Medical Spa Compliance Under the Microscope

Historically, medical spas have been regulated indirectly through general medical practice acts, nursing scope-of-practice rules and cosmetology licensing regimes rather than through statutes specifically defining and regulating "medical spas" as a distinct business category. Recently, however, more states have begun regulating or proposing to regulate medical spas directly. Because directly applicable guidance now exists in a growing number of jurisdictions, there is increased opportunity for enforcement and regulatory scrutiny. State-level enforcement does not operate in isolation, however. Federal agencies – principally the U.S. Food and Drug Administration (FDA) – have intensified scrutiny of the medical spa industry, and operators should treat federal exposure as a parallel, not secondary, compliance risk.

State Legislative Efforts and Enforcement Activity

States Enacting Dedicated Medical Spa Statutes

• Indiana: Senate Enrolled Act 282 / Public Law 136 (Signed March 2026; Effective July 1, 2026). Indiana's new law represents the most comprehensive regulatory framework for medical spas we have seen in the U.S. to date. It requires medical spas to 1) register with the Indiana Medical Licensing Board beginning on January 1, 2027, 2) designate a "responsible practitioner" (an Indiana-licensed physician, advanced practice registered nurse (APRN) or physician assistant with delegated prescriptive authority) to oversee facility operations, 3) report serious adverse events, 4) comply with healthcare provider advertising laws and 5) refrain from providing services at locations other than the medical spa itself. The law also limits compounding to a licensed pharmacist, physician or licensed individual under their supervision, and requires that any bulk drug substance used comes from FDA-registered facilities with valid certificates of analysis. Finally, the law imposes fines of up to $5,000 for operating an unregistered medical spa.
• Rhode Island: Medical Spas Safety Act (Effective June 30, 2025). Rhode Island's Medical Spas Safety Act took effect on June 30, 2025, and was codified at R.I. Gen. Laws Chapter § 23-105. The law broadly defines "cosmetic medical procedures" and requires every medical spa to employ or contract a physician or certified nurse practitioner as medical director, with specific training obligations beyond manufacturer- or vendor-provided programs. The law also directs that medical spas be licensed as healthcare facilities by the Rhode Island Department of Health – a significant shift from their prior treatment as ordinary medical offices – and requires the department to promulgate implementing rules and regulations that will govern that licensure process as of July 1, 2026. The medical director and patient-protection requirements – including implementing patient-care policies, overseeing delegation and supervision of procedures, and maintaining written protocols on-site for inspection – are already enforceable. The law's facility-licensure framework, however, is not yet finalized. The July 1, 2026, deadline has passed and the Department of Health has not yet issued those regulations. Holland & Knight will continue to monitor for updates.
• Texas: "Jenifer's Law" (HB 3749) (Effective September 1, 2025). Following a patient death attributed to remote physician delegation at an IV-therapy clinic, Texas enacted this law to require that elective IV therapy, when delegated by a physician, be prescribed or ordered by a PA or APRN, and administered by a registered nurse or higher-level provider under adequate physician supervision.

Other State Activity

In addition to enacting dedicated medical spa statutes, several states have filled the regulatory gaps through updated board guidance and interagency coordination.

• Georgia: The Georgia Composite Medical Board issued a position statement on May 7, 2026, targeting the "matchmaker medical director" model – arrangements in which a physician signs a contract but provides no genuine clinical oversight – and interpreting existing Georgia law to prohibit third-party physician-matching services (e.g., "Collaborating MDs/DOs," "APRN Match" or "NP Collaborator") that are paid for assigning or routing remuneration to a delegating physician. The statement clarifies that Georgia law¹ bars a physician from being an "employee" of an APRN or APRN-owned company when required to supervise an APRN, and the Medical Board construes this broadly to cover any remuneration, monetary or non-monetary, received in exchange for serving as the supervising or delegating physician. For IV hydration clinics specifically, the Board cautions against reliance on registered nurse/licensed practical nurse (RN/LPN)-only evaluation, generic standing orders, menu-based treatment without individualized patient assessment, noncompliant physician protocol arrangements, or sterile compounding and drug-handling practices that fail to satisfy Georgia pharmacy law and USP 797.²
• Oklahoma: The Oklahoma Board of Nursing approved new guidance on March 24, 2026, requiring nurses performing cosmetic and aesthetic dermatological procedures in medical spas to follow an individualized provider order based on a completed patient history and physical examination. The guidance expressly states that standing orders are not an adequate substitute.
• Illinois: The Department of Financial and Professional Regulation and Department of Public Health updated their joint medical spa memorandum on October 30, 2025, restricting ownership to physicians or full-practice-authority APRNs and classifying certain procedures as the practice of medicine, including the administration of botulinum toxin (commonly referred to as Botox), chemical peels beyond superficial depth, collagen injections, liposuction, microblading, microneedling and laser treatments.
• New Mexico: The state's medical board similarly revised its guidance on September 26, 2025, limiting delegation of cosmetic procedures to trained, certified medical assistants under direct physician supervision for non-incisive procedures only, while barring delegation to cosmetologists or estheticians altogether.
• Washington: The Department of Health has convened an interagency Medical Spa and Esthetic Services Work Group, which has published an interprofessional infection control checklist and informed consent guidance for the industry as of June 2025.

