North Carolina Med Spa Compliance Checklist 2026

Every other state guide starts with the licence. North Carolina does not have one, and that changes what a compliance checklist for this state has to be.

No med spa statute, no facility licence, no registry, no scheduled inspection. Operators arriving from Tennessee or Florida hunt for the permit that makes them legitimate and conclude the state is unregulated. It is not: North Carolina regulates people, not premises.

Authority runs through the Medical Practice Act at Chapter 90 (the North Carolina Medical Board, NCMB), the Nursing Practice Act (the North Carolina Board of Nursing, NCBON), and Chapter 88B (the Board of Cosmetic Art Examiners). None licenses your business; all can end it. So this is not a list of applications to file — it is a list of documents you must be able to produce.

North Carolina Has No Med Spa Licence — Which Is Why This Is a Document Checklist

What the state genuinely does not have

No facility licence, no statewide laser facility programme, no staffing ratio or equipment standard, no scheduled inspection. No rule in North Carolina law uses the phrase “good faith exam,” no statute sets a retention period for outpatient records, and no adverse-event report is mandated. Each silence is real, and each is handled below by saying what the state requires instead.

Three boards, and what each can do to you

The NCMB licenses physicians and PAs, registers entities practising medicine, and disciplines under G.S. 90-14. The NCBON licenses RNs and LPNs and publishes the position statement that makes nurse injection lawful at all. NPs sit in the overlap, approved by both boards under joint rules at 21 NCAC 32M and 21 NCAC 36 .0800. Primary sources: our North Carolina regulations summary.

How a North Carolina med spa is actually examined

Enforcement is complaint-driven: it arrives without warning, and as paper. A typical NCMB inquiry asks for the complete record, the consent, the pre-treatment evaluation, the agreement in force on the treatment date, and competency records for whoever treated — none of which can be created afterwards. For what changed this year, see our guide to North Carolina med spa regulatory changes in 2026.

How to read the checklists below. Each line is a named document, marked Legally required where a North Carolina statute, rule, or federal law compels it, or Recommended where the state is silent and the document exists because it is what defends you. Nothing is marked required that we could not tie to a source named here.

Section 1 — Entity, Ownership, and Registration Documents

The Certificate of Registration is not optional

Under G.S. 55B-10, no professional corporation may open, operate, or maintain an establishment without first obtaining a certificate of registration from the board governing that profession — for a medical practice, the NCMB. It renews annually, due December 31, and failure to renew is cause for suspension under G.S. 55B-13 — leaving the entity you bill through suspended while treatments continue.

Who may hold the shares

Chapter 55B and NCMB Position Statement 10.1.2 enforce the corporate practice of medicine. Shares pass only to licensees (G.S. 55B-6); a disqualified shareholder must sever all financial interest forthwith or the entity faces forfeiture under G.S. 55B-7, and G.S. 55B-14(c) sets the permitted physician, PA, and NP combinations. Outside capital sits in an MSO alongside the entity, never inside it — full analysis in who can own a med spa in North Carolina.

What the board asks for. Who owns the entity, and whether the certificate is current — which the NCMB verifies from its own records first. An MSO invites a follow-up: who sets protocols, prices, and clinical hiring?

Section 2 — Licensure and Credentialing for Every Role on the Floor

Verify at source, and track expiry

No state agency checks your roster — you do. Each file should hold a dated verification printed from the issuing board's own lookup, not the employee's certificate, because only the source shows expiry and discipline. Under 21 NCAC 32M .0104 an NP may not practise until notification of approval arrives from the Board of Nursing; scheduling one while approval is pending is unauthorised practice.

Who holds what — including the laser hair licence nobody expects

Medical assistants are not licensed or registered by any North Carolina board, so an MA has no independent scope and every task is a delegated act. Who may hold a syringe is worked through licence by licence in who can inject Botox in North Carolina; where skin care stops is in our esthetician scope of practice guide. Laser hair removal has its own track: under Chapter 86B a laser hair practitioner must hold an electrologist licence, complete a Board-approved course of at least 30 hours, and work only under a physician licensed to perform surgical services. An esthetician on that device is the wrong credential, not a paperwork gap.

What the board asks for. Both boards open with the same question: who performed the treatment, and what licence did they hold that day? A lapsed credential answers it in the complainant's favour before anyone reaches the clinical facts.

