Question 1

Can a good faith exam be done by telehealth?

Accepted Answer

In many states yes, provided it is a live synchronous audio-video encounter with a prescriber licensed in the state where the patient is located, who documents the same assessment an in-person visit would produce. Text-only questionnaires and static intake forms are widely rejected, and the prescriber must be identifiable to the patient.

Question 2

Can a medical assistant inject dermal filler?

Accepted Answer

In most states, no. Medical assistants are unlicensed personnel with no independent scope of practice, and states including California expressly prohibit them from performing cosmetic injections. A few states, notably Texas, allow a physician to delegate certain nonsurgical cosmetic procedures to properly trained unlicensed staff under written protocols and supervision.

Question 3

Can a minor get Botox or filler at a med spa?

Accepted Answer

Cosmetic treatment of a minor is off-label: BOTOX Cosmetic is FDA-approved for adults, and most hyaluronic acid fillers such as Juvéderm and Restylane are indicated for patients over 21. Off-label use is lawful but requires prescriber judgment, parental or guardian consent under state law, and documentation of the medical or psychosocial indication.

Question 4

Can a nurse own a med spa?

Accepted Answer

It depends on your state's corporate practice of medicine doctrine. In strict states such as Texas and New York, an RN or nurse practitioner cannot own the clinical entity delivering medical aesthetics and must use a management services organization alongside a physician-owned professional entity. In full-practice-authority states such as Arizona, Colorado and Florida, NPs commonly own med spas outright. RNs face tighter limits than NPs almost everywhere.

Question 5

Can consent forms be signed electronically?

Accepted Answer

Yes. The federal ESIGN Act and the Uniform Electronic Transactions Act, adopted in 48 states with equivalent statutes in Illinois and New York, make an electronic signature as legally valid as ink. Validity requires four things: intent to sign, the signer's agreement to transact electronically, attribution of the signature to that specific person, and a retained record both parties can reproduce. HIPAA security duties apply on top.

Question 6

Can estheticians do chemical peels?

Accepted Answer

Yes, but only superficial peels that act on the epidermis. Every state's cosmetology board limits estheticians to exfoliation that does not penetrate living tissue below the epidermis, which places medium and deep peels — TCA, phenol and higher-strength formulations — within the practice of medicine, requiring a prescriber's order and appropriate supervision.

Question 7

Can I treat a pregnant client?

Accepted Answer

Elective aesthetic treatments are generally deferred during pregnancy and breastfeeding. Botulinum toxin and dermal fillers have never been studied in pregnancy, so there is no safety data supporting use and manufacturers do not recommend it; most clinics therefore decline injectables, deep peels and elective laser outright. Some superficial services may proceed. The defensible approach is a written policy applied consistently, not an ad hoc decision at the chair.

Question 8

Can I use a free consent form I found online?

Accepted Answer

You can use one, but free forms rarely hold up: they usually omit state-specific disclosure requirements, current FDA labeling and boxed warnings, the identity of the examining prescriber and the treating provider, and HIPAA-compliant photo authorization language. No form makes a practice compliant — the underlying licensure, supervision and examination must be lawful first.

Question 9

Can med spas still prescribe compounded semaglutide?

Accepted Answer

Generally no. FDA removed semaglutide from the shortage list on 21 February 2025, ending the exemption that let pharmacies compound copies; enforcement dates passed in April and May 2025. Compounding an essentially-a-copy product is now prohibited under sections 503A and 503B, and in April 2026 FDA proposed excluding semaglutide from the 503B bulks list entirely.

Question 10

Do estheticians need a consent form for facials, peels and waxing?

Accepted Answer

Most state cosmetology boards do not expressly require a signed consent form for basic esthetic services, but written consent is still effectively mandatory: it is your primary defense in a negligence or battery claim, most professional liability carriers require it, and separate written permission is needed before any client photo is used in marketing.

Question 11

Do I need a business associate agreement with my software?

