Med Spa Compliance: A Nurse-Led Guide for Aesthetic Practices

Med spa compliance is the set of state and federal rules that apply when a practice offers medical aesthetic treatments: who may own the practice, who may examine, order, delegate and perform each treatment, how products are sourced, and how all of it is documented. It isn't a certificate you earn once. It's a working system your team follows every day, and it has to match what actually happens in your treatment rooms.

This guide is written from a nurse's perspective for med spa owners, medical directors and aesthetic RNs, NPs and PAs. It covers each area a regulator, inspector or attorney is likely to ask about, and what documentation shows you've addressed it.

What Med Spa Compliance Covers

Most treatments offered in a med spa, including neuromodulators, fillers, energy devices and IV therapy, are considered medical treatments. That brings in two layers of rules:

• State rules on ownership, supervision, delegation, scope of practice, the good faith exam and, in a growing number of states, med spa registration or licensure. These vary widely.
• Federal rules that apply everywhere: FDA requirements for drugs and devices, OSHA workplace safety standards, HIPAA privacy and security, and FTC truth-in-advertising law.

The American Med Spa Association describes compliance as "a living program that touches every aspect of operations — clinical, administrative, physical, and digital." Your policy and procedure manual is where that program is written down.

Where Enforcement Is Focusing

Regulators have paid much closer attention to med spas since 2024. A few examples:

• New York: after a statewide expansion of its investigation, the Department of State and partner agencies inspected more than 200 medical spas and cited 87 for possible violations, according to Holland & Knight. The New York Department of State now publishes consumer guidance on med spa services.
• Indiana: Senate Enrolled Act 282 requires medical spas to register with the Indiana Medical Licensing Board beginning January 1, 2027, and to designate a "responsible practitioner."
• Rhode Island and Texas: Rhode Island's Medical Spas Safety Act requires a physician or certified nurse practitioner medical director, and Texas's "Jenifer's Law" (HB 3749) sets who may order and administer elective IV therapy.
• Georgia and Oklahoma: Georgia's medical board issued a position statement on "matchmaker" medical director arrangements, and Oklahoma's Board of Nursing said standing orders aren't an adequate substitute for an individualized provider order.

Across these actions, Holland & Knight describes the violations as "strikingly consistent": unlicensed practice of medicine, absent or inadequate medical oversight, counterfeit and unlawfully compounded products, deceptive marketing, sanitation failures and documentation deficiencies.

Our own review of 32 aesthetic Board accusations points the same way: 22 cited missing or insufficient standardized procedures, and physician oversight and the good faith exam were also frequently cited. That review is a selected case set, not a national enforcement rate.

Ownership and Corporate Practice

Many states restrict who may own a practice that provides medical services, often called the corporate practice of medicine. Some allow only physicians to own it, some also allow certain nurse practitioners, and some require a specific management structure when a non-physician owns the business side. For example, Holland & Knight reports that Illinois's updated joint memorandum restricts med spa ownership to physicians or full-practice-authority APRNs.

What to document: your ownership structure, any management services agreement and how clinical decisions stay with licensed providers. Have a healthcare attorney in your state review the structure before you open or change it.

Medical Director Oversight

Regulators are looking for real clinical oversight, not just a signature on a contract. Holland & Knight recommends confirming that the medical director is personally involved in protocol development, chart review, staff training and periodic on-site visits, and documenting that oversight as it happens.

What to document: a written agreement that matches your state's rules, how the medical director is reached during treatment hours, chart review and site visit logs, and backup coverage. Our Medical Director Agreement Checklist covers what the agreement should include.

The Good Faith Exam

Before a prescription drug or device is used, most states require a provider with prescriptive authority to examine the patient and establish a practitioner-patient relationship. States differ on who may perform the exam, whether it can be done by telehealth and how often it must be repeated, as Quarles explains. In California, the Medical Board of California says the exam may not be delegated to an RN.

What to document: who performs the exam, how it's done, where it's recorded, the resulting order and how often it's repeated.

Scope, Delegation and Standardized Procedures

Your policies should say which roles may perform each treatment, under what supervision and with what training. How that's written depends on your state: standing delegation orders, protocols, collaborative agreements or, in California, standardized procedures. California requires each standardized procedure to address the elements in 16 CCR § 1474, including approval signatures, a record of authorized RNs, competency evaluation and periodic review.

What to document: a scope-of-practice matrix by license type, signed delegation documents that match the treatments you actually perform and a record of who is authorized for each. Holland & Knight recommends confirming that written delegation "accurately reflect[s] the procedures actually being performed and the personnel actually performing them."

Protocols, Consent and Charting

• Treatment protocols for each service: indications, contraindications, product, dosing or settings, technique and aftercare, consistent with current FDA labeling.
• Informed consent specific to each treatment, updated when a label changes. See our Kybella label update post for a recent example.
• Charting standards: the exam, consent, product and lot number, dose, areas treated, aftercare, and any complication and how it was managed.

Product Sourcing and Lot Tracking

Counterfeit and unapproved products are an active enforcement priority. In November 2025, the FDA issued 18 warning letters to websites selling unapproved and misbranded botulinum toxin products, and in October 2026 the CDC reported an investigation of a Colorado medical spa that administered an unapproved botulinum toxin product. The American Med Spa Association's supplier verification checklist recommends a written supplier-verification policy and periodic re-verification.

