Indiana Med Spa Compliance Checklist 2026

Most state compliance checklists are a list of topics wearing the costume of a list of documents. You read one, nod at "have a good faith exam policy," and close the tab no better prepared for the morning an investigator asks what is actually in your file. This one is built the other way round: every line names a specific artefact, says who wants it, and says whether Indiana law requires it, whether the requirement exists but its mechanics are still being written, or whether it is simply what we would keep in a practice we ran.

Indiana earns that treatment more than almost any state right now. For years the honest answer to "what are Indiana's med spa rules?" was that Indiana had none — no facility statute, no registry, no agency that looked at an aesthetics clinic as an aesthetics clinic. Authority came entirely from the general licensing statutes in Title 25 of the Indiana Code, administered by boards under the Indiana Professional Licensing Agency (PLA). That ended in 2026. Indiana now has a medical spa chapter with a name, a registration deadline, and a public database, and this is the last guide in our Indiana series — the index that ties the other five together. Every deep-dive is linked from the section it belongs to, and the whole set lives on the Indiana med spa compliance hub.

What Changed in Indiana — and How to Read Every Line of This Checklist

Two things happened in the 2026 session and they are easy to conflate. Senate Bill 282 created the medical spa registration scheme and the conduct rules that come with it. House Enrolled Act 1131, a separate cosmetology vehicle also signed by Governor Braun, redrew the esthetician scope of practice, adding microneedling, dermaplaning, and lash and brow services to the statutory definition and writing a microneedling depth range into IC 25-8-2-14.7. If your Indiana practice has both injectors and estheticians, both bills landed on your floor in the same month, and neither one substitutes for the other.

What did not change is the machinery underneath. The PLA still administers the boards. The Medical Licensing Board of Indiana still governs physicians and physician assistants and now holds the medical spa registry. The Indiana State Board of Nursing still governs advanced practice registered nurses, RNs, and LPNs. The Indiana State Board of Cosmetology and Barber Examiners still decides what may be done to skin before the work becomes medicine. The Indiana Board of Pharmacy picked up new investigative authority over drug compounding. Five bodies, one floor, and no single inspector who covers all of it.

The three labels used on every line below

A checklist that invents a requirement is worse than a short one, so every item carries one of three labels and nothing carries more authority than it has earned:

• Legally required — traceable to a statute, an administrative rule, or a federal obligation we can name in the same sentence. If we could not cite it, it is not in this tier.
• Pending rulemaking — the obligation exists in SB 282, but the form, fee, deadline mechanics, or submission channel has not been published. You should be preparing for these; you should not be told a fee amount by anyone, including us.
• Recommended — Indiana has not required it. It is what we would keep, usually because it is the document that answers the question an investigator asks second.

Who actually shows up, and what they ask for

Indiana enforcement is complaint-driven. A patient, a fired employee, or a competitor files with the PLA or with the Licensing Enforcement Section of the Office of the Indiana Attorney General. That office investigates and, where it finds cause, petitions the relevant board, which then holds a public hearing or accepts a settlement agreement. Sanctions run from censure and probation to suspension and revocation. Nobody knocks on your door with a clipboard on a Tuesday — but when the letter comes, it asks for exactly the documents an inspector would have asked for, and it asks for them in about two weeks. Our national med spa inspection guide covers how those requests are usually framed.

The SB 282 Registration Sub-Checklist, In Order and By Date

This is the part of the page you came for, and it is the part no generic checklist has. Indiana is one of a small number of states with an actual medical spa registration regime, and the sequence matters more than the content, because two of the dates have already passed and one has not.

Before you use it: the statutory picture below reflects SB 282 as enrolled in the second regular session of the 124th General Assembly and signed on March 5, 2026. The enrolled act and the bill history are published by the Indiana General Assembly at iga.in.gov under Senate Bill 282, and that is the text to read if you want the words rather than a summary of them. Where the coverage of the bill is consistent across sources but we cannot point at a published rule, we say so on the line.

Already in force: July 1, 2026

These obligations have applied since the summer. Nothing here is waiting for January.