Section 3 — The Delegation and Supervision File

PAs, NPs, and the instruments that carry their authority

Injecting is the practice of medicine under N.C. Gen. Stat. § 90-18, which treats a person who prescribes for or administers to another as practising medicine. Every non-physician draws that authority through a specific instrument; missing instrument, missing authority. A PA practises under continuous supervision documented in a signed statement of supervisory arrangements under 21 NCAC 32S .0213. Part VI of Session Law 2025-37 lets a PA with over 4,000 hours as a PA and 1,000 in the specialty register with the NCMB and practise unsupervised, from June 30, 2026 or earlier rulemaking — but only in a team-based setting as G.S. 90-1.1 defines it, meaning majority physician ownership. Most med spas will not qualify.

North Carolina is not a full practice authority state; the APRN definitions bill missed the May 8, 2025 crossover deadline, its sixth consecutive failure. Under 21 NCAC 32M .0110 and the parallel 21 NCAC 36 .0810, an NP must hold a signed, dated collaborative practice agreement with a primary supervising physician, kept at each site and reviewed yearly. Two details fail audits: three sites need three copies, and the review must carry a signature and a date.

Nurses, and the competence precondition that voids paper supervision

The NCBON Cosmetic/Aesthetic Dermatological Procedures position statement is what makes nurse injection lawful. It places Botox and filler, peels, laser hair removal, sclerotherapy and micropigmentation within RN and LPN scope when ordered by a practitioner with prescriptive authority — conditioned on a valid order, documented education and demonstrated competency, and written procedure and emergency policies. An RN needs no prescriber on site; an LPN needs direct on-site supervision. Section 90-171.20 bars any nurse from diagnosing or prescribing, so the nurse never selects drug or dose.

NCMB Position Statement 9.1.1 adds the rule that disqualifies absentee medical directors: a physician should supervise only care in which they are competent. North Carolina sets no mileage rule, response time, or visit frequency — and silence is not permission. See our North Carolina med spa medical director requirements.

What the board asks for. The NCMB asks for the agreement in force on the date of the treatment complained of, which is why undated, unversioned agreements are so damaging. The NCBON asks the nurse for the order, the competency validation, and the policy that governed it.

Section 4 — Good Faith Examination and Standing Orders

Where the requirement comes from, since no rule names it

No North Carolina statute or rule uses the phrase, and the substance is required anyway, assembled from three places: § 90-18 makes administering to a person the practice of medicine; the NCBON position statement conditions every nurse-performed procedure on a prescriber's order, presupposing a prescriber who evaluated; and NCMB Position Statement 4.1.1, Contact With Patients Before Prescribing, says what that prescriber must do. The evaluation falls to a physician, PA, or approved NP — never an RN, per § 90-171.20.

What has to be in the chart, and where standing orders stop

Position Statement 4.1.1 holds that prescribing to someone the prescriber has not examined to the extent necessary for an accurate diagnosis is inappropriate, and that a licensee should ordinarily perform an appropriate history and physical examination, establish a working diagnosis, and formulate a therapeutic plan. It adds that prescribing based solely on answers to a set of questions is inappropriate and unprofessional — which names the digital intake form. That is four chart entries; “tolerated well, 24u glabella” is the fourth alone.

NCMB Position Statement 5.1.4 permits telemedicine at the same standard of care where the threshold information for a reasonably presumptive treatment plan has been obtained — a route to the evaluation, not around it. A protocol pre-approving everyone who books is not an order. One point is genuinely unsettled: North Carolina names no re-examination interval for returning patients. Set one and follow it.

What the board asks for. The most requested set in an NCMB cosmetic complaint: who evaluated this patient, when, produce the note. If a nurse read a web form and the prescriber signed orders in a Friday batch, the file establishes the violation.

Section 5 — Consent Forms, Procedure by Procedure

What G.S. 90-21.13 gives you that most states do not

N.C. Gen. Stat. § 90-21.13 allows no recovery for treatment rendered without informed consent where the provider met the standards of practice among the same profession in similar communities, and a reasonable person would understand the procedure and its usual and most frequent risks and hazards. A written consent meeting that standard and signed by the patient is presumed to be a valid consent, rebuttable only on proof of fraud, deception, or misrepresentation. A generic “I consent to treatment” page does not earn it.

