September 2, 2026 16 min read

Utah Med Spa Compliance Checklist 2026

Utah issues no med spa facility licence, so there is no permit to hold up when someone asks whether you are compliant. What you hold up instead is a file — and Utah's unusually explicit delegation statute tells you exactly which documents have to be in it.

Quick Answer

There is no Utah med spa licence to obtain and no routine inspection to pass. Compliance means being able to prove, per procedure and per staff member, that the structure in Utah Code 58-1-505 and 58-1-506 was followed: a qualifying supervisor, a documented delegation group for everyone on the floor, 80 hours of documented education for anyone performing nonablative cosmetic medical procedures, a prescriber evaluation behind every prescription drug, and the patient-facing notices the statute requires. DOPL enforces this after a complaint, not before — so the file has to be right on an ordinary Tuesday, not on the day someone announces they are coming.

Every other guide in this cluster answers one question. This one is the index: it turns them into a list of documents you either have or do not have, with the artefact named on each line.

Every item is marked Required — a statute or rule we can cite imposes it — or Recommended, our judgement about defensible practice. Each section closes with what DOPL would actually ask to see, and where Utah is silent we say so. The primary sources sit in our Utah med spa regulations reference.

In short

Utah has no med spa facility licence and no inspection cycle. It has instead one of the most explicit delegation statutes in the country, so a Utah compliance file is not a permit folder — it is evidence. Two files carry the weight and are almost always the ones missing: a delegation-group evidence file recording which group each person falls in and the licence that puts them there, and an 80-hour documented education file for everyone performing nonablative cosmetic medical procedures. Build those first, then the ten sections below.

What a Utah Med Spa Compliance Checklist Is Actually For

There is no licence at the end of this

Discard the mental model most checklists are built on. In several states compliance has a terminal object: a facility permit, a certificate in the post. Utah issues none of those — no facility licence, no cosmetic registration, no application in which you describe your services and get permission.

What Utah imposes instead is the cosmetic medical facility requirement in 58-1-505: a cosmetic medical procedure may be performed only in a physician's office, or a facility that has a supervisor performing the supervision 58-1-506 requires. That is a condition on how you operate, not a document you obtain.

What replaces the permit: proof, per procedure and per person

So are you compliant? resolves in Utah to a narrower question: can you show, for this treatment on this patient by this staff member, that the 58-1-506 structure was followed? Every requirement is met by producing a particular piece of paper — an authorisation, a verification, a written instruction, an education record. Which is why Utah practices fail on documentation far more often than on staffing: the licences are usually right, and the evidence they were checked is not.

How to use this list

Work top to bottom once, building each named file. Then re-run sections 2, 3 and 8 at every hire and every renewal, because those decay silently as staff change. Nothing here substitutes for advice from a Utah healthcare attorney.

The Two Evidence Files No Generic Checklist Has

File one: the delegation-group evidence file

Utah Code 58-1-506 names two tiers to whom a cosmetic medical procedure may be delegated. Group A: a physician assistant acting in accordance with the Utah Physician Assistant Act, a registered nurse, a master esthetician, and an electrologist if evaluating for or performing laser hair removal. Group B: a practical nurse or esthetician licensed under Title 58, and a medical assistant. Every member must be acting within their respective scope of practice.

The group is not a job title. It is a determination you make about each person, and it drives the supervision tier for their work. So it needs to exist as a record:

  • Required. Delegation group determination sheet — one page per staff member naming the person, the group they fall in, and the specific Title 58 licence and number that puts them there.
  • Required. Dated DOPL licence verification for that licence, printed or screenshotted from DOPL's public lookup rather than transcribed from a certificate the employee supplied.
  • Recommended. Scope-ceiling note — a short statement of what that person may and may not do, recording that group membership was checked separately from scope.
  • Recommended. Re-verification date, tied to the licence renewal cycle rather than the hiring anniversary.

That third line matters most. Group membership sets the supervision tier for a task the licensee could already lawfully perform; it never enlarges a licence. A master esthetician sits in group A and still may not inject — the trap our guide to who can inject Botox in Utah works through licence by licence.

