What Protocols Does a Med Spa Need? The Full 2026 List
The complete, category-by-category inventory of the written protocols a compliant med spa needs in 2026 — and exactly who requires each one.
In short
A med spa needs one written protocol for every clinical service it performs, plus a universal set of emergency and operational protocols that apply no matter what you offer. Grouped by category, that is roughly 62 protocols across weight loss, injectables, skin and laser, body and wellness, hormone therapy, emergencies, and operations. A solo injector can open compliantly with 12 to 16; a full-service practice needs the whole library. This article lists them all, category by category, with the regulator or carrier that requires each one.
Ask ten med spa owners what protocols they need and you will get ten different answers — usually a vague list of "the ones for whatever we do." That is exactly the gap that gets practices cited, sued, or denied coverage. The real answer is specific and it is knowable: a compliant med spa needs a written protocol for every clinical service on its menu, plus a fixed set of emergency and operational protocols that apply to every practice regardless of specialty.
This is the full inventory. We have organized it into seven categories that mirror how services — and their risks — actually cluster: weight loss and GLP-1, injectables, skin and laser, body and wellness, hormone therapy, emergency protocols, and operations and compliance. For each category you get a table of the individual protocols, the reason each one is required (which board, which federal standard, which carrier, or which basic standard of care), and a link to the deeper guide where one exists. At the end you get two build lists: the minimum viable set for a new solo-injector spa, and the full 62-protocol library for a multi-service practice.
If you want the shorter framing of what "compliant" means as a whole, start with our companion piece on what med spa compliance actually requires. This article is the protocol-by-protocol layer underneath it.
- One protocol per clinical service you perform — no exceptions
- Plus a universal set: emergencies, intake, consent, HIPAA, training, medical director oversight, equipment
- Required by: state medical & nursing boards, OSHA, HIPAA, ANSI (lasers), and malpractice carriers
- How many: 12–16 for a solo injector; ~62 for a full-service med spa
- Every protocol must be signed and dated by your medical director
Why Written Protocols Are the Backbone of a Legal Med Spa
A med spa is a business that performs medical procedures. That single fact is what pulls you into the same regulatory world as a physician's office — even when the treatment feels like wellness or beauty. And in that world, the written protocol is the connective tissue that holds everything together. It is simultaneously the thing that authorizes a nurse to inject, the instruction set that keeps outcomes consistent across providers, and the document a plaintiff's attorney will subpoena first when something goes wrong.
Every delegated medical act in your practice — a nurse administering Botox, an esthetician running a laser, a medical assistant drawing up a GLP-1 dose — is only legal because a physician delegated it under a written protocol or standing order. Remove the protocol and the act becomes the unlicensed or unauthorized practice of medicine. That is why "which protocols do I need" is not a paperwork question; it is the question of which services you are legally allowed to offer at all.
Protocols also function as your operational spine. They guarantee that every provider screens the same contraindications, uses the same technique parameters, and responds to complications the same way. Without them, your clinical quality is only as good as whoever happened to be working that day — and your liability exposure balloons. If you have not yet built the umbrella document that houses all of this, read our guide to the med spa policy and procedure manual, and for the mechanics of writing a single SOP well, see our SOP writing guide. This article is about which protocols belong in that manual — not how to write one.
Who Actually Requires Your Protocols (Boards, OSHA, Carriers)
Before the inventory, it helps to know who is actually asking. "Because it's required" is not one requirement — it is four or five different bodies, each with a different reason, and each protocol below traces back to at least one of them.
State medical and nursing boards
This is the primary driver for every clinical protocol. Boards require that any delegated medical act be performed under a signed, written protocol or standing order that authorizes the specific procedure being performed. The trend since 2025 has been toward tighter documentation, not looser. Texas Medical Board Rule 169.28 now explicitly classifies non-surgical cosmetic procedures as the practice of medicine and requires all delegation to be in writing. California and Arizona have moved past generic standing orders entirely, requiring individualized patient-specific orders written after a Good Faith Exam before a delegate treats. The American Med Spa Association's summary of the Texas restructuring is a useful example of where the rules are heading nationally.
