Med spa compliance is not a single license or a single binder. It is a document set: for every question a state board, an OSHA inspector, an insurer, or a plaintiff's attorney can ask, there should be a specific record that answers it. This checklist covers the 16 documents an aesthetic or wellness practice should be able to produce on demand, who signs each one, and where each belongs.
Aesthetics Clinic-in-a-Box
The entire aesthetics documentation system: every treatment consent set (tox, fillers, microneedling, peel, laser, PRP, lash), the shared intake/photo/financial core, good-faith exam, HIPAA pack and all eight aftercare cards.
See what's inside — $99What med spa compliance actually means
A medical spa sits at the intersection of three regulatory systems that rarely talk to each other.
The first is professional licensure. Neuromodulators, dermal fillers, most energy-based devices, IV therapy and weight-loss medications are the practice of medicine. Who may perform them, who must supervise, and who may own the entity are governed by your state medical board, your state nursing board, and the corporate practice of medicine doctrine where your state enforces it. These rules differ sharply across state lines.
The second is health privacy and workplace safety. If you create, store, or transmit protected health information electronically and bill or transmit in certain standard ways, HIPAA obligations attach, and in practice most med spas operate as covered entities. OSHA's Bloodborne Pathogens Standard applies from the moment a needle is used on a patient.
The third is drug and device regulation. Botulinum toxins, fillers, semaglutide and compounded peptides are prescription products. Where they were purchased, from whom, and under whose prescription is a documented question.
Almost none of this is proven by a certificate on the wall. It is proven by paper.
The 16-document checklist
| Document | Why you need it | Who signs it | Where it lives |
|---|---|---|---|
| Treatment-specific informed consent (one per modality) | Proves the specific risks of that treatment were disclosed and accepted before it was performed | Patient and treating provider | Patient chart, dated and timestamped |
| Patient intake and medical history | Captures allergies, medications, pregnancy status, prior treatments and contraindications that drive the treatment decision | Patient, reviewed and initialed by provider | Patient chart, updated at least annually |
| Good-faith examination record | Documents that a licensed prescriber established the relationship, evaluated the patient and ordered the treatment plan | Prescriber (MD, DO, NP or PA with prescriptive authority) | Patient chart, separate from consent |
| Treatment chart note | Records what was actually done: product, lot number, expiration, units or volume, sites, technique, injector and patient response | Treating provider or injector | Patient chart, same day |
| Photo and media release | Separates clinical photography from marketing use; a bundled consent will not support publishing images | Patient | Patient chart, with images stored as PHI |
| HIPAA document pack (notice of privacy practices, authorizations, policies, risk analysis) | Establishes the privacy and security program a regulator will ask to see | Practice, with patient acknowledgment of the notice | Compliance binder; acknowledgment in chart |
| Business associate agreements | Required for every vendor that touches patient data: EMR, booking software, billing, marketing, IT, shredding | Practice and each vendor | Compliance binder, reviewed annually |
| Financial and cancellation policy | Sets pricing, packages, memberships, deposits, no-show and refund terms in writing before money changes hands | Patient | Patient chart or CRM record |
| Policies and procedures manual | The operating standard the practice will be measured against, covering clinical governance and daily operations | Practice leadership; staff acknowledge receipt | Compliance binder, accessible to all staff |
| Clinical SOPs by treatment and device | Step-by-step protocols for each service, including settings, contraindications and post-care | Medical director approval | Treatment rooms and compliance binder |
| Emergency protocols | Written response for vasovagal syncope, anaphylaxis, and vascular occlusion, with drug doses and escalation steps | Medical director | Posted in treatment areas, plus binder |
| Adverse event log | Central record of complications, near misses, corrective actions and manufacturer or FDA reporting | Provider who identified the event; reviewed by medical director | Compliance binder, reviewed quarterly |
| Medical director agreement, delegation and standing orders | Defines supervision, delegated procedures, chart review duties and fair-market-value compensation | Medical director and entity | Compliance binder, reviewed annually |
| Staff credential file (licenses, certifications, DEA where relevant) | Proves every person performing a service is licensed and current, with expiration tracking | Employee provides; practice verifies primary source | Personnel file |
| Training records (OSHA, HIPAA, device, emergency drills) | Demonstrates competency and satisfies annual training mandates | Employee signs; trainer countersigns | Personnel file, with rosters in binder |
| Certificates of insurance (professional liability, general liability, workers' compensation) | Required by landlords, medical directors and device manufacturers; confirms coverage matches the services offered | Carrier issues; practice retains | Compliance binder, refreshed at renewal |
The four documents that decide a dispute
If a complaint is ever filed, four records do most of the work.
The good-faith examination record proves a prescriber, not an unsupervised injector, established the patient relationship and authorized the treatment. Most states require a prescriber-level evaluation before any prescription-only aesthetic treatment, and registered nurses, medical assistants and estheticians cannot perform it, even in states where they may lawfully inject under delegation. Where telehealth is permitted for this exam, boards generally expect a synchronous live video encounter, not an intake form or a chat thread.
