Texas Med Spa Compliance: The Complete Guide to Rules, Delegation, and Recordkeeping

Who Regulates a Texas Med Spa? (There Is No Single "Med Spa License")

There is no single "med spa license" in Texas. A medical spa is a business model, not a licensed facility type, so a compliant med spa has to satisfy several different regulators at once depending on the services it offers:

• Texas Medical Board (TMB) — governs the practice of medicine, physician delegation, and supervision. Because injectables, most lasers, IV therapy, and medical-grade skin procedures are the practice of medicine, the TMB is the central regulator for most med spas. Its delegation rules live in 22 TAC Chapter 169, backed by the Texas Medical Practice Act (Texas Occupations Code, Title 3, Subtitle B) and the physician-delegation statute in Occupations Code Chapter 157 (Authority of Physician to Delegate Certain Medical Acts), with related provider-scope statutes in Chapters 204 (physician assistants) and 301 (nursing).
• Texas Board of Nursing (BON) — governs what RNs and LVNs may do. It sets the scope of practice that limits which delegated tasks a nurse can legally accept (Nursing Practice Act, Occupations Code Chapter 301; rules in 22 TAC Chapters 217 and 224).
• Texas Department of Licensing and Regulation (TDLR) — regulates laser hair removal facilities and technicians (Health and Safety Code Chapter 401, Subchapter M; 16 TAC Chapter 118).
• U.S. Department of Health and Human Services, Office for Civil Rights (OCR) — enforces HIPAA for patient health information.
• Federal OSHA — enforces workplace safety standards, including bloodborne pathogens and hazard communication. Texas has no state OSHA plan for private employers, so federal OSHA applies directly.

The practical takeaway: compliance is not a single form you file. It is an ongoing structure of physician oversight, written protocols, properly licensed staff, and documented practices that has to hold up if any of these agencies asks questions.

Physician Delegation and the Medical Director Requirement (22 TAC Chapter 169)

Every Texas med spa that offers medical cosmetic procedures must operate under a Texas-licensed physician (MD or DO) who delegates those procedures through signed, written protocols that the physician reviews at least annually. This is the single most important compliance concept for a med spa, and it is governed by 22 TAC Chapter 169 (Delegation), which the Texas Medical Board recodified effective January 2025. Chapter 169 replaced the older delegation rule formerly at 22 TAC §193.17 — that section has been repealed, so citing it is a red flag that a clinic's paperwork is out of date.

Under Chapter 169 (Subchapter E, §§169.25–169.28), non-surgical medical cosmetic procedures are expressly treated as the practice of medicine. To delegate them lawfully, the delegating physician must:

• Establish and maintain signed, dated written protocols (often called standing delegation orders) that describe each delegated procedure, the training required, patient selection and screening, and how to handle complications and emergencies. These protocols must be reviewed and re-signed by the physician at least annually.
• Be appropriately trained in or familiar with the delegated procedure and remain responsible for patient safety and every aspect of the procedure — delegation does not transfer legal responsibility away from the physician.
• Provide adequate supervision. A physician, physician assistant (PA), or advanced practice registered nurse (APRN) must either be on site during the procedure or be immediately available for emergency consultation, consistent with the protocol and the risk of the procedure.
• Ensure on-site emergency readiness. The reorganized Chapter 169 rules make emergency preparedness explicit: at least one person trained in basic life support (BLS) must be present on site while the patient is being treated, and a physician, PA, or APRN must be on site or immediately available for an emergency consultation and, if necessary, an emergency appointment.
• Ensure the patient relationship and records are handled properly, including an appropriate patient evaluation before treatment and medical records maintained under TMB rules.

A "medical director" who lends a signature but never reviews protocols, never evaluates patients, and is not reachable in an emergency does not satisfy these rules. Texas regulators and courts look at the substance of the oversight, not the title. Ownership matters too: Texas generally prohibits the corporate practice of medicine, so how a med spa is owned and how the physician is compensated (fee-for-service medical oversight versus a fixed "rent-a-doc" arrangement) can itself create liability. This is an area where a Texas healthcare attorney is worth the cost.

