Pennsylvania Med Spa Compliance Checklist (2026)

The two states closing this programme border each other and agree on almost nothing. New Jersey answers ownership with a board regulation and writes its examination duty into a rule. Pennsylvania answers ownership with a corporations statute, never wrote that rule at all, and split its delegation regulation in two.

So this is Pennsylvania's own: eleven sections of checkable items rather than essays, the reasoning left to the sibling guide named beside each. The Pennsylvania regulatory profile maps which body writes which rule.

How to Run This Checklist

The two marks, and why blurring them is expensive

Legal requirement means a Pennsylvania statute, a Commonwealth regulation or a federal rule, linked so you can read it; a no there is exposure that already exists. Best practice means no rule stands behind it — it is the standard of care, or the only way to prove something the law does require. Inflating the first is the failure this page avoids.

Answer from the document, not from memory

Each item is phrased so the honest answer comes from something you can put your hand on: an agreement, a chart entry, a licence verification, an invoice. If it cannot be produced within the hour, the item is a no.

When to run it

Run it before opening, before adding a procedure, whenever a clinician joins or changes role, and after any adverse event. What a reviewer asks for on the day is in the Pennsylvania inspection and enforcement guide.

1. Entity and Ownership: Is the Business Lawfully Structured for Pennsylvania?

Pennsylvania restricts the equity, and looks through the cap table

Most states answer ownership with a doctrine; Pennsylvania answers it with a corporations statute, which is harder to argue with. 15 Pa.C.S. § 2923 requires every ultimate beneficial owner of shares to be a licensed person, voids a non-conforming issuance, and voids any proxy handing control to someone who could not hold the shares directly.

Two questions decide the structure

Is every owner licensed to render what the entity renders? And where a second profession sits inside it, does 49 Pa. Code § 16.21 permit that combination — meaning the co-owner practises without referral or supervision? Credential by credential, that is who can own a med spa in Pennsylvania.

The licence nobody budgets for

If any part of the footprint operates as an esthetician salon, it answers to the State Board of Cosmetology and needs a salon licence with a designated person in charge under 49 Pa. Code § 7.62. Two regulators, one address.

2. Medical Director: What Pennsylvania Actually Expects

There is no medical director requirement — and that is the finding

The industry sells medical direction as the answer to compliance. Pennsylvania created no such role for an aesthetic practice: no designation, no qualification, no registration, no required agreement, no cap on sites.

What it requires is narrower — a physician who lawfully delegates each service under 49 Pa. Code § 18.402, or § 25.217 for a DO. A practice can hold an immaculate agreement and meet none of those conditions, which is why most items here are marked best practice.

What must be true about the overseeing physician

Everything else a director agreement contains — hours, chart review, availability, complication response — is contract, not regulation. That is why it has to be written. The Pennsylvania SOP and policy manual guide sets out what to put in it.

3. Staff Credentials and Scope: One Row Per Role

Pennsylvania's vocabulary, and why it matters on a form

Two terms travel badly. Pennsylvania's advanced practice title is certified registered nurse practitioner, or CRNP; another state's word imports that state's requirements too. And the Commonwealth licenses the esthetician, through the State Board of Cosmetology.

What each licence may and may not do

The reasoning behind every row, including the sliding scale of physician availability, is taken apart in who can inject Botox in Pennsylvania.

The rows that generate most findings

Two rows generate most findings. The registered nurse row, because a busy clinic slides from patient-specific orders into a standing menu without anyone deciding to. And the esthetician row, because 49 Pa. Code § 7.14a confines that licence to esthetician services — a line the Pennsylvania esthetician scope guide draws procedure by procedure.

4. Delegation and Supervision: What Must Be in Place First

Five conditions, none of which names a document

Nearly every treatment is a medical service performed by someone other than the physician answerable for it. Under 49 Pa. Code § 18.402 the delegation must be consistent with acceptable medical practice here; the physician must have assured the recipient's education, training, experience and competency; and must have determined it creates no undue risk to the particular patient being treated.

Read that third condition twice. It is per patient, and no document is required to answer it — which is precisely why one must exist. Only a contemporaneous record proves a state of mind now past.

