Med Spa Standing Orders and Written Protocols: The Document, Element by Element

Ask a med spa owner whether they have standing orders and you will usually get a confident yes, followed within thirty seconds by a document that is not one. Sometimes it is a treatment protocol — an excellent one, with dilution ratios and injection depths — that authorises nobody to do anything. Sometimes it is a medical director agreement, which establishes a relationship but never names an act. Occasionally it is a single page headed Standing Orders saying the medical director approves all treatments at the practice, signed once, three years ago, by a physician who no longer answers the phone.

None of these is a standing order, and the distinction is not pedantic. The standing order supplies legal authority for a delegated clinical act. When an investigator asks the nurse who injected on Tuesday on whose order did you do that, the standing order is the answer — or its absence is the finding. Every other document in the binder describes, instructs, governs or contracts. Only this one authorises.

This guide is about the document: what a compliant one contains, who signs it, how often it is re-signed, how it is versioned, and how it reads to someone official. Which states require standing orders varies, and that detail lives in our fifty-one jurisdiction regulations reference. Halfway down is a fully written specimen order for neurotoxin injection by a registered nurse, annotated clause by clause.

What a Standing Order Actually Is

Start with the definition regulators use. It is more specific than the way the phrase is used in the market, and the specificity is the point.

The regulatory definition, clause by clause

The Texas Medical Board's rules on standing delegation orders — the chapter is titled exactly that, at 22 Texas Administrative Code chapter 193 — define them as written instructions, orders, rules, regulations or procedures prepared by a physician and designed for a patient population with specific diseases, disorders, health problems or sets of symptoms, intended to provide authority for and a plan for use with patients presenting themselves before being examined by a physician, and expressly distinct from specific orders written for a particular patient.

Read slowly, that gives you the anatomy. Prepared by a physician tells you who signs. Designed for a patient population tells you the order must define a population — the defining structural feature, and the element most often missing. Provide authority for and a plan tells you the authorisation half is what makes it an order rather than a protocol. Distinct from specific orders tells you its limit: a class permission, not a judgment about the person in the chair.

Standing order, standing delegation order, protocol, standardized procedure

The vocabulary is genuinely inconsistent by state. Texas says standing delegation orders and prescriptive authority agreement. Georgia says nurse protocol agreement. California's nursing board says standardized procedures, specified in eleven elements at 16 CCR 1474. Name yours the way your state's rule names it and cite the rule in the header: one line, and it removes an entire category of argument about whether what you produced is what the rule asked for.

Standing Order vs SOP vs Policy Manual vs Delegation Agreement

This boundary decides whether a compliance binder is complete or merely thick. Four documents, four jobs, four authors, four audiences. Conflate any two and you get a gap you cannot see, because the binder looks full.

The one-sentence test

A standing order answers who may do this, to whom, on whose authority. An SOP answers how is this done, step by step. A policy and procedure manual answers how does this business govern itself. A delegation or supervision agreement answers what is the contractual relationship between the delegating clinician and the delegate. A document that does not clearly answer one of those four is probably answering two of them badly.

Why an SOP cannot carry the authorisation

The commonest substitution error is to write an outstanding treatment protocol and assume it authorises the treatment. An SOP is addressed to whoever performs the task and is silent on whether that person may. Our standard operating procedures guide covers what a good SOP does contain, the inventory a practice needs and how to build the set — and stays out of the authorisation question, because that question belongs here.

Why a policy manual cannot carry it either

The manual is the governance layer: privacy, employment and credentialing, marketing and photo consent, records retention, safety. Its clinical governance policies usefully describe the delegation framework, but a policy saying the practice delegates in accordance with state law is not itself a delegation. Our policies and procedures manual guide covers the full table of contents and the policy families; treat this page as the clinical-authority chapter beside it.

Why the agreement is the frame, not the instrument

A delegation or supervision agreement sets up the relationship: who supervises, how often, what chart review looks like, what happens on termination. Some states require it filed. Georgia's nurse protocol agreements are executed under O.C.G.A. § 43-34-25 and its Chapter 360-32 rules, filed with the Georgia Composite Medical Board within thirty days, and carry their own chart-review obligations. Those are relationship obligations, not act authorisations: a practice can satisfy every one and still hold no valid standing order for the act being performed.

