GLP-1 Enforcement Actions Against Med Spas: What Actually Gets a Practice Disciplined

Four Agencies, Four Different Questions

Operators tend to talk about "GLP-1 compliance" as if a single regulator were watching. In practice, four distinct authorities can open a file on a weight-loss program, and each one is asking a question the others are not. Understanding which question belongs to which body is the difference between a targeted response and a panicked one.

The FDA regulates drugs, drug labeling, and compounding. It does not license your clinic and it does not judge your clinical decisions. Its jurisdiction begins with the product: what it is, where it came from, and what was claimed about it. The agency's most common instrument against aesthetic practices is the warning letter, which alleges that a product is misbranded or unapproved and requires a written response within fifteen working days. Escalation from there runs to injunction, seizure, and referral for prosecution.

State medical and nursing boards regulate people. A board cannot fine your LLC out of existence, but it can suspend or revoke the license of the physician, nurse practitioner, or physician assistant whose name is on the prescriptions. Board questions are clinical: was there a real evaluation, was the prescription individualized, was the follow-up adequate, was delegation to unlicensed staff lawful.

State boards of pharmacy regulate the handling of drugs: who may possess them, who may dispense them, and under what license. This is the authority most med spa owners underestimate, because the conduct that triggers it — keeping vials in a refrigerator and drawing from them — feels like ordinary clinic operations rather than pharmacy practice.

The FTC and state attorneys general regulate commercial claims. They do not care whether your protocol is clinically sound; they care whether your advertising is truthful and substantiated. Weight loss has been a named FTC priority for decades, and the agency's health claims guidance is the standard your before-and-after gallery is measured against.

A single set of facts can produce action from all four at once. A clinic that buys compounded semaglutide from an unregistered source, stocks it without pharmacy licensure, injects it after a two-minute questionnaire, and advertises it as "the same as Wegovy" has handed each agency its own case.

The 2025–2026 Enforcement Record, in Order

The current environment is not a single crackdown. It is a sequence, and knowing the sequence tells you what is likely next.

The shortage pathway closes (late 2024 – mid 2025)

Compounding these drugs at scale was never a standing right. It rested on section 503A and 503B provisions that permit compounding of a drug that is otherwise essentially a copy of an approved product when that product appears on FDA's shortage list. Tirzepatide came off the list in late 2024; semaglutide followed in February 2025. FDA then set dated ends to its enforcement discretion — staged through the spring of 2025, with 503A pharmacies reaching their date before 503B outsourcing facilities. The agency's compounding FAQ for tirzepatide and semaglutide remains the reference document for those dates.

What survived was narrow and patient-specific: a compounded preparation that is not essentially a copy because an identified patient has a documented clinical need the approved product cannot meet. That is a chart-level justification for one person, not a business model.

The first warning letter wave (September 2025)

In September 2025 the FDA announced action against compounders and sellers marketing copycat GLP-1 products, issuing more than fifty-five warning letters in a single tranche. Several went to named med spas rather than to pharmacies or telehealth platforms — the moment the aesthetic industry stopped being a bystander in this story.

The telehealth wave (March 2026)

The following spring brought roughly thirty more letters, concentrated on telehealth weight-loss companies. The center of gravity shifted from who made the drug to who sold it to consumers, and the cited conduct was overwhelmingly promotional.

The 503B bulks proposal (April 30, 2026)

FDA then proposed to exclude semaglutide, tirzepatide and liraglutide from the 503B bulks list, finding no clinical need for outsourcing facilities to compound them from bulk substance. The proposal published in the Federal Register on May 1, 2026, and the comment period — later extended — closed on July 30, 2026. This is the piece with the longest shadow: the bulks list is the mechanism by which a 503B facility could lawfully compound from raw active ingredient absent a shortage. Exclusion would close it.

