Pennsylvania Med Spa SOPs: What Your Policy Manual Must Include

Most Pennsylvania aesthetic practices own a binder. Fewer own one that answers the question a Commonwealth prosecutor actually asks, which is not "do you have policies" but "show me the document that authorised this person to do this thing to this patient on this date." The first is reassurance. The second is evidence.

This page is about the second, and it is the Pennsylvania layer only. The general architecture of an SOP set and the generic contents of a manual live in our national guide to med spa standard operating procedures and our policies and procedures manual guide; nothing here restates them. The rest of the state library sits on the Pennsylvania compliance hub, with the jurisdictional summary on our Pennsylvania regulations page. Every requirement stated below as a Pennsylvania requirement is tied to published Commonwealth text; everything else is labelled practice rather than law.

Does Pennsylvania Require a Med Spa to Have Written SOPs?

No. No Pennsylvania statute or regulation requires a medical spa to hold a document called an SOP manual, a policy manual, or anything equivalent — and any vendor telling you otherwise is selling on a claim that does not exist. The reason is structural rather than permissive: the Commonwealth issues no medical spa licence or facility permit, so there is no credential to which a documentation condition could attach.

No Pennsylvania rule names a med spa SOP manual

Pennsylvania regulates practitioners and acts. A physician answers to the Medical Practice Act of 1985 and the State Board of Medicine, or to the osteopathic statute and its own board; a nurse to the State Board of Nursing; an esthetician to the Cosmetology Law of 1933, the act of May 3, 1933 (P.L. 242, No. 86), 63 P.S. §§ 507—527, and the State Board of Cosmetology. Ask any of them for the med spa chapter and there isn't one. Which body writes which rule is mapped in our Pennsylvania regulatory profile.

The documents Pennsylvania does require by name

Four written instruments are named in Commonwealth text and reach an ordinary aesthetic practice.

• The medical record. 49 Pa. Code § 16.95 for a medical doctor, § 25.213 for an osteopathic physician; contents and retention both specified.
• The physician assistant written agreement. § 18.142, signed by the physician assistant and the primary supervising physician, describing scope of practice and the nature and degree of supervision.
• The prescriptive authority collaborative agreement. § 21.285, required of any CRNP who prescribes or dispenses, kept at the primary practice location with a copy filed with the Bureau of Professional and Occupational Affairs.
• The controlled substance record. 35 P.S. § 780-112, a two-year log of what was administered, dispensed or distributed, open to inspection.

Where a Pennsylvania statute quietly asks for a written policy

One provision comes closer than any other, and it arrived recently enough that most manuals here predate it. When the General Assembly rewrote the informed consent section of the MCARE Act by the act of June 30, 2021, P.L. 330, No. 61, it expressly contemplated that facilities and physicians would develop policies and procedures governing when a qualified practitioner other than the physician may obtain consent — a statute describing a written policy as the mechanism by which a delegation becomes proper.

The evidentiary problem that makes writing unavoidable

Here is the argument that actually matters. Pennsylvania's central delegation rule, 49 Pa. Code § 18.402, permits a physician to delegate a medical service only where conditions about competency, risk and accepted practice are satisfied. None requires a form. All are facts about a state of mind in the past — and a year later, nothing demonstrates that a physician determined a nurse had sufficient training, or that a delegation created no undue risk to a particular patient, except a record made at the time. Pennsylvania did not require the document. Pennsylvania required the thing the document is the only surviving proof of.

What Must a Pennsylvania Med Spa Document About Delegation and Supervision?

Five conditions, none of which names a piece of paper, and all of which fail silently without one. Delegation is the most consequential documentation area in a Pennsylvania med spa, because nearly every treatment on an aesthetic menu is a medical service performed by somebody other than the physician who is legally answerable for it.

49 Pa. Code § 18.402: the conditions your delegation must satisfy

Subchapter G of Chapter 18 is titled Medical Doctor Delegation of Medical Services, and § 18.402 is the operative rule. A medical doctor may delegate a medical service to a health care practitioner or technician where the delegation is consistent with the standards of acceptable medical practice embraced by the medical doctor community in this Commonwealth; where the doctor has assured that the person receiving it has sufficient education, training, experience and competency to perform the service safely; and where the doctor has determined that the delegation does not create an undue risk to the particular patient being treated. The regulation also forbids delegating a service the physician is not personally trained, qualified and competent to perform, and forbids expanding another practitioner's scope where the General Assembly or that practitioner's own board has prohibited the service.