What to document: an approved product list, supplier license verification, invoices from authorized distributors, compounding pharmacy registration (503A or 503B) where relevant, storage and temperature logs, and lot numbers in each chart.

Complications and Emergencies

Your manual should cover recognition, escalation and treatment for the complications associated with each service, including vascular occlusion and anaphylaxis, plus your emergency kit contents, check logs, transfer plan and adverse event reporting through FDA MedWatch. Some states, including Indiana under its new law, also require reporting serious adverse events to the state.

Workplace Safety and Infection Control

Federal workplace safety rules apply to med spas like any other healthcare setting. The American Med Spa Association lists the key areas:

• Bloodborne pathogens (OSHA): a written Exposure Control Plan, hepatitis B vaccination, sharps disposal, annual training and exposure records for any procedure with potential blood exposure.
• Hazard communication (OSHA): Safety Data Sheets, container labeling and staff training.
• Laser safety: a Laser Safety Officer, controlled treatment areas, appropriate eyewear, warning signs and service records, following ANSI Z136.3.
• Infection prevention: written sterilization, disinfection, PPE and single-use device protocols, with logs.

Patient Privacy

Med spas that provide medical services and transmit health information electronically are generally HIPAA-covered entities. That means a current security risk analysis, written privacy and security policies, staff training, business associate agreements with vendors that handle patient information, and rules for before-and-after photos and patient testimonials.

Advertising and Marketing

Under the FTC's Health Products Compliance Guidance, advertising must be truthful and not misleading, and health claims need adequate support before they're published. State boards add their own rules on provider titles, disclosure of credentials and promotions. Review every ad, social post and before-and-after photo against both.

Training, Competency and Personnel Files

For each provider, keep license and certification verification, training records, initial and ongoing competency checks for each procedure they perform, and signed acknowledgment of the policies that apply to their role. This is the record that connects your written policies to the people performing treatments.

Reviews and Self-Audits

A manual is only current on the day it's approved. Review policies on a set schedule and whenever you add a treatment, product, provider or location. Holland & Knight recommends regular internal compliance audits, at least quarterly, using a standardized checklist and documenting findings and corrective actions. Start with our 10-minute manual self-check or the free Med Spa Compliance Readiness Checklist.

It also helps to have a written plan for an unannounced inspection or a Board complaint. See Board Complaint or Investigation: First Steps for Aesthetic Nurses.

State-Specific Requirements

Because the rules vary so much, a med spa compliance program has to be built for your state. Our state pages summarize the key rules and what each state edition of our manual covers:

• California Med Spa Policy and Procedure Manual
• Texas Med Spa Policy and Procedure Manual
• Florida Med Spa Policy and Procedure Manual
• Arizona Med Spa Policy and Procedure Manual
• New York Med Spa Policy and Procedure Manual
• All State Manuals

Frequently Asked Questions

What is med spa compliance?

It's following the state and federal rules that apply to a practice offering medical aesthetic treatments, including ownership, medical director oversight, the good faith exam, scope and delegation, product sourcing, safety, privacy and advertising, and documenting how your practice meets each one.

Who is responsible for compliance in a med spa?

Responsibility is shared. Owners are responsible for the business structure and operations, the medical director for clinical oversight and delegation, and each licensed provider for practicing within their own scope. Your policies should name who is responsible for each area.

Does buying a policy template make my med spa compliant?

No. A template can be a starting point, but it has to be customized to your state, your treatments and your providers, then approved, signed and followed. No template or manual guarantees a regulatory outcome.

How often should med spa policies be reviewed?

At least annually, and whenever you add a treatment, product, provider or location or a label changes. Some states set specific review requirements, such as California's periodic review requirement for standardized procedures.

Do med spa rules differ by state?

Yes, significantly. Ownership, supervision, the good faith exam, delegation and registration requirements all vary by state, and several states have passed med spa-specific laws since 2025.

Educational information only, not legal advice. Prepared from the sources linked on this page, reviewed October 2026. Laws and Board positions change; confirm current requirements with your state boards, medical director and a healthcare attorney. Our services support regulatory readiness and documentation but don't guarantee regulatory approval or disciplinary outcomes.

Sources

• Holland & Knight, Medical Spa Compliance Under the Microscope, August 2026
• American Med Spa Association, Med Spas Under the Microscope
• American Med Spa Association, How to Verify a Pharmacy or Drug Supplier
• New York Department of State, Med Spa Services: What You Need to Know
• Quarles, Med Spa Compliance Series: Good Faith Examination
• Medical Board of California, Cosmetic Treatments FAQs
• 16 CCR § 1474, Standardized Procedure Guidelines
• CDC MMWR, Investigation of Unapproved Botulinum Toxin Product Administered at a Medical Spa, Colorado, October 2026
• FDA, FDA Warns Companies Over Illegal Marketing of Botox and Related Products
• FDA MedWatch
• FTC, Health Products Compliance Guidance
• Aesthetic Nursing P&P, The Accusation Review 2026