The advertising wave (June 2026)

On June 16, 2026, FDA posted twenty-five warning letters issued eight days earlier to telehealth and weight-loss companies, again over advertising claims involving compounded semaglutide and tirzepatide. Three waves in roughly ten months, each one heavier on marketing language than the last.

What the Warning Letters Actually Cite

Read the published letters and a pattern emerges that surprises most operators: the allegations are rarely about how the injection was given. They are about words.

The recurring statutory hooks are the misbranding provisions of the Federal Food, Drug, and Cosmetic Act — the sections that prohibit labeling that is false or misleading in any particular, and that treat certain claims about compounded drugs as misbranding regardless of intent. "Labeling" in this context is far broader than the sticker on a vial. It reaches your website copy, your service pages, your intake packet, your paid ads, and your social posts.

Specific language cited across the letters includes:

• Describing a compounded preparation as having "the same active ingredient as the brand name medication," which FDA reads as implying equivalence to an approved drug
• Applying "clinically proven" or trial-derived efficacy figures to a compounded formulation that was never the subject of those trials
• Using brand names — Ozempic, Wegovy, Mounjaro, Zepbound — to describe a product that is not that product
• Claims or design choices that imply FDA approval for a compounded preparation
• Safety and effectiveness assurances offered without substantiation

The practical lesson is uncomfortable but useful: a practice can run a clinically careful program and still receive a letter because of a headline written by a marketing contractor two years ago. Conversely, a website audit is the cheapest risk reduction available in this entire area.

Why "we only repeated what the pharmacy told us" is not a defense

Practices frequently reproduce a compounder's promotional language verbatim. The letters do not treat that as mitigating. The entity making the claim to the consumer is the entity answering for it. If a supplier supplies you with marketing copy, treat it as a draft to be reviewed against the same standard you would apply to your own writing — and keep the review documented.

State Board Discipline: Where Licenses Actually End

FDA letters make headlines. Board actions end careers. And the board file typically opens from a different direction: a patient complaint, a pharmacy report, an insurance inquiry, a disgruntled former employee, or a referral from another agency that has already been through your records.

Board cases in this space cluster around a small number of allegations.

Prescribing without an adequate evaluation

Every state's medical practice act requires a bona fide practitioner-patient relationship before prescribing. The wording differs; the substance does not. A form the patient filled out on a phone, auto-approved without any real-time interaction, has been treated as falling short in multiple states. Telehealth is not the problem — telehealth is lawful for this purpose in most states. Asynchronous approval with no clinician judgment applied to the individual is the problem.

Volume inconsistent with the evaluation record

Investigators compare three numbers: prescriptions written, documented encounters, and hours the prescriber was actually available. When the first number cannot be reconciled with the other two, the case largely writes itself. This is the arithmetic that has hit telehealth-only weight-loss operations hardest, and it applies equally to a med spa whose off-site medical director signs in batches.

Delegation beyond scope

Who may inject, who may titrate, and who may perform the initial evaluation are separate questions with different answers in different states. Boards have acted where unlicensed staff performed assessments, where an aesthetician administered injections, and where a nurse adjusted doses without a standing order that actually authorized it. A standing order that is unsigned, undated, or written for a different drug class is treated as no standing order at all.

Inadequate follow-up and abandoned monitoring

A program that titrates a patient upward and then never sees them again is a documented failure of continuity. Boards look for scheduled reassessment, response to reported adverse effects, and a decision point where continuation was actively justified rather than assumed.

Records that do not exist

The most damaging finding is an absence. Charts assembled after a subpoena arrives are usually identifiable as such — from metadata, from uniform phrasing, from the fact that a hundred patients have materially identical notes. Reconstruction is worse than a gap, because it converts a documentation failure into a candour problem.

Board of Pharmacy Exposure: The Risk Operators Miss

Administering and dispensing are different regulated acts. Administering means a licensed clinician gives a dose to a patient for whom that dose was prescribed. Dispensing means transferring the drug itself to the patient to use later. Most med spas hold authority to do the first under a physician's oversight and hold no authority at all to do the second.

