Med Spa Policies and Procedures and What Your Manual Must Contain

What the manual is, and what it is not

A policies and procedures manual is not an employee handbook. The handbook governs the employment relationship: pay, scheduling, conduct, leave, discipline, dress code. The manual governs clinical and operational practice: who may perform what, under whose authority, using which protocol, documented how.

Keep them as separate documents. They are read by different people at different times, they are updated on different cycles, and in a dispute you will want to produce one without the other.

The manual also is not a marketing document or a training deck. It should be written in plain instructions, dated, versioned, approved by the medical director where clinical content is involved, and acknowledged in writing by every member of staff. If a procedure cannot be followed by a competent new hire reading it once, it is not finished.

Clinical governance: scope, delegation and the good-faith exam

This is the first substantive section, and it should be the most specific one in the manual.

State clearly which services the practice offers and which license level may perform each one in your state. Name the medical director and describe the actual oversight: how often charts are reviewed and how many, how protocols are approved, how the director is reached during treatment hours, and how frequently supervision meetings occur and are minuted.

Set out the good-faith examination policy in unambiguous terms. Every new patient receives a documented evaluation by a licensed prescriber before any prescription-only treatment is ordered. Registered nurses, medical assistants and estheticians cannot perform that exam, regardless of whether they may inject under delegation in your state. Specify whether telehealth is permitted for the exam in your jurisdiction and, if so, that it must be a synchronous live video encounter rather than an asynchronous form. State the re-examination interval, commonly annual or sooner if the patient's clinical status changes.

Then cover standing orders and delegation. Each delegated treatment should have a written, signed, dated protocol identifying the drug or device, the indications, the contraindications, the technique, the dose or setting range, the documentation required, and the point at which the injector must stop and call the prescriber. Standing orders do not create scope; they authorize the exercise of scope that already exists.

Emergency protocols: the section that matters most

Most manuals treat emergencies as an appendix. They should be the section you would read first at three in the afternoon on a bad day. Write each protocol as a numbered sequence, print it, and post it where the treatment happens.

Vasovagal syncope. By far the most common event in an injection practice. Signs are pallor, sweating, nausea, lightheadedness, bradycardia and loss of consciousness, often at the sight of a needle. The procedure: stop the treatment, protect the airway, lay the patient supine and elevate the legs, loosen restrictive clothing, apply a cool compress, monitor pulse and blood pressure, and do not let the patient sit or stand until symptoms have fully resolved. Document the episode, the vitals, and the recovery time. Escalate to emergency services if consciousness does not return promptly or if the presentation suggests a cardiac cause rather than a simple faint.

Anaphylaxis. Signs include urticaria, angioedema, stridor or wheeze, throat tightness, hypotension and a rapid, weak pulse. Epinephrine is the first-line treatment and delay is the main cause of death; antihistamines and corticosteroids are adjuncts and never a substitute. The procedure should state the intramuscular epinephrine dose used in your practice and its anterolateral thigh administration site, the instruction to call emergency services immediately, positioning, oxygen if available, the repeat dose interval if symptoms persist, and mandatory transport for observation because of the risk of a biphasic reaction. Name where the kit is stored and who checks its expiration dates monthly.

Vascular occlusion after filler. The protocol that separates a serious practice from a casual one. Signs are immediate disproportionate pain, blanching, dusky or mottled livedo reticularis discoloration, delayed capillary refill, and in the worst case visual disturbance or ocular pain suggesting retinal artery involvement. The procedure: stop injecting immediately, aspirate nothing further, and treat as time-critical tissue ischemia. Flood the affected territory with hyaluronidase, using generous dosing and repeating at defined intervals until perfusion improves, with warm compresses and massage between rounds. State the reconstitution method, the dose per anatomical territory, the repeat interval, and the escalation threshold. Any visual symptom is an ophthalmologic emergency requiring immediate transfer, not observation. Photograph the area, document times to the minute, arrange next-day follow-up, and log the event.

Because hyaluronidase only dissolves hyaluronic acid, the manual should also state plainly what your rescue options are for non-HA fillers, and that is a strong argument for restricting your filler menu.

Add the supporting infrastructure: a stocked emergency kit with a monthly expiration check and a signed log, a designated person responsible for it, documented emergency drills at a stated frequency, current basic life support certification for all clinical staff, and a written trigger list of when to call 911 rather than the medical director.

