics

LINKEDIN / @addoaesthetics

About Your Host, Daniela Woerner

Daniela Woerner is the founder of Addo Aesthetics and creator of the Growth Factor® Framework, a proven system that’s helped hundreds of spa owners build profitable, systemized businesses. With nearly 20 years in the aesthetics industry, she transforms overworked aesthetic professionals into confident Spa CEOs through strategy, systems, and soul led support. Daniela is also the host of Spa Marketing Made Easy, a top ranked podcast with over 1 million downloads, where she shares real world strategies to help spa professionals grow with clarity and confidence.

You built this business from the ground up. You are the reason that the clients come back. You’re the one who trained the team, who held the standard, who showed up on the days when they were hard and when they were easy. You’re excellent at what you do clinically, relationally, professionally, and that excellence is real. It’s earned, and yet you can’t leave, not really, not in the way that you imagined when you first decided to go out on your own. The idea was freedom, the freedom to work when you wanted, to earn what you desired, and to build something that was genuinely yours, but you actually built in many cases is a business that needs you in the room to survive, and that is a very different thing. There’s a term for this in the business world: owner dependency, and it means that the financial performance of a business is directly tied to the owner’s active participation, so in a spa context it often looks like this: you’re in the treatment room three, four days a week, generating a significant portion of your practice’s revenue yourself, because if you step back, the numbers don’t hold. You are, in the most literal sense, the most expensive employee in your own business. Today we’re going to talk about how that happens, why it’s a more serious structural problem than most spa owners realize, and what it actually looks like to build your way out of it with a real plan, real milestones, and a realistic timeline that’s not about an overnight transformation. This is one of the most important conversations that I have with Spa CEOs. Welcome back to Spa Marketing Made Easy. I’m Daniela, founder and CEO of Addo Aesthetics and creator of the Growth Factor framework. Now, whether you’ve been here for years or this is your first episode, I am so glad that you are here for this particular conversation.

We’re in our June series on operational excellence, and today’s episode is the one I want you to hear before you make your next hire before you sign your next lease, before you make any significant investment in growing your business, because you can do everything right, marketing team systems, client experience, and still build a business that quietly traps you inside it, not because you made a mistake, but because you never had a framework for building it any other way, that framework is what we’re talking about today. Now, let me explain what I mean when I say that the owner is often the most expensive employee in her own business, because I want to be like very clear and precise about this. When you’re in the treatment room, you are performing a provider function. You’re generating revenue through your hands, your skill, your time. It’s a valuable function. I am not disputing that in any way, shape, or form. But you are also the CEO of your practice. You are responsible for the strategy, the team culture, the financial decisions, the vision, the systems, the marketing direction, it’s a completely different role, and it requires your attention, your cognitive capacity, and your focused time. When one person is doing both of those things, something is always getting compromised, and most often it’s the CEO function, because the treatment room is where you feel the most competent, and it’s where you’re the most confident, and it’s where clients are waiting, it’s where the revenue is visible and immediate. So, your treatment room gets your body, and the business gets whatever energy is left. Now, the math problem underneath this is significant, because when you’re generating revenue in the treatment room, that revenue is counted as business revenue, but it’s not really business revenue in the way that matters the most, it’s provider revenue, revenue that exists because of your personal skill and your personal time, and that disappears the moment that you step back now? A business is supposed to be an asset. An asset generates value independent of the owner’s daily participation. Now, what most spa owners have built, again, this is how most of us do it, but you’re building a successful practice that requires your hands to run those are two different things, and knowing the difference changes how you built.