Read the phrase "the particular patient being treated" twice: a blanket authorisation covering everyone who walks in does not answer it. A per-patient judgement, recorded, does.

63 P.S. § 422.17 and the disclosure most consent forms omit

The statutory parent of that regulation is section 17 of the Medical Practice Act of 1985, at 63 P.S. § 422.17, and it adds a condition summaries often lose: the nature of the service and the delegation of that service must have been explained to the patient, and the patient must not object to its performance by the health care practitioner or technician. That is a patient-communication duty sitting inside a delegation statute, and a startling number of Pennsylvania consent forms do not meet it: if the person holding the syringe is not the physician, the patient should have been told beforehand and the record should show it.

The registered nurse: a competency duty the nurse owns personally

The Board of Nursing does not frame this as an employer obligation. Under 49 Pa. Code § 21.11 a registered nurse may not engage in areas of highly specialized practice without adequate knowledge of and skills in the practice areas involved, and under the standards of nursing conduct at § 21.18 a nurse is to undertake a specific practice only with the necessary knowledge, preparation, experience and competency, and to act to safeguard the patient from the incompetent, abusive or illegal practice of any individual. So the competency file is the only artefact through which a nurse can evidence a duty that is personally hers or his — and because that duty extends to illegal practice by any individual, a practice whose policies quietly ask an RN to cross a boundary is asking that nurse to absorb a risk it cannot indemnify. Which clinician may lawfully hold the syringe is worked through in our guide to who can inject Botox in Pennsylvania.

The CRNP: collaboration is a defined term, not a posture

Pennsylvania defines collaboration at 49 Pa. Code § 21.251: the immediate availability of a licensed physician to the CRNP through direct communication or by radio, telephone or telecommunications, and a physician available on a regularly scheduled basis for referrals and for review of the standards of medical practice. "Regularly scheduled" is the phrase to build around — a policy promising availability without naming an interval has not engaged with the definition. Note too what Pennsylvania removed: the Board deleted the old ratio limiting how many CRNPs one physician could work with, so manuals still citing a four-to-one cap are citing a rule that is gone.

The physician assistant: the written agreement and the ten-day clock

Here Pennsylvania is unusually prescriptive, and the requirement is genuinely a document. 49 Pa. Code § 18.142 requires a written agreement identifying and signed by the physician assistant and the primary supervising physician, describing the physician assistant's scope of practice and the nature and degree of supervision. Countersignature requirements are set in that agreement, with one carve-out the regulation fixes itself: the primary supervising physician shall countersign 100% of patient records completed by the physician assistant within a reasonable time not to exceed ten days during the first twelve months of practice post-graduation. Separately, § 18.159 obliges the supervising physician to timely review the records the physician assistant prepares so that § 16.95 is satisfied. That clock is a workflow with an owner, not a sentence in a binder.

What Must Be Documented About the Medical Director Relationship in Pennsylvania?

Nothing, by that name — and that is precisely why the agreement's contents are entirely your responsibility. Pennsylvania created no medical director licence, designation, registration or minimum qualification for an aesthetic practice. There is no form to file and no template the Commonwealth will bless.

Pennsylvania created no director role, so the paper defines it

What the Commonwealth wrote instead are the role-specific instruments already described. One physician can be a supervising physician for a physician assistant, a collaborating physician for a CRNP, and a delegating physician under § 18.402 all at once, and none of those roles carries the title. So a director agreement here is a private contract doing public work: it is where the § 18.402 conditions get their operational form, where the § 21.251 availability standard acquires a schedule, and where the line between clinical authority and business ownership is drawn. The corporate practice question is worked through in our guide to who can own a med spa in Pennsylvania.

What the agreement has to reach to be worth signing

Treat these as drafting practice rather than legal requirements, because that is what they are. Name the services the physician is authorising and those withheld. State the availability standard in units a reviewer can test: a response interval, a named substitute during absence. Describe the chart review, its sampling rate and its record. And say what happens when the relationship ends — who holds the records, and how the practice stops offering what it can no longer support.

