Med Spa Standard Operating Procedures: The Complete 2026 Guide

Almost every med spa owner who asks us about SOPs asks the same question. Not "how do I write one" — they can figure that out. The question is which ones. How many documents is a real library? Is there a list?

There is a list. It is derived rather than published — no state hands you a checklist — but it is knowable. It comes from three inputs: the services on your menu, the delegation structure your state requires, and the emergencies your menu makes possible. An injectables-only studio lands around 20 to 25 documents; a full-service practice running injectables, laser, weight loss, hormones, and IV therapy lands closer to 62.

This guide gives you that list by name, plus the parts that get skipped: what belongs inside each document, who signs it, how often it is reviewed, and what happens to your binder during an inspection.

What a Med Spa SOP Actually Is — And What It Isn't

A standard operating procedure is a written instruction telling a named role how to perform a specific task, in order, with the decision points and failure paths spelled out. That is the whole definition, and it is deliberately narrow: if a document does not tell a person what to do next, it is not functioning as an SOP whatever the cover page says.

The test is blunt. Hand the document to a competent clinician who has never worked in your building and ask them to perform the task using only that page. If they have to ask something it should have answered — which room, which product, whose signature — it is incomplete. Most med spa SOPs fail this not because they are wrong but because they are abstract: they describe a category of activity rather than the activity.

SOP vs. policy: the rule versus the execution

A policy states a rule and, ideally, the reason behind it. Every patient receives a good faith exam by a qualified clinician before any medical treatment is performed. That is a policy. It is a single sentence, it establishes a standard, and it does not tell anyone how to comply with it.

The SOP makes the policy operational. Who performs the exam. Whether telehealth is permitted in your state. Which form captures it and where that form lives in the chart. What the front desk does when a patient arrives and no exam is on file.

Practices routinely have the first and not the second. A binder of policies does nothing in an investigation, because an investigator is not asking whether you believe in good faith exams — they are asking whether one happened for the patient in the complaint. For the governing rulebook layer specifically, see the med spa policy and procedure manual guide.

SOP vs. protocol: the clinical content versus the workflow

In clinical usage, a protocol is the medical substance: the drug, the dose, the dilution, the injection depth and plane, the device settings, the contraindications. It is the part your medical director is professionally exposed by.

An SOP wraps that protocol in the operational reality of your practice. The protocol says reconstitute with 2.5 mL of preservative-free saline. The SOP says who reconstitutes, where the vial is logged, how the date is marked, how long the reconstituted product is usable here, and who checks the expiration before the injection.

Most operators say "protocol" for the treatment document and "SOP" for the operational one, and no regulator has written up a practice for using the wrong noun. For the inventory organized around clinical protocols by service line, our companion piece What Protocols Does a Med Spa Need? The Full 2026 List takes that angle.

Why Regulators, Carriers, and Medical Directors All Ask for Your SOPs

Written procedures are demanded by four separate parties for four different reasons, and only one is the government.

State boards: the SOP is the delegation instrument

In most states a nurse injector or aesthetician is not independently authorized to perform the medical acts a med spa sells. They perform them under delegation from a physician or, in full-practice-authority states, an advanced practice nurse — and the written protocol is frequently the mechanism granting that delegation. Without it the delegation may not exist, which means the treatment was the unlicensed practice of medicine however well it was performed.

Texas made this explicit: Texas Medical Board Rule 169.28, effective January 9, 2025, recognizes non-surgical cosmetic procedures as the practice of medicine, requires all delegation to be in writing, and adds physician-identification posting requirements. Indiana went further — Senate Bill 282, signed March 5, 2026, established the country's first comprehensive med spa framework, with most provisions effective July 1, 2026, facility registration due by January 1, 2027, a designated supervising practitioner per location, and 15-day adverse event reporting.

