Key takeaways
- A Florida med spa is a medical practice, so medical oversight is mandatory, not optional.
- The Florida Board of Medicine is the primary regulator, layered with the Board of Nursing and federal HIPAA.
- Core requirements: medical director, good faith exam, correct delegation, licensing, HIPAA, records and protocols.
- Most violations trace back to a staffing gap: the wrong person performing a medical service.
- This is general information for owners, not legal advice; confirm specifics with a Florida healthcare attorney.
In Florida a med spa is a medical practice, so medical oversight and compliance are mandatory.
When you run a med spa in Florida, you are running a medical practice, and the state treats it that way. This guide breaks down who regulates Florida med spas, the full compliance checklist, HIPAA, and the mistakes that get clinics fined. It is general information for owners, not legal advice, so confirm the specifics with a Florida healthcare attorney before you rely on it.
What is med spa compliance?
Med spa compliance is the set of medical, licensing, and privacy rules a clinic must follow because a medical spa is legally a medical practice, not a salon. In Florida, treatments patients think of as cosmetic, such as neurotoxins, dermal fillers, and laser, are medical procedures that must be prescribed, supervised, and performed by the right licensed professionals. Getting this wrong is the fastest route to a Department of Health investigation, fines, or losing the practice.
The core Florida med spa compliance requirements: oversight, good faith exam, delegation, HIPAA, and records.
Who regulates med spas in Florida?
There is no single med spa license. Oversight is layered across several bodies, and you answer to all of them. The primary regulator is the Florida Board of Medicine, the state authority that regulates medical practices and the delegation of medical procedures performed at a med spa.
| Body | What it governs |
|---|---|
| Florida Board of Medicine | The medical practice itself, physician oversight, and delegation of medical procedures |
| Florida Board of Nursing | What RNs, APRNs, and NPs may do and inject, and under what supervision |
| Board of Osteopathic Medicine | Oversight where the medical director is a DO |
| Federal HIPAA (HHS) | Patient health information, privacy, and records |
| Local and state business | Business registration, sales tax, zoning, and facility permits |
The Florida med spa compliance checklist
Use this as your baseline. Each item is where clinics most often slip:
- Medical director. A licensed Florida physician who owns the medical responsibility, sets protocols, and supervises care. See the medical director role in Florida, including the physician oversight and written protocols a med spa is required to have in place.
- Good faith exam. A qualified provider examines the patient and establishes a treatment plan before any medical treatment. Read how the good faith exam works in Florida and the examination and treatment plan a provider must complete before treatment begins.
- Correct delegation and scope. Only appropriately licensed professionals perform or inject, within their scope and supervision level.
- Professional licensing. Every clinical staff member holds an active, verified Florida license for the work they actually do.
- HIPAA safeguards. Privacy policies, patient consents, secure records and photos, and staff training.
- Standing orders and protocols. Written, physician-approved protocols for each treatment the clinic offers.
- Records, consents, and adverse-event procedures. Documented before-and-after, informed consent, and a clear plan if something goes wrong.
- Facility and business. Proper business registration, insurance, and sanitation standards.
Written protocols, consents, and verified licensing are the backbone of a compliant Florida med spa.
Do med spas need to be HIPAA compliant?
Yes. Because a med spa creates and stores protected health information, HIPAA applies alongside Florida rules. That means written privacy policies, patient consents, secure storage of records and photos, and staff training. For the federal standard, see the U.S. Department of Health and Human Services overview of HIPAA, which governs how a med spa must protect and handle patient health information. Treating patient data casually is a common and avoidable violation.
What qualifications do you need to run a med spa in Florida?
You do not personally need to be a physician to own a Florida med spa, but the medical services must be owned and supervised by a licensed physician acting as medical director. The ownership and oversight structure is the part first-time owners most often get wrong, so read who can legally own a medical spa in Florida and how the ownership and physician-oversight structure has to be set up correctly before you treat a single patient. If you are still planning the build, our step by step guide on how to open a med spa in Florida covers the medical structure and licensing so compliance is built in from day one.
Compliance is a staffing problem, not just paperwork
Here is what the law-firm guides leave out: most Florida med spa violations are staffing violations. An aesthetician performing a treatment reserved for a nurse, an RN injecting without proper delegation, or a medical director who never actually supervises are the issues that trigger real penalties. The paperwork can be perfect, but if the wrong person is in the treatment room, the clinic is exposed. That is why building a compliant clinic is inseparable from how to staff a med spa in Florida with the license-verified providers that each treatment legally requires.
Most med spa violations are staffing and scope problems, which is why compliant clinics hire carefully.
Common Florida med spa compliance mistakes
- Skipping or rubber-stamping the good faith exam.
- A medical director in name only, with no real oversight.
- Letting unlicensed or out-of-scope staff perform medical treatments.
- No written protocols or standing orders.
- Weak HIPAA practices around photos, records, and messaging.
- Assuming another state's rules or a national template apply in Florida.
For how these rules fit the wider industry, the American Med Spa Association tracks how each state regulates medical spa ownership, supervision, and who may legally perform treatments.
Related guides
- 1099 vs W-2 for Med Spa Staff in Florida: The Worker Classification Guide
- Med Spa Insurance in Florida: The Coverage Every Owner Needs
- Med Spa Non-Compete Agreements in Florida: What Owners Can and Cannot Enforce
Frequently asked questions
Who regulates med spas in Florida?
The Florida Board of Medicine is the primary regulator, working with the Board of Nursing and, for privacy, federal HIPAA. A med spa is regulated as a medical practice.
Do med spas need to be HIPAA compliant?
Yes. Med spas handle protected health information, so HIPAA privacy, consent, records, and training requirements apply in addition to state rules.
Do you need a medical director for a med spa in Florida?
Yes. Medical services must be supervised by a licensed Florida physician acting as medical director, with real oversight and written protocols.
Can a non-physician own a med spa in Florida?
Generally yes, but the medical side must be owned and overseen by a physician. The ownership structure has to be set up correctly from the start.
What is a good faith exam?
A qualified provider examines the patient and establishes a treatment plan before any medical treatment. It is a core requirement, not a formality.
What is the biggest compliance risk for a med spa?
Having the wrong person perform a medical service. Most violations are staffing and scope problems, which is why compliant clinics hire carefully.
Build a compliant clinic from the people up
Florida med spa compliance comes down to medical oversight, correct scope, privacy, and documentation, and every one of those depends on having the right licensed people in the right roles. Get the structure reviewed by a Florida healthcare attorney, and staff it with providers whose licenses and scope actually match the work.
