The short answer
A med spa needs three document layers: corporate and licensing records; clinical governance — medical director agreement, written protocols, standing orders, a delegation matrix and good-faith exam records; and patient-facing paperwork including intake, HIPAA notice and authorizations, procedure-specific consents, photo release and financial policy. State boards audit the clinical governance layer first, because that is where unlicensed practice and improper delegation surface.
What corporate and licensing documents come first?
Before a single form is printed, the entity structure has to be legal in your state. In corporate practice of medicine states, the clinical entity generally must be a professional corporation or PLLC owned by licensed physicians, with any non-licensee involvement routed through a separate management services organization under a written MSO agreement. Texas, New York and California enforce this strictly; Florida and Arizona are considerably more permissive. Get this wrong and every downstream form is signed by the wrong party.
The rest of this layer is unglamorous and non-negotiable: state business registration and EIN, local business and occupancy permits, professional licenses for every clinician on the floor, facility registration where your state requires one for laser or surgical suites, DEA registration if you hold controlled substances, a wholesale drug distributor or pharmacy relationship for injectables, medical waste and sharps disposal contracts, and OSHA bloodborne pathogen exposure control documentation.
Which clinical governance documents do boards actually ask for?
This is the layer that decides inspections. A medical director agreement should specify compensation, protocol review and signature, chart review cadence, availability standard, site visit frequency and adverse event handling — not just a name on a wall. Attach written clinical protocols and standing orders for every service offered, naming the device, drug, dose range and limits, each signed and dated, with a record of when they were revised for new devices or new providers.
You also need a delegation matrix that maps every service to the license types permitted to perform it in your state and every staff member to what their individual license authorizes. Add a good-faith exam record and specific treatment order for each patient before first treatment, a dated chart-review and QA log, training and competency files for each injector and laser operator, and an adverse event log.
| Document | Who signs it | Why the board wants it |
|---|---|---|
| Medical director agreement | Physician and entity | Proves supervision is real, not nominal |
| Standing orders and protocols | Medical director | Establishes the delegated authority for each service |
| Delegation matrix | Medical director | Shows no one worked outside scope of license |
| Good-faith exam record | Examining provider | Establishes the provider-patient relationship |
| Chart review / QA log | Medical director | Evidence of ongoing oversight, not a one-time signature |
What patient-facing paperwork does every med spa need?
Start with a medical intake and health history that captures medications, anticoagulants, isotretinoin use, autoimmune disease, keloid history, pregnancy and breastfeeding status, prior aesthetic treatments and Fitzpatrick type. Then a HIPAA Notice of Privacy Practices with an acknowledgement of receipt, a separate authorization for any use or disclosure that is not treatment, payment or health care operations, and a distinct photo and marketing release — consent to be photographed for the chart is not consent to appear on Instagram.
Layer procedure-specific informed consents on top: neurotoxin, filler, laser and energy devices, microneedling, chemical peel, PRP, and any weight-management or peptide program you run. Finish with financial and cancellation policy, telehealth consent if you screen remotely, and a patient rights and complaint procedure.
What this means for your paperwork
Build the binder in the order a board investigator reads it: entity and licenses, then medical director agreement and protocols, then the delegation matrix, then one representative patient chart showing intake, good-faith exam, consent, treatment record with lot numbers, and aftercare acknowledgement. If any link in that chain is missing for a single patient, investigators generally widen the review rather than close it.
Version and date every template, keep superseded versions rather than overwriting them, and record which protocol version was in force on any given treatment date. When a complaint arrives two years later, the question is what your documents said then — not what they say now.
Related questions
This answer is educational and is not legal or medical advice. Requirements vary by state and change over time — verify with your own legal and clinical advisors before applying anything here in practice.