The direction of travel is consistent even where statutes differ: blanket standing orders covering "all qualifying patients" are being replaced by an expectation of individualized, documented orders following a good faith exam on that specific patient. Your SOP set has to reflect that shift or it describes a model regulators have already moved away from.

Malpractice carriers: the SOP is an underwriting artifact

The audience most operators do not see coming. Carriers writing aesthetic practices increasingly request sample protocols during underwriting, and the response shapes the quote — a practice with no written SOPs can be declined, rated higher, or issued a policy with exclusions around the service lines it cannot document. The sharper risk is on the back end: if a claim arrives and the carrier can establish no written standard existed at the time, coverage arguments open up that otherwise would not. More in our med spa malpractice insurance guide.

Medical directors: the SOP is the scope of what they are agreeing to

A medical director signing a supervision agreement accepts liability for clinical activity they will mostly not observe, and the SOP set is the only concrete description of what that activity is. A director who signs without a protocol library has agreed to an unbounded obligation, and the good ones know it. Expect a serious one to ask for the set before signing, require changes, and want a defined path for approving new services. If yours never asked, that is a signal; see the complete guide to med spa medical directors.

Plaintiff attorneys: the SOP is the standard you set for yourself

In litigation your written procedure becomes the yardstick, and it cuts both ways. A protocol your staff followed is strong evidence care met the standard. A protocol your staff did not follow is worse than none. A document requiring a 14-day post-treatment call from a licensed nurse, in a practice where that call happens 40% of the time, has manufactured a documented failure rate. Write the protocol you will meet.

The Full SOP Inventory: Every Document a Med Spa Needs, by Category

Nothing below is a legal requirement in every state — no state publishes a required-SOP list — but every document named corresponds to a service line or a risk a med spa either has or does not have. Cross off what you do not offer and the remainder is your build list. Counts assume one SOP per service, the structure that survives inspection best: bundling six injectables into one "injectables protocol" consistently causes problems, because the contraindications and complication paths for Kybella and Sculptra have almost nothing in common.

Injectables — 10 documents

Highest volume, highest complaint rate. Each product family needs its own document because the failure modes are distinct.

• Botulinum toxin SOP — units by area, dilution standard, brand-switching rules across Botox, Dysport, Xeomin, and Daxxify, ptosis management
• Dermal filler SOP — product-to-plane mapping, cannula vs. needle criteria, danger-zone anatomy, escalation to the vascular occlusion pathway
• Lip filler SOP — volume limits and vascular anatomy differ enough to warrant its own document
• Sculptra (PLLA) SOP — reconstitution volume and hold time, depth, massage instruction, nodule management
• Kybella SOP — injection grid, dysphagia and marginal mandibular nerve counseling, session spacing
• Hyperdilute Radiesse SOP — dilution ratio, off-face use documentation, biostimulator counseling
• PDO thread lift SOP — sterile field, vector planning, extrusion and dimpling management
• Botox for hyperhidrosis SOP — a therapeutic indication with different dosing and documentation
• Aquagold / microchanneling SOP — device handling, compound preparation, single-use documentation
• Intralesional steroid SOP — concentration, atrophy risk counseling, frequency limits

Every filler document must point at the vascular occlusion SOP, and you must be able to show hyaluronidase is stocked, in date, and that staff know where it is — see our hyaluronidase guide.

Skin and laser — 9 documents

Energy-device work carries the most state variation in who may operate the device, and the SOP is where that gets written down for your state.

• Microneedling SOP — depth by zone, single-use cartridge policy, the medical-vs-cosmetic depth line your state draws
• RF microneedling SOP — energy and depth matrix, insulated vs. non-insulated needles, Fitzpatrick-based settings
• Chemical peel SOP — agent and concentration ladder, neutralization, who may perform each depth tier
• Laser hair removal SOP — fluence and pulse width by Fitzpatrick type, test spot requirement, eyewear protocol
• IPL photofacial SOP — filter selection, cooling, screening for sun exposure and photosensitizing medications
• HydraFacial SOP — tip handling, serum sequence, between-patient disinfection
• Exosome therapy SOP — sourcing documentation and regulatory-status disclosure, which is the entire risk here
• PRF SOP — draw, spin parameters, chain of custody from tube to patient, same-day use
• Dermaplaning SOP — blade handling and disposal, contraindication screening, licensure boundary

Every laser document should reference a facility-level laser safety SOP: safety officer designation, eyewear by wavelength, plume evacuation, key control. Several states regulate this separately from the treatment.