File two: the 80-hour documented education file

Subsection 58-1-506(2)(f) requires the supervisor to verify, before delegating, that the delegate has appropriate training, holds an unrestricted Title 58 licence or performs under the supervising physician's licence, and has maintained competence through documented education and experience of at least 80 hours, as further defined by rule. R156-1-506 supplies the content.

Both group definitions incorporate that test by reference, so the hours are constitutive of membership: an RN who cannot evidence 80 hours is not a qualified group A member, whatever their nursing licence says.

  • Required. 80-hour education record, one per delegate performing nonablative cosmetic medical procedures, itemised against the twelve R156-1-506 topics rather than filed as a stack of device certificates.
  • Required. Current CPR certification for health care providers — named in R156-1-506 as part of the required content, from the American Heart Association, the American Red Cross or its affiliates, or the American Safety and Health Institute.
  • Recommended. Topic-coverage matrix — the twelve topics against your staff, so gaps are visible at a glance rather than found during an investigation.
  • Recommended. Complication-management module evidence, held separately — it is a named topic and the one most often absent from vendor training.

The twelve topics: standards of care for nonablative cosmetic medical procedures; skin physiology; skin typing and analysis; skin conditions, disorders and diseases; pre and post procedure care; infection control; laser and light physics; laser technologies and applications; laser safety and maintenance; the procedures the individual may perform under Title 58; recognition and management of complications; and current CPR certification. The list is visibly laser-weighted, which tells you what DOPL treats as the risk.

What DOPL would ask to see: the determination sheet, the licence verification as of the treatment date, and the 80-hour documentation for each person named. A verification printed after the complaint arrived proves the opposite of what you want.

Section 1 — Entity, Ownership and the Structure File

What Utah does and does not restrict

Utah has no general corporate practice of medicine prohibition of the kind that shapes ownership in California or Texas, so lay ownership is broadly available. The restriction that bites is entity-specific: the Utah Professional Corporation Act at 16-11-8 bars anyone from being an officer, director or shareholder of a professional corporation unless licensed to render the same services, with shares issued in violation being void. The professional LLC provisions are more permissive, so the form you choose decides whether a lay investor is routine or fatal. Our guide to who can own a med spa in Utah works through the structures in detail.

The documents

  • Required. Certificate of organisation or articles of incorporation, filed with the Utah Division of Corporations and Commercial Code, plus current registered agent details.
  • Required. Operating agreement or bylaws, signed and matching the entity in use — not a template naming members who left.
  • Required, if a professional corporation. Shareholder register evidencing that every shareholder holds a licence to render the same professional services, per 16-11-8.
  • Recommended. Cap table with transfer restrictions, so a share transfer cannot accidentally create the voidness problem above.
  • Recommended. Management services agreement, if you use an MSO, with the fee methodology documented and the clinical entity — not the manager — owning the patient record.
  • Recommended. Municipal business licence and premises lease — local requirements that vary by city, not a DOPL matter.

What DOPL would ask to see: its jurisdiction runs to licensees rather than entities, so it rarely opens with corporate documents. It asks when the question becomes who directed the clinical decision — an MSO agreement letting a manager appoint or remove the supervisor draws attention.

Section 2 — The Supervisor Appointment and the Authorisation Trail

The appointment itself

Utah Code 58-1-505 defines the supervisor narrowly: a physician with an unrestricted licence under Chapter 67 or 68, or an APRN with an unrestricted licence under Chapter 31b. Nobody else qualifies — not a PA, not an RN, not an owner — and the role may pass only to another individual who independently qualifies. Utah never says medical director, so the relationship must be created deliberately. Our guide to Utah med spa medical director requirements covers what belongs in the agreement.

  • Required. Written supervisor appointment, naming the individual, identifying the 58-1-505 role expressly, and listing the procedures authorised.
  • Required. Dated evidence the licence is unrestricted, re-verified at each renewal. A probationary or stipulated licence still permits practice and does not support the supervisor role.
  • Recommended. Named alternate supervisor who independently qualifies, with their own verification on file. Without one, a single disciplinary restriction leaves you with no lawful basis to operate.

The authorisation trail

Every supervision definition in 58-1-506 is built on the phrase has authorized the procedure to be done on the patient. Authorisation is patient- and procedure-specific. A protocol pre-approving everyone who books is a record that no authorisation happened.

