The Florida Med Spa Compliance Playbook (2026 Edition)

Florida has more med spas than any other state, and it has become one of the most active places in the country for enforcing who may treat a patient and under whose authority. That combination — enormous demand and complaint-driven regulators who move fast — is why "how do I make my Florida med spa compliant?" is one of the most searched, and most consequential, questions an owner can ask. The problem is that the answer is scattered: a little in the Board of Medicine rules, a little in the Board of Nursing's guidance, a little in the Health Care Clinic Act, a little in cosmetology rules, and a lot in unwritten enforcement patterns.

This playbook pulls all of it into one place and organizes it the way you would actually build a practice: as a sequence of chapters, each one a layer of the compliance stack. For each chapter you get the rule in plain language, the trap that most often catches operators, the artifact that proves you did it right, and a link to our deeper Florida guide on that topic. Use it to build a new practice, audit an existing one, or prepare for an inspection you can feel coming.

Two framing notes before Chapter 1. First, almost everything a med spa sells — injecting a neurotoxin, firing a laser, drawing blood, prescribing a GLP-1 — is the practice of medicine in Florida, not cosmetology. Second, compliance in Florida is a documentation discipline: the boards are complaint-driven, so the record you can produce after a complaint usually decides whether the practice survives.

How to Use This Playbook

Work through the chapters in order the first time. They are sequenced so that each one depends on the ones before it: you cannot delegate a service (Chapter 3) until you have a medical director to delegate it (Chapter 2), and you cannot run a medical director relationship until your legal structure supports it (Chapter 1). After the first pass, treat the playbook as a reference — jump to the chapter that matches whatever you are changing, whether that is adding a laser device, hiring an injector, or preparing a consent form.

Each chapter ends by naming the specific written artifact that proves compliance for that layer, because in Florida the artifact is the compliance. A medical director you cannot document is, for enforcement purposes, a medical director you do not have. The final chapter maps every one of those artifacts to the written SOPs that carry them, which is where a real protocol library — like the complete med spa compliance SOP library these playbook sections come from — turns an outline into an operating practice. If you are opening from scratch, pair this with our step-by-step guide on how to open a med spa in Florida; if you are auditing, run the checklist near the end first, then read whichever chapters flagged gaps.

Chapter 1: Legal Structure & Ownership in Florida

Everything downstream depends on getting the entity and ownership right, because the structure determines which licenses you need and how the medical chain of command is allowed to work.

Who Can Own a Med Spa in Florida

Florida is unusual — and friendly to entrepreneurs — in that it does not enforce a strict corporate practice of medicine (CPOM) doctrine the way states like California, New York, or Texas do. That means a non-physician can own a med spa business in Florida: a registered nurse, a nurse practitioner, an esthetician, or a pure investor can be the owner of record. This is one of the biggest reasons the state's med spa count is so high. But ownership is not clinical authority. Owning the business does not let you perform, order, or supervise treatments beyond your own license. The medical services still have to run through a physician who provides delegation and supervision, and that separation between business ownership and clinical command is the structural distinction that keeps a Florida med spa lawful. For nurse-owned and NP-owned models specifically, walk through the Florida nurse practitioner med spa playbook, which covers the ownership-versus-authority line in depth.

The Health Care Clinic License Question

The trap in Chapter 1 is the Health Care Clinic license. Under Florida's Health Care Clinic Act, an entity that provides health care services and bills third-party payors generally must hold a Health Care Clinic license from the Agency for Health Care Administration (AHCA) — and a licensed clinic must operate under a designated medical or clinic director, with failure to maintain one being grounds for suspension. Many med spas are cash-pay and wholly physician-owned, which can bring them within a statutory exemption from Health Care Clinic licensure. That exemption is valuable but narrow, and getting it wrong is costly: operating an unlicensed clinic that needed a license is a serious violation. The artifact for this chapter is a documented entity-and-licensure determination — your formation documents, ownership records, and a written analysis (ideally reviewed by Florida healthcare counsel) of whether you are exempt or need to license with AHCA. Do not treat "everyone around here is cash-pay" as a substitute for that analysis.

Chapter 2: Medical Director Requirements & Supervision

The medical director is the keystone of the entire program. In Florida, the medical director is not a figurehead who lends a signature — the physician is the legal source of every treatment delegated in the practice, and the license that is on the line when delegation is sloppy.