Weight loss and GLP-1 — 10 documents

The fastest-moving category, and where 2026 rule changes bite hardest.

• Semaglutide SOP — titration ladder, sourcing documentation, GI adverse event management, pancreatitis and gallbladder red flags
• Tirzepatide SOP — separate titration schedule, separate adverse event profile, separate sourcing documentation
• Liraglutide SOP — daily-dosing workflow, operationally different from weekly agents
• Weight loss monitoring SOP — baseline labs, weigh-in cadence, dose-escalation and stop criteria
• Good faith exam SOP — the most-cited document here: who performs it, telehealth conditions, what is recorded
• NAD+ IV SOP — infusion rate, flushing and nausea management, why slow titration is not optional
• IV vitamin infusion SOP — formulary, compounding source, sterility, infiltration
• Glutathione IV SOP — sourcing, dose ceiling, sulfur-sensitivity screening
• MIC / lipotropic injection SOP — formulation documentation, site rotation, frequency limits
• B12 IM injection SOP — the lowest-acuity document here and the one most often missing entirely

The regulatory context changed twice. The FDA resolved the tirzepatide shortage in December 2024 and the semaglutide shortage in February 2025, ending the shortage-based compounding pathway; then on April 30, 2026 it proposed removing semaglutide, tirzepatide, and liraglutide from the 503B bulks list, closing large-scale compounding. Sourcing documentation inside each SOP has to reflect where your product actually comes from today — our 503A vs. 503B compounding guide works through what is left.

Hormone therapy — 10 documents

Longitudinal care, controlled substances, and lab-driven dosing — a different burden from anything else on a med spa menu.

• Female HRT SOP — candidate screening, route selection, risk counseling, monitoring intervals
• Male TRT SOP — diagnostic threshold and confirmatory testing, hematocrit monitoring, fertility counseling
• Hormone pellet therapy SOP — sterile insertion, dosing calculation, extrusion and infection management
• Thyroid protocol SOP — testing panel, treatment thresholds, referral criteria
• DHEA supplementation SOP — indication, monitoring, interaction screening
• Hormone good faith exam SOP — deeper than the aesthetic version, with a full history and physical
• Hormone lab monitoring SOP — which panels, at what intervals, with what action thresholds
• Hormone informed consent SOP — including off-label and compounded-product disclosure
• DEA controlled substance SOP — testosterone is Schedule III: ordering, storage, perpetual inventory, diversion response
• Patient monitoring and follow-up SOP — the continuity document that makes the rest defensible

If you store testosterone on site, that controlled substance SOP is not optional paperwork — DEA registration, lockable storage, and a running inventory are enforceable independent of your state board.

IV therapy and body contouring — 10 documents

Device-heavy, and in the IV lines the category with the most consequential enforcement history.

• CoolSculpting / cryolipolysis SOP — applicator selection, treatment mapping, paradoxical adipose hyperplasia disclosure
• Emsculpt / HIFEM SOP — screening for implanted metal and devices, intensity ramp, session spacing
• Ultherapy SOP — depth and transducer selection, nerve-avoidance mapping, treatment line documentation
• RF body tightening SOP — temperature endpoint, thermal monitoring, burn prevention
• Acoustic wave / shockwave SOP — indication documentation, intensity, treatment course
• Sclerotherapy SOP — sclerosant and concentration, session volume limits, ulceration management
• PRP hair restoration SOP — draw and spin parameters, injection grid, series schedule
• RF vaginal rejuvenation SOP — active FDA marketing-claim exposure, so claims language belongs in the document
• HRT/TRT delivery SOP — the operational injection document pairing with the hormone protocols above
• NAD+ injection SOP — the IM and subcutaneous route, distinct from the infusion protocol