  • Required. Per-patient, per-procedure authorisation, recorded in the chart with the date and the authorising supervisor identified.
  • Required. Written instructions for every delegation to a group B member — the indirect supervision definition requires them in writing, and a verbal briefing does not satisfy it.
  • Required. Supervision tier map, service by service, recording which of the three tiers applies and who must therefore be physically present.
  • Recommended. Contemporaneous presence log — rota, sign-in sheet or scheduling export showing where the supervisor was. The single most valuable optional record in a Utah file.

Why the tier map is not optional in practice

Utah defines its supervision levels rather than gesturing at them, and the difference is measured in physical distance. Direct: authorised, and the supervisor present and available for face-to-face communication where and when the procedure is performed. Indirect: authorised, written instructions given, and the supervisor present within the cosmetic medical facility. General: available in a timely and appropriate manner, in person, to evaluate and initiate care for a suspected adverse reaction.

Presence is not availability. A practice running group B staff while the supervisor covers from elsewhere is doing what the indirect definition rules out, and phone access does not cure it.

What DOPL would ask to see: the appointment, the licence verification, the authorisation, the written instructions if indirect supervision applied, and evidence of presence consistent with the tier. That last is where files fail: nobody reconstructs where the supervisor stood eighteen months ago unless something recorded it.

Section 3 — Licensure and Credentialing for Every Role on the Floor

The roster

Build one credential file per person, not one folder for the practice. Utah's esthetics credentials were restructured on 1 January 2026 by Senate Bill 330 of the 2025 General Session, which reorganised the Cosmetology and Associated Professions Licensing Act and added a 200-hour basic esthetics permit. Filing everyone as esthetician now hides a distinction that decides group membership. Our Utah esthetician scope of practice guide maps which treatments each tier actually reaches.

  • Required. Individual credential file per staff member, distinguishing a basic esthetics permit from an esthetician licence from a master esthetician licence rather than collapsing all three.
  • Required. Dated DOPL verification per licence, with status and any restrictions recorded.
  • Required. Physician assistant collaboration evidence, where applicable — 58-70a-307 grades collaboration by post-graduate clinical hours, so the file needs the hours record and any collaborative agreement still required.
  • Recommended. Credential expiry calendar with reminders set before the renewal date, not after.
  • Recommended. Job description per role stating the scope ceiling plainly, so no internal title — medical aesthetician, cosmetic injector — does work the licence underneath cannot.

The one role we will not give you a verdict on

A medical assistant is expressly named in group B, and the statute contemplates a delegate performing under the licence of the supervising physician and surgeon rather than holding a Title 58 licence. Read literally, that appears to permit delegation to a qualified medical assistant under indirect supervision. Whether DOPL reads it as reaching a prescription drug we could not confirm. So the entry is: get written DOPL confirmation before staffing this model, and keep the answer in the file.

What DOPL would ask to see: the identity, licence number and status of everyone involved, and the basis on which each was permitted to act. Where someone held no Title 58 licence, expect the question to turn to which provision you relied on.

Section 4 — Good Faith Examination, Prescriptions and Standing Orders

Utah does not use the phrase, and still requires the substance

No Utah statute says good faith exam, and the requirement arrives from two directions. Neurotoxin, filler and every GLP-1 are prescription drugs, so a prescriber must establish the relationship and evaluate to the standard of care before ordering. And 58-1-506 separately requires patient-specific authorisation before any delegate begins.

The evaluation belongs to a prescriber: a physician, an osteopathic physician, an APRN, or a PA within 58-70a-307. Not an RN, an LPN, a medical assistant or a master esthetician. Strip it out and an otherwise tidy delegation becomes unlicensed practice.

  • Required. Prescriber evaluation record per patient, dated, identifying the evaluating prescriber by name and licence.
  • Required. Prescription or order naming the product, dose or units, and treatment area — recorded before the delegate begins, not written up afterwards.
  • Required. Medical history and contraindication screening, current for the treatment, not carried forward indefinitely from an intake completed two years ago.
  • Recommended. Telehealth record where the evaluation was remote — identity verification, consent, and why the standard of care was met without a physical examination.
  • Recommended. Re-evaluation trigger policy stating when a returning patient needs a fresh evaluation rather than a repeat order.

