The 2026 Med Spa Compliance Checklist: Every Document Your Practice Should Have on File

Compliance is no longer a back-office afterthought for medical spas. In 2026, state boards across the country are inspecting more aggressively, and the practices that stay protected are the ones that build documentation into daily operations rather than scrambling when a complaint arrives. The good news: most of what regulators look for comes down to a defined set of documents. This checklist walks through the core compliance pillars and the paperwork that supports each one.

1. Ownership and corporate structure

In most states, the practice of medicine cannot be owned or controlled by a non-physician. Because injectables, lasers, and prescription therapies are generally treated as the practice of medicine, the entity delivering those services usually must be owned by a licensed physician or a physician-owned professional entity. The exact rules vary widely — some states allow nurse practitioners with full practice authority to own a practice, while others restrict ownership to physicians. Your formation documents and any management services arrangement should reflect the structure your state actually permits.

2. Medical director oversight

Nearly every state that permits injectables and energy-based devices requires a licensed physician to supervise the practice, whether as a formal medical director or through a collaborative or supervisory agreement. A signed medical director agreement that names specific duties, a supervision schedule, and a compensation arrangement is one of the first documents an inspector asks to see.

3. The good faith exam and patient-provider relationship

Before a patient receives a prescription medication, injectable, or device-based treatment, a qualified provider generally needs to evaluate them and establish a valid patient-provider relationship. Standardized intake and exam documentation helps demonstrate that a licensed provider actually reviewed each patient and made a clinical decision.

4. Procedure-specific informed consent

Generic, one-size-fits-all consent forms are a common weak point. Consent should be specific to each treatment, disclose material risks and alternatives, and be signed and dated before service. Spot-checks of consent forms are a routine part of inspections.

5. Written protocols and policies (SOPs / P&P manual)

Written standard operating procedures and a policy and procedure manual show that your team operates within scope and follows a consistent standard of care. Protocols that are copied, generic, or out of date create risk, so they should reflect the services you actually offer.

6. HIPAA and privacy safeguards

Because med spas deliver medical services, they are generally subject to HIPAA regardless of the aesthetic services they also provide. A notice of privacy practices, signed authorizations, and business associate agreements with vendors are part of a defensible privacy program.

7. Employment, contractor, and credentialing records

Current license verification for every clinical staff member, plus clear employment or independent contractor agreements, round out the file. Lapsed licenses — even briefly — can create meaningful exposure.

Your compliance document starting point

If you are assembling this from scratch, the fastest path is to start with attorney-drafted templates and tailor them to your services and your state. Each pillar above maps to a document set you can put in place this quarter.

Frequently asked questions

Does every med spa really need a medical director?
In nearly every state, if you offer injectables, lasers, or prescription-based therapies, a licensed physician must supervise the practice in some form. The title and structure vary by state, but physician oversight is the norm.

How often should I review my compliance documents?
A consistent internal review — many practices do this quarterly — helps catch lapsed licenses, outdated protocols, and missing signatures before they become findings during an inspection.

Where should I start if I have almost nothing documented?
Prioritize the documents inspectors ask for first: your medical director agreement, business structure, treatment protocols, consent forms, and good faith exam records.