How the four documents wire together

The standing order names the SOP that governs technique. The SOP header carries the order number authorising the task. The manual's clinical governance chapter lists current orders by number. The delegation agreement recites that the delegating clinician will issue and maintain them. Four cross-references, and the difference between a binder and a system.

Which Board Is Speaking, and Why It Changes the Answer

A reliable way to get standing orders wrong is to read a rule from the wrong regulator and apply it confidently. In aesthetics the same act is frequently governed by two boards at once, and they need not agree.

Medical boards govern the delegation of medical acts

Where the act is the practice of medicine — and injecting a neurotoxin, firing a Class IIIb or higher laser, or prescribing a weight-management drug usually is — the medical board's delegation rules decide whether it may be delegated at all, to whom, and on what terms. Colorado's medical board rules at 3 CCR 713-1.17 govern delegation of medical services to unlicensed persons under C.R.S. § 12-240-107(3)(l), and define medical-aesthetic services to expressly include Class IIIb or higher lasers, radiofrequency devices, intense pulsed light, any technique resulting in the structural alteration of human tissue, and cosmetic injections. Delegated medical-aesthetic services there are to be routine, technical services whose performance does not require the special skills of a licensed physician.

Nursing boards govern what the delegate may accept

The physician's authority to hand out an act and the nurse's authority to accept it are separate questions decided by separate boards, and the standing order sits at the intersection. California's standardized procedure rule lives in the Board of Registered Nursing's regulations, not the medical board's. Arizona's position on medical aesthetic procedures is set out in a State Board of Nursing advisory opinion, which contemplates a written provider order from an MD, DO or NP before a Level II or Level III procedure, in addition to an initial face-to-face good faith examination. Always ask which board issued the rule you are relying on.

Where the position is unsettled, say so

Whether an act may be delegated to an unlicensed medical assistant, whether a device class sits inside the practice of medicine, and whether a remote prescriber may order an in-person aesthetic treatment are all live and state-dependent. Where your state has not spoken, scope the order to what you can defend, note the open question in the review record, and revisit it annually. Our remote and telehealth medical director guide covers the supervision-at-a-distance version of the problem.

Anatomy of a Compliant Standing Order, Element by Element

There is no single national specification. But the rules that do address the document — Texas's standing delegation order provisions, California's eleven-element standardized procedure rule at 16 CCR 1474, the CMS hospital requirements at 42 CFR 482.24(c)(3), and the state agreement regimes in Georgia and Texas — converge on a recognisable element set. Fifteen elements in four blocks; a document missing any of the first twelve has a hole an investigator can walk through. The specimen in the next section shows each one written out.

Block one: the header, elements 1 to 3

1. Document identifier and title, so a chart entry, an SOP header and a training record point at the same document unambiguously. 2. Issuing clinician and authority block — name, credential, licence type, licence number and state, plus the rule and board it is issued under; Texas's minimum requirements call for the order to be in writing, dated and signed by the physician. 3. Effective date, review date and status, at the top rather than in a footer, because an inspector's first question is whether the order was in force on the date of the treatment.

Block two: the scope, elements 4 to 7

4. Purpose and scope, including explicit negative scope — what this order does not authorise. 5. Patient population, the defining element and the one most commonly absent; without it the document is a blanket authorisation, which is exactly what regulators have been narrowing. 6. Authorised delegates, named or a defined class, with a roster reference — California's rule requires a method of maintaining a written record of those authorised. 7. Competency prerequisites: the training and experience required before acting, and the mechanism for evaluating competence initially and on an ongoing basis. Our staff training and competency guide covers how to evidence it.