OSHA (federal, applies in every state)
Because your staff handle needles and blood, your med spa is covered by OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030), which requires a written Exposure Control Plan, annual review of that plan, a hazard communication program, and documented Hepatitis B vaccination offers. These are protocols in the compliance sense even though they are not clinical treatment SOPs — and inspectors do ask for them.
Malpractice carriers and accreditation bodies
Carriers increasingly request sample protocols during underwriting and write policy language that excludes coverage for an adverse event where no written protocol existed for the treatment involved. In other words, the protocol you skipped is exactly the one the insurer will point to when denying a claim. Voluntary accreditation bodies and, for lasers, the ANSI Z136.3 standard impose their own documentation expectations on top of the boards. The practical takeaway: build for the strictest requirement that touches each service, because that is the one that will be measured against you.
Weight Loss & GLP-1 Protocols
Weight-loss medicine is now the highest-volume — and fastest-scrutinized — category in the med spa world. GLP-1 programs involve prescription medication, dose titration, real metabolic risk, and (very often) compounded 503A/503B sourcing, all of which regulators and carriers watch closely. A weight-loss program needs about ten protocols. The monitoring piece is deep enough that we built a GLP-1 monitoring schedule template for it; the full clinical set lives in the Weight Loss Protocols kit.
Why regulators scrutinize GLP-1 programs
Semaglutide and tirzepatide are prescription drugs, so every dose requires a valid order tied to a Good Faith Exam and, in patient-specific-order states, an individualized order per patient. Compounded sourcing adds a second layer of exposure: your protocol has to document that product comes from a licensed 503A pharmacy or 503B outsourcing facility. This is where a missing or generic protocol converts an ordinary program into a board finding.
| Protocol | Why it's required |
|---|---|
| Patient screening & eligibility | Board — defines contraindications (personal/family MTC, MEN 2, pancreatitis) the GFE must clear before prescribing |
| Baseline labs & workup | Standard of care — establishes the metabolic baseline a carrier expects to see documented |
| Semaglutide dosing & titration | Board — the standing order must name the exact dose range each escalation stays within |
| Tirzepatide dosing & titration | Board — a separate drug needs a separate authorized dose ladder |
| Ongoing monitoring schedule | Standard of care — weight, vitals, tolerance, and lab cadence at each visit |
| Side-effect & GI management | Standard of care — nausea, gallbladder, pancreatitis red flags and dose-hold rules |
| Hypoglycemia management | Emergency overlap — required when patients also take insulin or sulfonylureas |
| Injection technique & drug storage | OSHA + standard of care — cold-chain, sharps, and self-injection teaching |
| Compounded 503A/503B sourcing | Board + FDA — documents legal sourcing and lot traceability of compounded product |
| Off-ramping & discontinuation | Standard of care — plan for tapering, maintenance, and weight-regain counseling |
Injectables Protocols
Injectables are the core of most med spas and the source of the category's single most dangerous complication — vascular occlusion. This set runs to about ten protocols, and it is the one carriers examine most closely because filler litigation is common and expensive. The full set lives in the Injectables Protocols kit.
The vascular occlusion protocol is non-negotiable
Every practice that injects filler must have a written vascular occlusion recognition-and-response protocol and hyaluronidase on-site — this is the emergency plaintiff attorneys probe first, and its absence is nearly indefensible. We cover the clinical detail in the vascular occlusion guide; the protocol itself must live in your manual, not just in someone's head.