What a Florida Medical Director Must Actually Do

A Florida med spa medical director must be a physician licensed under Chapter 458 (MD) or Chapter 459 (DO) who actively creates and signs treatment protocols, verifies the training and competency of the staff performing procedures, authorizes or performs good faith exams, reviews charts, and is genuinely available for consultation and emergencies. The trap is the "paper director" — a physician who signs a medical director agreement, is paid a modest monthly fee, and is never seen again. Florida enforcement is moving hard against this model: regulators increasingly want supervision that is documented, current, and substantively visible in day-to-day operations, and an absent director is one of the fastest ways to convert a routine patient complaint into a multi-board investigation. The artifact is a real, current medical director agreement paired with evidence of ongoing engagement — signed protocols, chart-review logs, training sign-offs, and reachability. Build it from our guides to Florida medical director requirements and the Florida medical director agreement.

The 2026 Legislative Signal

Watch the legislative direction even where it has not yet become law. In the 2026 session, Florida lawmakers introduced the Medical Spa Prescription Drug Oversight Act (SB 1728 and its House companion HB 1429), which would have placed med spas that handle prescription medications under direct Board of Pharmacy oversight, created a public database of licensed med spas, and required a designated supervising healthcare provider. That bill died in committee in March 2026, so it is not current law — but it is a clear signal of where Florida is heading: more visibility into who supervises, more accountability for how prescription drugs are handled, and less tolerance for absentee oversight. Build your medical director and supervision documentation as though that scrutiny is coming, because the enforcement posture already reflects it. Our overview of Florida regulatory changes in 2026 tracks the moving pieces.

Chapter 3: Scope of Practice & Delegation by Role

Once you have a medical director, the next question is who on your team may perform or accept delegation of each act, and under what supervision. Florida answers this role by role, and the answer always runs through the physician.

The Delegation Chain

Delegation in Florida is a chain of authority, not a job title. A treatment is lawful when a qualified provider has ordered it for a specific patient after a good faith exam, the medical director has delegated the act in writing to a person qualified to perform it, and that person works within the delegated protocol under adequate supervision. Break any link — no order, no written delegation, an untrained performer, or absent supervision — and the same treatment becomes the unlicensed practice of medicine. The critical mindset shift is that authority flows down from the physician, never up from a certificate. A weekend injector course or a device-vendor certification verifies training; it does not expand a license or create delegation authority. For the state-specific mechanics of documenting delegation, see our guide to Florida med spa scope of practice.

Role by Role: MD/DO, ARNP, PA, RN, LPN, Esthetician

Here is how the roles stack under Florida law. Physicians (MD/DO) may perform any procedure within their training and are the source of all delegation. ARNPs and physician assistants can perform most aesthetic procedures and can perform the good faith exam that authorizes treatment, generally operating under a physician relationship for the full med spa menu. Registered nurses may administer injections and perform many delegated procedures under a physician's order and supervision, but an RN cannot diagnose, cannot generate the treatment order from an exam, and depends on real physician engagement — the Board of Nursing has repeatedly emphasized that a standing order is not a substitute for an individualized assessment. LPNs have a narrower scope and perform certain delegated tasks, including venipuncture, under supervision. Estheticians (facial specialists) are limited to surface skincare that does not pierce the skin, draw blood, or inject; they may perform a delegated medical procedure like microneedling only inside a medical practice under physician authority — never on the cosmetology license alone. When any of these roles drifts past its line, you are in enforcement territory.

Chapter 4: Service-Line Rules — Injectables, Laser, Weight Loss & IV

Each service line has its own Florida rulebook layered on top of the general delegation structure. Get the delegation right and you still have to get the service-specific rule right.

Injectables (Botox & Fillers)

Neurotoxins and dermal fillers can be injected by a physician, an ARNP under protocol, a PA under delegation, or an RN under a physician order and supervision. A good faith exam by a physician, ARNP, or PA must precede treatment; the physician need not be physically present for each injection but must be genuinely available for consultation. Estheticians and unlicensed staff may never inject. The trap is the "injector certificate equals authority" myth — it does not. The artifact is a signed injectables protocol, a documented GFE for each patient, and delegation records for every injector. Our Florida Botox and filler regulations guide covers the supervision detail.

