PRP & PRF for Aesthetics 2026: Who Can Perform & Is It Legal?

Why PRP/PRF Is the Legal Core of Regenerative Aesthetics

"Regenerative aesthetics" has become one of the fastest-growing — and most legally treacherous — corners of the med spa market. Exosomes, stem-cell products, and various "biologics" are marketed with dramatic promises and, often, dramatic regulatory exposure. Sitting quietly at the center of that category is the one procedure that is genuinely ownable: platelet-rich plasma (PRP) and its second-generation cousin, platelet-rich fibrin (PRF). The reason is one word — autologous.

PRP and PRF are prepared from the patient's own blood, concentrated, and returned to that same patient. Nothing is sourced from a donor, a cell line, or a manufacturer. That single fact is what keeps these treatments inside the practice of medicine and out of the biologic-drug pathway that turns exosomes into a compliance minefield. If you want a regenerative offering you can defend to a board, an insurer, and a plaintiff's attorney, PRP/PRF is where you build it.

Autologous Means Lower Regulatory Risk

Because PRP is derived from and returned to the same patient, it is generally regarded as a lower-regulatory-risk treatment. It is prepared using FDA-cleared centrifuge systems, and when used within the practice of medicine — a licensed provider treating a patient after an exam — it sidesteps the stringent regulations that apply to manufactured biologics. That does not make it unregulated. It means the rules that govern it are the familiar med-spa rules: scope of practice, delegation, good-faith exams, informed consent, and blood-handling standards. Those are rules you can actually satisfy with documentation, which is exactly why PRP/PRF is buildable.

Where PRP/PRF Sits Next to Exosomes and Stem Cells

The contrast is the whole point. Exosomes and stem-cell products are typically allogeneic — sourced from donor cells or manufactured — which pushes them toward the biologic-drug framework and, in the FDA's current view, leaves no approved product for aesthetic use. PRP and PRF avoid that fork entirely by never leaving the autologous lane. We cover the exosome side of this line in depth in our companion guide on whether med spas can offer exosomes; the short version is that PRP is the legal option and exosomes are the one that can get a practice in trouble. If you are deciding what "regenerative" services to actually put on your menu, start from the autologous end.

PRP vs PRF: What Is Actually Different

Owners and patients use "PRP" and "PRF" almost interchangeably, but they are two different concentrates produced by two different processing methods. Understanding the difference matters clinically — and it matters for your consent forms and SOPs, which should name the specific product you use. From a compliance standpoint the two are handled almost identically; the differences are in preparation and release kinetics.

PRP — Single or Double Spin, With Anticoagulant

PRP is produced by drawing blood into a tube containing an anticoagulant (to keep the sample liquid) and spinning it in a centrifuge to separate the platelet-rich plasma layer from red cells. Some protocols use a single spin; others use a double spin to further concentrate platelets. The result is a liquid plasma rich in platelets, growth factors, and cytokines that is injected or applied promptly. Because the anticoagulant keeps it fluid, PRP is easy to inject through fine needles — but its growth-factor release is comparatively rapid and transient.

PRF — No Anticoagulant, One Slow Spin

PRF flips two variables: no anticoagulant and a single, slower spin. Without an anticoagulant, the blood begins to clot naturally during centrifugation, forming a three-dimensional fibrin matrix that physically traps platelets, leukocytes, and growth factors. That scaffold releases growth factors more slowly — studies describe sustained release over roughly one to two weeks rather than minutes — which is why PRF is often called a "second-generation" concentrate. A systematic review comparing the two for periorbital rejuvenation illustrates how actively this is still being studied; see the peer-reviewed PRP-versus-PRF review for the current evidence picture, which remains mixed.

Which One for Which Treatment

In practice, PRP has the larger evidence base and the longer track record, particularly for hair restoration; PRF's fibrin matrix makes it attractive for injections where a slower, sustained release and a slightly thicker consistency are desirable. Many practices offer both. The compliance takeaway is simple: your SOP and consent should specify which concentrate you use and how it is prepared, but the legal framework — autologous blood product, off-label aesthetic use, medical scope, OSHA handling — is the same for both. Do not let "PRF is newer" convince anyone it escapes the rules that govern PRP; it does not.

The Off-Label-but-Legal Status

The most common anxiety owners have about PRP is some version of "is this even legal?" The honest, defensible answer is that aesthetic PRP is off-label but legal — a distinction that trips people up because "off-label" sounds like a violation and is not. Getting this framing right is the difference between a program that markets confidently and one that either overclaims or needlessly avoids a legitimate service.

