Florida Statute § 458.348 — the 25-mile rule, written supervisory contract, and the "paper MD" problem.

Where § 458.348 fits in the Florida med spa stack

Florida regulates medical spas through a layered statutory and rule framework. The Medical Practice Act (Chapter 458, Florida Statutes) sets out who may practice medicine, who may delegate medical acts, and under what conditions. The Health Care Clinic Act (Chapter 400, Part X) handles the licensure of the physical clinic. The Board of Medicine implements the Medical Practice Act through rules in Title 64B8 of the Florida Administrative Code. Section 458.348, specifically, is the joint-review-and-supervision statute — it is the rule that determines whether a med spa's medical director arrangement is real supervision or, in regulator language, "paper supervision."

For a med spa, § 458.348 is doing most of the work. The injectables, IV therapy, microneedling, laser treatments, weight-loss compounds, and other clinical services your clinic offers are the "practice of medicine" delegated by a supervising physician to mid-level practitioners — usually an ARNP or a PA, and sometimes a registered nurse for narrowly-scoped tasks. § 458.348 is the statute that governs whether that delegation is lawful. Combined with Rule 64B8-9.009 (which expands on the supervisory protocol requirements), it is also the statute that determines whether your supervisory file looks defensible when a Florida Department of Health investigator opens a complaint.

The four operative requirements

1. A written supervisory contract

Under § 458.348, the supervisory relationship between a physician and a mid-level practitioner cannot be informal. The statute, read with Rule 64B8-9.009, requires that the supervising physician and the supervised practitioner execute a written supervisory protocol that addresses several specific elements:

• The practice setting and the patient population served;
• The medical acts that are delegated to the mid-level (e.g., administration of botulinum toxin and dermal fillers, IV therapy initiation, laser hair removal supervision);
• The protocols, clinical guidelines, or standards of care that apply to those medical acts;
• The manner and frequency of physician supervision — chart review, on-site visits, telephone consultation, the percentage of charts reviewed, the schedule of physical visits;
• The procedures for emergency consultation and transfer of care; and
• The procedures for prescribing and dispensing controlled substances, including Schedule III botulinum toxin under § 893.03.

The contract must be signed by both parties, dated, and on file at the practice. It must be available to a Department of Health investigator on request. A verbal arrangement, a one-line letter, or a template downloaded from the internet without customization is not, in the eyes of the Board of Medicine, a written supervisory contract.

2. The 25-mile rule and the contiguous-county alternative

Florida Statute § 458.348(1)(f) — and the parallel provisions for ARNPs in § 464.012 — set a geographic limit on supervision. The supervising physician's primary practice location must be located either (a) within 25 statutory miles of the supervised practitioner's primary practice location, or (b) in the same or a contiguous county. This is what's commonly called the "25-mile rule."

Two phrases in that sentence do most of the work, and most of the trouble.

"Primary practice location" is not the same as the physician's mailing address, the address on their DEA registration, or the city named on their CV. It is the location where they engage in the practice of medicine the majority of their professional time. For a busy emergency physician moonlighting as a med-spa medical director, the primary practice is the hospital, not the spa. For a retired plastic surgeon working from home and supervising five clinics, the question of where the "primary practice" sits becomes the entire investigation. ProofOps records the supervising physician's declared primary practice and supports it with corroborating documents — a current lease, a Medicare enrollment, payroll records, or a signed declaration — kept in the supervisory file.

"Statutory miles" is highway/road distance, not straight-line "as the crow flies." A physician 22 miles from your clinic by air but 31 miles by road is not within the rule. Practically, we calculate this with mapping APIs and document the calculation in the file with a date stamp, because road geography changes — a new bridge, a closed road, a new clinic location — and the question can re-emerge later.

The contiguous-county alternative softens the rule for rural and edge-of-metro practices: a supervising physician whose primary practice is in Broward County can supervise a clinic in Miami-Dade or Palm Beach County even if the road distance exceeds 25 miles, because those counties touch. A physician in Orange County cannot use the contiguous-county rule to supervise a clinic in Hillsborough County, even if the road distance is similar, because those counties do not share a border. ProofOps stores the county determination in the supervisory record and re-checks it whenever a clinic's address changes.

3. The four-supervisee cap

Florida § 458.348 caps the number of mid-level practitioners that one physician may supervise at any given time. The cap is four — a supervising physician may not have more than four physician assistants or ARNPs concurrently under primary supervision. There are narrow office-based and institutional carve-outs, but the headline number for med-spa work is four.