Laser & Energy Devices

Laser and light-based hair removal is regulated differently from most services: Florida routes it through the Department of Health Electrolysis Council, not the cosmetology board. An esthetician cannot perform laser hair removal on the facial specialist license; a non-physician who is not a PA or ARNP generally must be a licensed electrologist (a 320-hour approved program), and the treatment must be performed under physician supervision and responsibility under Chapter 458 or 459. Energy-based skin procedures like RF and IPL are likewise medical. The artifact is device-specific protocols, operator credentials and training records, and a supervision structure. Coordinate this with our Florida med spa laser safety guide.

Weight Loss & GLP-1 Programs

GLP-1 weight loss is prescribing, which makes it unambiguously medical. It requires a qualifying evaluation by a provider with prescribing authority, an appropriate diagnosis and monitoring plan, lawful sourcing of the medication, and — where compounded semaglutide or tirzepatide is involved — careful attention to 503A/503B pharmacy rules, an area regulators are watching closely. The trap is treating GLP-1 like a retail product ordered from a form rather than a prescription requiring an examination and follow-up. The artifact is an intake-and-eligibility protocol, prescriber documentation, a monitoring schedule, and sourcing records. See the Florida GLP-1 weight loss compliance guide for the full workflow.

IV Therapy & Regenerative Services

IV hydration and vitamin therapy involve a prescription and the administration of medications, so they require a provider order, a good faith exam, and RN/qualified-staff administration under supervision — not a walk-up menu delivered by unlicensed staff. Regenerative services that involve a blood draw and injection, such as PRP, stack two medical acts and cannot be performed by estheticians; our Florida microneedling and PRP scope guide details that boundary. The artifact for every service line is the same shape: a written protocol, a provider order, a GFE, and trained delegated staff.

Chapter 5: Consent & Documentation

Florida's boards are complaint-driven, which means the record you can produce after a complaint often decides the outcome. Consent and the good faith exam are the two documentation pillars every service depends on.

The Good Faith Exam

The good faith exam (GFE) is Florida's gatekeeper. It is the individualized assessment that establishes the patient-provider relationship and authorizes treatment, and only a provider with prescribing and diagnostic authority — a physician, ARNP, or PA — can perform it. An RN, an esthetician, or unlicensed staff cannot. The GFE must precede any medical treatment, and while Florida permits it to be conducted via compliant telehealth (useful for multi-location practices sharing a medical director), it still has to be a real, documented assessment tied to the specific patient and treatment. A standing order does not replace it; the exam is what makes the order lawful. The artifact is a completed, dated GFE in every patient chart, performed and signed by a qualifying provider.

Procedure-Specific Informed Consent

Generic "facial" consent forms do not cover medical procedures. Every injectable, laser, weight loss, IV, and regenerative treatment needs procedure-specific informed consent that names the treatment and the provider, discloses the known risks and realistic outcomes, and documents aftercare. A missing or mismatched consent is one of the first things a Florida investigator flags. The artifact is a signed, treatment-specific consent for each service, retained in the chart. Our guide to Florida med spa consent forms details what each form should contain and how to keep them current as your menu changes.

Chapter 6: HIPAA & Florida Records Retention

A med spa handles protected health information the moment it collects a medical history, photographs a patient, or documents a treatment. That triggers privacy and retention duties layered on top of everything above.

HIPAA in a Med Spa Setting

If your med spa transmits health information electronically in connection with a covered transaction, you are likely a HIPAA covered entity and owe the full privacy and security program: a designated privacy officer, a notice of privacy practices, workforce training, safeguards for electronic records, breach-notification procedures, and business associate agreements with vendors that touch PHI. Before-and-after photos are PHI. The trap is treating photos and text-message reminders as marketing assets rather than protected records. The artifact is a documented HIPAA program — policies, training logs, BAAs, and a breach-response plan. Our national med spa testimonial and marketing consent guide covers the photo-and-testimonial side that trips up the most practices.

Florida Records Retention

Florida imposes its own medical-records retention expectations on top of HIPAA, and the practical standard for a med spa is to retain adult patient records for years after the last treatment (longer for minors), maintain them securely, and be able to produce a complete chart — GFE, consent, treatment log, and adverse-event notes — on request. The trap is a records system that cannot reconstruct a full patient chart when an investigator asks. The artifact is a written retention-and-storage policy and a records system that can produce any patient's complete file quickly.

Chapter 7: AHCA & DOH Inspections

Two agencies matter for a Florida med spa, and knowing which one checks what tells you how to prepare.

