Texas Med Spa Compliance Checklist 2026: Full Audit List

Texas med spa owners rarely fail an audit for never having heard of a rule. They fail because the rules live in five rulebooks run by five agencies, none of which publishes a document titled "what a med spa must do." This page is the consolidation: each section states the Texas position, names the authority, says where the state is silent, and ends in tickable items.

1. Who Regulates a Texas Med Spa, and What Each One Can Take

No single license, no single inspector — five overlapping authorities, and a finding by one routinely produces a referral to another.

The medical and nursing boards

The Texas Medical Board licenses physicians and enforces the Medical Practice Act. It is the primary regulator of everything a med spa sells, because nonsurgical medical cosmetic procedures are the practice of medicine here. TMB acts against the physician license — the practice holds none to suspend, which is why the physician carries the exposure. The Board of Nursing separately regulates RNs, LVNs and APRNs under the Nursing Practice Act and 22 TAC Chapter 217; a nurse who accepts an assignment beyond their competence faces board action regardless of what the physician authorized.

TDLR, DSHS, TCEQ and HHSC

TDLR holds barbering and cosmetology at 16 TAC Chapter 83 and laser hair removal at 16 TAC Chapter 118 — the only one of the five that certifies an aesthetic procedure and registers the facility performing it. DSHS runs Radiation Control under 25 TAC Chapter 289 and supplies the medical waste definitions used for sharps; TCEQ carries disposal at 30 TAC Chapter 326. The Health and Human Services Commission licenses facility types such as ambulatory surgical centers, so a med spa doing only nonsurgical work typically holds no HHSC license.

2. Entity and Ownership: The Corporate Practice of Medicine Audit

Texas enforces the corporate practice of medicine doctrine strictly, and a sophisticated complaint attacks it first, because it is structural.

The rule, and who may own

A business entity not owned and controlled by licensed physicians generally may not employ physicians to practice medicine or own the practice delivering medical services. Because Texas classifies nonsurgical medical cosmetic procedures as the practice of medicine, the entity delivering injectables, medical lasers and prescription-based aesthetic services sits inside that restriction. Texas Occupations Code Chapter 162 offers limited alternatives, including board-certified nonprofit health organizations directed by physicians actively engaged in practice with all medical decisions set by physicians — a narrow route, not a workaround for an investor.

The two-entity structure

The conventional lawful arrangement is a physician-owned professional entity holding the clinical practice, plus a separately owned management services organization providing administration, marketing, staffing and premises at fair market value. The failure mode is rarely the structure; it is an agreement that quietly hands the manager control over hiring clinicians, setting protocols, or overriding a clinical decision. That is the paragraph an investigator reads. See our guide to who can own a med spa in Texas.

3. The Delegating Physician and What the Agreement Must Contain

Texas creates no licensed title called "medical director." It requires a delegating physician. Owners hire for the title; investigators audit for the function.

Where the rule lives in 2026, and what it requires

The historic home of the med spa rule was 22 TAC §193.17, Nonsurgical Medical Cosmetic Procedures, adopted in 2013 inside Chapter 193 on standing delegation orders. In the restructuring effective January 9, 2025, the board moved that content into 22 TAC §§169.25 through 169.29, with §169.28 the section most cited in med spa coverage. The framework carried forward largely intact; the section numbers did not, so a binder citing 193.17 is right on substance and stale on citation. A covered procedure includes injecting medication or substances for cosmetic purposes, administering colonic irrigations, and using a prescription medical device for cosmetic purposes. Each performer must be readily identifiable by a name tag showing identity and credentials. At least one person trained in basic life support must be on site whenever a procedure is performed. Each facility must post a notice in every public area and treatment room giving the delegating physician name and Texas medical license number. And procedures are not permitted without a physician or midlevel practitioner on site, or a physician available for emergency consultation after an adverse outcome. Our Texas 2026 regulatory changes guide tracks the restructuring.

What belongs in the written agreement

Texas publishes no fill-in-the-blanks medical director agreement and no rule dictates the commercial terms. A defensible one carries the physician identity and license number, the procedures delegated, the supervision model and availability commitment, the review obligations accepted, compensation at fair market value unrelated to referrals, insurance and indemnity, and termination with a patient transition plan. Our Texas medical director requirements guide walks the clauses one by one.

4. Standing Delegation Orders, Protocols and the Good-Faith Exam

Delegation is not a status conferred by association. It is documents that either exist on the date of the procedure or do not.