| Protocol | Why it's required |
|---|---|
| Consultation & Good Faith Exam | Board — a GFE must precede any prescription injectable in nearly every state |
| Informed consent (per product) | Board + carrier — treatment-specific risks, benefits, and alternatives on the record |
| Neurotoxin administration | Board — dosing, dilution, and injection-site SOP for Botox, Dysport, Xeomin, Jeuveau |
| Hyaluronic acid filler | Board — technique and depth by region (lip, cheek, jaw, under-eye) |
| Biostimulator injectables | Board — reconstitution and technique for Sculptra and Radiesse differ from HA |
| PRP / PRF | Board + OSHA — autologous blood handling and preparation SOP |
| Aseptic technique & injection safety | OSHA + standard of care — single-use, skin prep, and sharps handling |
| Vascular occlusion recognition | Carrier + standard of care — the highest-liability filler emergency |
| Hyaluronidase reversal | Standard of care — dosing and escalation for occlusion and overcorrection |
| Complication management & follow-up | Carrier — nodules, infection, asymmetry, and referral pathways |
Skin & Laser Protocols
Lasers introduce a requirement no other category has: a formal safety program mandated by a national consensus standard. This set runs to about nine protocols, and the laser-specific ones carry both a burn-injury risk and a scope-of-practice minefield. The clinical set lives in the Skin & Laser Protocols kit.
You need a Laser Safety Officer
Under ANSI Z136.3-2024, any facility operating Class 3B or Class 4 lasers — which covers essentially every aesthetic laser on the market — must appoint a Laser Safety Officer and maintain a written laser safety program covering the controlled treatment area, mandatory eyewear, and documented operator training before anyone runs a device. The LSO can be your medical director, an NP, or a trained staff member; what matters is that the role, the training, and the written program exist on paper.
| Protocol | Why it's required |
|---|---|
| Laser safety program & LSO | ANSI Z136.3 — mandatory for any Class 3B/4 device; names the LSO and controlled area |
| Device-specific operating SOP | Board + manufacturer — each device (laser, IPL, RF) needs its own settings protocol |
| Laser hair removal | Board — parameters by device and hair/skin type; a top burn-claim source |
| RF microneedling | Board + OSHA — depth/energy settings plus blood-contact handling |
| Chemical peels | Board — agent, strength, neutralization, and depth-of-peel authorization |
| Fitzpatrick assessment & test spot | Standard of care — screens burn and dyspigmentation risk before full treatment |
| Burn & adverse-event management | Carrier — the response protocol when a treatment injures skin or eyes |
| Eye protection & controlled area | ANSI Z136.3 — eyewear, signage, and access control during laser use |
| Device maintenance & calibration | Manufacturer + carrier — logged service keeps a malfunction from becoming your liability |
Body & Wellness Protocols
The body and wellness category is broad — infusions, injections, and energy-based body devices — and it hides the highest sterility and systemic-reaction risk in the whole menu inside IV therapy. This set runs to about ten protocols; the clinical library is the Body & Wellness Protocols kit.
IV therapy carries the highest hidden risk
An IV drip delivers substances directly into the bloodstream, which means a compounding error or a sterility lapse becomes systemic in seconds. IV therapy needs its own screening, compounding/sourcing, administration, and reaction protocols, and in many states an individual physician order per infusion. We cover the regulatory landscape in the IV therapy compliance guide — but the protocols themselves are non-optional.
| Protocol | Why it's required |
|---|---|
| IV therapy screening & eligibility | Board — contraindications and the order/GFE required before infusion |
| IV compounding & additive sourcing | Board + FDA — documents sterile technique and legal source of each additive |
| IV administration & monitoring | Standard of care — line placement, rate, and observation during the drip |
| Infusion reaction management | Emergency overlap — response to rigors, anaphylaxis, or fluid overload |
| IM vitamin & nutrient injections | Board — dosing SOP for B12, lipotropics, and similar injectables |
| Cryolipolysis / body contouring | Manufacturer + board — applicator settings and cold-injury prevention |
| RF & EMS body devices | Manufacturer — energy settings and contraindication screening per device |
| Wellness / recovery treatments | Standard of care — red light, compression, and adjunct therapy SOPs |
| Sanitation & equipment cleaning | OSHA — surface, applicator, and reusable-item disinfection |
| Adverse reaction & escalation | Carrier — documented response and referral for any body/wellness complication |
Hormone Therapy Protocols
Hormone therapy is the category most likely to involve a DEA-scheduled drug, which raises the documentation bar above every other service. Testosterone is a Schedule III controlled substance, so a hormone program needs controlled-substance record-keeping on top of its clinical protocols — about ten documents in all. The clinical set is the Hormone Therapy Protocols kit.