New York Enforcement Activity

Although most states have relied on medical board guidance and interagency coordination to address gaps in existing laws, New York has taken a more aggressive enforcement-driven approach to target noncompliant medical spas directly.

The New York Department of State issued a press release on January 8, 2026, summarizing the results of a statewide expansion of its investigation into businesses representing themselves as medical spas or otherwise providing medical spa services. This effort builds upon prior investigations focused on the New York City area. The Division of Licensing Services led the expanded enforcement effort in partnership with the Department of Health, the New York State Education Department and the New York City Office of Oversight and Investigations. Together, these agencies inspected more than 200 medical spas and cited 87 for possible violations, including the unlawful practice of medicine. Penalties have included monetary fines, license suspensions, license revocations and, in more serious cases, criminal charges. The Department of State also published detailed consumer guidance aimed at helping consumers identify and report potential non-compliance.

The statewide investigation follows a June-September 2024 multi-agency inspection of 15 New York-based medical spas that found violations at every location – most commonly unlicensed medical procedures, improper license display and missing safety records – and prompted a December 2025 report by the New York City Council recommending mandatory service-restriction notices, institutionalized joint inspections and a consumer education campaign.

Federal Regulatory Scrutiny and Enforcement

FDA: Counterfeit Botox, Unlawful Compounding and Deceptive Marketing

• DSCSA Warning Letter: First Enforcement Against a Medical Spa (April 1, 2026). The FDA issued its first-ever Drug Supply Chain Security Act (DSCSA) warning letter to a "dispenser" – a medical spa located in Southlake, Texas. The FDA found that the facility's patient dispensing records showed significantly more Botox administered than the facility had purchased from its authorized trading partner, raising substantial concerns that the facility obtained additional product from an unauthorized source. Inspectors also found an unlabeled vial of botulinum toxin lacking a lot number and expiration date on-site. This enforcement builds upon earlier FDA and Centers for Disease Control and Prevention (CDC) actions against counterfeit injectables, including a 2024 investigation into botulism-like reactions in 17 people across nine states and 18 warning letters issued in November 2025 to websites selling unapproved Botox products. This action signals that FDA enforcement under the DSCSA now extends beyond wholesale distributors and manufacturers to individual dispensing practices, including medical spas.
• Warning Letters to Telehealth Companies and Online Sellers Marketing Compounded GLP-1s (June 8, 2026). The FDA posted 25 warning letters on June 16, 2026, that were issued to telehealth companies for false and misleading marketing of compounded GLP-1 products, including semaglutide and tirzepatide. The letters, issued to the companies on June 8, 2026, cited two primary violations: marketing claims implying "sameness" between compounded products and FDA-approved drugs, and advertising practices that obscured the true source of the product, including branding drug images with the telehealth companies' own name or trademark in a manner suggesting the company itself was the compounder. This is the third round of such letters targeting telehealth companies – the FDA sent more than 55 letters to online sellers of compounded GLP-1 products in September 2025 and another 30 to telehealth companies in March 2026, citing similar violations.

These violations stem from the FDA's 2025 removal of semaglutide and tirzepatide from the federal drug shortage list, which eliminated the legal basis for mass-compounding these drugs and now limits compounding to narrow, patient-specific medical needs. Mass-marketed compounded versions sold to the general public no longer have valid legal justification. In February 2026, the FDA announced it would restrict the active pharmaceutical ingredients used in these largely unauthorized products and crack down on marketing that obscures this reality, warning of potential legal action including seizure and injunctions. Although these actions are not against medical spas specifically, the FDA's concerns apply directly to any entity marketing compounded GLP-1 products, and the recurring enforcement reflects the FDA's priority against the telehealth-to-med-spa pipeline that supplies many compounded weight-loss drugs.