The condition most consent forms miss

The statutory parent, 63 P.S. § 422.17, adds a duty summaries drop: the service and the fact of delegation must be explained to the patient, and the patient must not object. If the person holding the syringe is not the physician, the chart should say so.

Supervision does not mean the room

Neither provision imposes onsite presence or a mileage radius. 63 P.S. § 422.13 says supervision does not require personal presence for a physician assistant, and the rule frames availability functionally — matched to difficulty, delegate skill and patient risk.

5. The Good-Faith Exam: Who Performs It, When, and How It Is Documented

Pennsylvania never wrote the rule

Search the Pennsylvania Code for a good-faith examination requirement in aesthetics and there is none — no regulation naming it, no timing rule, no list of who performs it. Instead, separate provisions read together make treating an unexamined patient unlawful.

Where the duty actually comes from

Deciding a patient should receive a prescription neuromodulator is the practice of medicine. A registered nurse may administer only a drug ordered for that specific patient under 49 Pa. Code § 21.14, and an order presupposes somebody who assessed. No physician can find no undue risk to a patient they know nothing about.

The one place Pennsylvania is explicit

Controlled substances. 49 Pa. Code § 16.92 requires an initial history and physical before they are prescribed absent emergency; allows reliance on another provider's only within the preceding thirty days; requires counselling on diagnosis, dosage, instructions, frequency, duration and side effects; and requires the first record to specify symptoms observed and reported. Neuromodulators are not controlled substances — phentermine is.

Distance does not lower the standard

Pennsylvania's telemedicine statute, Act 42 of 2024, is direct: a provider delivering services through telemedicine meets the same standard of care as in person. Remote evaluation is available; a remote shortcut is not.

6. Patient Records, Consent and Retention

Seven years, and longer for a minor

49 Pa. Code § 16.95 sets the number: at least seven years from the date of the last medical service for which an entry is required, and a minor's record until one year after that patient reaches majority. Osteopathic physicians carry the parallel duty under their own board's rule.

Consent after Shinal, and after Act 61

40 P.S. § 1303.504 imposes a statutory consent duty for an enumerated set of procedures — surgery with its related anesthesia, and experimental medications or devices among them. In 2017 Shinal v. Toms held that duty non-delegable; Act 61 of 2021 then allowed reliance on a qualified practitioner.

So routine cosmetic injection is unlikely to sit inside that list, and a page saying the MCARE Act mandates consent for every neuromodulator treatment overstates the law. What does attach is the standard of care and the delegation disclosure under § 422.17.

Whether HIPAA reaches you at all

A provider becomes a covered entity by transmitting health information electronically in a standard transaction. A genuinely cash-only practice may sit outside the Privacy Rule; almost none stays there once a payer or billing vendor appears.

7. Drug Procurement, Storage, Handling and Disposal

Buy from an authorised source, and keep the paper

This is where a practice can do everything else right and still be in serious trouble. Federal law requires providers administering prescription drugs to buy only from authorised sources, and the FDA has repeatedly found counterfeit botulinum toxin in med spas across multiple states, linked to hospitalisations.

The controlled-substance items hiding on a weight-loss menu

Phentermine switches on two more regimes. 35 P.S. § 780-112 requires a two-year record — amount, date, and the patient's name and address — open to inspection. And the monitoring programme must be queried at a patient's first controlled substance prescription and at every opioid or benzodiazepine.

Sharps and waste answer to different regulators

The needles answer to different regulators. 29 CFR 1910.1030 requires a written exposure control plan and a sharps injury log, and the Department of Environmental Protection regulates medical and chemotherapeutic waste under 25 Pa. Code Chapter 284.

8. Emergency Preparedness and Adverse-Event Response

Pennsylvania imposes almost nothing here, which is the risk

No Commonwealth rule tells an aesthetic practice what to keep in an emergency kit, what training to hold, or when to call; no facility licence sets a standard because none exists. Nearly everything here is therefore best practice — and the absence of a rule is not the absence of a duty.

Build the protocol from your own menu

Work down your own service list and ask what each treatment does at its worst — anaphylaxis after an injectable, vascular occlusion after filler, burns after energy devices — then ask who is in the building and who can be raised in ninety seconds. The Pennsylvania inspection and enforcement guide covers what a reviewer looks for.