The set you need, plus the consents people forget

One consent per procedure type, each naming product, expected result, alternatives, and the risks genuinely usual for it — bruising, swelling, asymmetry and headache for neurotoxin; for filler, vascular occlusion and the rare but catastrophic vision loss. Off-label use is lawful medicine but must be disclosed plainly. Clinical and marketing photography deserve separate signatures.

What the board asks for. The signed consent, read against what the patient says they were told. The gap the NCMB looks for is between the risks disclosed and the complication that occurred.

Section 6 — The Medical Record, Retention, and HIPAA

What the chart must contain

A med spa chart is a medical record — a proposition routinely disproved by practices running on booking software with a free-text notes field. NCMB Position Statement 3.2.1, Medical Records — Documentation, Electronic Health Records, Access, and Retention, sets the Board's expectations. A defensible chart carries intake and history, the evaluation note, the consent, a treatment record with product, lot number, expiry, dose, dilution and sites, the performer and ordering prescriber, and aftercare. Lot number is skipped most and needed most: on a recall or a delayed nodule, it is how you answer.

Retention, where North Carolina is silent, and the breach layer that is not

State this carefully, because it is overstated everywhere online. North Carolina has no statute setting a retention period for outpatient medical records. The eleven-year figure people quote comes from 10A NCAC 13B .3903, the Medical Care Commission rule that applies to hospitals — eleven years after discharge for an adult, until the thirtieth birthday for a minor's record. It does not by its terms govern a med spa. Position Statement 3.2.1 frames retention as a professional obligation guided by the patient's future health care needs. Adopting the hospital standard voluntarily is what most North Carolina counsel advise; our records retention guide compares the states.

Most med spas are HIPAA covered entities, which brings a documented security risk analysis — the most common HHS finding against small practices, because it is the document nobody has. North Carolina adds a layer: under § 75-65 a business owning personal information of North Carolina residents must notify affected persons of a breach without unreasonable delay, and where more than 1,000 are notified at once must also notify the Attorney General's Consumer Protection Division and the nationwide reporting agencies. Violation is unfair or deceptive trade practice under § 75-1.1.

What the board asks for. The complete record for a named patient, judged against the chart the NCMB expects, not whatever your software exports. The quieter trigger is the patient who could not obtain their own records.

Section 7 — Drug Sourcing, Storage, and Dispensing Records

Buy from a licensed source, and keep the invoice

Prescription drugs must come from a licensed wholesale distributor or the manufacturer, in the practice's or prescriber's name, with the invoice retained; the federal Drug Supply Chain Security Act governs the documentation arriving with each shipment. Grey-market neurotoxin is the fastest route from a cost saving to a board complaint, because the invoice trail is the first thing requested when a product injury is investigated — and answering where this vial came from only works if the chart records lot numbers.

Administering versus dispensing: the registration line most spas miss

Administering a drug in the office needs no registration beyond the prescriber's licence. Dispensing — handing the patient a supply to take home, the entire GLP-1 model — is a separate regulated act. A physician who dispenses for a fee must register annually with the North Carolina Board of Pharmacy as a dispensing physician and comply with pharmacy law in all respects. For PAs and NPs it is stricter: they must register before any dispensing, may dispense only from a place holding a North Carolina pharmacy permit, and may not register as independent dispensers. A med spa with no pharmacy permit whose NP hands out semaglutide supplies has a model the state does not permit. Compounded sourcing: our North Carolina GLP-1 compliance guide.

Refrigerated products need a monitored fridge with a temperature log. Sharps and treatment waste fall under North Carolina's medical waste rules at 15A NCAC 13B .1200, administered by the Department of Environmental Quality: rigid, leak-proof, puncture-resistant containers, not compacted before off-site transportation.

What the board asks for. Where a complaint involves a product, the NCMB asks for the purchase records and the lot administered. The Pharmacy question arrives unprompted: a practice advertising take-home injections is advertising that it dispenses.

Section 8 — Device Records and Training Logs

Classify every device before you assign an operator

North Carolina issues no laser operator licence, no device registration, and no device inspection — producing the state's most common misconception, that anyone may run a laser. NCMB Position Statement 5.1.2 treats the use of lasers to alter tissue as the practice of medicine, so authority flows through delegation from a physician exactly as for injection: no operator credential exists because no independent scope does. The Cosmetic Art Board keeps FDA class 3, 3A, 3B and 4 and radiation-emitting devices out of esthetician scope, so an esthetician-operated laser fails at both ends.