The MD or DO question that changes your records policy

One detail deserves its own line because almost nobody catches it. Pennsylvania runs parallel medical and osteopathic boards with parallel regulations, and the two records rules are not identical twins. If your supervising or collaborating physician is a DO, the retention arithmetic in your policy comes from 49 Pa. Code § 25.213, not § 16.95, and the minors provision in particular differs. A manual quoting one rule while the practice runs on the other is wrong in a way that is trivial to fix and embarrassing to have missed.

What Patient-Record and Consent Documentation Does Pennsylvania Require, and What Is the Retention Period?

Seven years, from a starting point that depends on which board licenses your physician — and a consent regime rewritten in 2021 that is still being described incorrectly across most of this industry. This is where the Commonwealth is most specific and most frequently misquoted.

What § 16.95 requires a Pennsylvania chart to contain

A physician shall maintain medical records for patients that accurately, legibly and completely reflect the evaluation and treatment of the patient. The record must contain information sufficient to clearly identify the patient; to identify the person making the entry where that person is not the physician, which the regulation illustrates with a physician assistant or a certified registered nurse practitioner; the date of the entry; and the patient's complaints and symptoms. Aesthetic charts fail that specification in a recurring way: the entry identifying who performed the service is the element most often missing, because injectable documentation is built around the product rather than the person who administered it. Pennsylvania asks for both.

Seven years — but from what, and under whose rule?

Under 49 Pa. Code § 16.95 a patient's medical record shall be retained by a physician for at least seven years from the date of the last medical service for which a medical record entry is required. Under the osteopathic counterpart at 49 Pa. Code § 25.213 the record shall be retained for at least seven years from the last entry. Both say seven; they do not start counting in the same place, and a practice that has never noticed which rule governs it has never really made a retention decision. Write to the more protective reading, apply one date rule across every chart, and say which regulation you wrote to.

Minors: the one number that genuinely differs between an MD and a DO practice

Here the two rules diverge on the face of the text. Under § 16.95 a minor patient's record is retained until one year after the minor patient reaches majority, even where that means keeping it longer than seven years. Under § 25.213 it is retained until two years after the patient's eighteenth birthday, or seven years from the last entry, whichever is later. Aesthetic practices treat fewer minors than most of medicine, but not none. If you treat anyone under eighteen, that line must come from the rule governing your physician.

Consent after Act 61 of 2021: the policy the statute invites you to write

Pennsylvania's informed consent statute is section 504 of the MCARE Act, at 40 P.S. § 1303.504. Except in emergencies, a physician owes a duty to obtain the informed consent of the patient or the patient's authorised representative before the procedures the section enumerates — among them performing surgery including the related administration of anaesthesia, administering radiation, administering a blood transfusion, inserting a surgical device or appliance, and administering an experimental medication or device. Consent is informed where the patient has been given a description of the procedure and the risks and alternatives a reasonably prudent patient would require to make an informed decision.

Then the history most templates have not caught up with. In 2017 the Pennsylvania Supreme Court held in Shinal v. Toms that this duty belonged to the physician alone and could not be delegated. On 30 June 2021 the General Assembly answered, amending the section so a physician may again delegate the task to a qualified practitioner — a defined group reaching a physician assistant, a CRNP, a nurse midwife, a registered nurse authorised to perform the procedure within a delegated scope or to administer anaesthesia, another physician, and a physician in a residency or fellowship programme. A consent policy citing Shinal as current law therefore describes a rule superseded five years ago; and where a practice does delegate, the written policy naming which roles may take consent for which procedures is the mechanism the statute itself points to. Note also how narrow the enumerated list is: much of an aesthetic menu does not obviously sit inside it, so your consent architecture rests on the standard of care rather than the statute for most of what you offer.

Records requests: the three things § 16.61 makes disciplinable

Records access is a conduct rule here, not a customer service question. Under 49 Pa. Code § 16.61, unprofessional conduct includes failing to make the medical record, or a copy of it, available to the patient or to another designated health care practitioner upon the patient's written request. A practitioner may charge a reasonable fee for copies, and may withhold information only where, in the reasonable exercise of professional judgement, release would adversely affect the patient's health. Critically, a practitioner may not withhold a record because the patient has not paid for professional services. The same section treats revealing personally identifiable facts from the practitioner-patient relationship, without consent and outside statutory authorisation, as unprofessional conduct.

