What Does a Med Spa Medical Director Actually Do? (2026)

Ask ten med spa owners what their medical director does, and a surprising number will describe a monthly invoice. The physician's name is on the protocols, on the website, on the malpractice application — but they have never set foot in the building, never opened a chart, and could not tell you which injector treated which patient last week. For years, that arrangement was quietly tolerated. In 2026 it is the fastest way to lose both a physician's license and a practice's ability to operate.

This guide answers the question directly: what does a med spa medical director actually do? Not the sanitized one-line job description, but the real, enumerated duties a director owns — establishing protocols and standing orders, making delegation and scope-of-practice calls, setting good-faith-exam policy, reviewing charts, signing off staff competency, approving products and devices, and directing the response when something goes wrong. Just as important, it covers how to evidence each duty, because in enforcement the difference between a real director and a paper one is almost always a documentation trail. For the wider legal picture across states, pair this with our complete guide to med spa medical directors.

The Medical Director Role: Signature-for-Hire vs. the Real Job

A medical director is the licensed physician who takes legal responsibility for the clinical activities of a practice that employs non-physician providers. In a med spa, that means the doctor stands behind every unit of neurotoxin an RN injects, every laser pass an aesthetician makes, and every GLP-1 prescription a nurse practitioner writes. The role exists because most med spa treatments are the practice of medicine, and the practice of medicine requires a physician's authority — even when a physician is not the one holding the syringe.

The "Signature-for-Hire" Myth

The cheapest version of this relationship is what regulators call a "paper director," a "ghost director," or "rent-a-doc": a physician who signs the medical director agreement, lends their name to the protocols, collects a flat monthly fee, and does essentially nothing else. They do not review charts, do not answer clinical questions, are often unreachable during operating hours, and frequently "direct" dozens of facilities at once. On paper there is a director. In reality there is a signature.

The reason this model spread is simple economics — it is the least expensive way to check the box on a license application. The reason it is collapsing is equally simple: boards figured out that the box was empty. As the American Med Spa Association and multiple state boards have signaled in 2025 and 2026, the era of minimal med spa oversight is over, and passive arrangements are now treated as active liabilities. New York, New Jersey, California, Texas, and Florida have each intensified scrutiny of absentee supervision.

What "Medical Direction" Actually Means

The real job is clinical governance: designing the system that keeps patients safe and providers inside their lawful scope, then continuously verifying that the system is working. Everything that follows in this guide is a facet of that single idea. The director is not expected to personally perform every treatment or hover over every provider — but they are expected to have decided how each treatment is done, who is allowed to do it, what happens when it goes wrong, and to be able to prove that those decisions are theirs and that they are still paying attention.

One distinction is worth drawing early, because it confuses a lot of operators: owning liability is not the same as day-to-day clinical involvement, but you cannot have the former without the latter. A director carries the legal exposure whether or not they show up. What determines whether that exposure turns into a sanction is whether they can demonstrate ongoing involvement. The duties below are, in effect, the list of things that generate that demonstration.

Duty 1: Setting Protocols and Standing Orders

The foundational duty is authorship. Before a single patient is treated, the medical director must establish — or review, customize, and formally adopt — the written clinical protocols the practice operates under. These are the documents that define the standard of care in your building, and the director's signature is what converts a generic template into a binding, physician-endorsed instruction set.

Standing Orders vs. Protocols vs. Standardized Procedures

Three terms get used loosely; a compliant director keeps them straight:

• Protocol (SOP) — the detailed clinical instructions for performing one treatment: indications, contraindications, technique, dosing, and adverse-event management. This is the standard of care for that service.
• Standing order — a physician-issued authorization that lets a qualified provider administer a specific treatment under defined conditions without a separate patient-by-patient order. It supplies the legal authority to act.
• Standardized procedure — in states like California, a written policy jointly developed and signed that authorizes an RN to perform specific functions; it must be dated, specify supervision and record-keeping requirements, and be periodically reviewed.