Elective IV therapy deserves particular attention. Texas House Bill 3749, known as Jenifer's Law, took effect September 1, 2025 after a patient death following an infusion at a Texas med spa, restricting who may administer elective IV therapy to physicians, PAs, APRNs, and RNs. If IV is on your menu, your SOP has to name the credential required to start the line — and your staffing has to match it.

Operations — 5 to 10 documents

The category owners under-build, and the one investigators open first, because it holds the evidence of a functioning system.

• Patient intake and consent SOP — registration, history, treatment-specific consent, photography consent, and what happens when consent is incomplete
• Staff training protocol SOP — onboarding sequence, competency verification, documentation format, re-verification cadence
• Medical director supervision SOP — chart review sampling rate, on-call terms, protocol approval, new-service authorization
• Supply and inventory SOP — ordering, receiving, cold chain, lot and expiration tracking, DSCSA sourcing verification
• Aftercare and follow-up SOP — instruction delivery, contact windows, escalation triggers
• Infection control SOP — hand hygiene, surface disinfection, instrument reprocessing, sharps and biohazard
• Bloodborne pathogens exposure control plan — a named OSHA obligation with its own annual review requirement
• HIPAA and privacy SOP — notice of privacy practices, minimum necessary, breach notification, business associate agreements
• Records and retention SOP — what is kept, where, for how long, how it is destroyed
• Incident reporting SOP — the path an adverse event travels from chair to medical director to carrier

Counterfeit and gray-market product is a live enforcement theme, and the supply SOP is where you show you buy from authorized distributors — see our DSCSA compliance guide.

Emergency protocols — 8 documents

The smallest category, the most likely to be missing, and the only one read during the event rather than before it.

• Vascular occlusion SOP — recognition signs, hyaluronidase flooding with dose and re-dose interval, hourly reassessment, ophthalmology and ED referral triggers
• Anaphylaxis SOP — epinephrine dose and route by weight, second-dose timing, positioning, airway, mandatory EMS activation
• Syncope management SOP — the highest-frequency event in an injectables practice: positioning, vitals cadence, and what separates vasovagal from something worse
• Infection response SOP — presentation timeline, culture, empiric coverage, biofilm and atypical mycobacteria, referral threshold
• Laser burn injury SOP — immediate cooling, wound grading, documentation and photography, follow-up
• Adverse reaction SOP — the catch-all for events that do not fit a named pathway
• Emergency supply checklist SOP — contents, location, monthly expiration check with a signed log
• When-to-call-911 SOP — explicit, non-negotiable triggers, because hesitation is the documented failure in most of these cases

These need a different format: single laminated pages at the point of care, not a binder in the office. If your vascular occlusion protocol requires unlocking a cabinet and finding a tab, it will not be read during a vascular occlusion. The emergency protocol checklist covers the build.

How Many SOPs Does Your Practice Actually Need?

There is no regulatory quota. The arithmetic takes ten minutes: count the distinct services on your menu — distinct meaning a different product, device, or route of administration, not a different marketing name. Add the eight emergency documents, which every practice needs regardless of menu, because syncope and anaphylaxis are possible anywhere a needle enters a person. Add seven to ten operational documents. That is your number.

Practice type	Treatment SOPs	Emergency	Operational	Total
Injectables-only studio	6–10	8	7	21–25
Skin, laser, and injectables	14–18	8	8	30–34
Aesthetics plus weight loss	20–26	8	9	37–43
Full-service including hormones and IV	40–45	8	10	58–62

The failure mode is not too few documents overall. It is zero documents covering one high-risk service line — usually the newest one, added after the library was built and never folded back in. Weight loss is the classic case: practices that assembled a solid injectables and laser library in 2023 added GLP-1 services in 2024 and never wrote the monitoring, sourcing, or good faith exam documents that line requires. That is exactly what an investigator finds first, because it is the service the complaint is usually about.

