When a patient schedules an appointment they get a detailed email that includes personal information like what treatment they are getting. Med spas have to practice hipaa and this is a huge violation.