• Good faith examination policy, prescriber-only. A written policy naming who may perform the examination — physician, nurse practitioner, or physician assistant — with an explicit statement that registered nurses may not. Legally required
• Responsible practitioner designation letter. A signed designation naming the practitioner, their licence number, the services they are trained in, and their acceptance of the duties the chapter assigns. Legally required
• Single-location treatment policy. A one-page policy prohibiting treatment anywhere but the medical spa premises, with the mobile, home-visit, and event calendar formally retired. Legally required
• Serious adverse event notification procedure. A named owner, a fifteen-day clock, and a written route to the Medical Licensing Board. Legally required
• Compounded drug sourcing file. Purchase records and certificates of analysis for bulk drug substances, retained per the statute's record-keeping requirement. Legally required
• Advertising review against IC 25-1-9-4. A documented sweep of your website, social profiles, and paid ads for false or misleading claims. Legally required

Now through December 2026: the preparation window

You cannot register yet. You can be the practice that registers in the first week instead of the practice that discovers a problem in the last week.

1. Confirm the registrant. Decide which legal entity holds the registration — the clinical entity, not the management company — and get its name, address, and website exactly as they will appear. Recommended
2. Assemble the responsible practitioner packet. Licence verification, evidence of education and training in the specific services on your menu, and the collaborating or supervising physician's details if the designee is an NP or PA. Reporting on the application indicates it asks for the responsible practitioner's name and licence number along with any collaborating or supervising practitioner. Pending rulemaking
3. List your services and your drugs. A written service menu and a drug list — every prescription product you administer, including compounded preparations and whether anything is compounded on site. Pending rulemaking
4. Close the gaps the list exposes. A service you cannot staff to a lawful delegation chain is a service you should remove before you write it on a state form. Recommended
5. Watch for the board's rules. Track the Medical Licensing Board's rulemaking through the PLA and the Indiana Register. Fees, forms, renewal cycles, and any penalty schedule live there, not in the statute. Recommended

On or after January 1, 2027

• Registration application, filed. Beginning January 1, 2027 a medical spa must be registered under the chapter to do business. Keep the submission confirmation and any issued registration number in the compliance binder, not in an inbox. Legally required
• Public database entry, verified. The board must establish and maintain a public database of registered medical spas. Check your own entry the way a prospective patient would, and correct it if it is wrong. Legally required
• Change-of-designation procedure. A written internal process for what happens the day your responsible practitioner resigns, including who notifies the board and how quickly. Pending rulemaking
• Renewal calendar. A dated reminder for the renewal cycle once the board publishes one. Pending rulemaking

What is genuinely not knowable yet

Being specific about ignorance is part of being useful. As of this writing we cannot tell you the registration fee, the application form number, the renewal period, the penalty schedule for operating unregistered, or what "a sufficient amount of time on site" means in hours. Those are rulemaking questions. You will find confident numbers for some of them on vendor blogs; they are not in the statute, and a number you cannot trace to a rule is a number that will move. Ask the PLA, or ask Indiana counsel, and treat anything else as a guess.

Does this reach me? The medical spa definition in the chapter is functional, not cosmetic: broadly, a facility or practice that offers medical health care services, prepares or administers prescription drugs — including by intravenous, intramuscular, or subcutaneous delivery — and markets itself as focused on cosmetic, aesthetic, wellness, or longevity treatments. That language reaches IV hydration lounges, longevity clinics, and GLP-1 weight-loss programmes as readily as it reaches an injectables suite. If you have been telling yourself you are not a med spa, read the definition, not the sign on your door.

Section 1 — Entity, Ownership, and Corporate Structure Documents

Ownership is where Indiana enforcement gets structural rather than clinical, and it is the section most often skipped because it feels like it was settled at formation.