The bulk-inventory pattern sits uncomfortably between them. A refrigerator holding multi-dose compounded vials, from which staff draw whatever the next patient is scheduled for, is not a patient-specific supply. It is drug stock. Depending on the state, that arrangement can implicate pharmacy licensure, drug-outlet registration, wholesale distribution rules, or all three — and it is precisely the arrangement most commonly described in enforcement narratives from 2025 onward.

Three questions determine where you stand:

1. Whose name was on the container when it arrived? A patient-specific preparation shipped for one named person is a different legal object from a bulk vial.
2. Does the patient leave with the drug? If pens or vials go home with patients, you are almost certainly dispensing.
3. Can you trace every dose to an acquisition record? Lot number, source facility, receipt date, and the patient it went to. If not, you cannot answer the first question either.

The defensible model in most states is unchanged: the prescription is filled by a licensed pharmacy, the medication is patient-specific, and your role is the clinical encounter and the administration of that patient's own medication.

The FTC and State Attorney General Track

Advertising enforcement runs on a different statute and a different standard. The FTC asks whether a claim is substantiated by competent and reliable scientific evidence, evaluated on the quality of the research rather than the count of studies. Testimonials must reflect what consumers can generally expect, or carry a clear and conspicuous disclosure that they do not — and a disclosure buried below the fold, in grey type, does not qualify.

For a weight-loss program the recurring problems are predictable: numeric outcome promises, before-and-after galleries presented without context about what else the patient was doing, staff and influencer endorsements without disclosed material connections, and framing that presents a prescription drug as a lifestyle purchase.

State attorneys general add a second front. Consumer protection statutes reach conduct the FTC may never prioritise, and AG offices have been active on counterfeit and unregulated GLP-1 supply entering the country through informal channels. An AG inquiry into a counterfeit product will land on the clinic that injected it, and the first document requested will be the acquisition record.

What a GLP-1 Investigation Actually Looks Like

Investigations follow a recognisable shape. Knowing it removes most of the panic.

Stage one: the opening contact

Rarely a raid. Usually a letter, an email, or an unannounced but polite visit. It may name a complainant or may not. FDA warning letters arrive already alleging violations and set a fifteen-working-day response clock. Board inquiries typically open with a request to respond to a specific complaint within a stated window.

Stage two: the records request

The document list is fairly consistent across agencies: prescriber licences and any collaborative or supervisory agreements; standing orders and protocols with signatures and dates; a patient list for the service line; complete charts for named patients; acquisition invoices, lot records and pharmacy agreements; consent forms; adverse event logs; refrigeration and storage logs; and copies of advertising as it appeared, including archived pages.

Stage three: interviews

Staff are often interviewed separately, including front desk and unlicensed personnel. Contradictions between what the protocol says and what staff describe doing are the most productive material an investigator obtains. If your written SOP says a prescriber performs every initial evaluation and your medical assistant describes a different routine, the SOP has just become evidence against you.

Stage four: findings and disposition

Outcomes range widely. A letter of concern or advisory closes the matter with no public record in some states. A consent agreement may impose a corrective action plan, chart audits, additional training, or a practice monitor. Fines are common. Suspension and revocation are reserved for patient harm, dishonesty during the investigation, or repeat conduct. Federal matters can proceed to injunction or seizure, and in the most serious cases to criminal referral.

Stage five: the collateral consequences

Practices consistently underestimate this stage. Board actions are published. Malpractice carriers reprice or decline. Hospital privileges, payer credentialing, and other states' licences are all conditioned on disclosure of discipline elsewhere. A single consent agreement can follow a prescriber for a decade.

The Records That Decide the Outcome

Across every forum, the same handful of documents does the work. Each one answers a question an investigator will ask out loud.