The standing order that is not a standing order

Practices often hold a document titled standing orders listing products and doses. It is useful, and it is not an authorisation: a protocol says what may be done in general, while 58-1-506 asks who authorised this procedure for this patient. Keep both, labelled as different things.

What DOPL would ask to see: the complete patient record — evaluation, order, consent, and the treatment record identifying who performed the procedure and on whose authority. The first question about a bad outcome is not who injected but who evaluated, and when.

Every line on this checklist is a document. Here they all are.

The Operations & Compliance kit is the paperwork behind the list: the policy and procedure manual, delegation and supervision records, consent forms, HIPAA and records retention policies, training and education logs, and an inspection-ready file structure you can drop Utah's delegation groups straight into.

View Operations & Compliance Kit — $197

Section 5 — Consent Forms by Procedure Type

What Utah actually requires, stated honestly

This is where a careless checklist overstates the law. Utah's informed consent provision at 78B-3-406 sits in the Health Care Malpractice Act and is a litigation rule, not a licensing one: it presumes a patient who submits to care has authorised it, and puts on the patient the burden of proving the care carried a substantial and significant risk of serious harm they were not told about. Written consent is not mandated there for cosmetic procedures generally; what it does is shift the evidentiary position decisively in your favour.

So we mark the consent set recommended rather than required — and recommend it about as strongly as anything here. The genuinely required patient-facing paper in Utah is different, and appears in section 8.

The consent set

  • Recommended. Neurotoxin consent — product named, off-label use disclosed where applicable, onset and duration, and the specific risks including ptosis and asymmetry.
  • Recommended. Dermal filler consent, separate from neurotoxin, disclosing vascular occlusion and blindness as recognised risks and naming the reversal agent held on site.
  • Recommended. Laser, IPL and energy device consent, with Fitzpatrick type recorded and post-inflammatory hyperpigmentation disclosed.
  • Recommended. Microneedling consent recording the intended needle depth, which is the only document that can later show a treatment stayed within the master esthetics ceiling.
  • Recommended. Chemical peel consent by depth — superficial, medium and deep are different procedures with different supervision consequences and should not share a form.
  • Recommended. Weight-loss and hormone programme consent, disclosing compounded status expressly where the product is compounded.
  • Recommended. Telehealth consent, where the evaluation is remote.
  • Recommended. Consent for treatment of a minor, executed by a parent or guardian, with a written policy on which services you refuse to minors.

Two drafting notes. Name the performer and the supervisor on each form, so it dovetails with the patient notice below. And have consent signed after the prescriber evaluation, not at reception with the intake pack.

What DOPL would ask to see: the signed consent, whether it names the actual performer, and whether its date sits after the evaluation. A consent signed at 9:02 against an evaluation timed 9:20 tells an investigator what you would rather it did not.

Section 6 — The Medical Record, Retention and HIPAA

What a Utah chart has to be able to answer

Reduce the statute to a test: if your chart cannot answer who evaluated, who authorised, who performed, and under which tier, it will not answer DOPL either. Everything else is detail around those four facts.

  • Required. Treatment record per visit identifying the performer by name and credential, the authorising supervisor, and the supervision tier applied.
  • Required. Product record — product, lot number, expiry, units or volume, and injection or treatment map.
  • Required. Records transfer procedure. R156-67-502 makes knowingly failing to transfer records when properly requested unprofessional conduct, and that duty runs to the licensee personally — it cannot be signed away to a management company.
  • Recommended. Photograph set at baseline and follow-up, stored in the record rather than on a phone.

Retention: where Utah is not explicit

Retention is where checklists routinely assert a Utah rule that does not exist. Utah sets no universal minimum for office-based practice; the Medical Practice Act rule requires records to be kept consistently with applicable law and professional standards, without naming a number. The figures people quote come from the licensed facility rule at R432-600-21 — at least seven years after the last date of care, and for a minor until majority plus two years.

  • Recommended. Written retention policy adopting the seven-year benchmark and the minors rule — labelled as a policy you adopted, not a Utah med spa mandate.
  • Recommended. Destruction log recording what was destroyed, when, and under whose authority.
  • Recommended. Custodian arrangement naming who holds the records if the practice closes or the supervisor departs.