Block three: the clinical content, elements 8 to 12

8. The authorised act, with drug and device parameters — product, concentration, dose range per site, session maximum, interval, device settings, regions. An order saying neurotoxin as clinically indicated has delegated clinical judgment rather than a technical act, which is what most frameworks say may not be delegated. 9. Conditions precedent: a current documented evaluation of that patient by an authorised clinician, signed consent, a reviewed health history, no applicable exclusion, and the required supervision in effect. The individual evaluation belongs here as a condition in a line or two — it is a trigger the order points at, and our good faith exam by state guide is where it is worked through. 10. Exclusion criteria, absolute and relative, defining the outer edge of the delegated population. 11. Escalation, communication and stop rules, another enumerated California element. 12. Supervision level and availability, in the state's own vocabulary: immediate, direct, on-site and available for consultation are terms of art whose meanings differ across states.

Block four: the governance, elements 13 to 15

13. Documentation requirements — what the delegate records and where, including the standing order number in the chart entry; retention itself sits in the records policy, and our records retention guide covers how long. 14. Review and revision method: how the order was developed and approved, how it is revised, and the cadence. This is the first of Texas's minimum requirements and the element practices most consistently skip, because it feels like a document about the document — which is precisely why it demonstrates governance rather than asserting it. 15. Signature block and delegate acknowledgement. The second half is not universally required and is close to universally advisable, because in a complaint the delegate's board will ask what authority they believed they held.

A Worked Specimen: Standing Order for Neurotoxin Injection by an RN

What follows is a complete standing order for one named treatment — onabotulinumtoxin A injection to the glabellar complex, lateral canthal lines and frontalis by a registered nurse under physician delegation — annotated clause by clause.

Read it as a specimen, not a template to sign. The clinical parameters are illustrative, the authority line is a placeholder for the actual rule and board in your jurisdiction, and the names and licence numbers are invented. What transfers is the structure and the specificity.

What to do with the specimen

Put your current document beside it and mark the sections you cannot find. In most practices the missing four are the same: the population definition, the delegate roster with dates, the review-and-revision method, and the delegate acknowledgement. None requires new clinical work, only a decision written down. Then repeat for every act your practice delegates, because a standing order set is per-act: one order for neurotoxin does not cover filler, and neither covers the laser.

Who Signs a Standing Order — and Who Cannot

The signature is the operative element. Everything else is description. It follows that who may sign is a licence question, not a role question.

The authorising signature

The clinician whose licence supplies the delegated authority signs — in most med spas the medical director or another physician holding an active, unencumbered licence in the state where the treatment occurs. Out-of-state licensure does not travel, whatever the corporate structure says. Our guide to medical director duties and responsibilities covers what else that role signs up for.

When a nurse practitioner can be the authorising signature

State-dependent, and it turns on two questions in sequence. Does the nurse practitioner hold independent authority to order the act? And does the state route delegation of this act through the medical practice act, in which case a nurse practitioner cannot supply what a physician supplies, or through the nurse practice act, in which case they may? The confident advice circulating in operator groups is most often a correct statement about somebody else's state.

The delegate's signature, and who should not sign

A delegate acknowledgement is not always required and is close to always worth having: it evidences that the delegate read the scope, fixes the date from which they were authorised, and gives them something to hand their own board. Practice managers, lay owners and corporate entities, by contrast, should not sign at all. A non-clinician signature adds no authority, and in a corporate practice of medicine state it supplies an argument that a lay party is directing clinical care.

Review Cadence: How Often the Document Has to Be Re-Signed

The commonest defect in a med spa standing order is not that it is wrong. It is that it is old.

Annual is the defensible default

Where a state speaks, it generally says annually. Georgia requires nurse protocol agreements to be reviewed, revised or updated annually by the delegating physician and the advanced practice registered nurse, with each revision re-executed and filed with the Georgia Composite Medical Board within thirty days. Texas requires a prescriptive authority agreement and any amendments to be reviewed at least annually, dated and signed by the parties, under Occupations Code § 157.0512. The CMS hospital rule requires periodic and regular review for continuing usefulness and safety. Different regimes, one cadence — and where your state is silent, annual review is what a board will expect.

The five triggers that override the calendar

A review date is a floor, not a schedule. Five events should force an out-of-cycle review: a change in state law or board position affecting the delegated act; a change in product, concentration, device or technique; a change in delegates, including a new hire, a departure or a lapsed certification; any adverse outcome under the order; and a change of medical director. The last is handled worst, because a new medical director inherits a binder signed by someone else — and those orders authorise nothing until re-issued on the new physician's licence.

