Is Your Med Spa Audit-Ready? How to Close the Physician Oversight Gap
Being audit-ready means your daily operations match your written policies, and for most med spas that starts with physician oversight. On a recent episode of Medical Spa Insider, AmSpa founder and chairman Alex Thiersch, JD, talked with Joel Slesinger, CHC, CHPC, senior compliance professional at MedSafe. Slesinger has spent 25 years in dental, medical and aesthetic compliance. Here is what he wants every med spa owner to fix first, and how to build a program your team will follow.
Key Takeaways
- Slesinger names improper or absent physician oversight as the risk he would tell owners to address first.
- Written policies only protect you if staff follow them every day, including new hires.
- Cookie-cutter compliance programs create liability; build policies around the services you actually provide.
- Prepare for an inspection before one is triggered: assume each risk area is a gap, then write a fix.
- Nobody is 100% compliant. The goal is a documented, good-faith effort your whole team owns.
What is the biggest compliance risk for med spas?
The biggest risk Slesinger sees is weak supervision. Asked for the one issue a med spa owner should button up today, he pointed to “the improper or lack of physician oversight of employees within the facility.”
The supervising physician, often called the medical director, is responsible for all medical treatment provided at the medical spa. How much supervision is enough, and who can be delegated what aesthetic procedures, depends on your state.
Regulators are also targeting “ghost” or “matchmaker” medical director arrangements, where a physician signs on without real clinical involvement.
States are also writing oversight into new laws. Indiana’s SB 282 took effect July 1, 2026. It requires med spas to register with the medical board beginning January 1, 2027, designate a responsible practitioner and report serious adverse events within 15 days. As of October 2026, the board had not issued guidance on several key provisions. Similar bills have been introduced in Iowa, Florida, Arizona and Colorado.
As Slesinger put it, “You can have every policy procedure in the book… but then it comes down to are you adhering to what you’re supposed to do?”
Not sure what supervision your state requires? AmSpa members get a state legal summary and a free annual consultation with ByrdAdatto. Compare membership plans.
Why do med spa owners underestimate compliance?
Many owners assume compliance costs more than the penalty for ignoring it, Slesinger said. In reality, a med spa answers to several regulators at once: OSHA and the FDA at the federal level, privacy rules such as HIPAA, plus state boards, health departments and licensing agencies. Those rules vary from state to state.
OSHA is the piece that often “goes by the wayside,” he said, because owners focus on state licensing. Unlike health departments, which focus on patients, OSHA is “all about the employee.” Slesinger pointed to the Hazard Communication Standard and the Bloodborne Pathogens Standard. Under the bloodborne pathogens rule, employers with exposed staff must keep a written exposure control plan that is accessible to employees and reviewed at least yearly, and must train staff during working hours at no cost to them.
Why aren’t written policies enough?
Policies are the starting point. “Everything comes down to policies and procedures,” Slesinger said. But Thiersch noted a harder truth from AmSpa’s legal work: a stack of well-written policies that nobody follows can be worse than having none.
Turnover is where compliant practices most often slip. Slesinger calls it the Trojan horse: a new hire arrives, says “we didn’t do that where I worked at,” and stops following protocol. One person’s habits can unravel a compliant culture. Practices may choose policies stricter than the law requires, he added, and there is nothing wrong with that.
How do you make compliance training stick?
Make it specific. “Compliance should not be cookie cutter,” Slesinger said. Generic programs leave gaps that create liability for owners and risk for employees and patients.
Practical ways to make training last:
- Match the format to the team. Options include on-site sessions, online courses, live virtual training and seminars. People learn differently.
- Train on what you actually see. Slesinger builds on-site sessions around the practice’s own habits and gaps.
- Recognize what’s working. Pointing out what staff do well makes them more open to fixing what they don’t.
- Use real stories. Examples help staff connect a rule to a real consequence.
- Make it everyone’s job. Compliance is teamwork, “just like it is taking care of patients.”
How should a med spa prepare for an audit or inspection?
Prepare before anything triggers a visit. Slesinger said waiting until something happens can look like intent to an auditor.
His method: take each area that could prompt an investigation and assume it is already a problem in your practice. Then ask the whole team how to fix it. That mitigation plan becomes your policy. For the FDA, he said, inspections can be triggered by consumer complaints, discrepancies in pharmaceutical supply chain records and failure to report adverse events.
Also train front-desk staff to verify the identity of anyone who arrives in an official capacity, whether they claim to be from OSHA, a state board or a health department. Slesinger described a physician practice outside aesthetics where someone posing as a pharmaceutical rep walked into the back and left with controlled substances. Thiersch added that staff should know their rights during an investigation, because boards are becoming more active and one finding can snowball into others.
If an inspector does arrive, cooperate with lawful access. Refusing a properly identified inspector can itself be a violation. Notify the owner and medical director, don’t alter any records, and contact a healthcare attorney early.
Where should a med spa start building a compliance program?
Start small and start now:
- Accept that no one is 100% compliant. “Nobody but nobody is 100% compliant,” Slesinger said, from the largest health systems to three-person practices. The aim is a real, documented effort.
- Assess what you actually do. Not every med spa offers the same services. List your treatments, staff licenses and supervision arrangements.
- Get expert help. Slesinger recommends working with a certified healthcare compliance consultant to build site-specific policies. [Added] Pair that with a healthcare attorney for state supervision and ownership questions.
- Train so staff act without fear. Clear policies let providers do their jobs confidently. Fear and hesitation put staff and patients at risk.
- Check your state’s rules. Review AmSpa’s Medical Spa Laws summaries and watch AmSpa’s Legal Updates for new bills.
“Compliance and patient care go hand in hand,” Slesinger said.
Frequently Asked Questions
What does “audit-ready” mean for a med spa? It means your daily practice matches your written policies, and you can show it with documentation, training records and clear supervision.
Does every med spa need physician oversight? Medical treatments at a med spa generally require supervision by a physician or another qualified practitioner, but requirements vary by state. Check your state’s law or ask a healthcare attorney.
What OSHA standards apply to med spas? Slesinger highlighted the Hazard Communication and Bloodborne Pathogens standards. The bloodborne pathogens rule requires a written exposure control plan, reviewed at least yearly, and training for exposed employees.
What should staff do when an inspector arrives? Verify the person’s identity and cooperate with lawful access, notify the owner and medical director, don’t alter records, and contact counsel early. Your policies should spell out these steps.
How often should compliance training happen? At minimum, follow the schedules the regulations set, and retrain whenever new staff join or procedures change.
Get compliance support from AmSpa
AmSpa membership gives you state legal summaries, legislative alerts and a free annual consultation with ByrdAdatto, AmSpa’s national medical aesthetic law firm. Join AmSpa today.
Listen to the full conversation with Joel Slesinger on Medical Spa Insider. This article is for general information and is not legal advice.