Cross-State Themes: Common Enforcement Priorities

The federal enforcement activity, together with the emerging state enforcement and regulatory activity described above, reveals a consistent set of regulatory priorities that medical spa operators nationwide should anticipate:

1. Unlicensed Practice of Medicine and Inadequate Physician/Provider Oversight. Across all jurisdictions, frequently cited violations involve individuals performing medical procedures without proper licensure and the absence of meaningful physician oversight. Regulators, including those in New York and Georgia, are directly targeting "ghost" and "matchmaker" medical director arrangements that enable absentee physician oversight.
2. Product Sourcing, Labeling and Traceability. Counterfeit, unauthorized or improperly compounded products are now explicit federal and state enforcement priorities. The FDA's first-ever DSCSA warning letter to a med spa in April 2026, its parallel enforcement against counterfeit botulinum toxin and unlawfully marketed compounded GLP-1 products, and New York's identification of suspected counterfeit drugs in January 2026 collectively demonstrate that regulators are scrutinizing the entire product supply chain from manufacturer to patient.
3. Sanitation, Safety Recordkeeping and Documentation Gaps. The enforcement actions highlight pervasive failures in basic sanitation (overflowing sharps containers, improper medication storage), safety recordkeeping (missing adverse event documentation) and operational documentation (absent liability insurance, missing staff credentials, failure to display required licenses and postings, etc.). These findings suggest that even facilities with legitimate medical oversight may face enforcement exposure if administrative compliance is neglected.

Compliance Checklist: Preparing for Potential Enforcement Activity

In light of the enforcement trends described above, medical spa owners, operators, physicians and advanced practice providers should work with counsel experienced in medical spa regulatory matters to take the following immediate compliance steps:

1. Verify and Document Genuine Medical Director Engagement. Confirm that your medical director provides genuine, active clinical oversight, not merely a signature on a contract. The medical director should be personally involved in protocol development, chart review, staff training and periodic on-site visits. Document all oversight activities contemporaneously and eliminate (or reduce) reliance on third-party "matchmaker" physician services.
2. Ensure All Delegation Is Documented in Writing and Matches Actual Practice. Review all standing delegation orders, standing medical orders, protocols and prescriptive authority agreements. Confirm they are current, signed, and accurately reflect the procedures actually being performed and the personnel actually performing them. Ensure that written delegation does not authorize procedures or personnel beyond what the delegating physician actually oversees – and is permitted to oversee – in practice.
3. Verify Product Sourcing Through Authorized, Traceable Distributors. Confirm that all pharmaceutical products (including injectables such as Botox and dermal fillers) are sourced exclusively from authorized distributors. Maintain complete lot-tracking documentation, including purchase records, lot numbers and expiration dates for all products on-site. Be prepared to reconcile patient administration records against purchasing records.
4. Confirm Compounded Medications Come from Compliant Pharmacies. If your practice uses compounded medications, verify that those medications are obtained exclusively from properly registered 503A or 503B pharmacies that comply with applicable sterile compounding standards. Additionally, confirm that each compounded product has a current legal basis for compounding – particularly for GLP-1 products, which may no longer be eligible for mass compounding following the FDA's removal of semaglutide and tirzepatide from the drug shortage list.
5. Verify Required Postings, Notices and Staff Identification. Confirm that all required licenses, permits and regulatory notices are properly displayed in public areas and treatment rooms.
6. Conduct Recurring Self-Audits. Implement a schedule of regular internal compliance audits – quarterly at minimum. Use a standardized checklist that covers licensure, delegation, product sourcing, sanitation, recordkeeping and posting requirements. Document audit findings and corrective actions taken.
7. Train Staff on Responding to an Unannounced Inspection. Develop and train all staff on a written protocol for responding to unannounced regulatory inspections. Staff should know who to contact immediately (including legal counsel), what to provide and what to withhold pending legal review, how to document the inspection in real time, and the importance of professionalism and cooperation without waiving legal rights.

Notes

¹ See O.C.G.A. § 43-34-25(n); Ga. Comp. R. & Regs. 360-32-.04(5)

² In a June 4, 2026, follow-up letter, the Board clarified that the position statement does not create new law or policy, terminate active protocols or require clinics to close. Rather, the Board's intent was to reaffirm its commitment to ensuring genuine physician-Advanced Practice Provider collaboration.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.