• Articles of incorporation or organisation, and the current ownership ledger. Filed with the Indiana Secretary of State, matching the name on everything else. Legally required
• Professional entity documentation, if you formed one. Under IC 23-1.5-2-3 a professional corporation rendering services that only a licensed health care professional may perform must have licensed shareholders, and its directors and officers other than the secretary and treasurer must be licensed in the relevant field. Keep the shareholder list and the officer roster with the licence numbers attached. Legally required
• The management services agreement, in full. If a non-clinical owner runs the business side through an MSO, the agreement is the document that decides whether the structure survives scrutiny. Keep the executed version, every amendment, and the fee schedule. Recommended
• Lease or deed for the treatment premises. The registered location is now a regulated fact, not an address on a card. Recommended
• Local business licence, zoning approval, and biohazard waste contract. County and municipal, and easy to let lapse. Recommended

What a regulator asks to see here

Who owns the entity that bills for medical services, and does a licensed clinician actually control clinical decisions. Indiana's corporate practice of medicine posture is assembled from the medical practice act at IC 25-22.5 and the professional corporation rules at IC 23-1.5 rather than announced in a single prohibition, which makes the MSO question genuinely contested rather than clearly settled — and makes the terms of your agreement the whole argument. We work through the structures, the terms that get attacked, and what a layperson can and cannot hold in who can own a med spa in Indiana. Note also that SB 282 registers the facility; it does not bless an ownership structure, and a registration number is not a finding that your cap table is lawful.

Section 2 — Licensure and Credentialing for Every Role on the Floor

One folder per person, and the folder is the same for the owner as for the newest hire.

• Primary source licence verification for every clinician, printed or captured from the PLA licence lookup with the date of verification on it, refreshed at each renewal cycle. Legally required
• Responsible practitioner file. The designation, the licence, and the evidence of education and training in the health care services and treatments actually performed at the spa — the statute conditions the role on training, so an internal medicine physician who has never been trained on the energy device in room three is a gap you can see from the doorway. Legally required
• Collaborative practice agreement for every nurse practitioner, current and signed, because Indiana is a restricted practice state and an APRN's prescriptive authority under IC 25-23-1-19.5 rests on it. Legally required
• Physician assistant supervisory or collaborative agreement, with the count of PAs a single physician supervises kept inside the statutory ceiling in IC 25-27.5. Legally required
• Cosmetology board licences for estheticians and cosmetologists under IC 25-8, plus the microneedling training proof HEA 1131 requires of anyone offering microneedling. Legally required
• Current BLS or ACLS cards for everyone who treats patients. Recommended
• Signed job descriptions with an explicit scope statement per role. The cheapest document in this guide and the one that most often decides a disputed delegation. Recommended

What a regulator asks to see here

Whether the person who performed the treatment held a licence that reached it. Two Indiana boundaries do most of the damage: registered nurses and medical assistants who evaluate rather than administer, and estheticians whose room has drifted past what a cosmetology licence covers. The injector question by licence is worked through in who can inject Botox in Indiana, and the skin-side boundary — including where HEA 1131's microneedling range ends and medicine begins — in the Indiana esthetician scope of practice guide.

Section 3 — The Delegation and Supervision File

Indiana does not license medical assistants, publishes no cosmetic-injection rule for registered nurses, and has never issued a med spa supervision regulation. All of that means delegation in Indiana is proved by your paperwork or not at all.

• Written delegation protocol for every delegated procedure, signed and dated by the delegating prescriber, naming the procedure, the licence categories that may perform it, the training required first, and the limits. Legally required
• Individual competency sign-off per person per procedure, with the trainer, the date, the number of supervised cases, and the assessor's signature. Recommended
• Supervision availability record. Who was the covering prescriber on each treatment day, how they were reachable, and how quickly. Recommended
• Chart review log, showing the responsible practitioner actually reviewed a defined sample of delegated treatments on a stated cadence. Recommended
• Annual protocol review page, with the reviewer's signature and the date, because an undated protocol is treated as an unmaintained one. Recommended

What a regulator asks to see here

Not "was there a medical director" but "who authorised this specific act for this specific person, and how did you know they were competent." SB 282 pointedly did not use the phrase medical director; it created a responsible practitioner with statutory duties, which is a stronger thing and a more personal one — the designation puts a named clinician's own licence next to your delegation practices. What the role does and does not require, including how much presence "a sufficient amount of time" plausibly demands, is the subject of Indiana med spa medical director requirements. One practical note: keep the delegation file organised by procedure rather than by person, so that adding a service forces you to answer the authorisation question before the first patient is booked.