Infection control, sharps and device safety

OSHA's Bloodborne Pathogens Standard requires a written Exposure Control Plan wherever needles are used, reviewed and updated at least annually. Your manual should incorporate it rather than duplicate it.

Cover hand hygiene and personal protective equipment by task. Cover skin preparation and single-use policy: needles, cannulas and syringes are never reused between patients, and multi-dose vial handling must be specified. Cover sharps: puncture-resistant labeled containers at the point of use, no recapping, replacement before the fill line, and a documented disposal chain. Cover the exposure incident procedure, including immediate first aid, source testing, reporting timeline, post-exposure evaluation and the sharps injury log. Cover hepatitis B vaccination offered to at-risk employees, with declination forms retained.

If you reprocess instruments, write the full sequence: pre-clean, enzymatic soak, ultrasonic, package and date, sterilize with recorded time, temperature and pressure, dry, and store. Record biological indicator testing at your stated frequency and specify that a failed spore test quarantines the load and triggers a recall of items processed since the last passing test.

For energy-based devices, designate a laser safety officer, specify wavelength-appropriate eyewear for patient and operator, posted warning signage and controlled room access, manufacturer training records per device, patch testing policy, and a documented maintenance and calibration schedule.

Documentation, records and retention

Define what a complete chart note contains for each service: date and time, provider, product name, lot number and expiration, units or volume by site, device settings, patient tolerance, aftercare given, and follow-up scheduled. Require entries the same day.

Define your HIPAA operations: the notice of privacy practices, minimum necessary access, unique user credentials with no shared logins, encryption at rest and in transit, the process for patient access and amendment requests, business associate agreements for every vendor touching patient data, annual workforce training, and the breach assessment and notification workflow.

Define photography separately. Clinical images are protected health information. Marketing use requires its own written authorization that specifies the platforms, whether the face is identifiable, and how the patient revokes consent.

Define retention. HIPAA requires six years for HIPAA documentation such as policies, authorizations, risk analyses, business associate agreements and breach records. Clinical record retention is set by state law, commonly five to ten years after the last encounter for adults, with longer periods for minors extending past the age of majority. Where two rules overlap, keep the record for the longer period. State your destruction method and who authorizes it.

Patient-facing operations and keeping the manual current

Put the commercial rules in writing so that staff never improvise them. Cover consent workflow and who witnesses it, minors and legal guardians, the financial and cancellation policy including deposits, packages, memberships, no-shows and refunds, the complaint and grievance process with a named owner and a response deadline, the touch-up and revision policy, and the process for a patient who requests a treatment that is not clinically appropriate. That last one deserves a written script; refusing a sale is easier when the policy does it for you.

Finally, keep the document alive. Version every section with a date and an approver. Require a signed acknowledgment from every staff member at hire and at each annual update. Tie each SOP to a training record so that competency is provable, not assumed. Review annually, and immediately after any adverse event, service addition, device purchase, medical director change or state rule change. Assign one named person to own the review calendar.

The bottom line

A med spa policies and procedures manual earns its keep in the ten minutes after something goes wrong, which is why the emergency section deserves more attention than the rest of the document combined. Build it around clinical governance, emergency response, infection control, documentation and patient-facing operations, keep it separate from the employee handbook, and have the medical director approve every clinical protocol in writing. A manual that is versioned, acknowledged and reviewed on schedule is evidence of a functioning practice, while an undated one is evidence of the opposite.

Frequently asked questions

What is the difference between a policy and a procedure?

A policy states what the practice requires and why, such as "every patient receives a documented good-faith examination by a prescriber before any prescription treatment." A procedure states exactly how that requirement is met, step by step, including who does it, in what order, and what gets recorded. A manual that contains only policies gives staff nothing to follow under pressure.

Does a med spa legally have to have a policies and procedures manual?

Requirements vary by state and by service line. OSHA's Bloodborne Pathogens Standard requires a written Exposure Control Plan wherever needles are used, and HIPAA requires written privacy and security policies for covered entities. Beyond those, many state boards expect written protocols as evidence of proper delegation and supervision, and most professional liability carriers and medical directors require them contractually.

How often should the manual be reviewed?

Annually at minimum, with immediate updates whenever you add a device or service, change medical directors, move locations, or experience an adverse event that reveals a gap. Record the review date and the reviewer on each section, because an unreviewed manual dated three years ago is evidence against you rather than for you.

Related templates