Medical Spa Policies and Procedures Manual: The Complete 2026 Guide

A medical spa policies and procedures manual is the single written document that governs how your practice makes decisions. It states the rules: who may perform which treatments, under whose supervision, after what examination, with what documentation, and what happens when something goes wrong. Every other compliance document you own — consent forms, treatment protocols, training logs, incident reports — either flows from the manual or is referenced by it.

That is a different thing from a stack of clinical protocols. Protocols show you know how to perform a treatment. The policies and procedures manual shows the practice is governed — that someone with a license decided what this business may do, wrote it down, signed it, and reviews it on a schedule.

What Is a Med Spa Policies and Procedures Manual?

A policies and procedures manual is a governing document. It answers a question no treatment protocol can answer: by what authority does this business do medicine? A binder full of injection techniques does not establish that a physician decided a registered nurse could inject here, under these conditions, after this kind of examination. The manual does — medical staff bylaws, scaled down.

Policy, Procedure, and Protocol Are Three Different Things

Operators use these words interchangeably. A well-built manual keeps them distinct, because regulators, medical directors, and opposing counsel read them differently.

• Policy — a governing rule stating what your practice does and who owns it. Example: all prescription treatments require a documented good faith exam before administration.
• Procedure — the operational steps that carry out a policy: who does what, in what order, on which forms. Example: the intake workflow that screens contraindications, routes the chart for the exam, and records consent.
• Protocol (SOP) — the treatment-specific clinical instructions: indications, contraindications, technique, dosing, and adverse-event management for one service.

The manual owns the first two layers and points at the third. A manual that tries to be all three becomes unusable — too long to govern, too vague to treat from.

The Manual Is Not Your SOP Library

The most common structural mistake is collapsing the two: a practice buys treatment protocols, labels the binder "Policies and Procedures," and believes it is covered — until an inspector asks who is authorized to operate the laser, how licenses are verified, and where the exposure control plan is. The clean division: your manual governs the practice, your SOP library governs the treatments. The manual should require a current, physician-approved protocol for every service on the menu, then reference the library rather than reproduce it. For the treatment-by-treatment inventory, see our companion guide to med spa standard operating procedures.

The Manual Is Not Your Employee Handbook

The second mistake is merging the manual with the handbook. They overlap in the staffing sections but serve opposite legal purposes. A handbook is an employment document — pay, time off, scheduling, discipline — deliberately written to avoid creating a contract. A manual is a clinical governance document — scope, delegation, supervision, documentation, patient safety — deliberately written to be binding.

Blending them creates two problems. Handbook language disclaiming that nothing creates an obligation undercuts your clinical policies exactly where you need force, and when a board asks for your delegation policies you hand over a document containing your PTO rollover rules. Keep them separate and cross-reference.

Where "Aesthetic Policy and Procedure Manual" Fits

Some operators use "aesthetic policy and procedure manual" for the same document, particularly in practices built around injectables and devices. The label does not change the requirements. Med spa, aesthetic practice, or wellness clinic — the governing document must establish authority, scope, delegation, supervision, documentation, privacy, safety, and review. The service mix changes the protocol library, not the governance layer.

Who Requires a Med Spa Policies and Procedures Manual?

Few states name the manual in statute. What exists instead is a set of overlapping requirements from five directions, each satisfied by written policy and none by an undocumented practice habit. Together they make the manual effectively mandatory.

State Medical, Nursing, and Health Boards

Practice acts rarely name the manual, but they impose duties that can only be discharged in writing. Delegated acts must be authorized by a supervising physician under defined conditions, and the arrangement must be documented. Good faith exam requirements come from medical practice acts, nursing practice acts, delegation regulations, and board guidance — often all four at once, which is why practices need one document reconciling them.

Malpractice and Professional Liability Carriers

Carriers underwriting aesthetic practices have tightened materially. Applications now ask whether written policies exist, whether a medical director signed them, whether staff are trained against them, and when they were last reviewed. Answering no rarely means outright declination — more often a higher rate or an exclusion on specific procedures. The sharper risk comes after a claim, when a carrier can argue no written standard governed the conduct at issue. See our breakdown of med spa insurance and malpractice coverage.

Your Medical Director

The medical director is the most immediate requirer, because their license is the one exposed. A physician accepting oversight takes responsibility for clinical activity they do not personally perform and often do not witness. The manual makes that manageable: it defines what has been authorized, so the physician is accountable for a defined scope rather than whatever happened on the premises.