Section 4 — Good Faith Examination and Standing Orders

This is the highest-value section in the Indiana checklist, because SB 282 turned the good faith examination from an inference into a statutory line and put it out of reach of the role that was most often performing it.

• Written good faith examination policy stating that the examination is performed by a physician, nurse practitioner, or physician assistant and never by a registered nurse. Legally required
• A documented examination in every chart, before the first treatment of a course, with history, medications and allergies, relevant examination findings, the assessment, and the treatment plan. Legally required
• Re-examination trigger list. Written criteria for when a new examination is required — a new product, a new treatment area, a material change in health, or the passage of a stated interval. Recommended
• Patient-specific treatment order signed by the prescriber who performed the examination, distinct from the standing protocol. Legally required
• Standing orders and protocols by product, signed and dated, covering indications, contraindications, dosing ranges, and escalation. Recommended
• Telehealth examination policy, if any examination happens remotely, mapped against Indiana's telehealth requirements at IC 25-1-9.5. Recommended
• Third-party good faith exam platform contract, if you use one, together with a written acknowledgment that outsourcing the examination does not move the accountability off the spa or its responsible practitioner. Recommended

What a regulator asks to see here

Pull five charts and ask one question: who performed the examination, and were they a prescriber. An RN-performed evaluation is not a documentation defect that a later signature repairs. It means the treatment proceeded without a lawful order behind it, and both the nurse and the responsible practitioner are exposed. The second question is timing — an examination note created after the injection is a worse fact than no note at all.

Section 5 — Consent Forms, Procedure by Procedure

One general consent covering "aesthetic treatments" is the single most common documentation failure we see, in Indiana and everywhere else. Consent is procedure-specific because risk is procedure-specific, and the form is the only contemporaneous evidence of what the patient was told.

• Neurotoxin consent naming the product, the treated areas, the units, and the recognised risks including ptosis, asymmetry, and toxin spread. Legally required
• Dermal filler consent that names vascular occlusion, blindness, and delayed nodules explicitly, and records that hyaluronidase reversal was discussed. Legally required
• Energy-device consent per modality — laser, IPL, radiofrequency, radiofrequency microneedling — with burn, pigmentary change, and scarring risks stated and Fitzpatrick type recorded. Legally required
• Chemical peel and microneedling consent with depth, expected downtime, and post-inflammatory hyperpigmentation risk. Legally required
• Weight-loss and IV therapy consent covering the specific drug, whether it is compounded, the monitoring plan, and the discontinuation plan. Legally required
• Off-label use disclosure, since much of what a med spa administers is used off-label and the patient is entitled to know. Recommended
• Photography and marketing consent, kept separate from treatment consent, so that a patient can decline the second without declining the first. Recommended
• Minor treatment policy and parental consent form, if you treat anyone under eighteen at all. Recommended

What a regulator asks to see here

Whether the signed form matches the treatment delivered, on the date it was delivered, and who countersigned. Indiana has not published a med spa consent form template and SB 282 did not create one, so the standard being applied is the general one — informed consent adequate to the risk of the procedure, evidenced in the record. A form signed at the first visit two years ago, covering a product you no longer use, is not evidence of anything.

Section 6 — The Medical Record, Retention, and HIPAA

Indiana has a clean, citable retention rule, which is more than most states offer, and practices still get it wrong by treating the aesthetic chart as something other than a health record.