So adding a service is a documentation event, not just a clinical one. Before the first patient: the protocol is written, the medical director signs it, and the staff performing it are trained and signed off. Treating that as paperwork to catch up on later is describing, in advance, the finding an investigator will write.

Anatomy of a Good SOP: What Has to Be in the Document

A defensible SOP has a predictable skeleton. The format does not matter — plenty of good libraries are plain Word documents — but the elements do, because each one answers a question that gets asked when something goes wrong.

The eleven required elements

1. Title and document number. A stable identifier such as INJ-002 or EP-001. Without numbering you cannot cross-reference, and cross-referencing is what turns a stack of files into a system.
2. Version number and effective date. Not "last edited," which your file system already tracks and nobody will accept as evidence.
3. Purpose and scope. Two sentences. What this covers and what it does not — the boundary is the useful half, because it points the reader at the right document.
4. Roles and qualifications. Named by credential, not by person: "performed by an RN, NP, PA, or physician." Personnel change; credentials are the durable statement. This is the field that makes your SOP a delegation record.
5. Patient selection and contraindications. Absolute and relative, separated, with the relative list naming who decides and how the decision is documented.
6. Required pre-treatment steps. Good faith exam status, consent, photography, medication and allergy review, pregnancy screening, and the test spot where the device requires one.
7. The procedure itself, numbered. Products, doses, dilutions, depths, settings, sequence, timing. Numbered steps, not narrative — this is the part read while someone is holding a syringe.
8. Complication and escalation path. Named signs, the immediate action, and the document to jump to: "if blanching, pain out of proportion, or livedo appears, stop and go to EP-001."
9. Documentation requirements. What goes in the chart, on which form, by whom. An SOP that does not close the loop into the chart cannot be verified afterward, and unverifiable compliance is indistinguishable from none.
10. Aftercare and follow-up. What the patient is given, what they are told, and the contact window with an owner attached.
11. Approval block. Printed name, credential, signature, date. Most often missing, and carries the most weight.

What to leave out

Background, rationale, and literature review. They lengthen the document, date faster than the procedure does, and push actionable content below where a stressed reader looks. If your medical director wants the evidentiary basis recorded, put it in a separate appendix.

Version Control, Sign-Off, and Review Cadence

The most common defect we see is not a badly written protocol. It is a well-written protocol nobody can prove was in effect on the day in question.

Version control that survives a records request

Every document carries a version number and effective date on the page itself, not just in file metadata. When a protocol is revised, the previous version is archived rather than overwritten — you need to produce the document as it existed eighteen months ago, because that is the one that governed the treatment now in dispute.

A one-line change log at the foot of each document does most of the work: version, date, what changed, who approved. It is the difference between "here is the protocol in force that day, signed, with the training records for the clinician who performed it" and "here is our current protocol, which I believe is similar."

Sign-off: what actually needs a medical director signature

Anything clinical. Every treatment protocol, every emergency protocol, the good faith exam SOP, the delegation and supervision SOP, and any document touching a prescription drug or an energy device. In many states that signature is the legal instrument creating the delegation, which is why an unsigned clinical protocol is functionally no protocol.

Administrative documents — opening and closing, scheduling, cancellations, social media — do not need clinical approval and should not wait on it. Splitting the library this way keeps the clinical set current, because the director is only asked to re-sign what genuinely requires their judgment. Re-signature is required on any substantive revision: a typo fix is not substantive, a dose or scope change is.

Review cadence and the five triggers

Annually at minimum, plus immediately on any of five events: a new service or device, a staffing change that alters who performs what, a state rule change, an adverse event or near miss, and a product or supply change such as a new toxin, filler line, or compounding source.