Experienced medical directors ask for the manual before signing and refuse the engagement if they cannot change it. A prospective director who never asks to see your policies is telling you something about the oversight you are buying. See our guides to medical director requirements by state and the medical director agreement and cost structure.

Accreditation Bodies

Practices pursuing accreditation through AAAHC, AAAASF, or The Joint Commission face the most explicit documentation requirement of the five. Surveyors verify that a policy exists, is current, was approved by the governing body, can be described by staff, and was followed — and AAAASF requires full compliance across a three-year cycle, not just on survey day. Most med spas need not be accredited, but the standards are a useful benchmark. See our overview of med spa accreditation and certification options.

Landlords, Lenders, and Acquirers

The least anticipated requirer is commercial. Medical-use lease riders often require written protocols for medical waste, controlled substances, and hazardous materials, with indemnity for failures. Lenders want evidence of professional oversight, and a signed approval page is the cheapest proof. Acquirers are strictest: buy-side diligence requests the manual by name, and practices without one take a valuation discount. Our cost to open a med spa analysis puts governance documentation in context.

What Changed in 2026: New State Laws and Your Manual

For a decade, med spas were regulated indirectly, through rules written for other settings. That changed in 2025 and 2026 as states began legislating med spas directly. Requirements that used to be inferred are now written down, and the inferred version no longer suffices.

Indiana SB 282: The First Comprehensive Med Spa Statute

Governor Mike Braun signed Indiana Senate Bill 282 into law on March 5, 2026, with most provisions effective July 1, 2026 and registration with the Medical Licensing Board of Indiana beginning January 1, 2027. It creates a registration framework and public database, requires each spa to designate a responsible practitioner, and imposes adverse event reporting obligations.

The reporting provision lands directly on the manual. It cannot be met ad hoc: a practice needs a written procedure identifying which events are reportable, assigning responsibility for escalating them, and documenting what was reported and when. Without one, a practice is relying on someone recalling the rule under the worst conditions it will ever face.

Texas HB 3749 (Jenifer's Law): Delegation on Paper

Texas HB 3749, known as Jenifer's Law, was signed June 20, 2025 and took effect September 1, 2025. Named for Jenifer Cleveland, who died in 2023 after an IV infusion at a med spa, the enacted version was narrowed to elective IV therapy. It limits delegation of prescribing or ordering that therapy to a physician assistant or advanced practice registered nurse under appropriate physician supervision, and delegation of administration to a PA, APRN, or registered nurse.

For a Texas practice the exposure is documentary: the statute assumes a paper trail showing which provider was delegated which act, under which supervision arrangement, with which written protocol in force, plus records showing who ordered and who administered every service. A practice with an IV menu and no delegation policy has the clinical capability and none of the authority. See our coverage of the Texas med spa regulatory changes for 2026.

California SB 351: Governance, Ownership, and Who Decides

California SB 351, effective January 1, 2026, codifies the state's corporate practice of medicine doctrine and restricts private equity groups and hedge funds from interfering with professional judgment. It bars non-clinical owners from determining which diagnostic tests are appropriate, controlling referrals, being responsible for overall patient care, or dictating patient volume and clinician hours.

This is a governance requirement and belongs in Section 1 of your manual. Any practice operating under a management services organization, a friendly-PC structure, or outside investment needs its control arrangement described in writing with the clinical-decision boundary explicit: the professional entity owns clinical judgment, the management entity owns non-clinical operations.

What These Laws Have in Common

Three states, three mechanisms — registration, delegation, ownership — and one shared assumption: that a med spa is a governed medical practice with a documented internal structure, not a retail business that happens to sell injections. None of these obligations survives a practice with nothing written down, and building the manual now is cheaper than reconstructing one under a deadline. Our state-by-state regulation reference tracks where each jurisdiction stands.

The Full Table of Contents of a Policies and Procedures Manual

Here is the complete table of contents a compliant manual follows. Use it as a build checklist: every section belongs in your binder or document system, each carries a version date, and the clinical sections carry medical director sign-off. Section 6 is the only one that references rather than contains its material.

Everything but Section 6 is governance: it applies to every practice regardless of menu, and changes only when your law, structure, staffing, or systems change. Section 6 is the hinge — a short section governing a large library that lives elsewhere. Draft Sections 1 through 4 first, because they define authority and every later section inherits their decisions. You cannot write a credible consent policy before deciding who performs the good faith exam.

Clinical Governance Policies: Delegation, Supervision, and Scope

Section 3 is the section boards read first, and the one most often missing. It establishes that medicine performed in your practice happens under a physician's authority, with a defined chain from that authority to the hands doing the treatment.