Controlled-substance documentation is what gets audited
If your practice stores or dispenses testosterone, DEA-compliant inventory logs, storage, and prescribing records are not optional — they are the records a DEA or board audit will pull first. The clinical dosing protocols matter, but the controlled-substance handling protocol is the one that carries criminal, not just administrative, exposure.
| Protocol | Why it's required |
|---|---|
| Eligibility & baseline labs | Board + standard of care — hormone panel and workup before any prescription |
| Testosterone replacement (TRT) | Board — dosing, route, and titration SOP for a Schedule III drug |
| Bioidentical hormone therapy (BHRT) | Board — estrogen/progesterone regimens and compounded sourcing |
| Pellet insertion | Board — the minor-procedure SOP, aseptic technique, and consent |
| Thyroid management | Standard of care — dosing and lab-driven adjustment protocol |
| Controlled-substance handling | DEA — inventory logs, storage, and dispensing records for testosterone |
| Ongoing lab monitoring schedule | Standard of care — hematocrit, PSA, and hormone follow-up cadence |
| Informed consent (hormones) | Board + carrier — off-label and long-term risk disclosure on the record |
| Adverse-event management | Standard of care — polycythemia, cardiovascular, and mood red flags |
| Prescribing & refill policy | Board — who may prescribe, refill limits, and required re-evaluation |
Emergency Protocols Every Med Spa Needs
Emergency protocols are the one category that applies to every med spa regardless of service menu — because the emergencies happen regardless of what you meant to offer that day. This is roughly eight protocols, and it is the section most likely to save a life and a license simultaneously. The full set is the Emergency Protocols kit, and we maintain a free emergency protocol checklist you can audit against today.
The crash cart is a protocol, not just a box
Emergency medications and equipment must be on-site and governed by a written protocol that tells staff who does what. Anaphylaxis is the clearest example — epinephrine on the shelf is useless without a dosing-and-911 protocol and a trained team; see our deep dive on the med spa anaphylaxis protocol.
| Protocol | Why it's required |
|---|---|
| Anaphylaxis & severe allergy | Standard of care — epinephrine dosing, positioning, and 911 activation |
| Vascular occlusion escalation | Carrier — the filler emergency; hyaluronidase and specialist referral pathway |
| Vasovagal syncope | Standard of care — the most common med spa event; positioning and recovery criteria |
| Cardiac arrest & AED | Standard of care — CPR sequence, AED use, and EMS handoff |
| Seizure management | Standard of care — protection, timing, and transfer criteria |
| Severe hypoglycemia | Standard of care — required once you run GLP-1 or hormone programs |
| Local anesthetic toxicity (LAST) | Standard of care — for practices using topical/injectable anesthetic |
| Emergency supplies & 911 activation | Carrier + board — the crash-kit contents list and escalation decision tree |
All 62 protocols, already written.
The Complete Suite is this exact checklist as a finished library: every protocol in this article, professionally formatted and ready to adapt to your state and providers.
View Complete Suite — $997Operations & Compliance Protocols
The last category is the one every practice needs and most under-build: the operational protocols that govern the practice itself rather than any single treatment. This is roughly five documents, but they are the connective tissue an inspector reads first. The Operations & Compliance kit houses them.
Documentation is what inspectors actually read
Inspectors rarely watch you inject — they read your charts and your policies. Your documentation and charting protocol, your training records, and your policy manual are what convert good clinical work into a defensible practice. This is also where OSHA and HIPAA live, and where your staff training requirements get documented into evidence.
| Protocol | Why it's required |
|---|---|
| Policy & procedure manual / governance | Board + carrier — the umbrella document and medical director oversight model |
| Patient intake & informed consent | Board — GFE policy, history, and consent standards for every encounter |
| Staff training & scope of practice | Board — license verification and the credential-to-treatment matrix |
| HIPAA & privacy | HIPAA — Notice of Privacy Practices, BAAs, and breach notification policy |
| OSHA, documentation & inspection readiness | OSHA — Exposure Control Plan, charting standards, and inspection prep |
Get the Free Med Spa Compliance Checklist
See exactly which of these protocols your practice is missing. We'll email you the free checklist so you can audit your current protocol set against this list.