So, I want to give you a framework that has completely changed the way that I think about business building, and how I now guide every single one of our clients in the Growth Factor program, Bill. Your business as if you were going to sell, even if you never planned to, and I know that might sound like a little bit of an odd thing to say. If selling your practice has never been on your radar, stay with me here. When you build with a potential sale in mind, you’re forced to answer the question that most spa owners never ask: Would someone pay me full price for a business, or would someone even pay anything for this business if I were not in it? That question is clarifying in a way that almost nothing else is. Now, a buyer does not just buy your client list and your equipment; a buyer buys the revenue generating capacity of the business, the systems that produce results, the team that delivers the service, the processes that do not require the previous owner to be present. If the answer to could this business run without the owner is no, the valuation reflects that, and sometimes very drastically. But the reason I bring this up is not about selling. I bring it up because the discipline of building a sellable business is the same discipline that gives you your life back. A business with no owner dependency is a business that runs when you’re on vacation. It’s a business that doesn’t collapse when you take a health leave or have a family emergency. It’s a business that grew up, it became a real entity with real infrastructure, and not just a talented individual with overhead. Building as if you are going to sell is not about exits, it’s about building something that allows you to live the life that you want to live so many spa owners, solo injectors, maybe you, you genuinely love being in the room. The clinical work is not a burden, it’s a part of the business that you feel most alive in, the relationships with the clients, the craft of the treatment, the results you create. That’s why you got into esthetics in the first place. And so the idea of stepping away from it is not appealing. It might even feel like a loss now. Staying in the treatment room, that’s a valid choice, right? This is your business, and if delivering treatments is one of your deepest sources of joy and meaning in your work, I’m not here to tell you to stop. What I’m here to tell you is that the goal is not to get you out of the treatment room fully. The goal is to build a business that does not require you to be there. I want you to build your business to hit the revenue goals that you desire, and then if you want to bring in the treatment room a couple days a week, because it brings you joy, go for it. That’s amazing. I just don’t want you to be the primary revenue generator, two very different things. Okay, so when your business is built with the systems, the team, the financial structure to hit goals without your hands in the room, everything changes. The revenue that you generate as a provider becomes something separate from the business’s financial performance. It’s a bonus. It becomes extra. It becomes something you do because you love it, not because the business depends on it for survival. And that shift from I have to be in the room goes to I get to be in the room, I choose to be in the room. That is so significant, and it starts with building the business correctly underneath you. So, let’s talk about what this actually looks like in practice. Okay, because I think the conversation stops at the concept and never gets into the plan level, and without a plan, this is just going to stay aspirational instead of becoming real. So, inside of growth factor implementation, one of the things that we build with every single client is what I call a milestone plan to get the owner out of the room, not a vague goal. We have specific numbers bait in a roadmap that connects your team capacity to what the actual owner needs to get out of the room.

Okay, so we start with the profitability of each service. We know which treatments are going to generate what margins. We know what a fully productive provider day looks like at all the different revenues, that data is the foundation. Okay, we make database decisions. Then we look at the team, current capacity, current revenue generation, current trajectory. Where are they now? And realistically, where can they go? What does the team need to be generating, and at what margin, and what expense level for the business to hit its financial targets without the owner in the room, that number becomes the first milestone. So, when the team hits x in monthly revenue with expenses held at their target percentages, the owner can drop a day out of the treatment room without. Meaningful financial impact to the business, not someday, not eventually. When X happens, that is a completely different conversation than you should try and work less. That’s a plan, right? It has a number, as a condition, it has a trigger point that the owner and her team can actually work towards. Then, from there we build the next milestone. What does it take to actually drop a second day, a third? What is a full extraction look like, and what does the business need to look like for that to be financially neutral? This is not a short-term process. Okay, I’m not trying to make this this super simple thing. It takes work for sure, for some of our clients. This milestone plan comes together in six months. For others, it takes two years or more. It depends on the current size of your team, the current capacity of your space, the margin structure for your services, and how aggressively you want to grow.