What AHCA Checks

AHCA regulates facilities licensed as Health Care Clinics and enforces the clinic-director requirement. If your practice needs a Health Care Clinic license, AHCA can inspect the facility, verify that a qualified medical or clinic director is in place and functioning, and act — up to emergency license suspension — if that director role is vacant or a sham. Submitting a licensure application generally constitutes consent to inspection. The AHCA lens is facility-and-director-level. The artifact is your licensure determination from Chapter 1 plus the medical director documentation from Chapter 2, assembled and current.

What DOH Checks

The Department of Health and the professional boards (Medicine, Nursing, Cosmetology) police the licensure, delegation, and scope side — who performed what, under whose order, with what training and supervision. DOH activity is heavily complaint-driven, and a single patient complaint can open an investigation that reaches the injector's license, the medical director's license, and the facility at once. The artifact is the chart-level record for every patient: GFE, consent, delegation, treatment log, and adverse-event documentation. To rehearse an actual visit, work through our Florida AHCA inspection guide and the Florida DOH inspection-prep guide, which walk the documents each agency asks to see.

Chapter 8: Advertising & Marketing Rules

Marketing is where a compliant clinical program can still create legal exposure, because advertising is regulated separately and enforced by multiple bodies.

Honest Claims, Provider Transparency, and Photo Consent

Florida and federal rules converge on a few principles: do not misrepresent who performs treatments or their credentials, do not make deceptive or unsubstantiated efficacy claims, and do not imply a physician is on site delivering care when the reality is different. The FTC requires before-and-after photos and testimonials to be truthful, representative, and used with proper consent, and HIPAA requires patient authorization to publish identifiable images. The trap is a marketing team that promises "physician-led" care or posts patient photos without written authorization. The artifact is an advertising-review process and a signed photo/testimonial release for every image or story you publish. The consent guide pairs with this chapter for the release language.

Chapter 9: The Written-Protocol Layer — SOPs Each Chapter Needs

This is the chapter that ties the playbook together, because every rule above is only as real as the written protocol behind it. In Florida's complaint-driven system, the SOP is not paperwork for its own sake — it is the evidence that your delegation, supervision, and consent were genuine.

Mapping Chapters to SOPs

Each chapter demands specific written documents. Chapter 1 needs entity and licensure records. Chapter 2 needs a medical director agreement and delegation framework. Chapter 3 needs role-based delegation orders and scope policies. Chapter 4 needs procedure-specific clinical SOPs for injectables, laser, weight loss, IV, and regenerative services. Chapter 5 needs GFE and consent templates. Chapter 6 needs HIPAA and retention policies. Chapter 7 needs the inspection-ready assembly of all of the above. Chapter 8 needs an advertising-review SOP and release forms. Add infection control, sharps handling, emergency and adverse-event protocols, and staff training-and-competency check-offs, and you have the full document set an inspector asks for. Most practices do not draft all of this from a blank page — they adapt an existing library. That is exactly what the complete med spa compliance SOP library these playbook chapters are drawn from provides.

Turning the Playbook Into an Operating Practice

The difference between a med spa that survives a Florida complaint and one that does not is rarely a single missing rule — it is whether the documents match the treatment room. A defensible practice can, on demand, produce a current medical director agreement, delegation orders for each staff member, a GFE and signed consent for each patient, treatment logs, infection-control records, HIPAA policies, and adverse-event protocols. Keep that set current as your menu and staff change and you have converted this playbook into the operating spine of the practice. For the deeper guides behind each chapter, the Florida med spa compliance hub is the home base.

The Florida Compliance Checklist

Use this as a single-pass audit. Each row names the layer, the core Florida rule, and the artifact that proves it. If you cannot produce the artifact, that row is a gap.

Run the table top to bottom. Where you can hand an inspector — or your own attorney — the artifact in the right-hand column, that layer is defensible. Where you cannot, that is your next project, and the corresponding chapter above tells you how to close it.

Disclaimer: This article is for educational purposes only and does not constitute legal advice. Florida med spa compliance turns on overlapping authorities — the Board of Medicine and Board of Nursing (Chapters 458, 459, and 464, F.S.), the Board of Cosmetology and DOH Electrolysis Council, the Health Care Clinic Act and AHCA, and HIPAA and FTC rules — that change and that depend on the specific facts of your ownership, staff, devices, and services. Confirm current requirements with the relevant Florida agencies and consult a Florida healthcare attorney before opening, restructuring, or expanding a med spa.