• The individualized evaluation note. Answers: was there a real clinical encounter? Height, weight, BMI, history, medication reconciliation, contraindication screening, the clinical reasoning for this drug for this patient, and the identity and signature of the clinician who did it.
• The patient-specific prescription. Answers: was this dose lawfully authorised for this person? A dose drawn from stock with no prescription behind it has no answer.
• The acquisition record. Answers: where did this drug come from? Supplier identity and registration, invoice, lot number, expiry, receipt date, and the storage log covering the period held.
• The consent form that matches reality. Answers: did the patient know what they were receiving? A consent describing an FDA-approved product when a compounded preparation was administered is worse than no consent, because it evidences the misrepresentation.
• The monitoring record. Answers: was this managed or merely sold? Scheduled reassessments, documented tolerance and response, dose decisions with rationale, and adverse events with what was done about them.
• The advertising archive. Answers: what did you actually claim? Dated captures of your pages and ads, plus the review log showing who approved the language and when.

Notice the common property: all six are contemporaneous. Their evidentiary value comes from having existed before anyone asked. This is why compliance work has to be a routine rather than a response.

Responding to a Letter or Inquiry

The instinct to write back immediately, personally, and at length is the wrong one. A better sequence:

1. Preserve everything. Suspend any automatic deletion of records, messages, and analytics. Capture your live website before you change it — altering pages without preserving the original invites a far worse characterisation than the original copy ever would.
2. Engage counsel who practises in this area. Health regulatory defence is a specialty. Your business attorney is not the right person, and neither is the compounder's lawyer, whose client's interests diverge from yours.
3. Establish the facts internally before answering. Pull the charts, the invoices, and the ad archive yourself. A response that turns out to be inaccurate is a second, worse problem.
4. Answer within the deadline, in writing, precisely. Address each allegation specifically. Describe corrective action already taken with dates. Do not volunteer analysis of matters not raised.
5. Fix what is fixable immediately. Corrective action completed before the response is filed carries genuine weight in disposition. Corrective action promised for later carries much less.
6. Never mislead an investigator. Concealment, backdating, and reconstructed records convert a compliance matter into a dishonesty matter, and dishonesty is what boards revoke over.

Risk Profiles of Common Med Spa Models

Not every weight-loss program carries the same exposure. Ranked from lowest to highest:

• Branded product, pharmacy-filled, clinic administers. The patient's own prescription is filled at a licensed pharmacy; you provide the encounter and the injection. Lowest exposure across all four forums.
• Branded product, clinic-administered from patient-specific supply. Slightly more operational burden around storage and traceability, but the legal structure is intact.
• Compounded product, patient-specific, documented clinical need. Lawful in principle and narrow in practice. The exposure is proportional to how well the individual justification is documented — and to whether it would survive being read as a template applied to every patient.
• Compounded product, office stock, drawn on demand. The pattern most often described in enforcement narratives. Implicates FDA, pharmacy, and board jurisdiction simultaneously.
• Product from an undocumented or offshore source. Adds counterfeit and import exposure, removes any supply-chain defence, and forecloses the argument that you exercised reasonable diligence.

Layer advertising on top of each: any of these models becomes materially riskier the moment brand-name equivalence or numeric outcome promises appear in the copy.

If the 503B Bulks Exclusion Is Finalized

The April 2026 proposal is not yet a final rule, and the comment record closed only in July. But operators should plan on the direction rather than the timing. If semaglutide, tirzepatide and liraglutide are formally excluded from the bulks list, outsourcing facilities lose the remaining general mechanism for compounding them from bulk substance. What would remain is narrower still: patient-specific compounding under 503A where a documented clinical need genuinely cannot be met by an approved product.

For a med spa the planning implication is straightforward. Any part of your program's economics that depends on compounded supply should be treated as contingent. Practices that have already moved their weight-loss service line onto approved products, and that charge for the clinical program rather than for the molecule, are insulated from an outcome that would strand competitors mid-quarter. For the full regulatory picture on who may prescribe, how sourcing works and how programs are structured, see our GLP-1 compliance guide for med spas.