The four-supervisee cap is the second most-cited deficiency we see, and it is the one that catches growing groups by surprise. A medical director who supervised one ARNP at a single Boca Raton location in 2024 may, by 2026, be supervising six mid-levels across a Boca, Naples, and Tampa group without realizing the cap has been exceeded. The cap is computed across all clinics, not per-clinic. ProofOps runs that count automatically across every supervisory relationship recorded in the system, so an owner sees a hard ceiling before the fifth supervisee is hired.

4. The manner and frequency of supervision

Beyond the geography and the count, § 458.348 and Rule 64B8-9.009 require that the actual supervision happen and be documented. The Board of Medicine has consistently held that supervision is not a passive arrangement. A defensible supervisory file in 2026 typically contains:

• A schedule of on-site visits — the rule does not set a single national frequency, but the protocol itself must specify it (commonly monthly or quarterly visits for a low-acuity med spa, more often for higher-risk practices);
• A chart-review log showing the percentage of charts reviewed and the dates of review;
• Documented availability for telephone consultation during operating hours;
• Records of any clinical incident reviews or quality-assurance meetings;
• Renewals of the protocol — a supervisory protocol is not a one-time document. It should be reviewed annually and re-signed by both parties when material changes occur (new procedures added, change of primary practice, change in supervisees).

Owners often ask: "Is one chart review per month enough?" The honest answer is that there is no statutory percentage, and the Board has been deliberately fact-specific. The defensible position is to have a number in writing, follow it, and document that you followed it. A medical director who reviews 10% of charts on a monthly cadence, and can show the records of those reviews, is in a much stronger position than one whose protocol says "the medical director will review charts as needed."

The "paper MD" problem, defined

Across Florida med-spa enforcement actions, one fact pattern recurs: a clinic identifies a "medical director" on its website and on contract, but that physician has no operational presence at the practice. They do not visit. They do not review charts. They do not know which products the spa is using. They are, in some cases, in another state. The clinic is, in the language Board of Medicine investigators use, operating with a "paper" medical director.

The paper MD problem is not just a § 458.348 violation. It cascades. If supervision is fictional, then the Good Faith Exam done by an ARNP at the spa is not properly supervised; the standing protocols for Schedule III injectables are not properly authorized; the delegation of IV initiation is not lawful; the patient who is harmed has no real chain of supervisory accountability. The civil exposure for the clinic owner expands meaningfully when the supervisory record is empty.

What inspectors and investigators ask for, by name

From DOH and AHCA notices we've reviewed across Florida med-spa investigations, the standard documentation request typically names the following items:

• The current written supervisory protocol, fully executed;
• The supervising physician's Florida medical license verification (current, no probation);
• A roster of all current mid-level supervisees, by location, with start dates;
• The supervising physician's primary practice address, with a method of verification;
• Standing orders for delegated procedures (botulinum toxin, dermal fillers, IV therapy, laser);
• The chart-review log for a specified date range (often the prior 90 days);
• Records of on-site visits, with dates;
• Any incident reports, adverse-event records, or quality-assurance minutes;
• The clinic's emergency consultation procedure;
• Patient charts for one or more named patients, frequently the patient who triggered the complaint.

A clinic that can produce these in two days, indexed and bookmarked, is in a fundamentally different legal posture than a clinic that produces them as a stack of Drive folders and an apology. ProofOps is designed for the first posture.

How § 458.348 interacts with the rest of the Florida stack

§ 458.348 does not sit alone. Three other Florida frameworks pull on the same supervisory record:

• AHCA Health Care Clinic licensure (§ 400.9905, Rule 59A-33) — the AHCA application asks for the medical director's Florida license and the supervisory arrangement. An AHCA inspection typically samples the supervisory file. See our AHCA HCC explainer.
• Good Faith Exam standards (§ 458.348 + Board of Medicine rules + § 893.03 for Schedule III drugs) — a defensible GFE for an injectable is performed under the same supervisory protocol that § 458.348 governs. The supervisory file is the upstream document the GFE record depends on. See our Florida GFE explainer.
• The 20-day complaint response under § 456.073 — when a complaint lands, the written supervisory contract is the first exhibit. Practices that already have it ready respond meaningfully faster.

Why this gets harder, not easier, in 2027

SB 1728 / HB 1429 (the Medical Spa Prescription Drug Oversight Act) died in subcommittee on March 13, 2026. The bill would have layered Board of Pharmacy oversight, mandatory adverse-event reporting, and a new licensure category on top of the existing § 458.348 framework. Industry observers expect a similar bill in the 2027 session, and the legislative trend is toward narrower § 458.348 supervision standards, not broader. Clinics that build their supervisory documentation now will be substantially better positioned when the next bill — whatever number it carries — moves. See our SB 1728 explainer for the bill history.