What Must Be Documented About Drug Handling, Storage and Disposal?

Two record systems with two different clocks, and a database query that has to end up in the chart. Most aesthetic practices treat drug documentation as an inventory problem. Pennsylvania treats part of it as a regulatory record with a defined retention period and an inspection right attached.

What in your treatment room is actually a controlled substance

The threshold question decides which rules apply. Neuromodulators and dermal fillers are prescription products but not controlled substances; semaglutide and tirzepatide are not controlled either; lidocaine is not scheduled. Testosterone, arriving with a hormone menu, is Schedule III under federal scheduling; phentermine, arriving with a weight loss menu, is Schedule IV. A practice offering only injectables and skin treatments may hold no controlled substances at all — add a hormone or weight loss line and it does, usually without anyone updating the policy that says it doesn't.

The two-year drug record, and why it is not your chart

Pennsylvania's Controlled Substance, Drug, Device and Cosmetic Act imposes its own duty at 35 P.S. § 780-112. Every practitioner licensed to administer, dispense or distribute controlled substances shall keep a record of all such substances administered, dispensed or distributed, showing the amount, the date, and the name and address of the patient. That record shall be kept for two years from the date of administering, dispensing or distributing, and shall be open for inspection by the proper authorities. Note what it is not: not a seven-year record, so it runs on a different clock from the chart; and not satisfied by the chart alone, because a chart is organised by patient while an inspection of this record is organised by substance.

The PDMP query that belongs in the record

Pennsylvania's prescription drug monitoring programme was created by the ABC-MAP Act, the act of October 27, 2014, P.L. 2911, No. 191, codified at 35 P.S. §§ 872.1—872.40. Under section 8, at 35 P.S. § 872.8, a prescriber shall query the system for each patient the first time that patient is prescribed a controlled substance by the prescriber, for the purpose of establishing a baseline and a thorough medical record; where the prescriber believes or has reason to believe a patient may be abusing or diverting drugs; and each time a patient is prescribed an opioid or a benzodiazepine. This becomes live the moment phentermine or testosterone appears on the menu, and the statutory purpose — a thorough medical record — tells you where the evidence belongs: a dated note that the query was run, and what it showed.

CRNP prescribing limits your policy should restate

Under 49 Pa. Code § 21.284 a CRNP may prescribe a Schedule II controlled substance for up to a thirty-day supply and a Schedule III or IV substance for up to a ninety-day supply as identified in the collaborative agreement, and may not delegate prescriptive authority; under § 21.284b a CRNP prescribing or dispensing controlled substances shall register with the Drug Enforcement Administration and carry out minimum standards including an initial history and physical examination. The prescribing envelope is bounded by a document that also sits on file with the Bureau, so the agreement and the drug policy must move together.

Sharps and regulated medical waste

Pennsylvania regulates regulated medical and chemotherapeutic waste under 25 Pa. Code Chapter 284, administered by the Department of Environmental Protection: waste segregated at the point of origin; containers marked "regulated medical waste" with the universal biohazard symbol and the date the container was full or sealed under § 284.414; generators subject to the log and shipping paper requirements at § 284.701. We could not verify a generator-specific retention period for those logs in the published chapter text, so this page states none.

The federal layer is firmer. Under 29 CFR 1910.1030 an exposure control plan must be reviewed and updated at least annually and whenever tasks or positions change, documenting annually the consideration and implementation of appropriate commercially available safer medical devices. The same standard requires a sharps injury log recording percutaneous injuries from contaminated sharps, kept so as to protect the injured employee's confidentiality and retained on the schedule set by 29 CFR 1904.33.

What Training and Competency Records Should a Pennsylvania Med Spa Keep for Each Role?

Pennsylvania asks for competence and leaves the filing to you; the only enforceable retention periods on your training shelf are federal. That combination produces the most common gap in this state — practices with excellent certificates and no evidence of competency, which are not the same artefact.