Who Can Legally Perform Injectables and Procedures in Texas

In Texas, injectables such as Botox and dermal fillers may be performed only by a physician, or by a PA, APRN, or RN acting under proper physician delegation — never by an unlicensed person, and not by a licensed vocational nurse (LVN) or esthetician. Who may do what breaks down like this:

• Physicians (MD/DO) may perform injectables and other medical cosmetic procedures directly.
• Physician assistants (PAs) and advanced practice registered nurses (APRNs, including nurse practitioners) may perform them under physician supervision and delegation, and in many cases may also perform the required patient examination and order treatment when the delegation permits it.
• Registered nurses (RNs) may inject and perform many delegated procedures, but only under written physician delegation and protocols, with the physician (or a delegated PA/APRN) immediately available, and only after the patient has been examined and an order issued. An RN cannot independently decide who is a candidate, prescribe the product, or run a clinic without physician orders.
• Licensed vocational nurses (LVNs) generally may not perform cosmetic injectables or laser procedures. The Board of Nursing limits LVN practice to tasks that do not require independent nursing judgment, and injectables fall outside that scope even with physician delegation.
• Estheticians and cosmetologists may perform superficial, non-medical skin care (basic facials, superficial exfoliation, and — separately licensed — laser hair removal), but their TDLR license does not authorize injections, prescription products, medical-depth peels, or medical laser treatments.

Two rules trip up many clinics. First, delegation must be in writing — informal or verbal "the doctor said it's fine" delegation is not recognized. Second, the person performing the procedure must be trained and competent for that specific device or product; a valid license is necessary but not sufficient. Misclassifying who can do what is one of the most common and most serious med spa violations, and it can expose both the clinic and the physician to charges of aiding the unlicensed practice of medicine.

Lasers and IPL: Two Different Rulebooks (TDLR vs. the Texas Medical Board)

Texas splits laser and light-based treatments into two completely different regulatory tracks, and knowing which track a device falls into is essential. Laser hair removal is regulated by TDLR as its own licensed activity. Nearly every other cosmetic laser or intense pulsed light (IPL) treatment is regulated by the Texas Medical Board as a delegated medical procedure.

Laser hair removal (TDLR track). Under Texas Health and Safety Code Chapter 401, Subchapter M and 16 TAC Chapter 118, a laser hair removal business needs both facility and individual registrations:

• The facility must register with TDLR and must have a written contract with a consulting physician (a current Texas-licensed MD or DO) who is available for consultation and emergencies. Facility registrations are issued for a set term (generally two years).
• Individuals are licensed in a tiered structure: Apprentice-in-Training, Laser Hair Removal Technician, Senior Laser Hair Removal Technician, and Laser Hair Removal Professional, each with its own training, supervised-procedure, and examination requirements. Individual registrants must complete continuing education (8 hours) to renew.
• Devices must comply with all applicable federal and state laws (including FDA clearance) and be used according to the manufacturer's instructions.

Other cosmetic lasers and IPL (TMB track). Ablative and non-ablative skin resurfacing, laser tattoo removal, IPL photofacials, vascular and pigment laser treatments, and similar procedures are not laser hair removal and are not covered by the TDLR laser hair removal program. They are delegated medical procedures under 22 TAC Chapter 169 — meaning they require a delegating physician, written protocols reviewed annually, a proper patient evaluation, and performance by an appropriately trained and licensed clinician under supervision, exactly like injectables. A common and costly mistake is assuming a TDLR laser hair removal certificate authorizes these other laser treatments. It does not.