The Good Faith Exam Policy

A good faith exam policy must answer four questions in writing: who may perform the exam, what it must include, when it must occur relative to treatment, and how it is documented. The answers are state-specific and increasingly contested, with several states moving to restrict which license types may perform it and to require a patient-specific treatment order rather than a general clearance.

Cover the hard cases too, because that is where practices get caught: telehealth exams and the documentation standard that applies; how long an exam remains valid; what triggers re-examination when history or the requested treatment changes; and what happens when the examining and treating providers differ.

Delegation and Standing Orders

Delegation is the legal bridge between a physician's authority and a nurse's hands. The policy states which acts may be delegated, to which credentials, under what conditions. Standing orders are the instrument — a written physician authorization permitting a defined provider to administer a defined treatment without a separate order per patient.

Two failure modes recur: standing orders too broad to mean anything — a single page authorizing "aesthetic treatments" tells an investigator nothing — and standing orders never updated when a provider left or the medical director changed, leaving the practice on authority that expired with a signature. Require each order to name the authorizing physician, the authorized credential, the specific treatments, the limits, and a review date.

The Supervision Model and Availability Standard

State law defines the supervision categories — direct, indirect, general, collaborative — and the terms are not interchangeable between states. Name the model required for each service and credential combination, then state the practical standard: who is on call, how they are reached, the expected response interval, and what staff do if the supervising provider cannot be reached. That last provision matters more than it looks: without a written rule, the decision belongs to whoever is on the floor.

The Scope of Practice Matrix

The scope of practice matrix is the most useful page in the manual: a table mapping every service on the menu to the credentials authorized to perform it, with a column for any additional certification required. Build it conservatively — it should reflect what your state permits and what your medical director has authorized, which may be narrower. Date it, because the version in force on the day of an incident is the one that gets examined.

Medical Director Authority and Chart Review

The manual must state what the medical director actually does, in verifiable terms. "Provides oversight" is not a policy. A policy specifies the chart review cadence and sampling method, the events triggering mandatory notification, the authority to suspend a provider or service, and the documentation each produces. Written that way the arrangement generates evidence; written vaguely it generates nothing an investigator can credit.

HIPAA, Privacy, Records, and Consent Policies

Any med spa that creates, receives, maintains, or transmits protected health information is a HIPAA covered entity. Sections 8 and 9 carry privacy and records; Section 5 carries consent — three related but distinct bodies of policy that practices conflate.

Privacy Policies and What HIPAA Actually Requires in Writing

The Privacy Rule requires written policies, a Notice of Privacy Practices, a designated privacy official, workforce training, a sanctions policy, and documentation retained for six years. The Security Rule requires a risk analysis and documented administrative, physical, and technical safeguards. Business associate agreements are required with every vendor touching PHI — the EHR, practice management system, marketing platform, answering service, and usually the IT contractor.

The penalties are why this section stays current. For penalties assessed on or after January 28, 2026, HHS's inflation-adjusted civil monetary penalties run from a $145 per-violation minimum at the lowest culpability tier to $2,190,294 at the top tier, which is also the annual cap for identical violations. Under OCR's 2019 enforcement discretion notice the lower tiers carry reduced annual caps. Detail is in our HIPAA compliance guide for med spas; HHS maintains the framework on its compliance and enforcement pages.

One planning note: the Security Rule overhaul proposed in January 2025 has not been finalized. HHS moved the rulemaking to its long-term agenda, with July 2027 the anticipated timeframe for final action. Build against the Security Rule as it stands, with a note in the review calendar to reassess when a final rule lands.

Records Content, Retention, and Custody

Section 9 covers what a complete record contains, how long it is kept, and who keeps it. Retention minimums are set by state law and vary widely, with separate rules for minors that typically run from the age of majority rather than the date of service. State your period explicitly rather than writing "as required by law" — a policy that defers the question has not answered it.

Three provisions are commonly missing and consequential: a legal hold suspending destruction once a claim is foreseeable; a custodian arrangement specifying who holds records if the practice closes or sells; and a policy on the clinical photograph, which is part of the record and is often stored on a phone with no retention rule at all. See our guide to med spa medical records retention.

Consent Policy Versus Consent Forms

A stack of signed forms is not a consent policy. The policy governs the forms: who may obtain consent, what disclosure is required, how consent is documented when a plan changes mid-course, the rule for minors, and how often forms are reviewed against current protocols. Design against version drift — when a protocol changes, review the consent form in the same cycle, or you end up with a signed form that no longer describes what was performed. Our med spa consent forms guide covers what each form should disclose.