Version Control, Supersession and the Effective-Date Problem

Version control sounds like an administrative nicety until the first time somebody asks what the order said eighteen months ago. Then it is the whole case.

The question is always about a past date

Inspections and complaints are retrospective. Nobody asks whether the order is correct today; they ask what authority governed the treatment on 14 May, whether the person who performed it was authorised then, and whether the parameters used were within the envelope in force. A practice holding only the current version can answer none of those. A practice holding a versioned register answers all three in a minute.

What a standing order register contains

One row per order per version: document number, version, title, issuing clinician, effective date, superseded date, status, delegates authorised during that period, and the location of the executed signature page. Keep superseded versions rather than overwriting. The register is also the natural home for the review log, so version history and review history sit in one place rather than in two files that disagree.

How a Standing Order Is Read in an Inspection

Inspections are documentary. The inspector is not watching you treat; they are reading what you wrote and checking whether it matches what happened.

The three-document trace

The characteristic move is a trace: pick a chart, find the treatment, ask to see the authority for it. That means the chart entry, the standing order in force on that date, and the delegate's competency file. If all three line up, the trace closes; if any link is missing, the questions expand outward to other charts, other services and other staff.

What gets asked when the trace fails

The follow-ups are predictable: on whose authority was this performed, when did this person become authorised, was the supervising clinician available that day, and how many other treatments were performed under the same conditions. That last is the expensive question, because it converts a single-chart finding into a volume finding, and volume drives the size of a penalty. Our med spa inspection guide covers the wider sequence this sits inside.

How a Standing Order Is Read in a Board Complaint

A complaint is not an inspection. The reader is adversarial, the timeframe is a single incident, and the document is examined for what it failed to prevent.

Two licences are in the room

A complaint arising from a delegated treatment characteristically opens two files: the delegate's, at their board, and the delegating clinician's, at theirs. The standing order is the primary exhibit in both, read differently in each. The delegate's board asks whether she acted within the authority she held; the physician's board asks whether the delegation itself was appropriate — whether the act was delegable, whether this delegate was competent, whether the supervision described was the supervision provided. Our guide to medical director board complaints follows that second thread.

The order is read against what actually happened

The comparison is mechanical. Was the patient inside the population? Was the delegate on the roster that date? Were the parameters within section 8? Was the condition precedent satisfied and charted? Did escalation happen as written? Each mismatch is a finding — and a mismatch is worse than a silence, because an order specifying fifteen-minute physician availability at a practice that could not reach anyone for two hours is a documented breach of its own standard.

The ghost medical director problem

The enforcement pattern boards describe most consistently in aesthetics is the physician whose name is on a contract but who has no real involvement. Standing orders are where that shows, because they are dated: a set signed once at opening and never touched, with no review entries and no roster updates through two years of turnover, is a documentary record of absence. The inverse is equally true — a physician with a modest but genuine review history has, in the document set itself, the best evidence that the oversight was real.

Where a Standing Order Stops: The Limits of Blanket Authorisation

The most consequential thing to understand about standing orders is not what they authorise. It is where they run out.

Class authority is not individual authority

A standing order authorises an act for a population. It cannot conclude that the individual in front of you belongs to that population — that is a clinical judgment about a specific person, made by someone authorised to make it, and recorded. The order defines the envelope; the individual evaluation places the patient inside it. Reasoning that the order covers everyone so nobody needs assessing inverts the logic. Our good faith exam guide is the companion piece, and the two should be read together.

The direction of travel is toward individualised orders

Two 2026 developments point the same way. Arizona's Board of Nursing advisory opinion contemplates a written provider order from an MD, DO or NP for Level II and Level III procedures alongside an initial face-to-face good faith examination — an arrangement in which blanket approval of all treatments does not do the work. California's enforcement posture has moved toward expecting an individualised written order issued after a documented examination of that specific patient. A practice designing documentation for 2027 should assume the individualised order is where the requirement is heading.