What the FDA Actually Clears

The FDA does not "approve PRP." It clears the devices used to make it — the centrifuges, tubes, and kits — as Class II medical devices, typically through the 510(k) pathway. The cleared indication on most of those kits is narrow: often the preparation of platelet-rich plasma to be mixed with bone graft material in orthopedic or dental settings. Facial rejuvenation, microneedling-with-PRP, and hair restoration are not the cleared indication. That is the source of the "off-label" label: the device is cleared, but you are using the output for a purpose outside the specific indication in the clearance letter.

Why "Off-Label" Is Not "Illegal"

Off-label use of a cleared device or approved drug by a licensed clinician is a routine, lawful part of the practice of medicine. Physicians and the providers they delegate to use products off-label constantly — it is how much of medicine advances. What the FDA regulates is manufacturer marketing of off-label uses, not a clinician's decision to use a product for a patient. So a med spa performing PRP under medical direction, with a good-faith exam and informed consent, is practicing medicine off-label — which is legal. Where practices get into trouble is not the off-label use itself; it is advertising unproven claims, operating outside scope, or skipping the exam and consent. Keep your claims conservative and your process documented and PRP stays firmly on the right side of the line.

How This Differs From Exosomes

This is where autologous versus allogeneic becomes decisive. Off-label use of a cleared device to process a patient's own blood is legal. Injecting a manufactured or donor-derived exosome product is a different animal: the FDA has stated there are no approved exosome products for these uses, so the issue is not "off-label use of an approved thing" but "use of an unapproved biologic," which can constitute distributing an unapproved drug. PRP's autologous status is what keeps it in the first, defensible category. If you remember one sentence from this article, make it this: the patient's own blood keeps you in the practice of medicine; someone else's cells push you toward the drug-approval pathway.

Who Can Draw the Blood (Phlebotomy Scope)

Every PRP and PRF treatment begins with a blood draw, and that step is the first place scope-of-practice discipline matters. A venipuncture is not a spa service — it is a medical act, and the person performing it must be licensed and trained to do so. This is one of the most overlooked compliance points in regenerative aesthetics, precisely because the draw feels routine.

Blood Draw Is a Medical/Nursing Act

Drawing blood is within the scope of registered nurses, nurse practitioners, physician assistants, and physicians, and — where state law allows and under proper supervision — certified phlebotomists and appropriately trained medical assistants. It is not within an esthetician's license. An esthetician performs surface skin-care services; venipuncture is nowhere in that scope. So in a compliant PRP workflow, an esthetician may not draw the patient's blood, even if the same esthetician is cleared to perform superficial cosmetic services elsewhere in the practice. The draw must go to a clinician whose license includes it, operating under the practice's medical direction. This is the same scope logic that governs who may inject neuromodulators — see who can inject Botox in the United States for the parallel framework on delegated medical acts.

Delegation and the Good-Faith Exam

As with any medical procedure in a med spa, the authority to draw and treat flows from a delegation structure. Before the first draw, a provider authorized to do so must perform a good-faith exam (GFE) establishing that the patient is an appropriate candidate — reviewing history, medications, bleeding risk, active infection, and realistic expectations. The delegating physician (or, where permitted, an NP) owns the protocol and standing orders that authorize the nurse or phlebotomist to perform the draw. Skipping the GFE is one of the most frequently cited failures across aesthetic medicine, and PRP is no exception: no exam, no valid delegation, no defensible treatment. Confirm your state's specific rules on who may perform and who may delegate phlebotomy with your medical and nursing boards.

Who Can Inject or Apply PRP/PRF (Scope + Delegation)

Once the blood is drawn and processed, the concentrate has to go somewhere — injected into the dermis or scalp, or applied topically to skin opened by microneedling. Each of those routes is its own scope question, and each keeps PRP firmly in medical territory.

Injection Is a Medical Act

Injecting PRP or PRF — whether into the face for rejuvenation, under the eyes, or into the scalp for hair restoration — is the administration of a substance into the body, which is the practice of medicine. It sits alongside dermal filler and neuromodulator injection in scope terms: performed by physicians, NPs, PAs, and, under delegation and standing orders, registered nurses, subject to state law. An esthetician cannot inject PRP. The injector must be trained, competent, and working within a delegation chain anchored by the medical director, with the good-faith exam completed first. The autologous nature of the product does not change who may inject it; a needle entering a patient is a medical act regardless of what is in the syringe.