• A complete treatment record per encounter — date, provider and their licence, product with lot number and expiry, dose or settings, treatment sites, patient response, and post-care instructions given. Legally required
• Seven-year retention of original health records under IC 16-39-7-1, which also sets a five-year floor for x-ray film and makes failure to retain a disciplinable offence before the licensing board. Legally required
• A written retention and destruction schedule naming every record type, its retention period, and how it is destroyed. Recommended
• HIPAA policy set — privacy policies, a documented security risk analysis, workforce training records, and a breach notification procedure. Legally required
• Business associate agreements with your EMR vendor, billing service, marketing agency, and anyone else touching patient data. Legally required
• Notice of privacy practices, posted and acknowledged. Legally required
• Records access procedure for patient requests, with the fee schedule and response timeline written down. Recommended

What a regulator asks to see here

Whether the chart can reconstruct the encounter without the person who performed it. Lot numbers and device settings are the two fields that separate a defensible aesthetic record from a spreadsheet, and they are the two most often missing. Seven years is a floor, not a plan — the malpractice limitation period, minors' records, and your own insurer will each push it further. The mechanics of building a schedule that survives an audit are in our med spa medical records retention guide.

Section 7 — Drug Sourcing, Storage, and Dispensing Records

SB 282's other half is a compounding bill, and that is not an accident. Indiana legislators heard testimony about compounded injectables reaching aesthetic clinics through channels nobody was watching, and the statute responded on both ends — the pharmacy end and the med spa end. This section is where the two halves meet on your shelf.

• Purchase invoices tracing every vial to a licensed source, filed so that any product in your fridge can be matched to an invoice in under a minute. Legally required
• Certificates of analysis for bulk drug substances used in compounding, which the statute pairs with a requirement that such substances come from establishments registered with the FDA. Legally required
• Compounded drug records retained per the statute's schedule — records relating to the sale, transfer, or distribution of compounded drugs are kept for two years after the compounded drug containing the substance has expired. Legally required
• Compounding pharmacy due diligence file — licence status of your 503A or 503B source, in Indiana and in its home state, refreshed annually. Recommended
• Lot and expiry log with daily refrigerator temperature records, including the excursion procedure and what you did the last time one occurred. Recommended
• Controlled substance records, if you hold any, under the applicable state and DEA requirements. Legally required
• Drug destruction and returns log. Recommended

What a regulator asks to see here

Where the drug came from, and whether the person who ordered it could lawfully order it. The Indiana Board of Pharmacy gained oversight and investigative authority over compounding under SB 282, which means an aesthetics practice buying compounded semaglutide now has a second board with a reason to look at it. Weight-loss programmes carry the most exposure in this section by a distance, and the prescribing, monitoring, and compounded-product questions specific to them are covered in Indiana GLP-1 weight-loss compliance. If you have never had to answer a sourcing question, run the drill once: pick a vial at random and see how long it takes to produce the invoice, the source's licence status, and the patient it was used on.

Section 8 — Device Records and Training Logs

Indiana is thin here, and we are going to say so rather than fill the space. There is no Indiana statute or board rule that assigns laser and energy-device operation to particular licence categories the way some states do, and SB 282 did not resolve device scope by role either — it regulates the facility, the responsible practitioner, the examination, and the reporting duty. The analysis therefore runs through the general definition of the practice of medicine at IC 25-22.5-1-1.1 and through what each licence independently authorises. Treat any confident chart you are shown of "who may fire a laser in Indiana" as an opinion, and get the opinion in writing from Indiana counsel if you are relying on it.

• Purchase and registration records for every energy-based device, with serial numbers. Recommended
• Manufacturer training certificates per operator per device. Recommended
• Calibration and service history, matched to the manufacturer's stated interval. Recommended
• Written laser safety programme — a designated safety officer, wavelength-specific eyewear, controlled-access signage, and a plume evacuation policy. Recommended
• Per-treatment settings log, which is also the field that makes an adverse-event investigation survivable. Recommended
• Microneedling training documentation for anyone performing it under a cosmetology licence, which HEA 1131 requires be provided to the Professional Licensing Agency. Legally required

What a regulator asks to see here

After a burn or a scar, three things: the settings used, the operator's training on that specific device, and who was supervising. A practice that cannot produce all three is arguing from memory against a photograph.

