Med Spa Compliance Self-Audit Checklist
A walkthrough of the HIPAA, OSHA, and advertising areas a practice should periodically check itself against.
Educational sample — not legal advice. This is an educational sample for general orientation, not legal advice and not a compliance certification. Requirements vary by state and change over time. Have your own healthcare attorney review your specific situation before relying on anything here.
An original Inside MedSpa template
Use this to spot the common, fixable gaps. A checked box is a prompt to verify the substance actually exists and is current — not proof of compliance. Confirm specifics with counsel.
Structure & supervision
- You know whether your state is a strict / moderate / lenient Corporate-Practice-of-Medicine jurisdiction
- Your ownership structure (and MSO, if applicable) has been reviewed by healthcare counsel for your state
- A real medical director relationship exists in writing, with genuine (not nominal) oversight
- Who may inject, and under what supervision, matches your state’s current rules — re-checked for every location
- A good-faith-exam workflow actually happens for every patient and is documentable
HIPAA & patient privacy
- Specific, documented authorization is obtained before any identifiable patient image is used in marketing (separate from treatment consent)
- Clear policy on what patient information may be communicated, through which channels, on which devices
- No patient images living in personal-phone camera rolls without safeguards
- Staff trained on privacy basics; a HIPAA risk assessment has been performed
OSHA & workplace safety
- A written bloodborne-pathogens exposure control plan exists
- Sharps are handled and disposed of in proper containers and channels
- Appropriate protective equipment available and used; staff trained
- Hazard communication for on-site chemicals is in place; required records maintained
Advertising & marketing
- No guarantees of results or “typical results” claims that overpromise
- Testimonials and before/afters are honest, representative, and specifically authorized for marketing use
- Influencer / ambassador material connections (free or discounted treatment) are clearly disclosed
- Claims match what devices are actually cleared for — verified against documentation, not the rep’s pitch
Records & emergency readiness
- Documentation is contemporaneous, consistent, and never altered after the fact (corrections as dated addenda only)
- Injectable storage follows manufacturer requirements; conditions are monitored and logged
- A written, accessible emergency / adverse-event protocol exists and the team has rehearsed it
- Hyaluronidase stocked in genuine occlusion-management quantity (if injecting HA filler)
Educational sample — not legal advice. This is an educational sample for general orientation, not legal advice and not a compliance certification. Requirements vary by state and change over time. Have your own healthcare attorney review your specific situation before relying on anything here. © 2026 Inside MedSpa.