Topical Application During Microneedling

The other delivery route is topical: PRP applied to the skin's surface during or immediately after microneedling, so it can penetrate through the micro-channels the needles create. It is tempting to think that "just applying it topically" is a lower-scope act — but the skin has been deliberately punctured to the dermis, so the PRP is being introduced into opened tissue, and the microneedling itself is the gating procedure. That means the scope bar is set by the microneedling, not by the fact that the PRP is spread rather than injected. Which brings us to the treatment everyone actually asks about.

Microneedling With PRP (The "Vampire Facial")

The "vampire facial" — microneedling with topical PRP — is the most famous PRP treatment and the one most likely to be performed out of scope, because it looks, superficially, like a facial. It is not. It is a stack of two regulated medical acts, and treating it as a spa service is how practices end up in a compliance file.

How the Combined Treatment Works

In a vampire facial, the patient's blood is drawn and processed into PRP; the provider then performs microneedling to create controlled micro-injuries in the skin and applies the PRP so its growth factors absorb through the channels. The theory is that combining collagen-inducing microinjury with concentrated growth factors amplifies rejuvenation. Whatever the aesthetic merits, the procedure involves a venipuncture and dermal-depth skin puncture and reintroduction of blood — three reasons it is unambiguously medical.

The Scope Stack — Two Procedures in One

Compliance for a vampire facial means satisfying the scope requirements of both underlying procedures. The blood draw needs a clinician qualified in phlebotomy. The microneedling, because it penetrates the dermis, is generally the practice of medicine restricted to nurses, NPs, PAs, and physicians under delegation and medical director oversight — the exact framework laid out in our sibling guide on who can perform microneedling. If you also use a radiofrequency device, the bar rises again, as covered in our RF microneedling protocol guide. In most states an esthetician can do neither the draw nor dermal-depth microneedling, so a compliant vampire facial is a medical treatment delivered by clinicians — not a facial with a marketing name. Because two procedures stack, your consent and documentation must cover both, and your infection control has to account for blood on a punctured face. That last point is where the most serious cautionary tale in this entire field comes from.

PRP for Hair Restoration

If PRP has a flagship use with real evidence behind it, it is hair. Scalp PRP for androgenetic alopecia (pattern hair loss) is the application with the strongest published support, which makes it both a strong service offering and a place to keep expectations honest.

The Strongest Evidence Base

Multiple studies have found that PRP injections into the scalp can improve hair density and thickness in androgenetic alopecia, and it is widely used as a standalone or adjunct treatment. The evidence is stronger here than for most facial PRP indications — but it is not a cure. Results vary between patients, protocols differ, and maintenance sessions are typically required to sustain benefit. Your marketing should reflect that reality: describe PRP hair restoration as an evidence-supported treatment that improves density for many patients with ongoing sessions, not as a guaranteed regrowth solution. Conservative claims are both more honest and less likely to draw regulatory attention.

Scope and Consent for Scalp PRP

Legally, scalp PRP is treated like any other PRP procedure. It is off-label (the kit is a cleared device, not an approved hair-loss drug), performed under the practice of medicine, and requires the full stack: a blood draw by a qualified clinician, injection into the scalp by a provider within scope, a good-faith exam, and informed consent. The consent should specifically set expectations about variable results and the need for maintenance, because unmet expectations drive complaints even when the treatment was performed flawlessly. As always, the autologous nature keeps regulatory risk low relative to sourced biologics — but the scope and consent discipline is non-negotiable.

Blood Handling, OSHA, and Infection Control

Everything above concerns who may perform PRP. This section concerns how it must be handled — and it is the part of a PRP program where a lapse does not just create liability, it can seriously harm patients. The moment blood is drawn, you are working with a bloodborne-pathogen hazard, and federal workplace law applies.

The OSHA Bloodborne Pathogens Standard

The OSHA Bloodborne Pathogens Standard (29 CFR 1910.1030) governs any workplace where employees can be exposed to blood — which describes every PRP procedure. It requires a written exposure control plan, personal protective equipment (gloves and appropriate barriers), engineering and work-practice controls, safe sharps handling and disposal in approved containers, hand hygiene, surface decontamination, hepatitis B vaccination offered to at-risk staff, and post-exposure evaluation procedures. These are not optional best practices; they are enforceable federal requirements. The full standard is published at OSHA's bloodborne pathogens page, and it should be the backbone of your PRP infection-control SOP. For the broader program, see our med spa infection control protocol guide.