Our med spa medical records retention guide sets the state-by-state picture out in full.

HIPAA and the vendors

  • Required, if you are a covered entity. HIPAA privacy and security policies, a notice of privacy practices, a documented security risk analysis, and workforce training records. Most med spas transmitting any claim electronically are covered; cash-only practices sometimes are not, and should settle which in writing.
  • Required, where applicable. Business associate agreements with the EMR, the booking platform, the billing service and any MSO touching patient data.
  • Recommended. Breach response procedure with the notification timelines written down before you need them.

What DOPL would ask to see: the complete patient record. DOPL does not enforce HIPAA — that is the federal Office for Civil Rights — but an incomplete or reconstructed chart damages you in both forums simultaneously.

Get the Free Med Spa Compliance Checklist

The full practice-readiness audit — the yes/no checkpoints behind every file above, so you can find your documentation gaps before a regulator does.

No spam. Unsubscribe anytime.

Section 7 — Drug Sourcing, Storage and the Dispensing Licence

Sourcing diligence

Utah's Pharmacy Practice Act at Title 58 Chapter 17b, administered by DOPL with the Utah State Board of Pharmacy, requires pharmacies operating into Utah to be licensed here. Under R156-17b an out-of-state mail-service pharmacy shipping into Utah falls within the Class D classification. Diligence has two halves; most practices ask only the federal one.

  • Required. Supplier licence verification file — for every source of prescription product, its Utah pharmacy licence number confirmed against DOPL, alongside its FDA registration status.
  • Required. Purchase records tying each vial to an invoice from a verified source, so anything on the shelf can be traced back.
  • Recommended. Compounding diligence note distinguishing a 503A pharmacy compounding against an individual prescription from a 503B outsourcing facility — the only lawful route to office stock with nobody's name on it.

Two sourcing routes sit outside any Utah licence and belong on no checklist except as prohibitions: product labelled research use only, and patient-supplied or imported vials. Our Utah GLP-1 weight-loss compliance guide works through the sourcing position as it stands in 2026.

The dispensing medical practitioner licence — an item most Utah lists miss

Utah draws a line between administering a drug in your office and dispensing one for the patient to take away. The second is the practice of pharmacy: a physician, osteopathic physician, PA, nurse practitioner or optometrist who dispenses prescription drugs must hold a dispensing medical practitioner licence from DOPL under Part 8 of Chapter 17b.

Injecting neurotoxin in the treatment room is administration. Handing a patient a GLP-1 pen or a take-home course is dispensing, and a weight-loss programme is the commonest way a Utah med spa crosses the line without noticing.

  • Required, if you dispense. Dispensing medical practitioner licence for the individual practitioner, and the dispensing clinic pharmacy licence where the clinic structure requires it.
  • Required, if you dispense. Dispensing log with labelling that meets pharmacy standards.
  • Recommended. Written administer-versus-dispense policy stating which of your services fall on which side of the line.

Storage and controlled substances

  • Required. Temperature log for refrigerated product, maintained daily, with an excursion procedure.
  • Required. Lot, expiry and disposal records, plus a recall procedure that can identify affected patients from the chart.
  • Required, if you handle controlled substances. DEA registration plus a controlled substance inventory and log. Testosterone is Schedule III, so hormone programmes engage this where injectables and lasers do not.
  • Recommended. Secure storage with documented access control.

One point of accuracy: Utah's Controlled Substance Database check duty at 58-37f is written around Schedule II and III opioids. A med spa prescribing neurotoxin, filler or a GLP-1 does not trigger it. Several national checklists list a blanket database check as a Utah requirement; it is not one.

What DOPL would ask to see: where product came from, who ordered it, and the storage records. A complaint about a bad batch becomes a sourcing inquiry quickly, and an invoice from an unlicensed supplier turns a clinical question into a licensing one.

Section 8 — Device Records, Training Logs and the Patient Notices

The patient-facing notices Utah genuinely requires

This is the most concrete patient-facing obligation in Utah cosmetic practice. For nonablative cosmetic medical procedures, Utah Code 58-1-506 and R156-1-506 between them require that the patient receives written information giving the name and licensing information of the supervisor and of the person performing the procedure; that the supervisor's name is prominently posted at the facility; that a copy of the supervisor's licence is displayed on the wall; and that the patient has a telephone number answered within 24 hours.

