Yes. HIPAA is triggered by handling protected health information, not by billing insurance. The moment you collect an intake consent noting a recent lipo or BBL, coordinate drainage with a client’s plastic surgeon, or keep before/after photos tied to a name, you are creating and storing PHI. Being cash-pay changes your billing, not your compliance obligations, so you still need a risk assessment, safeguards, training, and business associate agreements with vendors like your booking platform.