One document has a firm federal floor. OSHA's bloodborne pathogens standard at 29 CFR 1910.1030(c)(1)(iv) requires the written exposure control plan to be reviewed and updated at least annually and whenever tasks or positions change, with documented consideration of safer medical devices and documented input from non-managerial employees providing direct patient care. That last clause is routinely missed — the review has to show you asked the people doing the work. Full text is on the OSHA 1910.1030 page.

Who Writes Your SOPs — and Who Has to Approve Them

Authorship and approval are different jobs, and conflating them is why so many libraries stall. The person best placed to write the operational detail is rarely the person whose signature the document needs.

The realistic division of labor

The lead clinician who performs the service writes the first draft of its treatment protocol. They know the products, the settings, the sequence, and what goes slightly wrong on a normal Tuesday. A medical director drafting from outside will produce something generic. The practice manager or owner writes the operational documents, because those describe how the building runs.

The medical director reviews, corrects, and signs everything clinical. Their job is not to write; it is to judge whether what is written meets the standard of care, is appropriately delegated for your state, and is something they will attach their license to. A good director sends drafts back — that is the process working.

Practices go wrong waiting for the director to originate documents. Directors are typically part-time, often covering several practices, on a retainer that does not contemplate drafting forty protocols. Send drafts to correct and the work moves. If you are still selecting one, our guide on how to find a med spa medical director covers what to ask about protocol involvement before signing.

What a signature actually certifies

Three things, worth stating explicitly so both sides understand the scope: that the clinical content meets the standard of care; that the delegation described is permissible in your state for the credentials named; and that the escalation pathway is medically sound. It does not certify that staff will follow the document. That obligation is yours, and it is discharged through training.

Training Staff Against Your SOPs and Documenting Competency

A signed protocol nobody has been trained against describes a practice you do not run. Regulators know this, which is why the training file is requested alongside the protocol in almost every investigation — and why the gap between the two is where findings come from.

Acknowledgment is not competency

Most practices have some form of acknowledgment: a sheet where staff initial that they have read the protocols. That is a useful record and it is not competency. Acknowledgment establishes that a document was distributed; competency establishes that the person can perform the procedure correctly, which requires observation. When a board asks why an unqualified person performed a treatment, "she signed that she read it" is a weaker answer than "she was observed performing it three times by the lead injector, who signed off on [date]."

What a defensible training record contains

Six fields, fitting on one page per employee per protocol: name and credential; document number and version; date; trainer's name and credential; method — read and discussed, demonstration, supervised performance, or independent performance observed; and both signatures.

Keep them by employee, not by protocol. A records request is almost always about a person and an incident, and a per-employee file produces the whole picture in one motion. Re-training follows the same triggers as protocol review: a record referencing version 1.0 of a document now at version 3.0 dates precisely when your training stopped.

The competency areas most often undocumented

Emergency response leads. Practices document injection training thoroughly and never document that the same clinician can locate the hyaluronidase, calculate the flooding dose, and state the escalation threshold. Run drills at least annually and write them up: date, scenario, participants, what went wrong, what changed. A drill log is disproportionately persuasive because so few practices keep one.

Device operation is second. Many states tie laser operation to specific training, and "the rep trained us at install" is not a record. Get the certificate, file it, note the device model. Our guide to med spa staff training requirements breaks down what the law demands by role.

How SOPs Are Used in an Inspection or a Board Complaint

Operators tend to imagine an inspection as a walkthrough — someone opening cabinets, checking sharps containers. That happens, but it is not where findings originate. Findings come from a documents comparison.

The records request comes first

Most board matters open with a letter, not a visit. The request is narrow: the written protocol governing the service at issue, the delegation or supervision agreement in force on the date of treatment, the training file for the person who performed it, and the complete chart. Sometimes the medical director's chart review log. Deadlines are measured in days.