They are cheap to satisfy and easy to fail, because they must be accurate on the day. A packet naming a supervisor who left in March, or a framed licence of a physician no longer engaged, is a failure an investigator confirms in seconds.

  • Required. Patient written notice naming the supervisor and the performer with licensing information, issued per treatment and matching the chart.
  • Required. Posted supervisor notice displayed prominently in the facility.
  • Required. Wall-displayed copy of the supervisor's licence.
  • Required. 24-hour follow-up telephone line, with a documented answering arrangement — not a voicemail nobody clears at weekends.
  • Recommended. Quarterly notice review, so posted names never lag the rota.

The device file

Utah operates no state laser registration scheme for cosmetic devices that we could verify, and we will not list one. What Utah regulates is who may operate the device and under what supervision — so the device file is an evidence file, not a permit file.

  • Recommended. Device inventory with make, model, serial number and FDA clearance reference.
  • Recommended. Manufacturer manual and service records, including calibration and repair history.
  • Recommended. Per-device operator training record, distinct from the 80-hour file, showing who was trained on which platform and when.
  • Recommended. Settings and endpoint recorded per treatment — fluence, spot size, passes, and for microneedling the depth, the only record that can retrospectively prove a treatment stayed within scope.
  • Recommended. Eyewear and laser safety procedure, with the safety officer named.

What DOPL would ask to see: the operator's training documentation, the 80-hour file, and the treatment record showing the parameters used. Where a burn or pigment change is alleged, the settings record separates a defensible judgement from an unexplained one. Our med spa inspection guide covers how to rehearse producing these under time pressure.

Section 9 — Adverse Events, Emergency Protocols and Insurance

Emergency preparedness

Utah's general supervision tier is defined around exactly this scenario: the supervisor must be available in a timely and appropriate manner, in person, to evaluate and initiate care for a suspected adverse reaction. That is a staffing commitment with a documentation consequence.

  • Required. Written emergency protocols covering anaphylaxis and, where filler is offered, vascular occlusion — the supervision structure presupposes a response capability, and R156-1-506 names complication management as required education.
  • Recommended. Emergency kit inventory with expiry log, including hyaluronidase where hyaluronic acid filler is used and epinephrine for anaphylaxis. Utah mandates no specific contents list that we could verify; this is standard-of-care practice, not a citable rule.
  • Recommended. Transfer and emergency services procedure naming the receiving facility.
  • Recommended. Drill record, annually, with attendance.

Adverse event logging and reporting

  • Recommended. Adverse event log recording what happened, who was notified, what was done and the outcome — kept whether or not anything is reportable.
  • Required, in defined circumstances. Reporting procedure. DOPL operates a healthcare provider reporting requirement obliging licensees and licensed health care facilities to report certain unlawful or unprofessional conduct in writing, including conduct resulting in disciplinary action or a significant adverse impact on public health, safety or welfare. We could not confirm the exact code section against a primary source, so the item is to obtain DOPL's current reporting guidance and keep it with the procedure rather than rely on our paraphrase.

That duty is not a general obligation to report every clinical complication. A bruise, a nodule or an asymmetry managed properly is a chart entry, not a filing.

Insurance

  • Recommended. Professional liability policy covering the entity and each clinician individually, with the aesthetic procedures you actually perform named on the schedule.
  • Recommended. Separate evidence of the supervisor's own coverage, and confirmation that supervising cosmetic procedures is within it.
  • Recommended. General liability and premises cover, plus cyber cover where you hold patient data.

We could not identify a Utah statutory insurance mandate, so every line here is recommended. The commercial point is sharper than the legal one: carriers commonly exclude acts outside the insured's scope, so an out-of-scope treatment can be both the claim and the reason it is denied.

What DOPL would ask to see: the protocols in force at the time, the adverse event record, and what the supervisor did when contacted. Insurance is not DOPL's concern, which is why nobody checks it until it matters.

Section 10 — Advertising, Photo Consent, and Where Utah Is Silent

The name on your door is a staffing rule

Utah Code 58-1-507 is short and widely ignored. A facility performing cosmetic medical procedures may not advertise or hold itself out as a medical spa, medical facility or medical clinic unless it has an individual on the premises, while such a procedure is performed, licensed under Chapter 67, Chapter 68, or as an APRN practising as a nurse practitioner under Chapter 31b.