It usually lands in your Promotions tab (or spam) — move it to your inbox and add MedSpa Standards to your contacts so you don't miss it.
The Minimum Viable Protocol Set for a New Med Spa
You do not need all 62 protocols on day one — you need every protocol for every service you actually offer, plus the universal set. For most new practices, that is a much shorter list. The mistake is the opposite of over-building: opening with clinical SOPs but no emergency, consent, or OSHA protocols, which is exactly the gap inspectors and carriers punish.
The solo-injector starting point (12–16 protocols)
A new spa offering only neurotoxin and filler can be fully compliant with a focused set: the injectables clinical protocols (consult/GFE, consent, neurotoxin, HA filler, aseptic technique, vascular occlusion, hyaluronidase, complication management), the core emergency protocols (anaphylaxis, syncope, vascular occlusion escalation, cardiac arrest/AED), and the operational baseline (policy manual, intake/consent, HIPAA, OSHA Exposure Control Plan, staff training). That is roughly 12 to 16 documents — every one signed by your medical director before your first patient. This is also the cheapest, fastest path to the very thing a complete med spa compliance library gives you at scale.
What to add when you add a service
Every new service category is a new protocol bundle, not a single document. Add lasers and you inherit the entire skin-and-laser set plus the ANSI laser safety program — jumping you from the mid-teens into the low 20s. Add GLP-1 and you inherit ten weight-loss protocols and a hypoglycemia emergency SOP. The rule never changes: before you sell a service, the protocols for it must already be written, signed, and trained. Build the bundle first, advertise second.
The Complete 62-Protocol Checklist
For a full-service med spa — one offering weight loss, injectables, skin and laser, body and wellness, and hormone therapy — the numbers add up to the complete library. Here is how the categories total out.
How the numbers add up
| Category | Approx. protocols | Required by |
|---|---|---|
| Weight loss & GLP-1 | ~10 | Board, FDA, standard of care |
| Injectables | ~10 | Board, carrier |
| Skin & laser | ~9 | Board, ANSI Z136.3 |
| Body & wellness | ~10 | Board, FDA, OSHA |
| Hormone therapy | ~10 | Board, DEA |
| Emergency protocols | ~8 | Standard of care, carrier |
| Operations & compliance | ~5 | Board, OSHA, HIPAA |
| Full-service total | ~62 | All of the above |
That total is why the Complete Suite is bundled at 62 SOPs — it is not an arbitrary marketing number, it is the count of protocols a genuinely full-service med spa is expected to maintain. If you offer fewer categories, you need fewer; the library simply lets you switch a category on the day you decide to sell it, instead of scrambling to write ten protocols under a launch deadline.
How to Keep Your Protocols Current
Owning the protocols is only half the requirement — keeping them current is the other half, and it is the half practices forget. A protocol that was accurate in 2024 but does not reflect your 2026 device settings, drug sourcing, or your state's new patient-specific-order rule is, from an inspector's or attorney's perspective, close to no protocol at all.
Build an annual review cadence
At minimum, every protocol should be reviewed and re-signed by your medical director once a year, with a dated signature on each document — and OSHA independently requires your Exposure Control Plan to be reviewed at least annually. Trigger an out-of-cycle review whenever you add a service, change a device, change medical directors, or an adverse event exposes a gap. Version-control each document with a revision date so that, for any incident, you can prove the protocol in force was current for the procedure your practice actually performed. That paper trail is the difference between a defensible practice and an indefensible one.
The fastest way to get to a current, complete set is to start from professionally written protocols and have your medical director review and sign them, rather than drafting 62 documents from a blank page. That is precisely what the Complete Suite is built to do — and if you would rather start by finding your gaps, the free compliance checklist below the FAQ shows you where to look first.