A practice that can produce those items in the versions in force on the relevant date is in a fundamentally different position from one needing three weeks to reconstruct them. Speed is itself evidence, and investigators read it that way.

The comparison is where findings are made

The investigator lays the documents side by side and looks for divergence. The protocol says the good faith exam is performed by the NP; the chart shows no exam. The protocol names an RN as the minimum credential; the training file shows an aesthetician license. The protocol is at version 3.0 dated last month; the treatment was eighteen months ago and you cannot produce what governed it.

Almost every finding is a mismatch, not an absence — which is why an aspirational protocol is actively dangerous. You supplied the standard you will be measured against and set it above what you do. Our med spa inspection guide walks through what boards check, in the order they check it.

When the complaint names your medical director

A complaint about a treatment is frequently also a complaint about supervision, and the director's license is in play alongside yours. What protects them is the signed protocols, the chart review log, and the record of new-service approvals. A director who signed a supervision agreement and never saw a protocol has essentially no answer to the claim that oversight was nominal — and paper-director arrangements are an explicit enforcement target in multiple states. Raise it with them directly; it aligns your interests. See what happens when a board complaint names your medical director.

Records, Retention, and Where Your SOPs Actually Live

Two retention questions get confused constantly. Patient records have state-mandated retention periods. SOPs have no such statutory period in most states — and should be kept longer than the records anyway, because their function is to prove what standard governed care at a past date.

How long to keep superseded versions

At least as long as your state's patient record retention period, and preferably longer. If a patient can bring a claim about a treatment performed seven years ago, you need the protocol as it existed seven years ago. Archiving is cheap; reconstruction after the fact is impossible and looks exactly like what it is.

Superseded versions belong in a clearly separated archive — a folder named for the year, never mixed with current documents. The failure mode is an investigator being handed an outdated protocol because it was sitting in the active folder, which turns a records production into a finding.

Where the documents physically live

A working library needs three locations, because each serves a different reader. The master set lives in one controlled digital location, access-controlled, with only the current approved version in the active folder. Point-of-care copies live in the room: emergency protocols laminated at each treatment station, treatment protocols accessible where the treatment happens. And a complete offline copy exists somewhere retrievable, because the day your practice management system is down is a plausible day to need the anaphylaxis protocol.

Where documents contain patient information — training records and incident reports often do — HIPAA safeguards apply to storage. Federal penalties were re-indexed effective January 28, 2026, with the lowest tier now running from $145 per violation up to $73,011 and an annual cap of $2,190,294 for identical violations, per the Federal Register notice. The records and retention guide covers periods by state.

Building From Scratch vs. Adapting a Template

The honest answer is not the one either side of the market gives. Templates are not a shortcut around the work, and from-scratch authorship is not automatically more defensible. What differs is where your hours go.

From scratch: 60 to 120 hours, and the hours are not the hard part

For a 30-document library, expect two to four hours per treatment protocol including research, one to two per operational document, then the review cycle with your medical director on top — 60 to 120 hours of internal time over eight to sixteen weeks, because it competes with running the practice.

The genuine advantage is that the document describes exactly what you do, in your language, with your product list. The genuine risk is omission: a blank page does not tell you what you forgot. The documents most often missing are the unglamorous ones — supply and sourcing, incident reporting, when-to-call-911, emergency supply expiration checks — precisely because nobody sits down intending to write them, and they are disproportionately what investigators ask about.

Consultant-built: $2,500 to $8,000, four to eight weeks

A healthcare compliance consultant or attorney produces a state-accurate library and, in the attorney's case, a defensible read on your delegation structure — money well spent on the structural questions if you are in a CPOM-strict state, multi-state, or running a management services organization. The cost is calendar time, and it produces a library you did not write, which creates the same staleness problem as a template if nobody internally owns maintenance.

Template-based: days, and the work moves to localization

A professionally built template set gives you a complete, correctly structured draft of every document in days, including the ones you would have forgotten. Nothing in any state rule requires original authorship; what is required is accuracy for your practice, correctness for your state, and medical director approval.

