top of page
Search

The Med Spa Compliance Binder: What an Owner Should Produce in an Hour

Writer: Michael Madrinkian
Michael Madrinkian
4 days ago
8 min read

Updated: 1 day ago

A med spa compliance binder is the set of records an owner can produce in an hour: signed orders, chart review logs, credentials, consents, and vendor agreements. It only counts if it matches how the practice runs, which a Practice Diagnostic checks. Your attorney decides what each record must say.


By Michael Madrinkian, MBA, PhD, Founder and Principal, Luminary Strategic



THE SHORT ANSWER


  • The test is speed. If you would have to search for a record, count it as missing and put it on the list for your attorney.

  • The binder can be a folder. What matters is that each record has a location, an owner, and a date.

  • A full binder can still describe a practice that does not exist. Tracing one recent chart back through its paperwork shows whether the records match the work.

  • Records have clocks. Medical records, privacy documents, training records, and signed agreements each run on their own schedule.

  • This is a starting list. It organizes a conversation with your attorney and medical director, who decide what your practice needs. These are general summaries as of November 2026.


WHAT GOES IN A MED SPA COMPLIANCE BINDER


The table above lists 13 records for a med spa compliance binder, grouped by the question each answers. Who oversees the clinical work? Who is qualified to do it? Which rules cover each service? What did patients agree to? Who owns the business? The list is an operating checklist of records to gather. It does not state what the law requires of your practice.


Vendors and trade groups publish longer lists. Three additions come up often enough to raise with your attorney:


  • A security risk analysis. The HIPAA Security Rule asks covered entities for an accurate and thorough assessment of the risks to electronic patient information (45 CFR 164.308(a)(1)(ii)(A)).

  • A bloodborne pathogens file. Employers with occupational exposure keep a written exposure control plan, reviewed at least annually, and train exposed staff at least annually (29 CFR 1910.1030).

  • Privacy training acknowledgments. The Texas Medical Records Privacy Act calls for training new employees within 90 days of hire and keeping each signed statement for six years (Health and Safety Code §181.101).


Service-specific items depend on your menu. A practice with elective IV therapy or laser hair removal has more to show than one offering injectables alone. Texas med spa regulations maps where each Texas rule sits and the records that follow from it.


Question for your attorney: which of these records apply to our practice, and what is missing from the list for our services?


THE ONE-HOUR TEST


Run this before someone else asks. It takes one hour and needs no outside help.


Set a timer. Ask your practice manager, or whoever would have to answer if you were away, to pull each of the 13 records from wherever they live. For each one, note where it was and who owns it. Leave the box empty if the person had to search or ask around. Anything still empty after the hour goes on the list for your attorney.


Owners usually run this themselves and pass, because they know where everything is. Having someone else do it tests the system. A record only you can find depends on you being there.


THE ONE-CHART TRACE


The one-hour test shows that the records exist. The trace shows whether they describe the work. Pick one treatment from last week, chosen by someone other than the owner, and follow it back:


  1. The chart. Who established the practitioner-patient relationship, on what date, and is the record complete for that visit?

  2. The order. Which written order covered that treatment on that date, and when did the physician last review and sign it?

  3. The protocol. Did the person who performed the treatment sign and date the protocol before that day?

  4. The training record. Does it cover this procedure, for this person, including complications?

  5. The schedule. Who on that day's shift held basic life support training, and who was on site or immediately available for an emergency?

  6. The disclosure. How was the patient told who would perform the treatment and that person's title?

  7. The consent. Which version did the patient sign, and was it the current one?

  8. The marketing. If this patient's photo or review appears anywhere, where is the authorization?


Items 1 through 6 follow Texas Medical Board delegation standards in 22 Texas Administrative Code §169.26 and §169.27, as summarized in the post linked above. Other states use other rules, so ask your attorney what your trace should cover.


Each broken link is an operating problem with a possible legal consequence. Write it down as a question for counsel and fix the process that let it happen. Repeat with a different provider and service each quarter. Three or four traces a year will show you more than any binder on a shelf.


WHAT TO DO WITH THE GAPS


Most owners who run these two tests find something. Sort what you found before you start fixing it.


Start with anything touching treatments happening this week: an order past its review date, a provider without a signed protocol, a training record missing for a procedure on tomorrow's schedule. Take those to your medical director and attorney first, since they decide what the gap means and what to do about it.


Next come the gaps in the process: a log kept by memory, a renewal date only one person knows, a consent form with three versions in use. Each needs an owner and a date. Filing the old paperwork comes last, because it changes nothing about how next week runs.


Give the list a deadline and review it at the next quarterly trace. A list nobody revisits is how the same gaps turn up a year later.