Pennsylvania asks for competence, not certificates

Three provisions converge. Section 18.402 requires the delegating physician to have assured sufficient education, training, experience and competency; § 21.11 bars a registered nurse from highly specialized practice without adequate knowledge and skills; § 21.18 requires a nurse to undertake a practice only with the necessary knowledge, preparation, experience and competency. None is satisfied by a vendor certificate, which proves attendance at a course. The document that answers them is a competency assessment: named assessor, named procedure, date, elements observed, outcome, and what happens on a fail.

What each role's file should contain

• Physician (MD or DO). Licence verification; the matrix entries authorised; chart review evidence; the written agreements the physician is party to.
• CRNP. Licence and certification; the § 21.285 agreement with filing evidence and biennial review date; DEA registration where controlled substances are prescribed.
• Physician assistant. Licence; the § 18.142 agreement; countersignature evidence, with the ten-day post-graduation regime tracked separately.
• Registered nurse. Licence verification; per-procedure competency assessments; the delegation instrument for each procedure; device and product training.
• Esthetician. Cosmetology Board licence and a written scope acknowledgment, the boundary itself being examined in our guide to the Pennsylvania esthetician scope of practice.
• Unlicensed personnel. A written statement of what this person does not do, and the bloodborne pathogens and privacy training that reaches everyone.

The federal training records with real retention periods

Under 29 CFR 1910.1030, bloodborne pathogens training records are maintained for three years from the date the training occurred, recording the dates, a summary of the content, the trainer's qualifications and attendees. Under 45 CFR § 164.316(b)(2)(i), HIPAA documentation must be retained for six years from creation or from the date it was last in effect, whichever is later — which applies to superseded versions. A practice that overwrites its policy file on every revision has been destroying the evidence of what its rules were on the day something went wrong.

What Incident and Adverse-Event Documentation Is Expected?

Pennsylvania's mandatory reporting regime does not reach an office aesthetic practice, which changes what your incident policy is for — it is an internal instrument, not a filing pipeline. Getting that right prevents both usual errors: promising the state a report it does not want, and concluding that because nobody must be told, nothing must be written.

Why the serious-event regime does not reach you

The MCARE Act's patient safety architecture, including serious event and incident reporting to the Patient Safety Authority and the Department of Health, applies to a medical facility, which the statute defines as an ambulatory surgical facility, a birth center, a hospital or an abortion facility. An office practice performing aesthetic medicine is none of those, so no Patient Safety Authority report follows a vascular occlusion in a Pennsylvania med spa, and no patient safety plan or officer requirement attaches.

The reports that do have a home

Several duties survive the gap. An employee needlestick belongs on the sharps injury log under 29 CFR 1910.1030 and may be recordable under the OSHA injury rules; a serious device-related injury may be reportable under the federal medical device reporting framework; a suspected adverse drug reaction can go to the FDA's MedWatch programme. A board complaint against any licensee starts the process described in our Pennsylvania inspection and enforcement guide, which is where an incident file usually ends up being read.

What an internal event record should capture

Write for the two audiences who will actually read it: a clinician managing the next hour, and a lawyer reading it in three years. A factual chronology with times, everyone involved and their role, product, lot and device settings, what was done and by whom, what the patient was told, and the review kept in a separate section so analysis never sits inside the treatment record.

What Should a Pennsylvania Med Spa's Emergency Protocols Cover?

Almost entirely standard-of-care territory, with one genuinely Pennsylvania mechanism you can use. The Commonwealth sets no crash-cart contents for an office aesthetic practice, mandates no drills and specifies no emergency training beyond what individual licensure implies.

The one provision Pennsylvania actually names

Subchapter G contains a clause worth building on: a medical doctor may approve a standing protocol delegating medical acts to another health care practitioner who encounters a medical emergency requiring medical services for stabilisation, until the medical doctor or emergency medical services personnel are available to attend to the patient. Pennsylvania has expressly contemplated a written emergency standing protocol as a lawful instrument of delegation. An emergency protocol signed by your physician is therefore not merely a good idea here; it is the form the regulation itself describes for authorising a nurse to act before the physician arrives. Draft it as a delegation, with the specificity § 18.402 demands elsewhere — which acts, by which roles, under which triggers, until when.

