Your Consent Form Has One Field. It Needs Six.

Key takeaways

• A single “I agree” checkbox is not a consent record. It cannot show which of the required disclosures a patient actually saw
• AHPRA’s Guidelines for registered health practitioners who perform non-surgical cosmetic procedures, in effect since 2 September 2025, apply to every registered health practitioner except medical practitioners, who stay under the Medical Board’s 2023 guidelines
• A defensible digital consent record needs at least six separate components: clinical consent, financial consent, image consent, a practitioner registration record, an age or cooling off record, and, for injectables, a per prescription consultation channel record
• Cosmetic surgery consent covers 22 disclosure items under Medical Board rules; non-surgical procedures cover 18 under the National Boards’ rules. Which count applies depends on which guideline governs the treatment, so the record needs to log that too
• Injectable prescriptions need a fresh in-person or video consultation every time. Text, email or online prescribing is explicitly not acceptable, which means one signed form at intake cannot stand in for later visits
• Between September 2022 and March 2025, AHPRA investigated about 360 notifications concerning non-surgical cosmetic procedures, with about 300 closed and over 1,500 calls to its cosmetic surgery hotline
• No published AHPRA case ties a finding specifically to consent record format. The stated enforcement posture and the notification volume are the evidence available, and this post says so plainly rather than inventing a case

A patient signs a consent form on a tablet at reception, taps a box that says “I agree to treatment”, and the booking software timestamps it. Eight months later a complaint arrives, and someone has to answer a specific question: what exactly did we tell this patient before they signed. The checkbox cannot answer it. It proves a tap happened. It says nothing about which risks were disclosed, which document version was shown, or whether financial and image consent were ever separated from the clinical sign off.

AHPRA’s Guidelines for registered health practitioners who perform non-surgical cosmetic procedures, in effect since 2 September 2025, set out what a practitioner has to disclose before consent is valid. They do not specify a database schema. That gap between the clinical obligation and the technical build is what this guide closes: what fields a digital consent record actually needs so it is still useful the day someone asks a hard question about it.

What AHPRA’s Guidelines Actually Require

The guidelines that took effect on 2 September 2025 apply to every registered health practitioner under the National Law who performs a non-surgical cosmetic procedure, with one exclusion. Medical practitioners are carved out and stay under the Medical Board of Australia’s own Guidelines for registered medical practitioners who perform cosmetic surgery and procedures, in force since 1 July 2023. Nurses, dentists, and other registered practitioners performing injectables, thread lifts, and similar treatments sit under the newer, non-surgical set. This split matters for a record system, because which guideline governs a given treatment changes what the consent record has to contain.

On the consent process itself, AHPRA’s announcement and the guidelines it introduced require a verbal consent discussion held with the patient, backed by written information in plain language. That information must not minimise the complexity of the procedure or overstate results in a way that implies an outcome the patient cannot realistically expect. Practitioners have to disclose their own registration details, including profession and any division or endorsement, and the qualifications of anyone else involved in the treatment. Costs have to be itemised, including deposits and payment terms, alongside a statement that the procedure is not covered by Medicare. Financial consent and consent for the use of clinical images are both named as separate elements, not folded into the general treatment agreement. For injectable prescribing specifically, the guidelines require an in-person or video consultation each time a prescription is issued, and state plainly that asynchronous prescribing by text, email or online is not acceptable practice.

Takeaway: the guidelines describe a conversation and a set of disclosures, not a form field. Turning that into something a record system can store and later retrieve is the practice’s problem to solve, not AHPRA’s.

Because the two guideline sets carry different disclosure counts (22 items for surgery under the Medical Board rules, 18 for non-surgical procedures under the National Boards’ rules, covered in full in our cosmetic procedure consent checklist), a consent record that does not log which guideline applied to a given treatment cannot later prove the right checklist was even used.