The director owns all three. A protocol without a standing order gives your nurses a recipe but no authority; a standing order without a protocol gives them authority but no defined method. Both gaps are exploitable in litigation. For the full anatomy of a protocol document, see our med spa standard operating procedures guide.

What a Compliant Protocol Set Covers

Every treatment on the menu needs its own signed protocol — neurotoxins, hyaluronic-acid and biostimulator fillers, laser and energy devices, microneedling, chemical peels, GLP-1 weight-loss injections, IV therapy, hormone therapy, PRP, and more. Each should carry a version date and the director's signature, and each should be re-reviewed at least annually and whenever a device, drug, regulation, or the director themselves changes. Protocols that were signed once at opening and never touched again are a common and telling audit finding: they show the system was built but not maintained.

Duty 2: Delegation and Scope-of-Practice Decisions

If protocols define how a treatment is done, delegation defines who may do it. This is one of the most consequential — and most frequently botched — director duties, because scope of practice is set by state law and varies dramatically by license type. Getting it wrong is not a paperwork problem; it is the unlicensed or unauthorized practice of medicine.

Deciding Who Can Do What

The director builds a scope-of-practice matrix that maps each credential in the practice — MD/DO, NP, PA, RN, LPN/LVN, medical assistant, aesthetician — to the specific treatments that credential may lawfully perform in that state, and under what level of supervision. In many states an RN may inject neurotoxin under a standing order after a good-faith exam, but may not perform the exam or make the diagnosis; an aesthetician may perform superficial procedures but not administer prescription products; a medical assistant's role is narrower still. Texas, for example, treats nonsurgical cosmetic procedures such as injections and prescription-device use as the practice of medicine that must be delegated by a physician to appropriately trained personnel. The director's job is to know those lines and encode them.

Written Delegation and Standing Orders

Delegation must be documented, not assumed. Written delegation — increasingly required explicitly, as under Texas Medical Board rules — is what makes the arrangement defensible, and paradoxically it is also what makes absentee supervision enforceable, because a missing or hollow delegation document is easy for an inspector to cite. The director signs the delegation, ties it to the relevant standing orders and protocols, and is accountable for the delegated act. When a provider drifts outside their matrix — an aesthetician starts doing injections, say — it is the director's responsibility to catch and stop it. For how delegation failures translate into personal exposure, read our breakdown of med spa medical director liability.

Duty 3: Good-Faith Exam Policy

Nearly every state requires a good-faith examination (GFE) before a prescription aesthetic treatment — including Botox and filler — is administered. The GFE is where a qualified provider reviews the patient's history, screens contraindications, and establishes that the treatment is appropriate. The medical director owns the policy that governs it, and in many practices performs a share of the exams personally.

Who May Perform the Good-Faith Exam

The GFE must be conducted by a licensed provider authorized to diagnose — typically a physician, NP, or PA, and in some states an RN only within narrow limits. The director defines who qualifies, whether the exam may be done via telehealth, and what must be documented for it to count. This has become a live enforcement area: California's SB 351, effective January 1, 2026, codified that the GFE is a purely clinical function that a management company may not influence — a direct shot at arrangements where business staff decide who gets examined and how. The director must ensure the exam stays a clinical decision, not an operational shortcut.

Building the GFE Into Intake

Policy is only as good as the workflow that enforces it. The director designs intake so that no prescription treatment can proceed without a documented GFE in the chart — the history reviewed, contraindications screened, and the exam attributed to a named, qualified examiner. When the GFE is skipped or back-dated, it is usually the first thing a plaintiff's attorney finds, and its absence undermines every treatment that followed.

Duty 4: Chart Review and Quality Assurance

If there is one duty that separates a real director from a paper one in the eyes of a board, it is chart review. Reviewing charts is the mechanism by which the director verifies that the protocols they wrote and the delegation they authorized are actually being followed — and it produces the clearest evidence that supervision is ongoing rather than nominal.