The written instruments, and what a usable protocol contains

Texas Occupations Code Chapter 157 is the delegation statute: a physician may delegate to a qualified and properly trained person under the physician's supervision any medical act the delegate is competent to perform. Chapter 164 is the discipline side of the Medical Practice Act, and improper delegation sits within it. The instrument is a standing delegation order naming a specific delegate, a standing medical order covering a class of delegates, a clinical protocol for a service line, or a prescriptive authority agreement where prescribing is involved. The test for each is whether a stranger to your practice could read it and know exactly what is authorized: the act, the drug or device, who may perform it, eligibility and exclusion criteria, screening, supervision, escalation triggers, review cycle, and the physician signature and date. A protocol without exclusion criteria and escalation triggers is a marketing document. Renew on a fixed cycle: an instrument signed by a physician who has since left the practice authorizes nothing, and the date on the signature is the first thing an investigator checks.

The good-faith exam, in person and by telemedicine

Before any medical cosmetic treatment, a physician, PA or APRN must perform a good-faith examination establishing the diagnosis and treatment plan. Patient-completed intake forms are not an exam; neither is a nurse's assessment. Texas Occupations Code Chapter 111 subjects a professional delivering a service by telemedicine to the same standard of care that would apply in person, so synchronous audiovisual telemedicine is a viable route and no prior in-person visit is required. What is required is that the remote encounter genuinely meet the in-person standard, with access to relevant records. A perfunctory video call attached to an already-scheduled treatment will not survive scrutiny.

5. Who May Inject: Nurse, APRN and PA Scope in Texas

Injection is the most audited act in a med spa, and Texas answers in two rulebooks that must both be satisfied.

Scope by role

A Texas-licensed physician may perform any of it. PAs and APRNs inject under physician delegation, and where prescribing is involved they need a prescriptive authority agreement — Texas is not an independent practice state for APRNs. An RN may administer neuromodulators and dermal fillers under valid delegation but does not originate the treatment decision: there must be a good-faith exam and an order for that patient, plus a standing delegation order or protocol covering the act. The Board of Nursing separately holds the nurse to 22 TAC Chapter 217 — standards of practice at §217.11, unprofessional conduct at §217.12 — including the duty to decline an assignment beyond their competence. Below RN level, Texas gives no bright line: the rules permit delegation to a qualified and properly trained person and publish no list by license type. The defensible reading is that the lower the credential, the heavier the physician's burden to evidence training, competence assessment and supervision — and an unlicensed injector is an enforcement target regardless of paperwork. Our Texas Botox delegation guide covers the role-by-role detail.

The prescriptive authority agreement

Texas Occupations Code §157.0512 sets the content: in writing, signed and dated; names, addresses and professional license numbers; the nature of the practice and its locations or settings; the categories of drugs or devices that may be prescribed; a plan for consultation and referral; a plan for patient emergencies; and the process for communication and information sharing. It must be reviewed at least annually, dated and signed, and quality assurance meetings conducted and documented. Section 157.0513 has the board maintain a public, searchable list of who holds an agreement with whom — so a patient or competitor can verify your arrangement from outside.

6. Laser Hair Removal Certification and the Rest of the Laser Room

Texas licenses laser hair removal as its own occupation and routes every other aesthetic laser through medical delegation. Assume one credential covers both and you get cited.

The four TDLR tiers, the facility and the consulting physician

TDLR administers laser hair removal under 16 TAC Chapter 118 and issues four individual certificates: apprentice-in-training, technician, senior technician and professional. Entry is a 40-hour training course leading to the apprentice-in-training certificate. Technician requires performing at least 100 laser hair removal procedures within 12 months under the direct supervision of a senior technician or professional; senior technician requires directly supervising 100 procedures within 12 months, audited by a professional; professional is the tier that can register a facility. Certificates run two years, and renewal requires eight hours of continuing education at every tier. The facility is registered separately and must contract with a consulting physician and designate an alternate, each maintaining a primary practice site within 75 miles — treat that as a hard filter when recruiting.

The 2026 rule position, and every other laser

Chapter 118 is current and active. The Texas Commission of Licensing and Regulation readopted it after the required four-year rule review, with the notice published in the March 13, 2026 Texas Register, and adopted amendments across several subchapters in 2026 — verify the sections your program depends on rather than trusting a training provider's summary. There is no TDLR certificate for resurfacing, vascular, pigment or tattoo-removal lasers; authority for those comes from physician delegation, with the same protocol and supervision discipline as an injection. DSHS Radiation Control separately registers certain devices under 25 TAC Chapter 289 — send DSHS your device list rather than assuming you are outside the program. Our Texas laser safety guide covers classification and safety documentation.

