VIO Franchise Group and SafeLink Consulting co-author this practice owners & operators series.
What Every Med Spa Owner & Operator Should Know
What every medical spa owner and operator needs to understand to protect their investment, their license, their staff, and the patients who trust them — before the regulator, the plaintiff’s attorney, or the better-prepared competitor shows up first.
You built or acquired a med spa because you saw the market, understood the demand, and believed in the value of what this industry delivers. Every one of those instincts was correct. But the compliance infrastructure that needs to sit underneath that business — the supervision structure, documented protocols, OSHA program, HIPAA posture — determines whether the investment you’ve made is durable or fragile. |
This is a business conversation, not a compliance lecture. The evidence now available — from peer-reviewed clinical research, federal enforcement actions, state legislative activity, and the operational experience of compliance leaders who have built these programs at scale — makes a straightforward argument: in the med spa industry right now, compliance infrastructure is competitive infrastructure.
THE OPPORTUNITY
The Market Has Never Been Better. The Regulatory Environment Has Followed.
11,000+ |
$17B+ |
$1.98M |
73% |
| Medical Spas in the U.S. - up 100% since 2018 | Industry revenue, adding $1B+ per year | Average annual revenue per location (2022) | Of consumers interested in a cosmetic procedure |
The demand side of this market is structurally driven and durable. But growth in an industry attracts regulatory attention, and this industry has had it. The December 2025 enforcement action in New York was not an isolated event — it was the beginning of a regulatory posture that is visibly tightening across the country.
|
|
|
THE REAL COST
The Cost of Non-Compliance vs. the Cost of Building It Right
The most common reason operators defer compliance investment is a perception that it is expensive and returns nothing until something goes wrong. That calculation is wrong on both counts.
|
THE HIDDEN COSTS OF NON-COMPLIANCE |
THE RETURNS ON COMPLIANCE INVESTMENT |
|
State board investigation and legal defense: $25,000–$150,000+ |
Defensible position in any investigation, complaint, or litigation |
|
OCR HIPAA fine (per violation, per year): up to $50,000 |
Staff confidence and lower turnover from clear operating standards |
|
Malpractice claim defense and settlement: six to seven figures |
Faster onboarding across locations from documented, portable protocols |
|
License suspension or revocation: loss of entire business value |
Clean due diligence for acquisition, investment, or franchise development |
|
Reputational damage from public enforcement: immeasurable |
Insurance premium advantages from documented safety programs |
|
Staff turnover driven by unclear clinical environment |
Brand protection: demonstrating — not just claiming — safety |
|
Failed acquisition or investment from compliance gaps in due diligence |
Regulatory confidence: prepared for the inspection that is coming |
|
Multi-location exposure when one site triggers enterprise-level scrutiny |
Scalability: compliance infrastructure that travels with every new location |
THE SIX OPERATIONAL GAPS
Where Most Practices Are Vulnerable Right Now
Two peer-reviewed ASDS studies (2024, 2025) documented these structural gaps nationally. The New York investigation found all six in actual enforcement citations.
Oversight that exists only on paper — a medical director named in a file but absent from daily operations. The studies found 50–81% of supervising physicians were not on-site during invasive procedures. This is not supervision; it is liability exposure with a physician’s name on it.
Scope-of-practice delegation without review — staff performing procedures they are not legally authorized to perform in that state under the supervision arrangement actually in place. The most common citation in state board enforcement actions against medspa operators.
OSHA obligations unmet — no written Exposure Control Plan, no documented bloodborne pathogen training, no HazCom program, no laser safety protocol. Federal obligations with federal enforcement consequences.
Documentation gaps — consent forms that don’t hold up under scrutiny, no photo authorization for marketing use, missing treatment records, no incident documentation. Under investigation, undocumented means undone.
Training delivered but not tracked — staff who received some training but for whom no competency record or completion log exists. Without documentation, training did not happen in the eyes of any regulator.
No single source of truth — compliance status lives in scattered binders, individual memory, and the assumption that someone else is handling it. For multi-location operators, this is compounding.
! |
The Supervision Reality: 78.6% of medical directors surveyed nationally were not board-certified in dermatology or plastic surgery. 30% did not perform any procedures themselves. The nominal medical director arrangement — a physician on paper but not in the building — creates the illusion of oversight while providing none of its protections. |
THE INDUSTRY MODEL
What Readiness Looks Like When Built Deliberately - The VIO Framework
VIO Franchise Group’s Compliance Department built a readiness framework that maintains consistent operational standards across a large national franchise network. Four instruments, one system.
|
VIO FRANCHISE GROUP · COMPLIANCE DEPARTMENT · FRANKLIN, TN David Carter, Senior Director, Compliance |
|
At VIO, we treated readiness as infrastructure, rather than paperwork. Four instruments, one system. |
ed readiness as infrastructure rather than paperwork. Four instruments, one system.