How Often Charts Must Be Reviewed

Frequency requirements vary. Some states or protocols specify a percentage of charts or a fixed cadence; others leave the interval to the director's professional judgment. What does not vary is the expectation that review be consistent and documented. A director might sample a set percentage of each provider's charts monthly, weight the sample toward newer injectors and higher-risk treatments, and log every review. The specific number matters less than the demonstrable pattern — a defensible rhythm you can show a regulator, not a one-time spot check.

What the Review Looks For

A chart review is a targeted audit. The director checks that a good-faith exam is documented and attributed, that consent is present and treatment-specific, that the treatment stayed within the provider's authorized scope, that dosing and device parameters matched protocol, that any adverse event was recognized and handled correctly, and that the record is complete enough to defend. Chart audits, consent verification, and prescribing oversight are precisely how directors catch deficiencies before a regulator or plaintiff does.

Corrective-Action Loops

Review without follow-through is theater. When a review surfaces a recurring problem — a provider consistently under-documenting the GFE, say — the director's duty is to close the loop: retrain, amend the protocol, tighten the workflow, and document the correction. That corrective-action trail is doubly valuable, because it shows not only that the director is watching but that the practice self-corrects, which is exactly the posture boards reward and juries respect.

Duty 5: Staff Training and Competency Sign-Off

The director sets the bar for who is qualified to treat patients and signs off that each provider clears it. This is not the same as running every training session personally; it is owning the standard and the gate. If an undertrained provider harms a patient, the question a board asks is who cleared them — and the answer is the medical director.

Onboarding and Competency Verification

Before a new provider treats patients unsupervised, the director should require verified licensure, completion of any device-manufacturer training (mandatory for most laser and energy platforms), and a documented competency assessment demonstrating the provider can perform each delegated treatment safely. That sign-off — dated and attributed — is the artifact that proves the gate exists. Our guide to med spa staff training requirements details what each role must complete before going live.

Ongoing Competency and Continuing Education

Competency is not a one-time event. The director sets expectations for continuing education, periodic re-verification of skills, and retraining triggered by new devices, new services, or chart-review findings. Training logs — who was trained, on what, by whom, and when — sit alongside chart-review logs as the documents most likely to be requested after an incident, and their presence or absence tells the whole story of whether the director was engaged.

Duty 6: Adverse-Event and Emergency Oversight

Aesthetic medicine has real emergencies — anaphylaxis, vascular occlusion from filler, vasovagal syncope, laser burns, and rarely cardiac events. The medical director owns the system that anticipates and responds to them, before, during, and after any incident. This is where the difference between an involved director and an absentee one can become the difference between a managed complication and a catastrophe.

The Director's Role When Something Goes Wrong

During an emergency, the director is the clinical authority the team escalates to, and they must be reachable within the response window their state requires — whether that means on-site presence or immediate availability by phone or electronic means. A director who cannot be reached when a patient is deteriorating is the single scenario boards cite most often, and it is the fact pattern most likely to convert a bad outcome into a license action. Afterward, the director leads the review: documenting what happened, notifying carriers or regulators where required, and feeding the lessons back into protocols and training.

Emergency Readiness the Director Owns

Readiness is a duty, not an afterthought. The director specifies the emergency protocols for each foreseeable event, the required crash-kit and medications that must be on-site at all times — epinephrine, hyaluronidase for filler occlusion, an AED — and ensures staff are drilled on their roles. When an inspector or carrier asks to see your emergency preparedness, they are really asking whether the director did this work in advance or is improvising after the fact.

Duty 7: Product, Device, and Formulary Approval

The director decides what the practice puts into patients and what technology it points at them. This duty is easy to overlook because it feels operational, but sourcing and device decisions are clinical judgments with real safety and legal stakes.