Telehealth Violations: The Category That Grew Fastest

Two of the three warning letter waves since September 2025 were aimed primarily at telehealth weight-loss operations, and the reasoning transfers directly to any med spa that uses a remote prescriber. Telehealth itself is not the violation. Most states expressly permit establishing a practitioner-patient relationship remotely, and for a weight-management consultation there is rarely a physical examination finding that a competent remote encounter cannot capture. What draws action is the substitution of a form for a clinician.

The distinction regulators draw is between synchronous and asynchronous care. A synchronous encounter means live interaction — video, or in some states audio — in which a licensed prescriber applies judgment to a specific person and could, in principle, decline. An asynchronous model in which a patient completes a questionnaire and an approval is generated has repeatedly been characterised as prescribing without an adequate evaluation, because no clinician ever exercised discretion about that individual.

Several structural features have proved particularly damaging when investigators find them:

• Approval rates near one hundred percent. If essentially every applicant is approved, the evaluation is decorative. Boards ask for the denial rate early, and an inability to produce any declined patients is treated as an answer in itself.
• Prescriber caseloads that cannot be reconciled with clock time. Divide prescriptions written by hours logged. When the result implies a two-minute encounter, no amount of template documentation rescues it.
• Cross-state prescribing without licensure in the patient's state. The governing licence is generally the one in the state where the patient is physically located at the time of the encounter, not where the clinic or prescriber sits. Multi-state programs frequently get this wrong.
• Subscription structures that couple payment to supply. When the business model bills monthly for medication regardless of clinical review, the incentive to continue therapy without reassessment is visible on the face of the arrangement.
• Prescriber-of-record who never meets anyone. A physician whose role is to countersign decisions made by others has, in several state actions, been found to have engaged in prescribing without a bona fide relationship.

For a med spa running a hybrid model — in-person injections, remote prescriber — the practical safeguards are modest. Ensure the remote encounter is live and documented as such, with duration recorded. Ensure the prescriber is licensed where the patient sits. Ensure the prescriber has and uses the authority to decline. And ensure the chart shows a decision rather than a workflow completing itself.

Compounding Violations: 503A and 503B Are Not Interchangeable

Sourcing allegations turn on a distinction many operators have never had explained to them, and getting it wrong is the difference between a defensible file and an indefensible one.

A 503A pharmacy is a traditional compounding pharmacy, licensed by a state board. It compounds for an identified individual patient pursuant to a valid prescription for that patient. It is not permitted to produce a drug that is essentially a copy of a commercially available approved product, and it is not permitted to manufacture inventory for office stock in the way a drug company would.

A 503B outsourcing facility registers with the FDA, is subject to current good manufacturing practice requirements, and may produce batches without patient-specific prescriptions — which is why it is the only lawful source of true office stock in most arrangements. But its ability to compound from a bulk active ingredient depends on that substance appearing on the 503B bulks list or the drug being in shortage. That is exactly the door the April 2026 proposal would close for semaglutide, tirzepatide and liraglutide.

Set against that framework, the recurring allegations become legible:

• Continuing to obtain compounded semaglutide or tirzepatide from a 503A pharmacy for general use after the shortage pathway closed, with no patient-specific clinical justification recorded
• Treating a template justification — the same sentence about ingredient sensitivity in every chart — as if it were an individualized clinical finding
• Holding 503A-sourced, patient-specific preparations as pooled stock and administering them to other patients
• Buying from a facility whose registration status was never verified, and which turns out not to be registered at all
• Sourcing "research grade" active ingredient or peptide products that were never intended for human administration and carry no lawful pathway whatsoever

The verification burden sits with the purchaser. Before a first order and at least annually thereafter, obtain and file the facility's current registration or licence, its most recent inspection findings and any warning letters, a certificate of analysis for each lot received, and a written statement of the legal basis on which it is compounding the product you are buying. A supplier unwilling to provide those documents has told you what you need to know.