Section 9 — Adverse Events, Emergency Readiness, and the Fifteen-Day Report

Indiana now has a reporting duty with a clock on it, which changes this section from prudent to mandatory.

• Serious adverse event notification procedure — notification to the Medical Licensing Board of Indiana no later than fifteen days after a patient's serious adverse event, with a named owner and a deputy for when that person is away. Legally required
• A written definition of what triggers the report, tracking the statutory language: death, a life threatening occurrence, or inpatient hospitalisation. Everyday bruising and nodules are not in it; an anaphylaxis transfer or an admission after a vascular occlusion is. Legally required
• Internal incident report form completed for every complication, reportable or not, because the pattern is what a board finds interesting. Recommended
• Anaphylaxis protocol with in-date epinephrine, checked on a log with the expiry visible. Recommended
• Vascular occlusion protocol with hyaluronidase on site, in date, in quantity, with the dosing algorithm printed and the escalation contact named. Recommended
• Emergency transfer plan naming the receiving hospital and the route, rehearsed rather than filed. Recommended
• Post-treatment contact procedure with a documented follow-up call for higher-risk treatments. Recommended

What a regulator asks to see here

Whether you reported, whether you reported inside fifteen days, and what you did in the room before the ambulance arrived. The submission channel and the form for the notification are the kind of detail the board's rulemaking will settle, so confirm the current route with the PLA rather than assuming an email address will do. Fifteen days sounds generous until the event happens on a Friday and the person who knows about it is on annual leave.

Section 10 — Advertising, Before-and-After Photographs, and Insurance

Advertising is the compliance area a competitor can audit from their sofa, and in a state that is about to publish a database of registered medical spas, that matters more than it did last year.

• Advertising review against Indiana's practitioner standards. IC 25-1-9-4 makes advertising services in a false or misleading manner, and fraud or material deception in the course of professional services, grounds for board discipline. SB 282 additionally directs medical spas to comply with the existing advertising rules for health care practitioners. Keep a dated review of your site and social profiles. Legally required
• Provider credential disclosure. Do not let a website imply that treatments are physician-performed when they are delegated, and do not let "medical director" appear where the statute now expects a responsible practitioner. Recommended
• Before-and-after photo consent, separate, specific to the channels used, revocable, with the revocation procedure written down. Recommended
• Photo library governance — unretouched, consistent lighting and angles, no stock or manufacturer images presented as your own results, and every image traceable to the patient who consented to it. Recommended
• Testimonial and influencer disclosure policy meeting the federal endorsement rules, including disclosure of anything of value given in exchange. Recommended
• Single-location advertising audit. Because treating outside the registered location is now prohibited, any advertisement offering an off-site event is an advertisement of a violation. Legally required
• Professional liability policy covering every procedure on the menu, plus general liability, and a written confirmation from the carrier that delegated procedures performed by nurses are covered. Recommended
• Certificates of insurance for the responsible practitioner and any independent contractor clinician. Recommended

What a regulator asks to see here

Whether your public claims match your private file. A complaint that starts with a marketing claim ends with a chart request, and the gap between the two is what gets sanctioned. If you would rather start from a written set of policies than draft eleven of them this quarter, our med spa SOP and compliance templates cover the operational documents behind every section above, and the Indiana profile at med spa regulations by state: Indiana keeps the primary sources in one place.

This article is for informational purposes only and does not constitute legal or medical advice. Indiana medical spa, scope-of-practice, delegation, and drug compounding requirements are administered by several bodies — the Indiana Professional Licensing Agency, the Medical Licensing Board of Indiana, the Indiana State Board of Nursing, the Indiana Board of Pharmacy, and the Indiana State Board of Cosmetology and Barber Examiners — and Senate Bill 282 is new law whose implementing rules had not been published when this was written. Items marked pending rulemaking are obligations whose mechanics the boards have yet to fix, and where Indiana's position is genuinely unsettled we have said so rather than guessed. Confirm current requirements with the relevant board and consult an Indiana healthcare attorney before making staffing, sourcing, or registration decisions.

Frequently Asked Questions