HIV transmitted at a spa, traced by the genetic sequence of the virus

In summer 2018, a woman aged 40–50 received a positive HIV test result while
abroad. She reported **no injection drug use, no recent blood transfusion, and
no recent sexual contact** outside her current partner, who tested negative.

What she did report was **a platelet-rich plasma (PRP) microneedling procedure
— a "vampire facial" — at a spa in New Mexico** that spring. The procedure
draws the client's blood, separates plasma from cells, and injects the plasma
back into the face.

**HIV transmission through cosmetic injection services had never been
documented.**

The investigation had no records to work from

**Spa A's owner operated without appropriate licences at multiple locations
and had no appointment system storing client contact information.**
Investigators had to **compile and cross-reference names and telephone numbers
from consent forms, handwritten appointment records and telephone contacts** to
reconstruct who had been there — eventually identifying 59 clients at risk,
20 who had received PRP with microneedling and 39 other injection services.

The investigative team was not permitted to collect specimens from the spa
at the September 2018 inspection: it was conducted by the New Mexico Regulation
and Licensing Department, which had no authority to take them. The source of
contamination was therefore never found, and never will be.

What the inspection did find

• **A centrifuge, a heating dry bath and a rack of unlabelled tubes of blood on
  a kitchen counter**
• **Unlabelled tubes of blood and medical injectables stored in the kitchen
  refrigerator along with food**
• Unwrapped syringes in drawers, on counters, and in ordinary bins
• No autoclave on the premises — nothing capable of sterilising anything
• Equipment surface-cleaned with disinfectant spray and wipes between
  clients; **disposable electric desiccator tips cleaned by alcohol immersion
  and reused**

How the link was established

Between 2018 and 2023, five patients — **four women and one man who had never
visited the spa but was a sexual partner of one of them** — were identified.

The proof came from the virus. **Whole blood specimens were used to generate
HIV-1 pol, gag and env sequences**, compared against genetically similar
GenBank sequences and **46 local control sequences from routine New Mexico
surveillance**. **All patients' sequences clustered together strongly in a
monophyletic clade with high confidence.**

Sequencing also excluded: a former client diagnosed with HIV in 2012 was
tested and did not belong to the cluster. And two of the five, a couple, had
stage 3 or chronic infection, indicating exposure before the spa. That left
three patients with no known social contact with one another, whose
infections the evidence attributes to contamination at the spa.

Two diagnoses that arrived years late

**Two of the five had previously received a positive rapid HIV result during
routine life-insurance evaluations** — one in 2016, one in autumn 2018. **Only
one was notified of the result**, and had the diagnosis confirmed in winter

2019. The other learned of it **after hospitalisation with an AIDS-defining
      illness in autumn 2021**. A third patient was diagnosed the same way in spring
      2023.

The public health response

Spanish was the first language of many clients. The response used direct
calls, Health Alert Notifications to providers statewide, notice to the
Office of Border Health and neighbouring jurisdictions via CDC's Epidemic
Information Exchange, four press releases, and testing events advertised on
social media, radio, newspaper and television in English and Spanish, with
investigators canvassing community health centres and businesses in
predominantly Spanish-speaking neighbourhoods.

**198 former clients and their sexual partners were tested during 2018–2023.
No additional HIV infections were found, and no hepatitis B or C.** Free
testing remains available.

What it changes

Two recommendations follow, and neither is about HIV specifically:

• **Adequate infection control practices at spas offering cosmetic injection
  services**, to prevent transmission of HIV and other bloodborne pathogens
• Maintenance of client records, so that a traceback is possible at all —
  the missing records are why 59 people had to be found by cross-referencing
  handwritten notes

And for clinicians: **in the absence of known HIV risk factors, cosmetic
injection services might be considered as a route of transmission.**

Source: Centers for Disease Control and Prevention, MMWR.