7. Esthetician Scope: Where the Cosmetology License Stops

The Texas line between skincare and medicine is anatomical, not commercial — not the acid percentage on a bottle.

The line TDLR draws

Barbering and cosmetology were consolidated into 16 TAC Chapter 83 effective September 1, 2023. On the esthetics license, a Texas esthetician works on the surface of the skin: facials, manual and mechanical exfoliation, microdermabrasion, superficial peels acting only on the epidermis, extractions, masks, makeup and non-laser hair removal such as waxing. TDLR published a notice of intent to review Chapter 83 in the Texas Register in June 2026 under the standard four-year cycle, so confirm the current text before rewriting a job description around it.

What sits on the other side

Anything that penetrates or removes living tissue below the epidermis is a nonsurgical medical cosmetic procedure and belongs to the Medical Board: microneedling, medium and deep peels, injections and medical lasers. An esthetician may perform one only as a physician's delegate, with the same protocol, competence evidence and supervision as any other. Dermaplaning is the Texas-specific trap: TDLR has indicated that razor-tool dermaplaning falls under barbering and generally requires a Class A Barber license, while a medical scalpel points to the Medical Board. Our Texas esthetician skin scope guide maps each service to a side of the line.

8. Records, Retention, HIPAA, Consent and Photography

Most Texas complaints are won or lost on records — not because the treatment was wrong, but because the file cannot prove it was right.

What the chart must contain, and for how long

For every treated patient: identity and history, the good-faith exam with examiner and credential, the diagnosis and treatment plan, the signed consent, the treatment note naming who performed the procedure and under whose order, the product with lot number, the post-treatment instructions, and any follow-up or adverse event. The Texas Medical Board records rule requires retention for seven years from the date of last treatment, and where the patient was under 18 at the last treatment, until they reach age 21 or seven years from the last treatment, whichever is longer. Records tied to a civil, criminal or administrative proceeding may not be destroyed until the physician knows it is finally resolved. The rule was historically 22 TAC §165.1 and moved in the January 2025 restructuring — confirm the current section number before citing it.

HIPAA, the Texas overlay, and consent

HIPAA applies if you are a covered entity, and Texas adds a layer through the Medical Records Privacy Act at Health and Safety Code Chapter 181. Section 181.101 requires training on state and federal PHI law appropriate to the employee's duties within 90 days of hire, and requires each trained employee to sign a statement verifying completion. One point is widely misreported: there is no standing two-year retraining cycle in the statute — retraining is triggered by a material change in PHI law affecting duties, no later than the first anniversary of that change. Consent should be procedure-specific: what is done, by whom and under what credential, the material risks, alternatives, expected course, and that results vary. A generic spa waiver is not informed consent, and photography is a distinct permission with its own scope — clinical record, training, website, social, advertising — each use separately ticked and revocable.

9. Advertising and Before-and-After Claims

Two regulators read your marketing differently. TMB asks whether the claim is truthful and substantiated by a responsible licensee. The FTC asks whether the net impression on a consumer is deceptive.

The Texas Medical Board rules

Physician advertising sits at 22 TAC Chapter 164, and three provisions matter operationally. Every physician is responsible for the form and content of advertising for their practice and is deemed to have reviewed and approved it — you cannot delegate that to an agency. At the time an ad is placed, the licensee must already possess information substantiating the truthfulness of any representation of material fact in it. And a recording or copy of any advertisement must be retained for two years from the last date of communication. Where photographs of actual patients are used, patient consent must be obtained first. Separately, Texas Occupations Code Chapter 164 makes false or deceptive advertising a disciplinary matter under the Medical Practice Act.

The FTC layer and the before-and-after file

Federal law overlays claim substantiation, disclosure of material connections with endorsers, and testimonials — incentivized reviews, staff reviews posed as customer reviews, and atypical results claims without clear qualification are all exposure. Treat every before-and-after pair as an evidence package: the consent covering that use, the image dates, the treatment record, and a note of any editing or lighting change. Our Texas advertising compliance guide covers the FDA and FTC dimensions in full.

10. Drug Purchasing, Storage, DSCSA and Sharps

Everything in a vial carries a federal file too, and this is where a Texas med spa most often has correct practice and no paperwork.