Employment, Training, and Credentialing Policies

Sections 4 and 12 answer a question an investigator asks directly: how do you know the person who performed this treatment was qualified to? The answer has to be a file, not a recollection.

Credentialing and Primary Source Verification

The credentialing policy sets what must be verified before a clinical hire treats a patient. Primary source verification — checking the license directly with the issuing board rather than accepting a copy — is the standard, and the file should also hold DEA registration where applicable, malpractice coverage evidence, CPR or ACLS certification with expiry, and the signed scope-of-practice acknowledgment. Re-verification is the part practices skip: set an interval and keep a tracked expiry calendar. Our med spa hiring and credentialing guide lays out the full file checklist.

Onboarding and Competency Verification

The training policy should distinguish two things that get merged. Orientation is exposure to the manual, evidenced by an attestation signature. Competency is documented evidence that a provider can perform a treatment to standard — an observed performance signed off by a qualified assessor, per treatment category, before independent practice. State what happens when a provider adds a service (new verification, not an assumption that adjacent skill transfers) and who can suspend a provider pending re-verification.

The Annual Training Calendar

HIPAA training, OSHA bloodborne pathogen training, and device-specific training run on different clocks, and a manual requiring each separately with no calendar produces a practice that completes some and forgets others. The cleanest structure is one annual training matrix listing each training, its frequency, its owner, and where completion records live. Our guide to med spa staff training requirements covers what each must include. Section 12 is also where the manual and the handbook come closest: state that clinical determinations rest with the medical director while employment consequences follow the handbook's process.

Safety, Infection Control, and Emergency Policies

Sections 10 and 11 get inspected on sight. An inspector can assess much of this by walking the treatment rooms, which makes gaps here visible in a way governance gaps are not.

The Bloodborne Pathogen Exposure Control Plan

OSHA's bloodborne pathogens standard, 29 CFR 1910.1030, requires a written exposure control plan and is specific about maintenance: it must be reviewed and updated at least annually and whenever necessary to reflect new or modified tasks and procedures affecting occupational exposure, and new or revised employee positions with occupational exposure. The annual review must also document consideration and implementation of appropriate, commercially available, effective safer medical devices.

One requirement is regularly missed: the employer must solicit input from non-managerial employees with direct patient care responsibilities in identifying, evaluating, and selecting engineering and work practice controls, and must document that solicitation in the plan itself. A plan that has never recorded staff input is incomplete on its face.

Infection Control and Instrument Reprocessing

The policy covers hand hygiene, skin antisepsis, single-use device policy, sharps handling and disposal, surface disinfection between patients, and — where any reusable instrument exists — cleaning, disinfection or sterilization, and the log proving it happened. Practices that believe they have no reusable instruments should check: microneedling handpieces, cannulas, and certain device tips have caught practices out. See our med spa infection control protocol guide.

Laser and Energy Device Safety

Where the practice operates lasers or other energy-based devices, the manual needs a laser safety policy: a designated laser safety officer, a controlled treatment area with signage and window coverings, wavelength-specific eyewear with an inspection routine, plume management, key control, and a pre-treatment device check. Several states also impose device registration or operator certification requirements that belong here.

Emergency Response Policy

Section 11 differs from your emergency protocols the way the manual differs from the SOP library. The policy establishes the system around them: which emergencies the practice must be prepared for, what medications and equipment must be on-site and who checks expiry dates, the rule that no treatment proceeds without the corresponding emergency capability present, and the reporting chain from event to medical director to any external report your state requires — now statutory in Indiana. Our emergency protocol checklist covers the clinical protocols, and our guide to how emergency protocol gaps become lawsuits covers what happens without the system.

Marketing, Advertising, and Photo Consent Policies

Section 13 is the newest section in most manuals and the one most often missing, because marketing usually sits with someone who never sees the compliance binder. That separation is the problem: marketing generates more routine regulatory exposure than most clinical functions, and does so publicly.

Advertising Review and Substantiation

The policy should require that claims be substantiated before publication, that credentials be described accurately — "medical director" and "physician-supervised" are claims with legal content — and that a named person review advertising before it goes live. It should also address discount structures that raise fee-splitting questions in some states, and the rule that a promotion may not commit the practice to a treatment before a good faith exam has occurred.