There’s not a single right timeline, but here is what every client has in common, on the other side of building this plan, they know where they are going, they have a number to work towards, they are no longer moving in the direction of someday, they are moving towards a specific achievable milestone, and that changes the energy of everything, now here’s where AI enters this, and I don’t think I am any more capable of recording an episode than or doing a training without talking about AI. It’s such a powerful tool, but the milestone plan that I just described, it involves layering multiple data sets: service profitability, team capacity, revenue trajectories, expense percentages, owner salary goals. Doing that analysis manually. Oh my gosh, that is.. I don’t even know where I would start. Right, that’s going to take people with a whole different level of expertise than me and a large amount of time and a large amount of money, but AI has changed that considerably. So, inside of our growth factor implementation program, we use AI to run the scenario modeling that underlies the milestone plan, so we can ask it to look at current numbers and show us what happens if team revenue increases by 20% why expenses hold at their current percentages. We can ask it to model the point which the owner’s treatment day revenue becomes genuinely optional rather than structurally necessary. We can ask it to identify the gap between where the team is now and where they need to be for the first milestone to be reachable. What used to take hours or even days or weeks now takes one focused 50 minute session, and more importantly, we can run multiple scenarios, different growth rates, different expense assumptions, different team configurations quickly enough that the owner can actually see her options rather than committing to one plan without understanding the alternatives. The other piece AI helps us with is building the monitoring structure that tells the owner where she’s approaching her milestone, because a plan without accountability and visibility is a wish. The AI-supported tools that we build inside of the program help owners to track the metrics that matter, see the progress in real time, and know when the trigger point is genuinely within reach, you don’t have to guess when you can afford to step back, you can see it now. I want to paint a picture of what the other side of this looks like, because I think it’s important to hold the destination clearly when you’re doing this kind of foundational work.

 

When you build a business without owner dependency, something fundamental shifts in your relationship with the business itself. You stop being the ceiling right now. Your business can only grow as fast as you can grow, because your capacity is the limiting factor. When your team is the engine and you are the architect, the ceiling lifts. Growth becomes a team project, not a personal endurance test. You start making different decisions when you’re not attached to the treatment room as the financial necessity.

You start asking different questions. Where do I want to put my energy? What does this business need from me as the CEO right now? Those are leadership questions, and they produce leadership decisions. You have something real to leave behind or keep. Whether you ever intend to sell your practice or not, you’ve built something with genuine value. A business that runs independently, it hits financial targets, and has the infrastructure to sustain performance, that’s an asset. It’s also, frankly, a business that’s far more enjoyable to own. And if you do love the treatment room, if you choose to be there because it brings you joy, that choice is finally free. You’re there because you want to be, not because the business requires. Wires you to be every client who gets there will tell you it changes everything. Now, listen, you did not build your business wrong. You built your business the way that most providers build it, by leading with your clinical skill, building client loyalty, and growing as fast as the demand allowed the fact that you’re essential to your business right now is not a failure, it’s the natural outcome of a certain type of growth. So, what you’re hearing today is an invitation to build the next layer, the layer that turns a practice into a business, the layer that turns revenue into an asset, the layer that turns your presence in the treatment room, from an obligation into a choice. This is not about working less, it’s about building more, more infrastructure, more team capacity, more systems, more independence. It takes time, it takes attention, but it produces something that grinding through another year of full books, simply cannot a business that is genuinely yours. So, I’ve got a question for you. If your business had to run without you in the treatment room, starting 90 days from now, what would break? What systems are not in place? What team capacity is not there? What financial structure is missing those gaps, are your build list. You don’t have to fix all of them at once. You don’t have to have a perfect plan tomorrow, but I want you to know that building towards them is possible, and it’s more concrete and more achievable than it might feel right now. The milestone-based approach to stepping out of the treatment room is exactly what we build inside of growth factor implementation. We look at your numbers, your team, your capacity, your financial goals, and we build a real plan with real milestones that tells you specifically what needs to happen before you can step back, how long it might take, and what we’re watching to know that you’re getting there, the plan exists, the path is real, and you don’t have to figure it out alone. So, if that sounds like a conversation that you’ve been needing to have, I would love for you to learn more about growth factor implementation by clicking the link below this episode. For everyone who listened today, thank you so much. This is the work that matters, not more bookings, not another service on the menu, not investing in another super expensive machine. This right here is how you build a business that supports the life you want to live. Share this episode with another spa owner who is excellent at what she does, and exhausted by what her business requires of her. She needs to hear that there’s a way through, and that it starts with a plan. Thank you again for being here. And I’ll see you next week.

Share Now