The events your menu generates

Work from what you actually offer rather than a generic list. An injectables menu generates vascular occlusion, hyaluronidase reconstitution and dosing, visual change after periocular filler, and delayed nodules; a weight loss menu, hypoglycaemia and severe gastrointestinal events; any injectable, anaphylaxis; devices, burns and ocular exposure. Each needs a written response with a named decision-maker, a transfer threshold, a post-event documentation step — and a drill record, the only evidence any of it was rehearsed.

The Section-by-Section Pennsylvania Med Spa SOP Manual Outline

Seven parts, in build order, each named policy tied to what it has to address in this Commonwealth.

Part 1 — Authority and structure

• Scope and applicability policy. Entity, sites, services, and which licensing acts reach each.
• Governance and clinical authority policy. The physician exercising delegation authority, and whether that physician is an MD or a DO.
• Document control policy. Versioning, approval, superseded-version retention on the six-year HIPAA rule.
• Annual review policy. A fixed month, plus the triggers forcing an out-of-cycle review.

Part 2 — Delegation and oversight

• Delegation policy. The § 18.402 conditions, with the per-patient risk determination explicit.
• Delegation matrix. Service by role by authorising instrument by supervision standard.
• Written agreements register. Every § 18.142 and § 21.285 agreement, with dates, filing evidence and next review.
• Availability and collaboration policy. The § 21.251 standard given an interval, a substitute and a log.
• Chart review policy. Sampling rate, reviewer, findings record, ten-day countersignature regime.

Part 3 — The patient record

• Record content policy. The § 16.95 elements, with the person making each entry treated as mandatory.
• Treatment documentation standards. Product, lot, expiry, dose, sites, settings, performing clinician.
• Retention and destruction policy. The seven-year rule for your physician's board, the correct minors provision, a destruction method.
• Records request policy. The § 16.61 duties: turnaround, copying fee, no withholding for unpaid services.
• Custody-on-closure policy. Who holds records if the practice or the relationship ends.

Part 4 — Consent and communication

• Informed consent policy. § 1303.504 as amended in 2021, naming which qualified practitioners may take consent for which procedures.
• Delegation disclosure. The § 422.17 requirement that the patient be told a practitioner rather than the physician will perform the service.
• Consent forms register. One per procedure, versioned, with the risks actually discussed.
• Photography and marketing consent policy. Separate from treatment consent, withdrawal handled.
• Privacy policy and notice. HIPAA obligations, documentation on the six-year rule.

Part 5 — Drugs, devices and waste

• Drug procurement and storage policy. Sources, temperature monitoring, expiry checks with a named owner.
• Controlled substance policy. The § 780-112 record and its two-year clock, access limits, counts, discrepancy procedure.
• Prescribing policy. The § 872.8 query duty, where it is evidenced, the § 21.284 supply limits.
• Device policy. Maintenance and calibration records, manufacturer training per operator, escalation.
• Waste policy. Segregation, marking under § 284.414, hauler credentials and shipping papers under § 284.701.

Part 6 — Personnel and competency

• Credentialing policy. Primary source verification at hire and at a stated interval.
• Scope acknowledgment policy. A signed, role-specific statement of the boundary.
• Competency assessment policy. Per-procedure, named assessor, observable elements, remediation.
• Training calendar. Bloodborne pathogens on its three-year record, privacy, emergency response, devices.

Part 7 — Safety, emergencies and review

• Infection control policy. Hand hygiene, skin preparation, single-use discipline, instruments, cleaning.
• Exposure control plan. The 1910.1030 plan, its annual review and safer-device documentation.
• Emergency response policy. The physician-approved standing protocol, algorithms, kit contents, drills.
• Incident and adverse event policy. Internal record, review, and the federal reports that apply.
• Complaint policy. Intake, response, and the escalation path if a board inquiry follows.

Which Policies Change When an Esthetician, an RN, or a CRNP Performs the Service?

Three change every time: the authorising instrument, the supervision standard and the documentation set. A manual describing services without describing who performs them has skipped the only variable Pennsylvania cares about.