Accepted Answer

Yes, if the vendor creates, receives, maintains or transmits protected health information on your behalf. Under HIPAA, that covers practice management systems, online booking and intake, EHRs, cloud hosting, e-signature tools, texting and email marketing platforms, billing services and IT support — even when data is encrypted and the vendor holds no key. The agreement must be signed before any patient data reaches the platform.

Question 12

Do I need a medical director for my med spa?

Accepted Answer

If your med spa performs any procedure that constitutes the practice of medicine — neuromodulators, fillers, prescription-strength peels, lasers penetrating living tissue, IV therapy or prescribing — you need physician oversight. In corporate practice of medicine states such as California, Texas and New York, the rules also restrict who may own the clinical entity, not just who supervises.

Question 13

Do I need a Spanish consent form?

Accepted Answer

Federal language-access rules under Title VI and Section 1557 apply only if you receive federal financial assistance, which most cash-pay med spas do not. But consent obtained in a language the patient cannot read is not informed consent under state tort law regardless of federal status, so if you serve Spanish-speaking clients you need bilingual forms and a qualified interpreter, not a family member translating.

Question 14

Do I need consent for PRP?

Accepted Answer

Yes, and it needs disclosures a generic aesthetic consent does not contain. PRP consent must state that the centrifuge or kit is FDA-cleared as a device while the aesthetic procedure itself is not FDA approved for that indication, describe venipuncture and blood-handling risks, name infection, bruising, nodules, prolonged swelling and treatment failure, and set realistic expectations about the number of sessions and the evidence base.

Question 15

Do I need consent to post before and after photos of clients?

Accepted Answer

Yes. Using an identifiable patient photo in marketing requires a separate written authorization meeting the core elements of 45 CFR 164.508, and HIPAA treats marketing uses specially under 164.508(a)(3). A treatment consent does not cover it, cropping the eyes does not reliably de-identify, and the FTC Endorsement Guides at 16 CFR Part 255 also apply to the results you show.

Question 16

Do I need separate consent for each treatment?

Accepted Answer

Yes. Informed consent is legally procedure-specific: it must disclose the material risks, alternatives and expected outcomes of the particular treatment being performed, so a single blanket med spa consent cannot cover filler, neurotoxin, laser, peels and microneedling at once. Use one master registration and policy document plus a distinct signed consent for each procedure, re-consented when the treatment plan, product or provider changes.

Question 17

Do lash technicians need a liability waiver?

Accepted Answer

Yes. Lash extension services carry documented risks — cyanoacrylate adhesive allergy, corneal abrasion, chemical burns from remover, contact dermatitis and traction lash loss — and beauty-industry liability carriers expect a signed waiver plus a patch-test record for every client. A waiver will not defeat a negligence claim in most states, but it defeats the far more common claim that nobody explained the risk beforehand.

Question 18

Does HIPAA apply to texting clients about appointments?

Accepted Answer

Yes, if your practice is a HIPAA covered entity. HIPAA does not prohibit texting patients — it requires reasonable safeguards and permits unencrypted channels when the patient has been warned of the risk and still requests them. Under 45 CFR 164.522(b) you must accommodate reasonable requests for alternative communication means, and the request and warning should be documented.

Question 19

How do I document Botox units and lot numbers?

Accepted Answer

Record the brand and manufacturer, the vial lot number and expiration date, the diluent and volume used, the reconstitution date and time, units delivered at each anatomical site, total units, needle gauge, and the treating clinician. Add an injection map. Lot documentation lets you trace patients if a product is recalled, and it is the evidence that separates legitimate supply from the counterfeit botulinum toxin the FDA and CDC warned about in 2024.

Question 20

How do I handle a complaint about treatment results?

Accepted Answer

See the patient in person promptly, examine and photograph objectively, and document the complaint in the patient's own words. Involve the medical director, rule out a genuine complication before treating it as a satisfaction issue, and log it in your complaint and adverse event registers. Notify your malpractice carrier before offering money framed as compensation, and never alter or backdate a chart entry.

