Florida AHCA Inspection: What Inspectors Check First at Med Spas
Most Florida med spa owners think about compliance as a checklist. AHCA inspectors think about it as a sequence. Here's the order they actually work through your practice — and why it matters which gap they find first.
Quick Answer
What do Florida AHCA inspectors check first at a med spa?
Florida AHCA inspectors follow a consistent priority sequence: (1) Medical Director Agreement and physician license, (2) staff credentials and scope of practice, (3) written treatment SOPs signed by the medical director, (4) emergency protocols posted in treatment rooms, and (5) HIPAA and patient consent documentation. The Medical Director paperwork is almost always the first request.
How Florida Med Spa Inspections Actually Work
Florida med spa inspections come from two directions. The Agency for Health Care Administration (AHCA) oversees healthcare clinic licenses and conducts routine and complaint-driven inspections of licensed facilities. The Florida Department of Health (DOH) investigates complaints against individual licensed providers — physicians, nurses, APRNs, and PAs working inside your practice.
An unannounced inspection triggered by a patient complaint can involve both agencies simultaneously. A routine AHCA inspection of your clinic license typically provides some advance notice, but you cannot count on it. The standard every Florida med spa must operate to is: would this survive an inspection that happens tomorrow with no warning?
The sequence below reflects the consistent pattern of what inspectors request first. It is not a random walk through your practice. They have a methodology, and understanding it lets you close the highest-risk gaps first.
Priority 1: The Medical Director Agreement
Every AHCA inspection of a Florida med spa begins here. The inspector will ask to see the Medical Director Agreement within the first few minutes. This single document — or its absence — sets the tone for everything that follows.
What Inspectors Verify in the Agreement
A compliant Medical Director Agreement must specify: the physician's full name and active Florida license number, the scope of medical oversight responsibilities, the minimum frequency of on-site visits, how clinical protocols are reviewed and approved, and the compensation structure (flat fee only — never a percentage of revenue or volume). Inspectors look specifically for whether the agreement describes actual supervision or is generic boilerplate that could apply to any business.
The Active License Check
Immediately after reviewing the agreement, inspectors verify the Medical Director's Florida license status on the DOH license lookup. An agreement with a physician whose license is suspended, lapsed, or under restriction is treated as no Medical Director at all. Keep a printed copy of your Medical Director's license in the same binder as the agreement, and check its status quarterly.
What Triggers Immediate Escalation
If you cannot produce a written Medical Director Agreement on the spot, or if the physician named in the agreement has any license issues, the inspector will note this as a serious deficiency. In the post-2026 enforcement environment, "ghost" medical directors — physicians listed on paper who have never visited the practice — are treated as a patient safety violation, not a paperwork technicality.
Priority 2: Staff Credentials and Scope of Practice
The second thing inspectors request is the credential file for every clinical staff member. This means current Florida license for each provider, verification that the license is in good standing, and documentation confirming what procedures each staff member is authorized to perform.
The Scope of Practice Matrix
Best practice is to maintain a written Scope of Practice Matrix — a simple document listing each clinical role (MD, APRN, PA, RN) and which procedures they are authorized to perform under your practice's supervision structure. Inspectors find this document immediately useful because it shows you have thought through the question deliberately rather than leaving scope decisions to individual judgment calls on the floor.
The RN Injection Question
This is the area where Florida med spas most frequently have a problem. In Florida, RNs can administer injectable medications — including Botox and fillers — but only pursuant to a physician's order and with appropriate supervision. An RN injecting under a blanket standing order from a medical director who is not immediately available creates a scope of practice problem. The inspector will ask: what was the physician supervision arrangement for each RN injection session? If you cannot point to a specific written delegation protocol and a physician who was reachable, you have a citation.
License Expiration Tracking
Florida professional licenses renew on a biennial cycle, and the renewal dates vary by profession. An expired license caught during inspection — even by one week — results in the same treatment as no license at all. Maintain a simple spreadsheet tracking every staff member's license type, license number, and renewal date, with a calendar reminder 90 days before each expiration.
Florida-Ready SOPs
Get 62 Professionally Written SOPs — Ready for Your Medical Director to Sign
Every protocol an AHCA inspector expects to see — written, formatted, and organized for Florida med spa compliance.
Browse SOPs — Starting at $197Priority 3: Written Treatment SOPs Signed by the Medical Director
After credentials, inspectors turn to your written clinical protocols. The question is not whether you have protocols — nearly every med spa has something written down — but whether those protocols are complete, current, and carry the Medical Director's signature.