IV Therapy: Texas's Tightened 2025 Rules (HB 3749, "Jenifer's Law")

Elective IV therapy in a Texas med spa is now subject to stricter rules that took effect September 1, 2025. House Bill 3749, known as "Jenifer's Law," was enacted after a patient death and tightened who may administer elective IV therapy outside a traditional medical setting and how it must be supervised.

Key points of the current framework:

• What it covers. The law applies to "elective IV therapy" — administering fluids, nutrients, medications, or blood directly into the bloodstream to relieve temporary discomfort or promote wellness — when it is provided outside a physician's office, licensed hospital, or licensed health care facility. That squarely includes stand-alone IV lounges and med spas.
• Who may administer. Only a physician, PA, APRN, or RN may administer elective IV therapy, under physician supervision and orders. Delegating IV administration to unlicensed staff or to an LVN is no longer permitted.
• Ordering and prescribing. A physician may delegate the ordering or prescribing of elective IV therapy only to a PA or APRN acting under adequate physician supervision — not to an RN or unlicensed staff.
• Required patient evaluation. As with other medical procedures, treatment must follow an appropriate patient assessment consistent with the delegating physician's protocols.
• Postings and identification. Each public area and treatment room must post the delegating physician's name and Texas medical license number and a notice explaining how to file a complaint with the Texas Medical Board. Staff performing delegated acts must wear identification showing their name and credentials.

More broadly, 2025 brought a wave of tightening around med spa delegation and supervision in Texas. The direction of travel is consistent: written delegation, licensed clinicians only, real physician oversight, and clear disclosure to patients. Treat any "anyone can hang the bag" IV model as non-compliant.

The Patient Evaluation ("Good Faith Exam") and Standing Delegation Orders

Before a med spa performs a medical cosmetic procedure on a patient, a qualified provider must evaluate that patient and issue an order — you cannot treat a walk-in on protocol alone. This up-front evaluation, often called a "good faith exam," is what establishes the practitioner-patient relationship and makes the resulting treatment a legitimate delegated medical act rather than unlicensed practice.

In practice, a compliant workflow looks like this:

• The evaluation is performed by the physician, or by a PA or APRN acting under the physician's delegation, and covers the patient's relevant history, the appropriateness of the requested treatment, and any contraindications. Telemedicine may be permitted for this step in some circumstances, but it must meet Texas telemedicine standards and the delegating physician's protocol — it is not a rubber stamp.
• The order authorizes the specific treatment for that specific patient. Standing delegation orders and written protocols set the framework, but they supplement, not replace, an appropriate individualized evaluation and order.
• The treatment is then performed by an appropriately licensed and trained clinician (physician, PA, APRN, or RN within scope) under the supervision the protocol requires.

The patient evaluation is frequently the weakest link in med spa compliance. Skipping it, or having an unlicensed staff member "clear" patients, converts an otherwise routine treatment into a violation and is a recurring theme in Texas enforcement actions and civil suits. Building the evaluation and order into the intake process — and documenting them — is one of the highest-value things a clinic can do.

HIPAA and the Texas Medical Records Privacy Act (Patient Records and Privacy)

Texas med spas must protect patient health information under both federal HIPAA and the Texas Medical Records Privacy Act — and the Texas law reaches further than HIPAA does. Many cash-pay med spas assume HIPAA does not apply to them because they do not bill insurance. That is a dangerous assumption in Texas.

• HIPAA (45 CFR Parts 160 and 164). HIPAA's Privacy, Security, and Breach Notification Rules apply to "covered entities" and their "business associates." A med spa is generally a covered entity if it transmits health information electronically in connection with a standard transaction (for example, billing insurance). If HIPAA applies, the clinic needs a Notice of Privacy Practices, signed business associate agreements with vendors that touch patient data, a documented security risk analysis, safeguards for electronic records, workforce training, and a breach-response process.
• Texas Medical Records Privacy Act (Texas Health and Safety Code Chapter 181, enacted via HB 300). Texas defines "covered entity" far more broadly than HIPAA — it reaches essentially any person or business that comes into possession of, obtains, assembles, stores, or uses protected health information in Texas. That means even a cash-only med spa that never touches insurance is very likely a covered entity under Texas law. Chapter 181 also requires customized privacy training for employees within 90 days of hire, plus additional training within a year of any material change in state or federal law concerning PHI; periodic refresher training (for example, annually) is a widely recommended best practice rather than a fixed statutory requirement. Chapter 181 further imposes its own notice and consent obligations for certain electronic disclosures of PHI.