Formulary and Sourcing Approval

The director approves the formulary — which neurotoxins, fillers, and pharmaceuticals the practice uses — and, critically, that they are sourced from licensed, FDA-compliant suppliers. Counterfeit or grey-market injectables and improperly compounded medications are a recurring enforcement and patient-safety problem, and the director is the backstop against them. Where the practice stores controlled substances or prescription toxins, the director oversees inventory, storage, and dispensing controls to prevent diversion and misuse.

Device Parameters and New-Service Sign-Off

When the practice adds a laser, energy device, or new service line, the director reviews and approves it before it goes live — validating that staff are trained on the specific platform, that device parameters are written into the protocol, and that the service fits the practice's scope and supervision model. Adding a service without the director's clinical sign-off is a classic way a med spa outruns its own compliance; the director's approval gate is what keeps the menu and the governance in sync.

Documenting Active Involvement: The Audit Trail

Every duty above shares a second half: it must leave evidence. In enforcement, the practical difference between a real medical director and a paper one is almost never a philosophical debate about engagement — it is whether the practice can produce documents. The audit trail is the defense.

The Evidence a Board or Plaintiff Looks For

When a board investigates or an attorney sends a discovery request, they are looking for a specific set of artifacts: protocols and standing orders signed and dated by the director; a chart-review log showing what was reviewed and when; training and competency sign-offs; adverse-event reviews with corrective actions; product and device approvals; and some record of availability during operating hours. Present those, and the director's involvement is self-evident. Produce only a signed agreement and a bank record of monthly payments, and you have described a paper director in their own words.

A Simple Involvement Log

The cleanest way to stay ahead of this is a running involvement log — a single record where every director touchpoint is captured: dates of chart reviews, protocol updates, staff sign-offs, site visits or telehealth check-ins, and adverse-event debriefs. The test to apply is blunt: if the director vanished tomorrow, could you show a full year of their fingerprints on the practice's clinical governance? If the honest answer is no, the relationship needs work regardless of what the contract says. Operators sourcing a new director should build this expectation in from day one — our guide on how to find a medical director for a med spa covers vetting for genuine engagement rather than the cheapest signature.

How Duties Scale With Multiple Locations

The duties do not change when a practice grows — but discharging them gets harder, and failing at them gets easier. This is where many otherwise-legitimate arrangements quietly cross into paper-director territory without anyone intending it.

Ratios, Distance, and Span-of-Control Limits

Several states cap how many locations or providers a single physician may supervise, or impose distance and availability limits that make far-flung oversight impossible on paper. Even where no explicit cap exists, there is a common-sense ceiling: a physician nominally directing dozens of facilities across a state cannot plausibly review charts, answer clinical calls, or be reachable during simultaneous emergencies. That implausibility is exactly what enforcement targets — a director's name on twenty sites is not evidence of oversight, it is evidence of its absence. The specific requirements differ by state; our med spa medical director requirements guide breaks them down.

Systematizing Oversight Across Sites

Scaling compliantly means systematizing the duties, not diluting them. That looks like standardized protocols applied consistently across every location, a scheduled and logged chart-review rotation, delegated site leads or lead injectors who escalate to the director, and a documentation system that rolls each site's activity up to a single reviewable record. Done well, a director can genuinely oversee multiple sites; done as an afterthought, more locations simply multiply the number of charts nobody is reading. The distinguishing factor, again, is whether the involvement is documented and real — the same test that applies to a single storefront.

The Bottom Line: The Role Is a Job, Not a Signature

A med spa medical director's real work is clinical governance: authoring protocols and standing orders, deciding and documenting delegation, setting good-faith-exam policy, reviewing charts and running quality assurance, signing off staff competency, approving products and devices, and owning the adverse-event system — with every one of those duties leaving a documented trail. The 2026 enforcement climate has made the stakes plain. Boards are no longer asking whether a practice has a medical director; they are asking whether that director is actually directing, and they expect to see the evidence.

The good news for operators is that this is buildable. The duties are knowable, the documents are standardizable, and the difference between a defensible relationship and a dangerous one is mostly a matter of having the right templates and the discipline to keep them current. That is precisely what the tools below are built to provide.