Compliance
Medical Spa Compliance Readiness Checklist
A structured compliance review tool for licensed medical providers operating or planning an aesthetic practice. This checklist is educational and does not guarantee compliance or constitute legal advice.
Last reviewed: 2026-08-04
Licensure
- All treating providers hold active, unrestricted licenses in the state of practice.
- Licenses are verified through the state board's public database.
- License expiration dates are tracked and renewed in advance.
- Any required facility licenses or registrations are current.
- DEA registration is current if controlled substances are handled.
Scope of Practice
- Each provider's permitted treatments are documented and verified against state scope rules.
- Providers do not perform treatments outside their licensed scope.
- Scope-of-practice documentation is reviewed annually.
- Any scope changes (new treatments, new products) are verified before implementation.
- Providers are aware of any state-specific scope restrictions for their license type.
Ownership
- The practice ownership structure is reviewed by an attorney for corporate-practice-of-medicine compliance.
- Any required MSO or management agreements are documented.
- Ownership percentages and roles are clearly defined.
- The practice is not owned by an unlicensed individual in a manner prohibited by state law.
- Business filings and registrations are current.
Oversight
- The level of physician oversight required by state law is documented.
- A medical director or supervising physician agreement is in place if required.
- The agreement specifies the physician's responsibilities and availability.
- The physician is licensed in the state and eligible to serve as a medical director.
- Oversight arrangements are reviewed annually.
Delegation
- Delegation rules for each provider type are documented and followed.
- Written delegation or standing orders are in place where required.
- Delegated tasks are within the delegating provider's scope.
- Delegation documentation is maintained in patient records.
- Providers understand the difference between delegation, supervision, and collaboration.
Good Faith Exams
- Whether a Good Faith Exam is required before treatment is confirmed for your state.
- The qualified provider who performs the exam is identified.
- The exam is documented in the patient record.
- The timing and frequency of exams comply with state requirements.
- Telehealth exam rules are verified if remote exams are used.
Policies and Protocols
- Written treatment protocols exist for each procedure offered.
- Protocols are reviewed and signed by the medical director or supervising physician.
- An emergency-response plan and anaphylaxis protocol are documented.
- Infection-control policies are in place and followed.
- An adverse-event reporting procedure is documented.
Consent
- Informed consent forms exist for each treatment type.
- Consent forms include risks, benefits, alternatives, and expected outcomes.
- Consent is obtained and documented before each treatment.
- Consent forms are signed by the patient and the treating provider.
- Consent forms are stored in the patient record.
Patient Records
- Treatment notes are documented for every patient visit.
- Records include product name, lot number, injection site, and dosage.
- Before-and-after photos are consented and stored securely.
- Record retention periods comply with state requirements.
- A system exists for patients to request their records.
Privacy
- A HIPAA privacy policy is in place and acknowledged by staff.
- Business Associate Agreements are signed with vendors who handle PHI.
- Patient information is stored securely with access controls.
- A breach-notification procedure is documented.
- Staff training on privacy is conducted and documented.
Medication Handling
- Prescription products are sourced from licensed pharmacies or suppliers.
- Product storage meets manufacturer temperature and security requirements.
- Lot numbers and expiration dates are tracked.
- Compounded products are obtained from a compliant compounding pharmacy.
- A waste-disposal procedure for medications and sharps is documented.
Infection Control
- OSHA bloodborne-pathogens training is current for all staff.
- Personal protective equipment is available and used.
- Surface disinfection protocols are documented and followed.
- Sharps disposal containers are available and disposed of properly.
- Sterilization procedures are documented if reusable instruments are used.
Emergency Preparedness
- An emergency kit is stocked and checked regularly.
- Staff are trained in anaphylaxis recognition and epinephrine administration.
- Emergency contact numbers and the nearest emergency facility are posted.
- A patient-transfer protocol is documented.
- Emergency drills are conducted periodically.
Training
- All providers have documented training for the treatments they perform.
- Training certificates are kept on file.
- Continuing education requirements are tracked and met.
- New staff receive orientation on protocols and emergency procedures.
- Competency is assessed before a provider treats patients independently.
Insurance
- Professional liability insurance covers all providers and treatments.
- General liability insurance is current.
- Coverage limits are reviewed annually.
- Any required workers' compensation coverage is in place.
- The policy covers the specific aesthetic procedures performed.
Advertising
- Marketing claims are truthful and not misleading.
- No guarantees of results are made.
- Before-and-after photos have patient consent and HIPAA compliance.
- Social media content complies with professional-board advertising rules.
- Provider credentials are accurately represented.
Chart Review
- A chart-review schedule with the medical director is established and followed.
- Chart-review findings are documented and shared with providers.
- Deficiencies are corrected and tracked to completion.
- A sample of charts is reviewed at a defined frequency.
- Chart reviews include consent, treatment notes, and product documentation.
Ongoing Compliance Review
- A compliance audit is conducted at least annually.
- State board rule changes are monitored.
- Policies and protocols are updated when rules change.
- Staff are notified of policy changes and retrained as needed.
- A compliance log or tracker is maintained.
Your Next Step
Ready to take the next step?
Use this checklist alongside the relevant NOVI support options. Requirements vary by state, license and practice structure — confirm specifics with qualified guidance.
NOVI resources are provided for general educational purposes and are not legal, medical, tax, financial, licensing, or regulatory advice. Requirements may vary by state, provider credentials, practice structure, and services offered. Current requirements should be confirmed with qualified professionals and official regulatory sources.