Acts that cannot be delegated at all

Some acts sit outside delegation however well the document is drafted. Delegation frameworks generally reserve acts requiring the exercise of independent medical judgment, and state rules commonly limit delegated aesthetic services to routine technical services not requiring the special skills of a licensed physician. Which acts fall on which side is state-specific and, for some device classes and injectables, genuinely unsettled — where you cannot find a clear answer, scope narrowly to what you can defend and note the open question. Our guides to who can inject Botox across the United States and esthetician scope of practice by state cover the scope side in detail.

Ten Ways Med Spa Standing Orders Fail

The recurring defects, in rough order of how often they appear. Each is cheap to fix before it is found and expensive afterwards.

One to four: the document is not really a document

1. There is no standing order, only a protocol. Excellent technique documentation and no authorisation. 2. There is a single blanket page. One signature approving all treatments, with no act, population or delegate named. 3. The order names no population. Which makes it a blanket authorisation with extra steps. 4. The order is unsigned, or signed only by a manager. The most complete document in the binder authorises nothing without the clinician's signature.

Five to seven: the document has drifted from reality

5. The named delegates left. The roster lists two nurses who are gone and omits the three who now inject. 6. The medical director changed and the orders did not. Every order is signed by a physician with no current relationship with the practice. 7. The service menu grew and the orders did not. A new device, filler line or weight-management programme, and the authorisation set still reflects the opening menu — a failure that scales with growth. Our protocol inventory by service line is the checklist for what the menu now requires.

Eight to ten: the governance never existed

8. No review history. The order may be perfect and there is no evidence anyone has looked at it since signing. 9. No version control. Superseded copies were overwritten, so the practice cannot say what governed a treatment last spring. 10. Nobody can find it. The order exists, in a folder, on a laptop, belonging to a consultant who worked with the practice in 2024 — and documents that cannot be produced are, at the moment they are asked for, indistinguishable from documents that do not exist.

Building Your Standing Order Set: Sequence and Scope

If you are starting from nothing — or from something you now suspect is nothing — this is the order to do it in.

Step one: inventory the delegated acts

List every service on the menu and, for each, who performs it. Circle every row where the performer is not the person whose licence independently authorises the act. Those rows are your standing order set, and the count is usually larger than expected. Do this before drafting anything: the commonest sequencing error is drafting a beautiful neurotoxin order while four other delegated services carry no authorisation at all.

Step two: confirm the state authority for each act

For each circled act, identify whether it may be delegated in your state, to whom, under what supervision, and which board says so. Every element below inherits its validity from this step, so it needs genuine research or a healthcare attorney; where the answer is unsettled, record that and scope conservatively. Our fifty-one jurisdiction regulations reference is the starting point, each value citing its own primary source.

Step three: one order per act, not one for everything

Per-act is the right granularity. It keeps each order short enough to be read by the person acting on it, and maps cleanly to how an inspector traces from a chart. One master order covering the whole menu is simultaneously too long to use and too vague to defend.

Step four: build the register before the second order

Set up the register when you have one order, not nine. Retrofitting version history is tedious and entirely avoidable, and the register is a spreadsheet with eight columns — no system, vendor or project required.

Step five: wire the orders into the rest of the documentation

Add the order number to the relevant SOP headers, the current order list to the clinical governance chapter of the policy manual, a recital to the medical director agreement that the delegating clinician will issue and maintain standing orders, and the order-number field to the chart template. Four edits, and four document families stop being four binders and start being one system. If you would rather adapt a set that already has this structure built in, our library of ready-to-use med spa compliance SOPs and protocol kits is written for exactly that.

This article is for informational purposes only and does not constitute legal advice. Standing order, delegation and supervision requirements are set by each state's legislature, medical board and nursing board and change over time; several positions described here — including which aesthetic acts may be delegated, whether a nurse practitioner may issue the authorising order, and how far an individual patient-specific order is now expected in addition to a standing order — vary by state and are in some jurisdictions genuinely unsettled. The specimen standing order is illustrative and its clinical parameters are examples rather than recommendations. Confirm current requirements with the relevant state board and consult a healthcare attorney and your medical director before adopting, signing or relying on any standing order.

Frequently Asked Questions