What That Means for the Build

A digital consent record built to survive scrutiny needs to separate concerns the way the guidelines separate them, rather than collapsing everything into one submit button. In practice that means six distinct pieces of data, each with its own timestamp:

Clinical consent. The record needs a field for which information document version the patient was shown, not just that “a document” existed. Practices update their information sheets; if the version served in January differs from the one served in July, the record has to say which one a specific patient actually saw. A consent_document_version field, tied to a hash or a version number of the actual PDF or web page content, does this.

Financial consent. A separate entry, not a checkbox bundled with the clinical one. It should itemise the total cost, deposit amount, refund terms, and carry an explicit acknowledgement that no Medicare rebate applies. Bundling this into the general consent means a practice cannot show cost disclosure happened as its own step, which the guidelines require.

Image consent. Also separate, covering the purpose of any photographs, where they are stored, whether the patient has a right to preview images before advertising use, and whether they can withdraw consent later. A patient cannot be made to accept image use as a condition of treatment, so this cannot share a checkbox with the clinical consent either.

Practitioner registration record. Not just the practitioner’s name on the form. The record needs to show the patient was told the registration type, profession, and any division or endorsement, because the guidelines require that disclosure specifically.

Age and cooling off record. For patients under 18, the guidelines require a cooling off period of at least seven days. That means the record needs a date of birth and a first consultation date stored as queryable fields, not buried in free text, so the interval can be calculated and enforced by the booking logic itself. This overlaps with age gating in the booking flow, covered separately in age gating a cosmetic booking flow.

Prescribing channel record, for injectables. Because a fresh in-person or video consultation is required each time a cosmetic injectable is prescribed, this cannot be a one-off field on the patient’s master record. It needs to be logged per prescription event, capturing the consultation channel and excluding text, email or online as valid options.

Takeaway: the build problem is not one form with more fields. It is six records with their own timestamps that between them can answer, months later, exactly what a patient was told and when.

A Worked Example

Cosmetic clinic. An injectable clinic’s online booking form had a single mandatory checkbox reading “I agree to the terms and consent to treatment”. A complaint arrived alleging a patient was not told about a specific risk before an anti-wrinkle treatment. The clinic pulled the record and found a timestamp and a boolean. No document version, no itemised risk disclosure, no separate financial consent covering the disputed cost, and no way to show which consultation channel authorised the prescription. The fix was not a better checkbox. It was six structured records instead of one, each capturing its own timestamp and content.

Cosmetic dentistry. A dental practice offering veneers, a procedure named in AHPRA’s advertising guidance material, scanned signed paper consent forms into its practice management system as PDF attachments. The PDFs were not searchable and carried no structured fields, so answering “did we disclose maintenance requirements to this patient” meant opening and reading the document by hand. Across a few hundred patients that becomes unworkable, particularly if the practice ever needs to respond to an AHPRA information request across multiple files at once. The fix was to move consent capture into the practice management system’s structured forms rather than a scanned image, so each disclosure item became a queryable field.

The illustrative comparison below shows the gap between the two approaches against the six record components above. It is a worked example, not a measured industry statistic.

Takeaway: a tick box and a structured record can carry the same visible “consent given” status on screen while being completely different assets the day a complaint tests them.

What to Check on Your Own Site

1. Open your intake or booking form and count the consent fields. Is it one checkbox or several distinct entries?
2. Check whether the document version shown to a patient is logged against their record, or whether you only know the current version, not the one they saw.
3. If you perform or prescribe injectables, check whether your system records the consultation channel, in-person or video, on every prescription, not only at initial signup.
4. Confirm date of birth is captured before slot selection and that a first consultation date is stored so a seven day interval can be calculated for patients under 18.
5. Check whether image consent is its own record, with fields for storage, preview rights and withdrawal, separate from procedure consent.
6. Check whether financial consent is itemised and timestamped separately from clinical consent.
7. Try to answer, from your own system, “what exactly did we tell patient X before they consented” without opening a scanned document by hand.
8. Confirm consent records are exportable or queryable, not locked inside email threads or unsearchable PDF attachments.

