Type "medical spa EMR software" into Google and you'll get a stack of ranking pages that assume you need a certified clinical records system — the kind a hospital or a prescribing medical practice runs. Most people running that search don't need that. They need treatment notes, consent, and photos living on one client record, next to the booking and the invoice. That's a different product, and shopping for the wrong one wastes money on infrastructure you'll never touch.
What Is a Certified EHR Actually For?
A certified EHR exists for practices that write prescriptions, bill insurance directly, or need their records to move between providers. It's built to connect a practice into a larger insurance-and-referral system — e-prescribing, claims, records that talk to other providers' records.
An injectable-driven, aesthetics-focused practice running neurotoxin and filler on a cash-pay basis isn't doing any of that. No claim to file. No prescription to route. No other system waiting on an interoperability feed. The certification solves a problem this practice doesn't have.
A handful of medspas do write prescriptions and operate as full medical clinics. Those practices genuinely need a certified EHR running alongside whatever handles the front desk. That's a narrow case. It is not most of the market typing "medical spa EMR" into a search bar.
What Clinical Depth Looks Like Instead
What most searchers actually want is treatment history on a single client record — not reconciled nightly between two systems, not exported and re-imported. Provider notes with an addendum trail, so a correction is visible instead of silently overwritten. Dosages and lot numbers where relevant. Before/after photos attached to the chart itself, not sitting in a camera roll.
Consent is its own problem if you're still doing it on paper. E-signed, versioned consent forms capture the client's name, a timestamp, the device or IP the signature came from, and the exact version of the form that was signed. Consent language changes. If you update a neurotoxin consent form in March and a client signed the old version in January, you need to know which one is on file — not just that "a form" exists somewhere. The strongest version of this auto-sends when the appointment is booked and lands on the chart before the client walks in.
None of that is a certified EHR. It was never trying to be one.
The Sizing Mistake
Buying up or down a size is the most common and most expensive mistake in choosing a CRM. Buy something too thin on clinical depth and you're back to spreadsheets for lot numbers and a filing cabinet for consent. Buy a full certified EHR when you don't bill insurance or prescribe, and you're carrying machinery a cash-pay practice has no use for — and training staff on it.
Prices vary several-fold between single-location starter tiers and multi-location plans with AI and marketing bundled in. That spread alone tells you the sticker price isn't the useful number. Compare total cost, not the sticker: what's bundled versus billed separately, what the add-ons cost once you actually need them. The cheapest headline plan is often not the cheapest system once you've filled in what it left out.
HIPAA Is the Floor Either Way
Whether you're running clinical charting inside a CRM or a full certified EHR, you're handling PHI. A Business Associate Agreement needs to be in place with whatever platform touches it — that doesn't change based on which side of the EHR line you're on.
If compliance is a paid tier, the base product doesn't have it. HIPAA shouldn't be something you chase on the enterprise plan; it should be the floor at every tier, because the data isn't less sensitive on a cheaper one. Look for strict tenant isolation, with every record and every query scoped to one practice, an append-only audit log on every PHI read, and encryption in transit and at rest. We'd call that defensible, not a guarantee — nobody certifies "HIPAA compliant" the way a certification body certifies an EHR, so treat any platform claiming an absolute guarantee as overselling it.
The Actual Test
Two questions decide this, not a feature checklist. Do you write prescriptions? Do you bill insurance directly? If either is yes, you need a certified EHR alongside whatever runs your front desk — that's the regulatory lane you're in, full stop. If both are no, clinical depth inside a CRM is very likely enough, and a certified EHR would be solving a problem you don't have while leaving scheduling and payments to some other piece of software you'd still have to buy.
Where Lumè Fits — and Where It Doesn't
Lumè provides clinical charting — treatment history, e-signed consent, photos, dosages and lot numbers, all on one client record alongside the booking and the invoice. It is not a certified EHR, and we wouldn't tell you otherwise. If your practice writes prescriptions and operates as a full medical clinic, you need a certified EHR running alongside it. That's a real case. No amount of clinical charting inside a CRM substitutes for it.
For everyone else — solo nurse injectors, single-location spas, small multi-location groups adding providers and rooms — this is the layer built for how the work actually runs. It isn't built for a large enterprise chain managing dozens of locations across multiple service verticals; that's a different buying decision entirely. Our HIPAA architecture is built for the practice in between: one that holds PHI, needs the BAA in the contract, and has no use for the certification machinery a hospital-grade EHR was built to carry.