Read that as an operations requirement, not a marketing one: a copy problem with a rota answer, usually owned by people who never compare notes. Note too that the 58-1-507 list is narrower than the supervisor definition — it names the nurse practitioner role — so satisfying 58-1-505 does not automatically satisfy it.

  • Required, if you use those words. Rota evidence showing a qualifying individual on the premises whenever cosmetic medical procedures are performed.
  • Recommended. Advertising review record — website, social profiles and directory listings checked against the name rule and against your actual staffing.
  • Recommended. Claims substantiation file. Avoid guaranteed outcomes, medically supervised where nobody supervises, and FDA approved attached to a compounded preparation — false, and precisely what the FDA writes letters about.
  • Recommended. Marketing agreement review against R156-67-502, which reaches percentage-of-revenue referral arrangements that owners rarely think of as fee-splitting.

Before-and-after photographs

  • Recommended. Specific written photo consent for the specific use — clinical record, website, social media and paid advertising are four different permissions, not one.
  • Recommended. Withdrawal procedure letting a patient revoke consent, with a record of removal.
  • Recommended. Image provenance log confirming every published image is your own patient. Stock or manufacturer images presented as your results add a consumer-protection problem to a professional one.

Where Utah is genuinely silent or unsettled

Four honest gaps. First, the medical assistant delegation question in section 3 — the text is broader than most operators expect and DOPL's reading is unconfirmed. Second, retention for office-based practice, where seven years is a facility standard adopted by analogy. Third, the reporting section number in section 9, which we deliberately did not assert. Fourth, SB 330's esthetics permit vocabulary against the older administrative rules, not visibly conformed when we checked.

The build order: identify a qualifying supervisor and verify the licence is unrestricted; assign every staff member to a delegation group in writing; check the scope ceiling separately from the group; document the 80 hours against the twelve topics; map the tier service by service; put the patient notices up and keep them current; and require a prescriber evaluation and patient-specific authorisation every time. Rather than drafting the underlying manuals, consent forms and delegation records from scratch, our library of med spa SOP and compliance templates covers the documentation behind every line above.

Bottom line

Utah gives you no licence to obtain and no inspection to pass, which makes the evidence file the whole of compliance. Build the delegation-group determination and the 80-hour education file first — they are constitutive of lawful delegation and usually what is missing. Put the supervisor appointment, the per-patient authorisation and the written instructions behind them. Then satisfy the four patient-facing notices in 58-1-506, the cheapest requirements here and the easiest to be caught failing.

Every guide in this cluster sits on the Utah med spa compliance hub, and you can compare Utah against every other state in our med spa regulations by state reference.

This article is for informational purposes only and does not constitute legal or medical advice. Utah scope-of-practice, delegation and supervision rules are administered by the Utah Division of Professional Licensing within the Department of Commerce, advised by the Utah Physicians Licensing Board, the Utah Board of Nursing, and the Utah Board of Cosmetology and Associated Professions, and they change over time. Items marked Required reflect a statute or administrative rule we were able to cite; items marked Recommended are our view of defensible practice and not legal obligations. Where Utah is silent or genuinely unsettled — the medical assistant delegation question, retention for office-based practice, and the reporting section number among them — we have said so rather than guessed. Confirm current requirements with DOPL and consult a Utah healthcare attorney before relying on this list.