Sourcing, storage and DSCSA in 2026

Prescription products must come through manufacturer-authorized channels, with invoices, lot numbers and delivery records retained; the purchasing file is the first thing a federal inspector reconstructs. Refrigerated stock needs continuous temperature monitoring with a retained log, physical security, expiry rotation and a documented disposal route. The Drug Supply Chain Security Act separately imposes enhanced drug distribution security requirements on trading partners, including dispensers. The FDA granted an exemption for small dispensers — those whose owning company had 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians as of November 27, 2024 — running until November 27, 2026. Two honest caveats: the exemption does not remove existing DSCSA obligations; and whether a med spa is a DSCSA dispenser at all depends on how it acquires and administers product, on which the agency has published no med-spa-specific guidance. That second question is one for counsel.

Sharps and medical waste

Sharps from a health care-related facility are medical waste and must be managed as special waste. Definitions sit at 25 TAC §1.132 under DSHS; storage, transport, treatment and disposal sit with TCEQ at 30 TAC Chapter 326. Treated sharps sent to a landfill require a written statement that the shipment was treated by an approved method. The federal OSHA bloodborne pathogens standard at 29 CFR 1910.1030 adds a written exposure control plan reviewed at least annually, a sharps injury log, hepatitis B vaccination offered to at-risk employees, and annual training.

11. Emergency Preparedness and Adverse-Event Response

The cosmetic-procedure rule already puts basic life support and physician availability on your floor. Build the emergency program around those anchors.

Protocols, the kit and the drill

At minimum, cover anaphylaxis, vasovagal syncope, filler vascular occlusion including the hyaluronidase pathway, burns and adverse device events, needlestick and exposure, and the transfer-to-higher-care decision with the receiving facility named. Each protocol names who acts, what is given, and when 911 is called — none should end at "call the physician." Stock is only compliant if in date and reachable: log contents and expiry, check monthly, and run a documented drill so the people rostered have rehearsed it. A drill you cannot evidence did not happen.

Adverse-event reporting

Texas publishes no general med spa adverse-event registry, so reporting duties come from elsewhere: the FDA MedWatch route for drug adverse events, the device reporting pathway, your liability carrier's notice terms, and any duty triggered by a board complaint. Because there is no single Texas form, write your own internal incident report and use it every time.

12. Staff Credentialing Files and Inspection Readiness

Everything above resolves into one question: when someone asks, can you produce it? Practices rarely fail for having no documents, but for not assembling them inside the response window.

The credential file, and what the regulators ask for

One file per clinical staff member: primary-source license verification with the date it was run, the expiry with a calendar reminder, training certificates, the competence assessment signed by the delegating physician, the delegation instrument naming them or their class, current BLS certification, the signed PHI training verification, bloodborne pathogen training records, and the hepatitis B offer or declination. A TMB matter usually arrives as a documents request, not a raid, and the categories are predictable: the delegating physician agreement, the standing delegation orders and protocols in force on the date of the incident, the prescriptive authority agreement for any APRN or PA, the full chart including good-faith exam and consent, the treatment record naming the performer and the order relied on, product records with lot and source, staff license verification and training records, photograph consent, and evidence of the posted notice. TDLR instead inspects its own programs: laser hair removal certificates and facility registration, consulting physician contracts, procedure logs, continuing education and, where cosmetology applies, establishment licenses. Our Texas inspection and violations guide covers the DSHS facility side.

Building the binder and rehearsing it

Assemble one binder, physical or digital, using the sections above as tabs, with an index and a named owner per tab. Then rehearse: pick a treatment date at random and produce the full document set, timed. If you would rather not draft it all from scratch, our med spa SOP and protocol kits cover the policy, protocol, consent and training templates behind most of these rows.

Two closing notes. Texas does not license med spas as a facility type, so no certificate proves you are compliant — compliance here is evidenced by documents, not a wall plaque. And several points above are genuinely unsettled: delegation below RN level for injections, and whether a med spa is a DSCSA dispenser, are questions the agencies have not answered cleanly. Where this article says a question is open, it is open — resolve those with Texas counsel in writing, and file the answer.

Disclaimer: This article is for educational purposes only and does not constitute legal advice. Texas med spa regulation is split across the Texas Medical Board, the Board of Nursing, TDLR, DSHS and federal agencies, and the Medical Board reorganized its rulebook in January 2025 — confirm current section numbers with the relevant agency. Consult a Texas healthcare attorney for advice specific to your practice.