What a Compliant SOP Must Include
Each treatment-specific SOP must cover: patient selection criteria and contraindications, pre-treatment assessment requirements, the step-by-step procedure, product specifications (including dose ranges for injectables), post-treatment monitoring and care instructions, and the adverse event response pathway. A protocol that says "administer Botox per physician order" without specifying the assessment, documentation, and complication response process will be flagged as incomplete.
The Medical Director Signature Requirement
Every SOP must be reviewed and signed by the Medical Director, with the date of review clearly indicated. Unsigned protocols are treated as if they do not exist from a compliance standpoint. When you update a protocol, get a fresh signature with the new date. A protocol last signed three years ago by a physician who no longer works with your practice is non-compliant on two counts.
Protocols That Inspectors Look For Specifically
In 2026, Florida inspectors are specifically requesting protocols for: injectable neurotoxins, injectable fillers, any GLP-1 or weight loss medication administered in-clinic, any laser or energy-based device treatment, and all chemical peel procedures. These are the categories most associated with adverse events and regulatory complaints.
Priority 4: Emergency Protocols Posted in Treatment Rooms
Emergency protocols are the most frequently cited category in Florida med spa inspections — not because practices don't have them, but because they are not accessible where they need to be. A 40-page emergency binder in the back office is not the same as a laminated vascular occlusion protocol posted in the treatment room where fillers are administered.
What Must Be Physically Posted
Florida inspectors specifically check for posted emergency protocols in treatment rooms. At minimum, the following should be laminated and posted in each treatment area: anaphylaxis response steps with epinephrine auto-injector location, vascular occlusion recognition and response, syncope management, and the practice address and nearest emergency department. The 911 address needs to be explicitly stated — staff under stress should not have to remember or look up the physical address of the building.
Emergency Supplies
Beyond documentation, inspectors verify that the physical emergency supplies exist and are not expired. Epinephrine auto-injector on-site, sharps containers accessible, and an updated emergency supply log. An expired epinephrine auto-injector is a citation even if the protocol documentation is perfect.
Staff Training Records
Inspectors ask whether staff have been trained on emergency protocols. Verbal confirmation is not enough. You need a dated training log with staff signatures confirming they participated in emergency response training. An annual emergency drill — even a tabletop exercise — documented with signatures is the standard.
Priority 5: HIPAA and Patient Consent Documentation
HIPAA compliance is the fifth area inspectors cover, but it carries significant independent enforcement risk because HIPAA violations are reported to the Office for Civil Rights (OCR), which operates entirely separately from AHCA. A med spa can pass an AHCA inspection and still face a six-figure OCR fine for how it handles before/after photos or patient text messages.
What Inspectors Check in This Category
During the AHCA inspection, they look for: Notice of Privacy Practices posted in the waiting area and in new patient intake packets, procedure-specific informed consent forms signed and dated for each patient, and photo consent forms separate from treatment consent for any before/after images used in marketing.
The Patient Record Spot-Check
Inspectors may pull a sample of patient records to verify that consent documentation is present and complete. What they look for: does the consent form describe the specific procedure performed, does it list risks and alternatives, is it signed before the procedure date (not the same day or after), and is it procedure-specific rather than a single generic consent for all services.
How to Run Your Own Mock Inspection
The most effective preparation is to walk through your own practice in the same sequence an inspector would. Block 90 minutes, assign one person to play the inspector role, and follow this exact order:
- Request the Medical Director Agreement — can you produce it within 60 seconds? Is the physician's license current? Does the agreement match the actual supervision arrangement?
- Pull every clinical staff member's license — look up each one on the DOH license lookup in real time. Any lapsed, restricted, or conditional licenses?
- Review three treatment SOPs — pick the three highest-volume procedures. Are they complete? Are they signed? Are they current?
- Walk each treatment room — are emergency protocols posted? Is the epinephrine auto-injector present and not expired?
- Pull three patient charts — is consent documentation present, procedure-specific, and pre-dated?
Every gap you find in this exercise is a gap an inspector will find. Fix it before they show up.
Summary
- AHCA inspections follow a consistent priority sequence — not a random walkthrough
- The Medical Director Agreement and physician license verification is always the first request
- Staff credentials and scope of practice documentation come second — the RN injection question is high-risk
- Treatment SOPs must be complete, current, and carry the Medical Director's dated signature
- Emergency protocols must be physically posted in treatment rooms, not just filed in a binder
- HIPAA consent documentation is reviewed last in the AHCA inspection but carries independent OCR enforcement risk
- A 90-minute mock inspection walkthrough, done quarterly, is the most effective preparation
Disclaimer: This guide is for educational purposes only and does not constitute legal advice. Florida med spa regulations are subject to change. Consult a licensed Florida healthcare attorney for guidance specific to your practice.