Before-and-After Photography

Before-and-after images carry two obligations at once. The FTC treats them as advertising claims, requiring that they represent typical results or carry adequate disclosure, that they not be retouched to exaggerate outcomes, and that any material connection to the person depicted be disclosed. HIPAA treats them as protected health information requiring valid authorization for marketing use. The provision that prevents most problems is simple: promotional use requires a separate, written, revocable authorization distinct from the clinical photography consent in the record. See our guide to the FTC before-and-after photo rules for med spas.

Reviews, Testimonials, and Endorsements

The FTC's Rule on the Use of Consumer Reviews and Testimonials took effect October 21, 2024 and prohibits buying positive reviews, having insiders write reviews without disclosing the connection, and suppressing negative reviews to create a misleading picture. It authorizes civil penalties for knowing violations, with the applicable maximum at $53,088 per violation in 2026. The FTC publishes a plain-language questions and answers page on the rule.

For a med spa the exposure is ordinary: a discount offered for a review without disclosure, staff reviewing their own employer, an undisclosed influencer partnership, or review-gating that routes unhappy patients to a private form. Prohibit each by name, and address the HIPAA problem that arises the moment you respond to a review — acknowledging someone is a patient is a disclosure. Our guide to testimonial marketing consent and HIPAA covers responding without confirming treatment.

Social Media and Staff Devices

The final provision covers personal devices in clinical areas: whether staff may photograph in treatment rooms, on whose device, where images are stored, how they are transferred and deleted, and the rule for content showing patients or charts in the background. A practice that has never written this down is relying on judgment in a setting where one background screen in a reel is a disclosure.

Approval, Version Control, and Annual Review

Section 15 separates a manual that helps you from a document that hurts you. An unapproved, undated, unattested manual is worse than none in one specific way: it establishes what the practice knew it should be doing, and provides no evidence anyone did it.

The Approval Page

The manual opens with an approval page carrying the practice name, version number, effective date, and dated signatures from the owner and the medical director. Every clinical section carries the medical director's approval. When the medical director changes, the incoming physician reviews and re-signs — approval is not inherited, and a practice operating on a departed director's signature is operating on nothing.

Version Control

Version control means every policy carries a version number, an effective date, and a revision history noting what changed, when, and who approved it. Superseded versions are archived rather than deleted, because the question in any dispute is which version was in force on the date at issue — and a practice that overwrites its policies cannot answer it. Name where the authoritative copy lives and state that printed copies are uncontrolled.

The Annual Review Calendar

Annual review is required in several places at once: OSHA for the exposure control plan, accreditation standards for periodic policy review, and carriers who ask when the manual was last reviewed. One calendared annual review of the whole manual, with a written record of what was examined, what changed, and who participated, satisfies all three. List the out-of-cycle triggers too: a change in state law, a new service or device, a change in medical director, an adverse event, or an internal audit finding.

Staff Attestation

The last link is proof that the people bound by the manual have read it. The attestation log records each staff member's signature against the version they were trained on, at hire and after each material revision. Without it, a practice facing an allegation that someone deviated from policy cannot establish they ever knew it — which converts an individual performance failure into an institutional training failure, a distinction worth a great deal in both a board proceeding and a claim.

How the Manual Is Used in an Inspection or a Complaint

Everything above is theory until someone outside the practice asks to see the document. There are three scenarios where that happens, and the manual behaves differently in each.

The Announced Inspection or Survey

In an announced inspection the manual is the spine of the visit. The inspector uses it to structure the walkthrough: the policy says single-use items are discarded after each patient, so a drawer gets opened; the policy says eyewear is inspected before each laser treatment, so the log gets requested.

That cuts both ways. A policy you do not follow is an admission. Write to what the practice will actually sustain, not to an aspirational best practice: requiring weekly emergency-kit checks performed monthly is worse than requiring monthly checks performed monthly.

The Unannounced Visit or Complaint Investigation

Complaint-driven investigations are narrower and more adversarial. The request is specific: produce the policies and records relating to a named patient, provider, or service, as they existed on a given date. This is where version control earns its cost. A practice that can produce the policy in force that day, the standing order that authorized the provider, the credentialing file, and the attestation signature has told a complete story. One that cannot establish what was in force nine months ago has not.

The response process itself belongs in the manual: who may receive an investigator, who is notified, whether counsel is contacted before documents are produced, and how a copy of everything produced is retained. Practices without that policy make their worst decisions in the first twenty minutes. Our guide to med spa inspections covers the document requests, and our review of common med spa compliance violations covers what these investigations most often find.