|
THE POLICY HANDBOOK Consolidated operating standards across admin and clinical domains — HIPAA, records retention, hazard communication, laser protocols, infection control. Every policy with companion checklist. One version, every location. |
|
THE REGULATORY HANDBOOK The OSHA framework in working form — exposure control, bloodborne pathogens, chemical safety, emergency response, PPE. Actual inspection forms and a Duties to Remember schedule, not a summary of the law. |
|
THE COMPLIANCE PLAYBOOK Combined self-assessment and implementation guide. Regulations mapped to policies and protocols. Simultaneously a benchmarking tool, a daily operational reference, and a training resource that closes the loop between policy and practice. |
|
THE COMPLIANCE DASHBOARD Live picture across the network — training, licensure, inspection readiness in one place. Readiness visible before the inspection, not discovered during it. |
| One principle holds these instruments together: Compliance is a habit, not a binder. |
THE SAFELINK FRAMEWORK
Five Pillars Every Practice Needs Before They Need Them
|
01 GOVERNANCE |
Medical director relationship formalized in writing against your state’s current supervision requirements. Corporate structure reviewed for CPOM compliance. Delegation authorities mapped to scope-of-practice rules. This is the foundation everything else rests on. |
|
02 CLINICAL |
Procedure-specific protocols for every service on your menu. Complication response procedure documented, trained, & posted — with a direct physician contact number. After-hours patient contact process established before a patient ever asks for it. |
|
03 HIPAA & |
Security Risk Analysis current. BAAs with every vendor. Photo and marketing authorization language practice-specific and legally reviewed. Staff training documented annually. Your brand reputation depends on this. |
|
04 WORKPLACE |
Written Exposure Control Plan matched to your actual procedures. Laser Safety Officer designated. Bloodborne pathogen training documented by staff member and date. Incident log maintained. Your staff deserve the same care you extend to patients. |
|
05 INFECTION |
Sterilization protocol with weekly spore testing log. Single-use device policy enforced and audited. Environmental cleaning protocols written and consistently followed. External review on a defined schedule. |
THE GROWTH EQUATION
Compliance Infrastructure Is How You Scale Without Breaking
Single-location operators can defer this work — until an adverse event, complaint, or inspection forces the issue. Multi-site operators, DSO-affiliated practices, and franchise networks cannot defer it. A compliance failure at one location creates enterprise-level exposure. A supervision arrangement tolerable in one state may be unlawful in the next.
-
⇒ For acquisition and expansion: Compliance due diligence should be part of every deal. Supervision gaps, HIPAA exposure, and OSHA non-compliance are material liabilities — not surprises to be discovered after close.
⇒ For franchise development: Your compliance program must travel with your brand. Inconsistent compliance across franchise locations creates enterprise liability that no marketing will repair.
⇒ For investor readiness: Investors and lenders increasingly conduct compliance due diligence alongside financial due diligence. A clean compliance posture is table stakes in a serious transaction.
⇒ For daily operations: Compliance infrastructure reduces friction at every level — faster onboarding, lower turnover, cleaner documentation, and a culture where clinical and operational quality reinforce each other.
|
The practices that survive enforcement scrutiny, litigation, and the scrutiny of acquirers are not the ones that got lucky. They are the ones that built the infrastructure before they needed it — because they understood it was not overhead. It was the foundation. - Matt Rahman, CISSP, CHPSE · SafeLink Consulting Inc. |
The medspa industry is maturing. The regulatory environment is tightening. The patient population is increasingly sophisticated. And the competitive landscape is increasingly defined by which operators can prove — not just claim — that their practices are safe, compliant, and built to last.
That is the business case for compliance. It was always true. The enforcement data, the peer-reviewed literature, and the state legislative calendar have simply made it impossible to ignore.
Ready to Build the Infrastructure That Protects Your Investment?
SafeLink Consulting and VIO Franchise Group work with single-location owners, multi-site operators, DSOs, and franchise networks to build practical, scalable compliance programs. The assessment is where it starts.
VIO Franchise Group | info@viomedspa.com
SafeLink Consulting Inc. | info@safelinkconsulting.com | Learn about medical spa compliance services
SOURCES & REFERENCES
1. Almukhtar RM et al. Supervision Unveiled: Navigating the Supervision Landscape in Medical Spas. Dermatol Surg. 2024;50(10):954–957.
2. Second national medspa supervision study. Dermatol Surg. 2025. (ASDS) [full citation on file].
3. American Med Spa Association. 2022 Medical Spa State of the Industry Report.
4. NYC Council. Joint Investigation into Growing Industry of Medical Spas. council.nyc.gov. Dec. 11, 2025.
5. AestheticsPro. 2025 OSHA Safety Rules for Medspas. aestheticspro.com.
6. Jalian HR et al. Increased risk of litigation: laser surgery by nonphysician operators. JAMA Dermatol. 2014;150:407–411.
7. Gibson JF et al. Medical oversight and scope of practice of medical spas. Dermatol Surg. 2019;45:581–587.
8. Wang JV et al. Experiences with medical spas and associated complications. Dermatol Surg. 2020;46:1543–1548.
Learn more: Read our other blogs.
>> Medical Spa Compliance: Under the Microscope.
>> What Every Med Spa Clinician Should Know: License and Liability