Practical baseline for a Texas med spa: maintain a written privacy and security program, train staff and document it on the Texas timeline, use business associate agreements with software and marketing vendors, lock down photos and electronic charts (before-and-after images are PHI), and have a breach-notification plan. Penalties matter here — HIPAA civil penalties are tiered and can reach into the millions of dollars for the most serious violations, and Texas can impose its own penalties on top of federal enforcement.

OSHA Requirements for Med Spas (Bloodborne Pathogens and Hazard Communication)

Because med spas use needles, cannulas, and blood-contaminated materials, federal OSHA standards apply, and the Bloodborne Pathogens Standard is the one most relevant to injectable and IV clinics. Texas does not run its own OSHA program for private employers, so the federal rules apply directly to your clinic.

The core OSHA obligations for a med spa include:

• Bloodborne Pathogens Standard (29 CFR 1910.1030). Maintain a written Exposure Control Plan reviewed at least annually; offer the Hepatitis B vaccination to employees with occupational exposure at no cost; provide and require appropriate personal protective equipment; use engineering and work-practice controls (sharps containers, safer sharps devices, no recapping); train employees at hire and annually; and follow post-exposure evaluation and follow-up procedures.
• Hazard Communication Standard (29 CFR 1910.1200). Maintain a chemical inventory and Safety Data Sheets (SDS) for hazardous products (peels, disinfectants, and similar), label containers properly, and train staff on chemical hazards.
• Recordkeeping and reporting. Larger employers must keep injury and illness records (OSHA Forms 300/300A/301), and serious incidents must be reported to OSHA within the required timeframes.
• Other applicable standards can include emergency action planning and proper medical-waste handling, which in Texas is also governed by state medical-waste rules.

OSHA penalties are adjusted annually for inflation and can climb well into six figures for willful or repeated violations, so a documented safety program is not optional. The good news is that a compact, written safety binder — exposure control plan, SDS collection, training logs, and vaccination records — covers most of what an inspector will ask to see.

Recordkeeping, Retention, and Required Postings

A Texas med spa has to keep complete medical records for every patient and retain them for years, not months. Documentation is both a compliance requirement and the clinic's best defense if a treatment is ever questioned.

• What to keep. For each patient: the intake and health history, the patient evaluation and order, informed consent for each procedure, the specific product or device and settings used (lot numbers for injectables), who performed the treatment, before-and-after photos, and any adverse-event documentation. The signed, annually reviewed delegation protocols and each provider's training and competency records belong in the clinic's compliance file.
• How long to keep it. Under Texas Medical Board rules (22 TAC Chapter 165), a physician must retain medical records for at least seven years from the date of last treatment. For a minor, records must be kept until the patient turns 21 or for seven years from the last treatment, whichever is longer. Because a med spa's records are created under the delegating physician's authority, the clinic should retain records on the same schedule.
• Required postings and identification. Post the delegating physician's name and Texas medical license number in treatment areas, along with the complaint-notice information required by the Texas Medical Board (and, for elective IV therapy, the postings required under the 2025 law). Staff performing delegated procedures must wear identification showing their name and credentials. A registered laser hair removal facility must also display its TDLR registration and required consumer notices.

A final caution: having the documents is not the same as being compliant. Signed protocols that no one follows, a consent form that is never explained, or a training log for a device the clinician has never actually been checked out on will not protect you. Compliance is the combination of the right paperwork and the actual practices behind it, maintained over time.