Compliance documentation for Texas med spas
Almost everything a med spa does is legally the practice of medicine — which means your paperwork has to prove physician delegation, patient evaluation, and staff scope. The Compliance Kit gives you that documentation set, built against the rules the Texas Medical Board actually enforces.
More than one agency has a say
There is no single Texas license that covers everything a med spa does. These are the bodies whose rules your documentation has to satisfy.
Texas Medical Board
Physician delegation and protocols under 22 TAC Chapter 169 — the rule that replaced the repealed §193.17 in January 2025.
Texas Board of Nursing
What an RN may do under delegation, and what an LVN may not.
TDLR
Laser hair removal is licensed separately from other cosmetic lasers (Health & Safety Code Chapter 401, Subchapter M).
Federal OSHA & HHS
Bloodborne pathogens, hazard communication, and HIPAA — alongside Texas's own HB 300 privacy law.
What's actually at stake
Real, published maximums — not scare numbers. Every figure below is a statutory or regulatory cap, not a typical assessment.
Privacy penalties are set by statute
Texas Health & Safety Code §181.201 sets civil penalties of up to $5,000 per negligent violation, $25,000 per knowing violation, and $250,000 where PHI is used for financial gain — up to $1.5 million a year for a pattern or practice. Federal HIPAA penalties are capped at $2,190,294 per provision per year (effective January 28, 2026).
OSHA applies to every clinic with needles
Federal OSHA maximums, effective January 15, 2026: $16,550 per serious violation and $165,514 per willful or repeated violation. Texas has no state OSHA plan for private employers, so these apply directly.
Delegation is the thing that gets audited
A “name-only” medical director, verbal delegation, or protocols still citing the repealed §193.17 are among the most common findings — and they're documentation problems, which means they're fixable on paper.
Figures are maximum penalties published by the agencies themselves and verified as of August 2026. Actual assessments vary widely with the facts. Read the full Texas Med Spa compliance guide for the underlying rules.
The documents a med spa is expected to have
A 48-page manual (read the sample) plus the forms, logs, and checklists behind it — written for med spas, not adapted from a generic national template.
- Physician delegation protocolsStanding delegation orders written per procedure and device, with the annual review log the rule expects.
- Patient evaluation & treatment ordersGood-faith-exam forms that put the evaluation and the individualized order in the chart.
- Staff credential & scope logWho may inject, who may not, and the evidence that each provider was checked out on the device.
- IV therapy protocol addendumUpdated for HB 3749 (“Jenifer's Law”), effective September 1, 2025.
- Emergency readiness & BLS logThe on-site emergency requirements in 22 TAC Chapter 169.
- HB 300 privacy programNotice of privacy practices, business associate agreements, and the 90-day training log Texas requires.
- OSHA exposure control planBloodborne pathogens, hepatitis B offers and declinations, plus hazard communication and SDS.
- Records retention scheduleThe 7-year rule under 22 TAC Chapter 165, including the minors calculation.
One payment covers your documentation set
Start with the free assessment if you'd rather see where you stand first.
- 48-page manual for med spas
- All forms, logs & checklists above
- Training documents
- Implementation guide
- 30-day email support
- Everything in the Compliance Kit
- Updates when the rules change
- New regulation alerts
- Annual review support
- First 30 days of Shield free
Preview before you purchase
Read the sample manual, the training guide, and run the free gap assessment first. Because the Kit is delivered instantly as digital documents, all sales are final — so we want you confident in exactly what you're getting. If you hit a delivery problem, contact us within 7 days and we'll make it right.
Questions med spa owners ask
Do I need a medical director?
Yes. Any med spa offering medical cosmetic procedures must operate under a Texas-licensed physician who delegates through signed written protocols reviewed at least annually under 22 TAC Chapter 169. The Kit includes those protocol templates and the review log.
Our protocols cite 22 TAC §193.17. Is that a problem?
That provision was repealed and replaced by Chapter 169 in January 2025. Protocols still citing it are a signal the paperwork is out of date. The Kit is written against Chapter 169.
Can an RN inject without the physician on site?
An RN can inject under written delegation and protocols, after the patient has been evaluated and an order issued, with a physician or delegated PA/APRN immediately available. The arrangement has to match your written protocol — which is exactly what the delegation documents record.
Does HIPAA apply if we're cash-only?
Even where federal HIPAA may not reach you, Texas's own Medical Records Privacy Act (HB 300) defines covered entity broadly enough to include essentially any business holding protected health information. The Kit covers the Texas requirements either way.
Is laser hair removal covered?
Yes, and it's treated separately — laser hair removal is TDLR-regulated with its own facility registration and consulting-physician contract, while other cosmetic lasers are delegated medical procedures under the Texas Medical Board. The Kit addresses both tracks.
Is this legal advice?
No. Compliance Ghost provides compliance documentation tools and educational resources only. Our products are not a substitute for the advice of an attorney. For your specific situation, consult the Texas Medical Board, the Texas Board of Nursing, TDLR, or a qualified Texas healthcare attorney.
See where your med spa stands
The gap assessment is free and takes about two minutes. You'll get a scored breakdown before you spend anything.