The Enforcement Anchor

There is no published AHPRA case that finds against a practitioner specifically over consent record format or content. That is a genuine gap in the public record, not something this guide is going to paper over with an invented example.

What does exist is volume and posture. Under its announcement of the new guidelines, AHPRA reported that it investigated about 360 notifications concerning non-surgical cosmetic procedures between September 2022 and March 2025, with about 300 of those closed, and received more than 1,500 calls to its dedicated cosmetic surgery hotline over the same period. That is an active complaints pipeline, not a dormant rule. AHPRA’s public statements around the September 2025 guidelines also carried a direct warning that practitioners found prioritising profit over patient care would face action.

Takeaway: the absence of a named consent record case is not evidence the risk is low. It is evidence the category is new. A notification pipeline running at 360 cases over roughly two and a half years is the backdrop a defensible record exists to answer to.

Where This Gets Hard

A digital consent record, however well structured, is still only as good as what actually happened in the room. A system with six perfectly separated fields cannot prove a verbal conversation covered the right content if the practitioner did not actually have it. The record documents that a process occurred and what was shown in writing. It cannot independently verify a spoken disclosure.

There is also a practical ceiling on retrofitting old records. A clinic moving from a single checkbox to a structured system today cannot go back and split out image consent from clinical consent on a form signed two years ago. The improvement applies from the point of the rebuild forward, and older records stay as thin as they were captured.

The regulator says a verbal consent discussion plus written disclosure covering risks, qualifications, costs and image use is required before consent is valid; the build consequence is a record system that captures each of those as a separate, timestamped entry; whether a specific clinic’s existing setup discharges that obligation in its own circumstances is a question for its medical defence organisation or its lawyer.

Status

In force since 2 September 2025. The Guidelines for registered health practitioners who perform non-surgical cosmetic procedures are current, binding guidelines for every covered practitioner, not a proposal and not pending commencement. The specific record-keeping fields set out in this guide are a build translation of that obligation, not a separately codified data standard AHPRA has itself published.

Frequently Asked Questions

Does a single “I agree” checkbox meet AHPRA’s cosmetic procedure consent requirements?

No. AHPRA’s guidelines for non-surgical cosmetic procedures require a verbal consent discussion plus written information covering risks, qualifications and costs, and treat financial consent and image consent as separate items. A single checkbox records that someone clicked, not which of those items were actually covered.

What is the difference between clinical consent, financial consent and image consent in a digital record?

They are three separate disclosures under AHPRA’s guidelines, covering the procedure itself, the costs involved, and the use of clinical photographs. A defensible digital record keeps them as three distinct entries with their own timestamps, not one bundled checkbox.

Does an injectable prescription need a fresh consent record every time, or does one signed form cover future visits?

A fresh one every time. AHPRA’s guidelines require an in-person or video consultation each time a cosmetic injectable is prescribed and state that asynchronous prescribing by text, email or online is not acceptable, so the record needs a per prescription entry, not a single lifetime consent form.

Get Your Consent Flow Checked

Get in touch and RockingWeb will walk your intake and booking system as a patient would and report where your consent capture is a single checkbox and where it already behaves like a record.

Sources

1. AHPRA - Putting patients first: New guidelines for cosmetic procedures, 2 September 2025. Checked 15 August 2026.
2. AHPRA - Booming billion-dollar cosmetic industry on notice with new cosmetic procedures guidelines, 3 June 2025. Checked 15 August 2026.
3. Medical Board of Australia - Guidelines for registered medical practitioners who perform cosmetic surgery and procedures, in effect 1 July 2023. Checked 15 August 2026.
4. Clayton Utz - Navigating the 2025 AHPRA guidelines on cosmetic procedures. Checked 15 August 2026.
5. Meridian Lawyers - Changing the face of the cosmetic industry: new guidelines regulating non-surgical cosmetic procedures. Checked 15 August 2026.

Last reviewed: 15 August 2026.