Corrections & Updates Log
Last updated: October 6, 2026
Med spa operators use our guides to make compliance decisions. When we get a factual claim wrong, we fix the page and record the correction here: the date, the page, what it said before, what it says now, and the basis for the change. This log covers corrections made since July 1, 2026, newest first.
How we handle corrections
- When we find an error — in our own review, or because two of our pages disagree — we correct the page itself rather than adding a note beside the old text.
- We date the change: the corrected page's last-modified date in our sitemap is updated, and each entry below gives the date the correction went live.
- We record a correction here when a factual claim a reader could have relied on changed. Typo fixes, formatting, broken links, and pages we expand without changing an existing claim are not listed.
- Every change to the site is made in a version-controlled repository. Each entry below carries the reference of the change that made it.
Report an error
If you think something on this site is wrong, email support@medspastandards.com with the page address and the claim in question. A link to the rule, statute, or board document you are relying on helps us check it quickly.
Corrections
October 5, 2026 · Change ref: 6270eb6
HIPAA Compliance Guide for Med Spas — who HIPAA applies to
Before: The guide said any med spa that provides medical treatments or keeps patient records is a HIPAA covered entity, and that being cash-pay only makes no difference.
Now: It says a med spa is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction, such as an insurance claim or eligibility check (directly or through a billing service), and that a strictly cash-pay practice may fall outside HIPAA's direct reach while state privacy law still applies.
Basis: HIPAA's covered-entity test turns on standard electronic transactions, not on keeping records; this brought the guide into line with the correction to our testimonial and marketing consent guide (September 20, 2026, below).
October 5, 2026 · Change ref: 6270eb6
HIPAA Compliance Guide for Med Spas — civil penalty amounts
Before: The FAQ gave the top annual penalty as $1.9 million per violation category, while the penalty table on the same page gave $1,500,000.
Now: The FAQ matches the table — $100 to $50,000 per violation, with annual caps per violation category from $25,000 to $1,500,000 — and notes that these amounts are adjusted for inflation over time and should be confirmed with compliance counsel.
Basis: The page contradicted itself; we resolved it to the figures in its own penalty table and added the inflation-adjustment caveat, since current adjusted amounts can differ from those figures.
September 20, 2026 · Change ref: e5bd4fa
Med Spa Testimonial & Marketing Consent: The HIPAA Rules — who HIPAA applies to
Before: The guide said a med spa that keeps patient charts, screens medical history, and administers prescription treatments is a HIPAA covered entity, "full stop."
Now: It says covered-entity status depends on transmitting health information electronically in connection with a standard transaction, that storing records is not the test, and what still binds a practice that falls outside HIPAA.
Basis: HIPAA's covered-entity definition turns on the electronic standard transaction; primary sources could not be opened when the page was updated, and the page says so and adds no new citation.
September 19, 2026 · Change ref: fdbf78e
Florida Med Spa SOPs: What Your Policy Manual Must Include and Florida Botox & Filler Regulations: 2026 Compliance Guide — physician supervision of RN injections
Before: The two pages disagreed: the policy manual guide called the claim that Florida requires a physician to be physically present for RN cosmetic injections a "myth" and told readers to delete it, while the Botox and filler guide stated the requirement but attributed it only to unspecified Board guidance.
Now: Both pages say the Florida Board of Nursing has required direct supervision — the physician physically present and visualising the injection, with no APRN substitute — and cite declaratory statement DOH-24-0637 (May 2024), noting that it is not a promulgated rule and binds only its petitioner.
Basis: Board of Nursing declaratory statement DOH-24-0637 and the petitions preceding it.
September 10, 2026 · Change ref: 43fc9b9
Who Can Inject Botox in the United States? — LPN and LVN verdicts by state
Before: The state table listed Texas and New York as states whose boards had expressly excluded LPNs/LVNs from cosmetic injection, and listed Arkansas, South Dakota, Utah, and Arizona as not squarely addressed.
Now: Texas and New York are "not squarely addressed — treat as no" (no categorical prohibition, but no affirmative authority either); Arkansas is "no — board has addressed it"; South Dakota is "yes — with conditions" (neurotoxin under direct supervision, fillers excluded); Utah is "conditionally," because its delegation statute names the practical nurse; and Arizona is marked as conflicting between our own sources and unresolved.
Basis: Each row was checked against our own state guides and state regulations dataset, and now names the source it relies on.