Litigation and Discovery

In a malpractice claim the manual arrives via a discovery request and is read by an expert whose job is to find the gap between the standard of care and what your practice did. A complete, current, approved, followed manual establishes that the practice defined a reasonable standard and that the provider was trained and authorized. The most damaging case is the intermediate one — a manual that exists, reads well, and was not followed, handing the plaintiff the standard and the breach in a single exhibit.

What Happens When There Is No Manual at All

The consequences compound rather than substitute. Regulatory citations arrive first, often with a corrective action plan and a re-inspection. Board exposure follows for the medical director, whose license is at risk for inadequate supervision independent of anything the owner faces. Then insurance — a coverage dispute at the worst possible moment, or a non-renewal. And the practice often loses its medical director, because a competent physician who learns there is no governance documentation withdraws.

Writing the Manual Yourself vs. Adapting a Template

There are two honest paths and one dishonest one: write the manual from scratch, adapt a professionally drafted template, or download a generic file, change the practice name, and file it unread. The third is common, and it is the fact pattern behind most of the "manual that was not followed" problems above.

The Real Cost of Writing From Scratch

Writing from scratch means researching your state's medical practice act, nursing practice act, and delegation rules; reconciling them with federal HIPAA and OSHA requirements; and having a physician and ideally a healthcare attorney review the result. For an owner-operator, a realistic estimate is 80 to 150 hours over three to six months, plus 5 to 15 hours of medical director time. Governance drafting is a specialist skill and the failure mode is invisible: a manual can read beautifully and still omit the delegation provision a board will ask about.

What a Template Does and Does Not Solve

A template solves the structural problem. It supplies the section architecture, the language regulators and carriers expect, and the provisions easiest to omit — the input-solicitation record in the exposure control plan, the legal hold in the retention policy, the separate promotional authorization. That is the bulk of the work, and the part that benefits most from having been drafted by someone who does it repeatedly.

A template does not solve customization, and any vendor claiming otherwise is selling you the third path. State-specific provisions must be set to your state, the scope of practice matrix to your actual staff and menu, the supervision standard to your actual arrangement, and the approval page must be signed. Realistically a good template moves the work from 80–150 hours to 10–20 hours plus medical director review — a meaningful reduction, not an elimination.

The Hybrid Most Practices Actually Use

The route most practices take, and the one we would recommend, is a template for the governance sections and bespoke work for the clinical ones. Sections 3, 4, and 6 — delegation, credentialing, and the protocol index — are where your practice is genuinely specific and where medical director time is best spent. Budget that review as a real line item rather than a favor: a physician who reads the manual, changes what they disagree with, and signs something they endorse is providing the oversight the manual claims exists.

Which Kits Cover Which Parts of Your Manual

MedSpa Standards publishes the governance layer and the clinical protocol library separately, so you can buy the part you are missing. The Operations & Compliance Kit covers the manual itself; the treatment kits cover the protocol library it references.

Your 30-Day Policies and Procedures Manual Build Plan

A manual is built in the wrong order more often than it is built badly: authority first, then the sections that depend on it. Four weeks is realistic starting from a template with an engaged medical director.

Week 1: Establish Authority

Draft Sections 1 through 4: governance and ownership structure, scope of services, clinical governance and delegation, and credentialing with the scope of practice matrix. Confirm your state's good faith exam, delegation, and supervision rules first, and have the medical director review these four sections before anything else is drafted. End the week with a signed matrix and a standing order set naming providers, treatments, and conditions.

Week 2: Patients, Privacy, and Records

Draft Sections 5, 8, and 9: intake and consent, HIPAA privacy and security, and records retention. Reconcile consent forms against the protocols in force and fix any version drift. Inventory your vendors and confirm a business associate agreement exists for each one touching PHI — usually where the week's surprises are. Set the retention period explicitly and write the legal hold and custodian provisions.

Week 3: Safety, Emergencies, and Staff

Draft Sections 10, 11, and 12: the exposure control plan with documented staff input, infection control and laser safety, the emergency response policy with its inventory and expiry-check owner, and the training framework with its annual matrix. Walk the treatment rooms while drafting rather than after — this is where written policy and physical reality diverge most easily.

Week 4: Marketing, Audit, and Sign-Off

Draft Sections 13 and 14: advertising review, photo and testimonial authorization, social media and device policy, then quality assurance with its chart review schedule, incident log, and audit checklist. Assemble Section 15, produce the approval page, and obtain owner and medical director signatures. Hold the staff orientation, collect attestation signatures against the version number, and calendar the annual review. On the day the last signature lands the manual is in force — and the next task is making the practice match it.