Question 21

How long must a med spa keep patient records?

Accepted Answer

State law sets the retention period, not HIPAA. Most states require five to ten years after the last patient contact for adults, and longer for minors — often until several years past the age of majority. HIPAA itself imposes no medical record retention period, but 45 CFR 164.530(j)(2) requires six years for required HIPAA documentation such as authorizations and policies.

Question 22

How often should consent forms be re-signed?

Accepted Answer

There is no universal interval. Re-sign a treatment-specific consent for each new procedure type and each new course of treatment, refresh the health history at every visit, and obtain a fresh good faith exam when the plan, product or patient's health changes. HIPAA authorizations run until their stated expiration date or event under 45 CFR 164.508(c).

Question 23

Is a good faith exam required before Botox?

Accepted Answer

Yes. Botulinum toxin is a prescription drug, and every state requires a licensed prescriber — a physician, nurse practitioner or physician assistant acting within scope — to examine the patient, establish a medical indication and issue a patient-specific order before injection. A registered nurse cannot perform that exam, and a standing order does not replace it.

Question 24

Is a liability waiver enforceable in a med spa?

Accepted Answer

Rarely, for the part that matters. Most states refuse to enforce a release that excuses a provider's own negligence in a medical service, applying the public-policy analysis from Tunkl v. Regents of the University of California, and no state enforces waivers of gross negligence or statutory violations. A med spa's real protection is a documented informed consent, not an exculpatory clause.

Question 25

Is a med spa a HIPAA covered entity if we don't take insurance?

Accepted Answer

Not automatically — but most med spas are. Under 45 CFR 160.103, a health care provider becomes a covered entity by transmitting health information electronically in connection with a HIPAA standard transaction, such as e-prescribing or an electronic claim or eligibility check. Cash-pay status alone does not exempt you, and state privacy laws apply regardless.

Question 26

Is BPC-157 legal to prescribe in a med spa?

Accepted Answer

BPC-157 is not FDA-approved for any indication and is not on the FDA's 503A or 503B bulks lists, so compounding pharmacies have no lawful pathway to compound it from bulk. Its April 2026 removal from Category 2 was procedural — the nominations were withdrawn — and the July 2026 advisory committee vote favoring it is non-binding until FDA completes rulemaking.

Question 27

Is PRP FDA approved?

Accepted Answer

No. The FDA clears the centrifuges, tubes and kits used to prepare platelet-rich plasma as medical devices under the 510(k) substantial equivalence pathway, but it has not approved PRP itself for aesthetic, facial or hair-restoration use. Several clearance summaries state the resulting PRP has not been evaluated for any clinical indication. Aesthetic PRP is therefore a lawful off-label practice of medicine, not an FDA-approved treatment.

Question 28

What consent do I need for microneedling?

Accepted Answer

Microneedling consent must name the device and needle depth, state whether the treatment is being performed as a cosmetic or a medical procedure under your state's rules, disclose infection, scarring, post-inflammatory hyperpigmentation and granuloma risk, identify any topical or serum applied during treatment, and record the operator's licence and supervision.

Question 29

What forms do I need to open a med spa?

Accepted Answer

A med spa needs three document layers: corporate and licensing records; clinical governance — medical director agreement, written protocols, standing orders, a delegation matrix and good-faith exam records; and patient-facing paperwork including intake, HIPAA notice and authorizations, procedure-specific consents, photo release and financial policy. State boards audit the clinical governance layer first, because that is where unlicensed practice and improper delegation surface.

Question 30

What if a client refuses to sign a consent form?

Accepted Answer

Do not proceed with an elective cosmetic procedure. Consent is a conversation and the signature is only evidence of it, but treating without documented consent exposes you to a battery claim with no defense. Document the disclosure you gave, the patient's refusal to sign and their stated reason, have a witness sign the note, and decline the treatment.

Question 31

What is a good faith exam in a med spa?