RECORDS HAVE CLOCKS


A binder assembled once goes stale. Some records have to be kept for years after they stop being current, and others need a fresh signature on a fixed date. The table below collects the general periods we could trace to a primary source. Your attorney confirms which apply to you and whether a longer period makes sense.



Keep superseded versions. When a consent form or protocol changes, the old version still explains what happened under it. Label each one with the dates it was in force.


POLICIES AND PROCEDURES: BUYING A MANUAL


Med spa policies and procedures are the part of this work most often sold as a product. The American Med Spa Association and compliance vendors offer manuals, forms, and templates. A purchased manual can save weeks of drafting and is a reasonable place to start.


The risk is the gap between the page and the practice. A manual that describes chart review every two weeks, in a practice that reviews charts when the physician has time, documents a process nobody follows. Before adopting any template, walk through it with your medical director and strike or change each step your team will not perform. Then have your attorney review what remains.


Luminary helps decide what the practice's systems need to do. Vendors supply the manuals, training, and software. Luminary takes no compensation from device makers, distributors, lenders, or software vendors, and no referral fees from attorneys, compliance vendors, or placement services. How Luminary stays independent.


WHO KEEPS IT, AND WHO SEES IT


One person owns the binder. In most practices that is the practice manager, with the owner reviewing it each quarter. Their job is to keep the location, owner, and renewal date of each record current. The clinical content stays with the medical director and the legal content with counsel.


Keep patient information out of it where you can. Chart review logs and incident logs can identify patients. Store those where your patient records are stored, and limit who can open them. The binder can point to them.


Decide in advance who responds to a request. Records get requested by regulators, insurers, buyers, and investors. Staff should know to route any such request to the owner, who brings in your attorney before anything is produced. A buyer's diligence list will also look much like the table above, so an owner who may sell someday gets a second return on this work.


Question for your attorney: if a buyer, an investor, or a regulator asks for our records, what should we produce, and who should respond?


WHERE THIS FITS IN A DIAGNOSTIC


Compliance operations is one of the Practice Diagnostic's four lenses. Luminary checks whether the records a practice should keep exist and are current, and findings come back as risk flags, each written as a question for your attorney. The Diagnostic takes three weeks, from $5,000. Designing the systems behind the binder sits in the Advisory Engagement, from $15,000, and the Executive Advisory Retainer keeps a compliance calendar in each quarterly review.


Luminary Strategic is a firm of medical spa consultants whose principals own and operate regulated aesthetics and wellness practices. Luminary does not give legal advice or write manuals. How Luminary approaches med spa compliance.


FREQUENTLY ASKED QUESTIONS


Are med spas HIPAA compliant?


That phrase hides the first question, which is whether HIPAA applies. A health care provider is a covered entity when it sends health information electronically in connection with a covered transaction, such as billing insurance (45 CFR 160.103). A cash-pay practice may need to ask counsel how that definition fits. The Texas Medical Records Privacy Act defines a covered entity more broadly, and it reaches many people who handle protected health information (Health and Safety Code §181.001). Ask your attorney which rules cover your practice.


Is a med spa compliance checklist the same thing as a binder?


A checklist tells you what to gather. A binder is what you have after gathering it. Checklists online vary by state and by vendor, so use one as a starting point and let your attorney decide what fits your practice.


Should the binder be paper or digital?


Either works as an operating matter, and most practices end up with a digital folder with restricted access. What counts is that the right person can find each record quickly and that past versions are kept. Your attorney can tell you whether any record needs a particular form.


How often should an owner review it?


Quarterly is a workable rhythm for most practices: run one chart trace, check renewal dates, and confirm new hires and services have their records. Add a review before any new service, new location, or sale. Your medical director and attorney may set a tighter schedule.


Does a solo injector need this?


The records follow the services and the delegation, whatever the size of the practice. A solo practice usually has fewer of them and one person who knows where everything is. Write it down anyway, so the practice can keep running when that person is out.


REQUEST A SCOPING CALL


Luminary works with med spa and wellness practice owners in person across Dallas-Fort Worth and virtually nationwide. A scoping call is 30 minutes and confirms which engagement fits. Request a scoping call or call 469-894-8793.


SOURCES


Rule summaries checked November 3, 2026.


Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
Luminary Logo

7200 W University Dr., Ste 200

McKinney, TX 75071​

469-894-8793​

  • Facebook
  • Twitter

Strategic advisory for med spa owners. In person across Dallas-Fort Worth, virtually nationwide.

© 2026 Luminary Strategic. All rights reserved.

Privacy

Terms & Conditions 

bottom of page