The New Mexico "Vampire Facial" Cautionary Case

The reason these rules exist in their strictest form is written into public-health history. A CDC investigation traced at least three HIV infections to PRP microneedling "vampire facials" at an unlicensed New Mexico spa — the first documented cases of HIV transmission through a cosmetic injection-type procedure. Investigators found the facility reused single-use disposable equipment across clients and stored unlabeled tubes of blood and injectables in a kitchen refrigerator alongside food. The details are stomach-turning precisely because every failure was preventable with basic blood-handling discipline. The CDC's own conclusion was that requiring adequate infection-control practices at spas offering cosmetic injection services prevents transmission of HIV and other bloodborne pathogens. Read the primary source — the CDC MMWR report on the New Mexico cluster — and let it anchor your staff training. This is the case every PRP program should know.

Single-Use, Labeling, and Point-of-Care Rules

The operational rules that prevent a New Mexico scenario are concrete. Every tube, needle, cannula, and microneedling cartridge that contacts blood must be single-use and single-patient — never reprocessed, never shared. Each patient's blood must be clearly labeled with identifiers from draw to reinjection to eliminate any possibility of a mix-up. PRP should be processed and used point-of-care, on the same patient, in the same visit, using closed-system kits designed for the purpose. Blood is never stored near food or in non-medical refrigerators. Sharps go straight into approved containers. None of this is exotic; it is the standard of care, and documenting that your practice follows it is what separates a defensible program from a headline. The American Med Spa Association maintains practical guidance for operators building these programs at americanmedspa.org.

Consent and Documentation

PRP and PRF are procedures where documentation does double duty: it satisfies the compliance requirement and it manages the expectations that drive most patient dissatisfaction. Because outcomes are variable and the science is still evolving, honest, specific paperwork is one of your best protections.

What PRP/PRF Consent Must Disclose

Informed consent for PRP or PRF should be treatment-specific — a generic facial consent is inadequate for a procedure that draws and reintroduces blood. It should disclose the realistic risks: bruising, swelling, infection, the small but real bloodborne-pathogen considerations inherent to blood procedures, and the possibility that results are modest or require multiple sessions. Critically, it should state plainly that aesthetic PRP is an off-label use of the device and that individual results vary, so no specific outcome is guaranteed. For vampire facials, consent must cover both the microneedling and the PRP; for scalp PRP, it must address variable regrowth and maintenance. Setting expectations in writing, signed before treatment, is where consent stops being a formality and starts being a defense.

The Chart Record

Beyond the consent form, the chart should capture the full picture of each PRP treatment: the good-faith exam and candidacy determination; the specific product and preparation method (PRP versus PRF, single or double spin, kit used); the provider who drew the blood and the provider who injected or applied it, with credentials; lot numbers of disposables where applicable; the treatment areas and technique; and any adverse events with follow-up. This record is what a board investigator, insurer, or attorney will request first, and its completeness is frequently the difference between a defensible file and an indefensible one. The same documentation discipline that governs the rest of your practice applies here — see our overview of the med spa policy and procedure manual for how PRP records fit the larger system.

Building a Compliant PRP/PRF Program

Pull the threads together and a compliant PRP/PRF program is not about any single rule — it is a system that keeps every treatment autologous, in scope, cleanly handled, and documented. Two artifacts anchor that system, and both should exist on paper before your first patient.

The Scope-of-Practice Matrix

A scope-of-practice matrix maps each credential in your practice — esthetician, medical assistant, phlebotomist, LPN, RN, NP, PA, physician — to exactly what they may do in the PRP workflow: who may perform the good-faith exam, who may draw blood, who may process the sample, and who may inject or apply the concentrate, consistent with your state's rules. Done well, the matrix prevents the most common failure mode in regenerative aesthetics: a team member drifting into a step their license does not cover — an esthetician doing the draw, or a nurse injecting without standing orders. Make the delegation chain explicit and put it where staff can see it.

The Documentation Checklist

Behind the matrix sits the paperwork that proves compliance: a PRP/PRF SOP signed and dated by the medical director; standing orders authorizing the delegated providers to draw and treat; an OSHA exposure control plan and blood-handling protocol; a documented good-faith exam before each new patient's first treatment; treatment-specific informed consent naming the off-label status; device and preparation records; and an adverse-event protocol. Keep product, provider, and technique in the chart for every treatment. When a board or insurer asks how you knew the right person performed the right step under the right handling, this documentation is the answer — and its absence is treated, in litigation, almost the same as having done nothing at all. Pre-written, physician-ready PRP/PRF SOPs, blood-handling protocols, delegation templates, and consent forms live in the Skin & Laser Protocol Kit. Tomorrow's post in this series tackles the harder question of where exosomes fall — and why PRP remains the safer regenerative bet — and the whole cluster consolidates into our microneedling laws by state pillar.