When an esthetician performs it

The authorising instrument is the Cosmetology Board licence itself, and the policy question is a boundary rather than a delegation. Pennsylvania licenses an esthetician to perform esthetician services, and a physician's delegation cannot expand that scope where the practitioner's own licensing act or board forbids the act — § 18.402 says so directly. The documentation is therefore inverted: instead of a delegation record you want a signed scope acknowledgment recording what this person does not do. Pennsylvania issues no laser or energy-device operator credential, which is not the same as saying anyone may operate one.

When an RN performs it

Now delegation is live, and so are three documents that were not needed a paragraph ago: the physician's authorisation, the per-procedure competency assessment, and the per-patient determination that the delegation creates no undue risk. Where a registered nurse takes consent under the 2021 amendment, that must sit inside a written policy and within a delegated scope. The RN cannot prescribe, so any prescription product needs an order traceable to a prescriber in the chart.

When a CRNP performs it, and the three-column rewrite

The CRNP arrives with authority the other two roles lack, and paperwork the others do not generate: a collaborative relationship meeting the § 21.251 definition, and where prescribing is involved a § 21.285 agreement kept on site, filed with the Bureau and reviewed biennially. Prescriptive authority may not be delegated onward. Write your high-volume procedures in three columns — esthetician, RN, CRNP — showing the authorising instrument, the supervision standard and the required documents for each. Practices that do this find boundary problems while writing, which is the cheapest possible moment to find one.

The Documentation Failures That Most Often Surface in Pennsylvania Complaints

Not missing binders — mismatches, borrowed numbers and paper describing a practice nobody runs. Investigations rarely turn on the absence of a document. They turn on a document that says something the practice cannot support.

The retention number borrowed from the wrong board

A policy citing § 16.95 in a practice supervised by a DO, or a number imported wholesale from a neighbouring state, tells a reviewer that nobody read the governing rule — a small error with an outsized cost, because it is the first thing checked.

Consent architecture that still assumes Shinal

Five years after the amendment, this state is full of manuals asserting that only a physician may obtain informed consent — and practices behaving inconsistently with their own policy as a result. Either position can be defended; the mismatch cannot.

Oversight documents that describe a different practice

Agreements promising weekly chart review that never happened; an availability standard nobody could meet; a matrix listing services abandoned two years ago and omitting the device bought last spring. A document that overstates your oversight is worse than a thinner accurate one: it sets the standard you will be measured against, then supplies the evidence you missed it.

The drug log that was never separated from the chart

Practices adding a weight loss or hormone line rarely revisit the drug policy, and the § 780-112 record is the one most often absent entirely — discovered at the worst possible moment, when someone asks to see it.

Requirement or Best Practice? The Pennsylvania Split

The left column is tied to published Commonwealth or federal text; the right is defensible practice with no Pennsylvania rule behind it.

Required by cited text	Best practice only
Medical record content and retention (49 Pa. Code §§ 16.95, 25.213)	An SOP or policy manual as a named document
Physician assistant written agreement and countersignature (§§ 18.142, 18.159)	A written medical director agreement
CRNP prescriptive authority collaborative agreement, filed and reviewed biennially (§ 21.285)	A delegation matrix, in that form
Delegation conditions and patient disclosure (§ 18.402; 63 P.S. § 422.17)	Per-procedure competency assessments as documents
Records access on written request (§ 16.61)	Emergency kit contents and drill schedules
Controlled substance record, two years (35 P.S. § 780-112)	Internal incident and adverse-event reports
PDMP query duties (35 P.S. § 872.8)	Annual policy review cadence
Exposure control plan, training records, sharps log (29 CFR 1910.1030)	Scope acknowledgments for estheticians and unlicensed staff
HIPAA documentation retention, six years (45 CFR § 164.316)	Photography and marketing consent as separate instruments

Read the right-hand column before dismissing it: several of those items are the only evidence by which a left-hand column requirement can be proved. The Commonwealth mandated the obligations and left you to invent the proof.

Frequently Asked Questions

This guide is informational and is not legal advice. Pennsylvania statutes, regulations and board practice change, and how any provision applies turns on facts this page cannot know. Confirm current requirements against the published statute and regulation text and with a licensed Pennsylvania healthcare regulatory attorney before adopting or relying on any policy described above.