The training log is the document you will actually need

The NCBON position statement requires documented education and demonstrated competency before a nurse performs a cosmetic procedure, and NCMB Position Statement 9.1.1 requires the delegating physician to be competent in what they supervise. Both resolve into one artefact: a training record, per person and per device, showing what was completed, who assessed competency, when, and against what criteria. A manufacturer's attendance certificate is not one.

What the board asks for. On a burn or scarring complaint: who operated the device, at what settings, with what training, under whose delegation. Produce the certificate but not the delegation and you have answered half the question.

Section 9 — Adverse Events, Emergency Protocols, and Reporting

The written emergency policy is a precondition, not a nicety

North Carolina imposes almost no affirmative reporting duty for a cosmetic complication, yet the emergency documentation is legally required — because the NCBON position statement conditions nurse performance on written policies covering the procedure and the emergency response. If your RN injects filler with no written vascular occlusion protocol, her authority to have treated at all is in question. The protocol must be specific enough to act on under pressure: recognition signs, hyaluronidase dose and reconstitution, escalation, transfer.

What North Carolina actually requires you to report

There is no North Carolina statute or rule requiring a med spa to report a cosmetic adverse event, and no state registry. What exists is G.S. 90-14.13: the insurer reports any award or settlement to the NCMB within 30 days, and a licensee with no professional liability insurance, or insured outside North Carolina, must report personally within 30 days — penalties $250, then $500. So the internal event log is the whole institutional memory; our guide to why med spas get shut down traces how often closure follows a pattern visible internally for months.

What the board asks for. After a complication: what the protocol required, whether it was followed, and what training the clinician had. A signed, procedure-specific protocol beats a supplier's generic emergency page.

Section 10 — Advertising, Before-and-After Photos, and Insurance

Truthful advertising, and photo consent that reaches the use

NCMB Position Statement 8.3.1, Advertising and Publicity, holds that advertising which is deceptive, false, or misleading is unprofessional conduct under the Medical Practice Act — a ground for discipline under G.S. 90-14. The Board defines advertising broadly — oral, written, digital and online communication disseminated at a licensee's direction — and asks whether the public would be confused or deceived. The recurring failures: calling non-physician staff “doctor”; advertising a certification nobody holds; guaranteeing results; passing stock images off as your patients. Each is also a G.S. 75-1.1 exposure.

Patient images are protected health information, so a before-and-after post is a disclosure of PHI requiring a written HIPAA marketing authorisation — the treatment consent does not cover it. The images must be honest too: consistent lighting and angle, no filter differences, no retouching. An altered pair is deceptive advertising under Position Statement 8.3.1.

Insurance: what North Carolina requires, and what it does not

Stated plainly, because it is misreported constantly: North Carolina does not require licensees to carry professional liability insurance, and sets no statutory minimum. What exists is the G.S. 90-14.13 reporting duty on the uninsured licensee personally, plus the commercial reality that credentialing bodies and lenders expect coverage, usually $1 million per claim and $3 million aggregate. The exposure that matters is exclusions: carriers commonly exclude acts outside the insured's scope, so the delegation failure that creates the board problem voids the coverage.

What the board asks for. Advertising complaints arrive with the evidence attached — a competitor's screenshot — and the NCMB asks who approved the claim. The material being public, the Board needs no cooperation from you to build the file.

The Complete North Carolina Med Spa Compliance Checklist

Everything above in one pass. Run it before you open, before you add a service, and the day any complaint arrives. If you would rather adapt finished documents than draft from a blank page, our ready-to-use med spa compliance SOPs cover the policy, protocol, and consent side of every row, and our med spa policy and procedure manual guide shows how they fit into one binder.

The through-line is worth naming. In a licensure state, compliance is an event: you apply, you are inspected, you are approved. In North Carolina it is a condition — files that must be true on any given day, because the day they are tested is chosen by somebody else. The North Carolina med spa compliance hub collects all seven guides in one place.

This checklist is for informational purposes only and does not constitute legal or medical advice. North Carolina has no med spa statute, and much of what governs an aesthetic practice here sits in board position statements and joint rules revised without legislative action. Confirm current requirements with the Medical Board, the Board of Nursing, the Board of Cosmetic Art Examiners, and the Board of Pharmacy, and consult a North Carolina healthcare attorney.

Frequently Asked Questions