The work does not disappear — it relocates, and it is roughly 15 to 30 hours rather than 60 to 120. You localize state scope-of-practice language, insert your products and device settings, name your credentials and roles, delete services you do not offer, and route the clinical set to your director for signature.

The failure mode is worth naming plainly: a template deployed unmodified is worse than nothing. It documents a practice that is not yours, and every divergence is a mismatch waiting to be found. If you are not going to localize, do not buy.

Approach	Cash cost	Your hours	Time to complete	Main risk
From scratch	$0	60–120	8–16 weeks	Silent omissions
Consultant or attorney	$2,500–$8,000	10–20	4–8 weeks	No internal ownership
Template, localized	$197–$997	15–30	1–3 weeks	Shipped unmodified

Most practices under about eight providers end up on the template path with an attorney reviewing the delegation structure specifically — the piece that is genuinely state-legal rather than clinical. Our med spa SOP library is built for that workflow: complete drafts by category, structured for localization, approval blocks already in place.

Ten SOP Failures That Turn Into Enforcement Actions

The recurring patterns, ordered roughly by how often they appear in the enforcement record.

1. No protocol for the newest service. The library was built once and the menu kept growing. Weight loss and IV therapy are the usual gaps.
2. Unsigned clinical protocols. Written, circulated, never approved — which in delegation states can mean the treatments were performed without valid authorization.
3. Blanket standing orders with no individualized order. A protocol covering "all qualifying patients" and nothing patient-specific in the chart. The fastest-moving enforcement theme of the last two years.
4. Training records that stop. Everyone trained at onboarding, nothing since, protocols revised twice in the interim.
5. Protocol-to-chart mismatch. The document requires a step the chart never shows.
6. Credential drift. The protocol names an RN minimum; the schedule shows someone else. Common after a staffing change nobody propagated into the documents.
7. No superseded versions retained. Cannot prove what governed care at the relevant date.
8. Emergency protocols not at the point of care. Present in the binder, absent from the room, unread during the event.
9. No supply or sourcing documentation. Cannot show product came from an authorized distributor.
10. Aspirational content. Follow-up calls, photography, or review steps written as required and performed inconsistently.

Nine of these ten are consistency failures rather than absences — the documents exist and have drifted. That is good news, because drift is fixable with a scheduled review. Our breakdowns of why med spas get shut down and the violations regulators actually find show how these escalate when left alone.

Your 90-Day SOP Build Plan

Sequenced by risk, which means the least enjoyable documents come first.

Days 1–14 — Emergencies. All eight documents. Laminate them, put them at the point of care, confirm the supplies each references are stocked and in date.

Days 15–30 — Delegation and the good faith exam. The good faith exam SOP, the medical director supervision SOP, and written delegation for every service, all signed. This layer determines whether your treatments are authorized at all.

Days 31–60 — Treatment protocols, highest volume first. Whatever you do most and whatever carries the most risk — for most practices that is toxin, filler, and any GLP-1 line.

Days 61–75 — Operations. Intake and consent, supply and inventory, records and retention, infection control, incident reporting, and the OSHA exposure control plan.

Days 76–90 — Training and the review calendar. Train every staff member against every document applying to their role, document it, set the annual review month, and run one emergency drill.

Then it is maintenance: the annual review block plus the five triggers, a fraction of a day per month. And it is current, not merely present, that a records request tests.

Disclaimer: The information provided by MedSpa Standards is for educational purposes only and does not constitute legal, medical, or professional advice. Regulations vary by state and change frequently. All documents should be reviewed and customized by your Medical Director and legal counsel to ensure compliance with applicable state and federal regulations.

Published: February 2026 | Last Updated: August 7, 2026 | Category: Compliance Guides | Tags: med spa SOPs, standard operating procedures, med spa protocols, medical spa compliance, med spa templates