The treatment-specific consent proves risk disclosure. A generic "aesthetic services" waiver is weak evidence. A filler consent that names vascular occlusion, blindness and the hyaluronidase protocol is strong evidence, because it shows the patient was told the thing that actually went wrong.
The chart note proves what happened. Product name, lot number, expiration date, units or volume per site, injector, and the patient's tolerance are the details that separate a defensible record from a reconstructed one. Lot tracking also lets you respond to a manufacturer recall in an afternoon rather than a week.
The photo release proves permission. Clinical images are protected health information. Written authorization must state where images will be used, whether the face is identifiable, and how consent can be revoked. Bundling this into the treatment consent is the single most common HIPAA marketing error in aesthetics.
The operational and staffing layers
Documents 9 through 12 in the table describe how the practice runs when nobody is watching.
The policies and procedures manual is the umbrella. Clinical SOPs sit beneath it and get specific: device settings, Fitzpatrick considerations, patch testing, contraindications, aftercare. Emergency protocols must be written before they are needed, posted where treatment happens, and rehearsed. The adverse event log is the one most practices skip, and it is the one that demonstrates a functioning quality program rather than a reactive one. Log the near misses too. A pattern in near misses is free information.
Documents 13 through 16 answer the question of who is allowed to touch a patient.
The medical director agreement is not a formality to be signed once and filed. In states that enforce the corporate practice of medicine, compensation must be fair market value for defined services and cannot be a share of clinical revenue. More importantly, the agreement must describe oversight that actually occurs: chart review at a stated frequency, protocol approval, availability for consultation, and periodic staff meetings. An agreement without evidence of active supervision is worse than none, because it documents an obligation you did not meet.
Credential files need expiration tracking, not just copies. Training records need signatures and dates. Insurance certificates need to match the services you advertise; a policy that excludes energy-based devices will not respond to a laser burn claim.
Where the documents live and how long you keep them
Three homes, and nothing should be in two of them without a reason.
The patient chart holds consents, intake, the good-faith exam, chart notes, photo releases and financial acknowledgments. The compliance binder, physical or digital, holds HIPAA policies, business associate agreements, SOPs, emergency protocols, the adverse event log, the medical director agreement and insurance certificates. The personnel file holds credentials and training records, and it must stay separate from patient records.
Retention is a state question. HIPAA does not set a minimum for clinical records; it requires six years for HIPAA documentation such as policies, procedures, authorizations, risk analyses, business associate agreements and breach records. State law sets the clinical record period, commonly five to ten years after the last encounter for adults, with extended periods for minors that run past the age of majority. When the periods conflict, keep the record longer.
How to run this checklist
Quarterly is the right cadence for a practice of any size. Pull ten charts at random and verify that each contains a current good-faith exam, a treatment-specific consent, and a chart note with lot numbers. Check every license and certification for expirations landing in the next 120 days. Physically inspect the emergency kit for expired epinephrine and hyaluronidase. Read the adverse event log with the medical director and record the review. Confirm that every new vendor added since the last audit has a signed business associate agreement. Annually, refresh staff acknowledgments of the handbook and the policies manual, and re-verify insurance limits against the current service menu.
The bottom line
Med spa compliance is a documentation discipline rather than a licensing event. Sixteen documents, kept current and stored where they can be produced within minutes, cover the questions a board, an inspector, an insurer, or an attorney will actually ask. The two that fail most often are the good-faith exam and the treatment-specific consent, and both are cheap to fix before you need them. Build the set once, then audit it quarterly and let each state-specific requirement drive the details.
Frequently asked questions
Is there a single med spa license in the United States?
In most states there is no standalone "med spa license." A medical spa is regulated as a medical practice, so compliance rests on the licenses of the individual providers, the ownership structure permitted in your state, and the documentation that proves supervision and consent. A few states layer on facility registration or office-based surgery rules on top of that.
Which compliance document is most often missing when something goes wrong?
The good-faith examination record. Practices usually have a consent form on file, but frequently cannot produce evidence that a licensed prescriber evaluated the patient and ordered the treatment before an injector performed it. That gap is what turns a complication into a scope-of-practice complaint.
How long should a med spa keep patient records?
Retention is set by state law, not by HIPAA, and commonly runs five to ten years after the last encounter for adults, with longer periods for minors that extend past the age of majority. Separately, HIPAA requires six years of retention for HIPAA documentation such as policies, authorizations, risk analyses and business associate agreements. When two rules overlap, follow the longer one.
Related templates
Free template for your practice
Get a ready-to-edit version of the document this guide describes, plus new templates as we publish them. One useful email now and then, no spam.
This guide is educational and is not legal or medical advice. Verify requirements with your own advisors and your state board before applying them in your practice.