Frequently Asked Questions

What does a Utah med spa need to be compliant in 2026? +
Not a licence — Utah issues no med spa facility licence at all. What it needs is evidence that the structure in Utah Code 58-1-505 and 58-1-506 was followed: a cosmetic medical procedure supervisor who is a physician or an APRN with an unrestricted licence; a written delegation group determination for every person on the floor; at least 80 hours of documented education under R156-1-506 for anyone performing nonablative cosmetic medical procedures; a prescriber evaluation and patient-specific authorisation behind every treatment; written instructions where indirect supervision applies; and the patient notices 58-1-506 requires, including the supervisor's posted name and a telephone number answered within 24 hours.
Does DOPL inspect med spas in Utah? +
Not on a routine cycle. Because Utah issues no med spa facility licence, there is no periodic facility inspection of the kind a licensed health facility receives. DOPL acts on complaints, which reach its Bureau of Investigation from patients, competitors, former employees, other licensees and state agencies, and may be filed anonymously. An investigation typically opens with a letter setting a response deadline. The practical consequence is that you cannot prepare for a Utah inspection, because you will not be told one is coming — the file has to be defensible on an ordinary day.
What documents does a Utah med spa need on file? +
At minimum: the written supervisor appointment and dated proof the supervisor's licence is unrestricted; a delegation group determination and licence verification per staff member; the 80-hour education record per delegate, itemised against the twelve R156-1-506 topics; per-patient, per-procedure authorisations; written instructions for every group B delegate; a supervision tier map by service; complete treatment records naming the performer and the authorising supervisor with product, lot and expiry; consent forms by procedure type; the patient written notice naming supervisor and performer; supplier licence verifications; and device and training logs. Formation documents and insurance sit behind those.
Do you need a licence to open a med spa in Utah? +
No facility licence, but that is not the same as no requirements. You register the entity with the Utah Division of Corporations and Commercial Code, and you may need a municipal business licence. What Utah imposes clinically is the cosmetic medical facility condition in 58-1-505: cosmetic medical procedures may be performed only in a physician's office or a facility where a supervisor is performing the supervision 58-1-506 requires. That is the provision that defeats mobile-injector, hotel-suite and in-home models however the entity is registered. Individual practitioners, of course, need their own DOPL licences.
How long does a Utah med spa have to keep patient records? +
Utah does not set a single explicit minimum for office-based private practice, and we would rather say that than quote a number that is not in the rule. The Medical Practice Act rule requires records to be maintained consistently with applicable law and professional standards without naming a period. The specific figures widely quoted come from the licensed facility rule at R432-600-21: at least seven years after the last date of patient care, and for a minor until the age of majority plus two years, in no case less than seven. Adopting that as written policy is defensible practice rather than a med spa mandate.
What is the 80-hour requirement for Utah med spa staff? +
Subsection 58-1-506(2)(f) requires a supervisor to verify, before delegating, that the delegate has maintained competence to perform nonablative cosmetic medical procedures through documented education and experience of at least 80 hours, as further defined by rule. R156-1-506 lists the content: standards of care, skin physiology, skin typing and analysis, skin conditions and diseases, pre and post procedure care, infection control, laser and light physics, laser technologies and applications, laser safety and maintenance, the procedures the individual may perform under Title 58, complication recognition and management, and current CPR certification. Because the group definitions incorporate the test by reference, a delegate without the hours is not a qualified group member.
Can a Utah practice call itself a medical spa? +
Only on a staffing condition. Utah Code 58-1-507 provides that a facility performing cosmetic medical procedures may not advertise or hold itself out as a medical spa, medical facility or medical clinic unless it has an individual on the premises, while a cosmetic medical procedure is performed, licensed under Chapter 67, Chapter 68, or as an APRN practising as a nurse practitioner under Chapter 31b. So the name is a rota commitment. Note the list is narrower than the 58-1-505 supervisor definition, which means satisfying the supervisor rule does not by itself satisfy the advertising rule.
Does Utah require written consent for cosmetic procedures? +
Not as a general licensing rule, and we will not overstate it. Utah's informed consent provision at 78B-3-406 sits in the Health Care Malpractice Act and is a litigation standard: it presumes a patient who submits to care has authorised it, and requires the patient to prove the care carried a substantial and significant risk of serious harm of which they were not informed. Written consent is not mandated there for cosmetic procedures generally; what it does is shift the evidentiary position decisively in the provider's favour. Treat consent forms as strongly recommended rather than statutorily required, and note that the genuinely required patient paperwork in Utah is the 58-1-506 notice naming the supervisor and the performer.

Every Protocol, Ready to Adapt

Stop assembling the file. Start from a complete one.

All 62 SOPs across injectables, laser, weight loss, hormones, operations and emergencies — supervision and delegation records, consent forms by procedure type, emergency protocols, records and retention policies, and the training logs Utah's 80-hour requirement expects you to keep.

View Complete Suite — $997

More Utah compliance guides on the Utah med spa compliance hub.