What Enforcement Costs, and How Long It Lasts

Owners generally ask about penalties in the abstract and are surprised by where the real cost falls.

Direct financial exposure varies enormously. Civil monetary penalties at state level commonly run from the low thousands into six figures depending on the number of violations and whether patient harm occurred. Federal matters that proceed past a warning letter into injunction or seizure carry costs measured mainly in destroyed inventory, halted operations and legal fees rather than fines. Legal defence for a contested board matter routinely reaches five figures before a hearing is held.

Time is the underrated cost. A board investigation frequently runs twelve to twenty-four months from complaint to disposition. Throughout that period the prescriber must disclose the pending matter on credentialing and licensure applications, and the practice must operate under the uncertainty of an unresolved file.

Insurance responds badly. Most malpractice policies exclude regulatory defence unless a specific endorsement was purchased, and many exclude coverage entirely for claims arising from unapproved or unlawfully sourced products. A clinic that injected a compounded preparation it could not document may discover that its carrier declines both the defence and the indemnity.

Reputation and access persist longest. Board actions are published and are searchable indefinitely. Payer credentialing, hospital privileges, licensure in additional states, and even merchant processing can all be affected by a single consent agreement. Practices that sell or seek investment find that a disclosed regulatory action reprices the transaction well beyond the size of the original fine.

Weighed against that, the cost of the corrective work is trivial: a website review, a documented sourcing file, a real evaluation note, and a consent form that describes what the patient is actually receiving.

A Self-Audit You Can Run This Week

None of this requires a consultant to begin. Work the list in order; each item maps to something an investigator will ask.

Product and sourcing

• ☐ Every product in your refrigerator traces to an invoice naming a licensed, registered source
• ☐ Lot numbers and expiry dates are recorded for every unit received
• ☐ Each administered dose links to a specific patient and a specific prescription
• ☐ Storage temperature logs are complete and excursions have documented responses
• ☐ No product is present whose origin you cannot evidence on paper

Prescribing and clinical

• ☐ Every patient has a documented individualized evaluation by an authorised prescriber
• ☐ Evaluations involved real-time clinical interaction, not questionnaire auto-approval
• ☐ Contraindication screening is recorded, not assumed
• ☐ Standing orders are signed, dated, current, and actually cover the drugs in use
• ☐ Delegation matches your state's scope rules for each staff role

Consent and monitoring

• ☐ Consent names the actual product administered, including compounded status where applicable
• ☐ Boxed warning content and serious risks are disclosed in the consent
• ☐ Reassessment intervals are defined and the charts show they happened
• ☐ Discontinuation criteria exist and have been applied at least once in practice
• ☐ Adverse events are logged with the clinical response recorded

Advertising

• ☐ No page equates a compounded preparation with a branded product
• ☐ No numeric weight-loss promise appears anywhere, including social posts and paid ads
• ☐ Testimonials and before-and-after images carry clear, prominent context
• ☐ Material connections with anyone endorsing you are disclosed
• ☐ Dated archives of your pages exist, and a named person reviews copy before it publishes

The Honest Summary

The enforcement record of the past two years is not evidence that med spas should exit weight management. It is evidence that a specific way of running these programs — buy in bulk, screen lightly, advertise aggressively — has stopped being survivable. The practices in trouble are almost never the ones that made a close clinical judgment call. They are the ones that never made a clinical judgment at all, and whose files show it.

The corrective is unglamorous and entirely within reach: source from documented suppliers, evaluate every patient individually and write it down, consent to what you actually give, monitor on a schedule you can evidence, and say nothing in marketing you could not substantiate to a regulator. Programs built that way have been passing inspections throughout this period, quietly, while their competitors were answering fifteen-day letters.

Nothing here is legal advice, and enforcement posture varies significantly by state. Bring a healthcare regulatory attorney into the conversation before you make structural changes — and certainly before you answer a letter.

For a complete, compliant protocol set you can implement immediately, see our Weight Loss Protocol Kit.