9. Training and Competency Records

The duty a nurse owns personally

Pennsylvania frames competency as an individual obligation rather than an employer's programme. Under 49 Pa. Code § 21.18 a nurse undertakes a specific practice only with the necessary knowledge, preparation, experience and competency, and acts to safeguard patients from incompetent or illegal practice by anyone.

Training is not competency

A certificate proves attendance. The delegation rule asks that the physician assured the delegate's competency — an observation someone made and can describe. The Pennsylvania SOP and policy manual guide lays out the documentation set.

10. Advertising and Patient Communications

The representation rules that genuinely bind

Pennsylvania has no aesthetic advertising code, but 63 P.S. § 422.41 makes misleading, deceptive, untrue or fraudulent representations a ground for discipline against the licence — covering the website, the pricing page, the credential line under a staff photograph and what the front desk says.

Identification is a rule, not a courtesy

It is unusually direct about physician assistants: 49 Pa. Code § 18.171 requires a conspicuous tag using the term Physician Assistant. Extend the principle as policy — a patient should not have to guess whether the person injecting them is a physician, a CRNP or a nurse.

Images, claims and things people forget are records

Before-and-after images are the highest-risk asset a med spa owns: your own patients, a separate authorisation where the Privacy Rule applies, no editing into a result the treatment did not produce. The FDA has also acted against illegal marketing of botulinum toxin products.

11. Insurance

MCARE is a real Pennsylvania requirement, and it is checkable

Most states leave professional liability cover to the market; Pennsylvania legislated it. Under 40 P.S. § 1303.711, providers covered by the MCARE Act must carry $500,000 per occurrence or claim and $1,500,000 per annual aggregate — for a non-hospital provider doing more than half its practice here — alongside MCARE Fund participation, with 49 Pa. Code § 16.32 tying it to the licence. Where the Fund receives no evidence of coverage, it reports the provider to the board.

What MCARE does not do

It does not cover the entity, the premises, a data breach, or a treatment the carrier never knew you offered. Adding a device platform or a weight-loss programme without telling the carrier is how practices discover the policy did not stretch.

What Pennsylvania Med Spas Most Often Get Wrong

Four failures account for most of what goes wrong here. None is exotic, all are cheap to fix in advance, and each stays invisible until something opens the chart.

1. Buying a title instead of building a delegation record

A practice pays a retainer, receives a signed agreement, and believes the question is answered. Pennsylvania never asked for that agreement. It asked whether a physician assured competency, determined no undue risk for this patient, and told the patient. The file holds a contract and no evidence of the three.

2. Letting the standing menu replace the patient-specific order

A returning patient books the same treatment, the nurse knows the dose, the prescriber is busy, and the order becomes a formality. But 49 Pa. Code § 21.14 lets an RN administer a drug ordered for a patient in the dosage and manner prescribed, and a menu is not an order. Two licences are exposed, not one.

3. Never telling the patient the physician delegated

63 P.S. § 422.17 makes explanation to the patient, and the absence of objection, a condition of lawful delegation — and most Pennsylvania consent forms say nothing about it. An otherwise careful delegation is incomplete on its face, and one sentence is the remedy.

4. Buying injectables outside the authorised chain

A supplier offers product well below the usual price, the vials look right, and nothing goes wrong for months. The FDA's counterfeit findings are the other outcome: harmed patients, product you cannot trace, and a defence that begins by explaining the invoice.

The Complete Pennsylvania Med Spa Compliance Checklist

One row per section. Where a row is a no, the section above holds the remedy. Background sits on our Pennsylvania med spa regulations page, and the rest of this wave on the Pennsylvania compliance hub.

This checklist is for informational purposes only and is not legal or medical advice. Pennsylvania has no med spa-specific regime, so much of it is assembled from general law and can turn on facts particular to your practice, and rules change after publication. Confirm current requirements with the State Board of Medicine, the State Board of Osteopathic Medicine, the State Board of Nursing, the State Board of Cosmetology and the Department of Health, and take advice from a Pennsylvania healthcare attorney.

Frequently Asked Questions