Accepted Answer

A good faith exam is the evaluation a licensed prescriber performs before ordering a medical treatment — reviewing history, examining the patient, screening contraindications, establishing a medical indication and issuing a patient-specific order. It derives from state prescribing law requiring an appropriate prior examination, and it cannot be performed by a registered nurse or unlicensed staff.

Question 32

What is informed refusal?

Accepted Answer

Informed refusal is the documented mirror image of informed consent: the record that a patient with capacity declined a recommended treatment, test, referral or precaution after being told the specific consequences of declining. It must name what was recommended, why, what was explained about the risks of refusing, that questions were answered, and that the patient still declined. A signature alone is not enough.

Question 33

What is the corporate practice of medicine?

Accepted Answer

The corporate practice of medicine doctrine is a state-level rule prohibiting corporations and non-physicians from practicing medicine, owning a medical practice, employing physicians, or controlling clinical decisions. It exists to keep business judgment from overriding medical judgment. Enforcement varies sharply: Texas, New York and California apply it strictly, while Florida and Arizona impose few restrictions. Med spas are a primary enforcement target.

Question 34

What must a Botox consent form include?

Accepted Answer

A Botox consent form must identify the specific product and units, state the treatment areas, disclose material risks including the FDA boxed warning for distant spread of toxin effect, flag any off-label area, describe alternatives and the option of no treatment, set realistic onset and duration expectations, and record who performed the good faith exam and who injected.

Question 35

What must a filler consent say about vascular occlusion?

Accepted Answer

A filler consent must name vascular occlusion explicitly and disclose its consequences: permanent blindness, skin necrosis and scarring, and rarely stroke. It must describe the warning signs, state that treatment with high-dose hyaluronidase is time-critical and most effective within hours, and make clear that reversal can fail and that non-hyaluronic-acid fillers cannot be dissolved at all. Omitting this is the most litigated gap in filler consent.

Question 36

What paperwork does my malpractice insurer expect?

Accepted Answer

Underwriters and claims teams expect a documented treatment menu matched to licensed scope, procedure-specific signed consents, a medical director agreement with signed protocols and standing orders, credentialing and training files for every clinician, a good-faith exam on every chart, a dated chart-audit log, an adverse event and complaint register, and evidence that your medical director carries an individual policy. Missing documents can trigger coverage disputes, not just higher premiums.

Question 37

What should a med spa intake form ask?

Accepted Answer

A med spa intake must capture full medical history, all medications and supplements with specific attention to anticoagulants and isotretinoin, allergies including lidocaine and latex, autoimmune and bleeding disorders, keloid tendency, herpes labialis history, pregnancy and breastfeeding status, Fitzpatrick skin type, recent aesthetic treatments and their dates, and the patient's actual goals. It feeds the good-faith exam, so it must be reviewed by the treating provider, not just filed.

Question 38

What should be in a med spa employee handbook?

Accepted Answer

A med spa handbook needs the standard employment content — at-will disclaimer, anti-harassment and reporting, wage, overtime, tip and commission rules, leave entitlements and an acknowledgement page — plus clinic-specific sections most templates omit: scope-of-practice limits per license, HIPAA and patient photography rules, social media boundaries, infection control and OSHA duties, and adverse event reporting.

Question 39

Who can legally inject Botox in my state?

Accepted Answer

Botulinum toxin is a prescription drug, so injecting it is the practice of medicine. Physicians, physician assistants and nurse practitioners may inject in every state; registered nurses may in most, but only under a prescriber's patient-specific order following a good faith exam. LPN/LVN rules vary sharply by state, and estheticians may never inject anywhere in the US.

Question 40

Who can perform laser hair removal?

Accepted Answer

It depends entirely on your state. Most states treat laser hair removal as the practice of medicine, delegable by a physician to an NP, PA or RN under defined supervision after a good-faith exam; a minority — including Arizona, Colorado and Utah — allow specially credentialed estheticians or laser technicians; and New York is unusual in having no operator restriction. Verify with your medical, nursing and cosmetology boards before buying a device.

Answers: compliance questions for aesthetic and wellness practices