How ProofOps Medical handles § 458.348

ProofOps treats § 458.348 as a structured record, not a folder. Each supervising physician on file has a record that includes: the executed protocol PDF (with signatures verified), a Florida DOH license poll that runs weekly, a primary practice address that is geocoded against every clinic location and re-checked when either changes, a supervisee count that auto-updates as practitioners are added or removed, a chart-review log that the medical director can populate by email or app, and an annual renewal reminder that fires 60 days before the protocol's anniversary.

The output is the part that matters. Every month, the supervisory file generates a one-page section in the inspection-ready PDF: the protocol citation, the primary practice address, the supervisee count, the chart-review percentage and dates for the period, and any open items. If a complaint arrives, the full supervisory exhibit is one click away.

Frequently asked questions

Can my Florida med spa's medical director live in another state?

No. § 458.348 requires that the supervising physician's primary practice location be in Florida and within 25 miles or in the same/contiguous county as the supervised practitioner. A physician licensed only in another state cannot serve as a Florida med spa medical director, regardless of multistate licensure compacts, telemedicine arrangements, or contract language to the contrary. The MD must hold an active Florida Board of Medicine license and have a primary Florida practice location.

How often does the supervisory protocol need to be re-signed?

Florida statutes do not set a single re-execution interval, but Board of Medicine investigations routinely flag protocols that are more than a year old and have not been reviewed. ProofOps' default is an annual review with re-signature, plus an immediate re-execution whenever a material change occurs: new delegated procedures, a new primary practice address, a new clinic location, or a change in supervisees.

What does "primary practice location" actually mean in 2026?

The Board of Medicine has been pragmatic about this. The defensible position is the address where the physician spends the majority of their clinical time. For a hospital-employed physician moonlighting as a medical director, that's the hospital. For a private-practice physician with three offices, it's the one with the most patient contact. For a semi-retired physician with no other clinical practice, it becomes a closer fact question — and that's exactly the situation where investigators look hardest.

Can a single physician supervise four ARNPs at four different med spas?

Yes — up to the four-supervisee cap and provided each clinic is within 25 miles or in the same/contiguous county as the physician's primary practice. Four med-spa supervisees in Miami-Dade, Broward, Palm Beach, and Monroe is a legally defensible configuration if the geography works. Four supervisees split between Tampa and Orlando is not, because Hillsborough and Orange counties are not contiguous and the road distance exceeds 25 miles.

What is the penalty for a § 458.348 violation?

Penalties range from administrative remediation to disciplinary action against the medical director's Florida license, up to and including suspension, revocation, and substantial fines. Civil exposure for both the medical director and the clinic owner is independent and case-specific. Where § 458.348 violations are paired with patient harm, criminal exposure is no longer hypothetical — Florida case law since 2022 has produced multiple charging decisions tied to "paper MD" arrangements.

Do I need a written supervisory contract if my spa is 100% physician-owned?

If the supervising physician is also the owner and is performing the medical acts personally, the delegation question is reduced. But the moment a non-physician (an esthetician, an LMA, a front desk staffer, even another physician's nurse) performs a delegated medical act under that physician's license, the § 458.348 framework engages. Most med spas have at least one delegated workflow, even if the owner is a physician. The defensible practice is to keep a written supervisory protocol regardless.

Does the protocol need to be filed with the Board of Medicine?

No. § 458.348 protocols are generally kept on file at the practice and produced on request. AHCA Health Care Clinic licensure and ARNP-specific filings have their own forms — but the core supervisory protocol is an internal document until an investigator asks.

How ProofOps Medical helps with § 458.348

ProofOps centralizes every document § 458.348 asks for: the supervisory protocol, the supervising physician's Florida DOH license verification, the primary practice address with geocoded distance to every clinic location, the supervisee count, the chart-review log, and the annual renewal cadence. Our AI agents track expirations, surface drift before AHCA does, and produce a monthly readiness PDF you can hand to your medical director, your insurance broker, or — if it ever comes to it — a Department of Health investigator.

Get a free audit — tell us about your clinic and we'll send back a written summary of your specific § 458.348, AHCA, and HIPAA gaps within 48 hours, whether or not you sign with us. Or watch the 6-minute walkthrough first.

This page is informational. It is not legal advice and should not be relied upon as the basis for compliance decisions. For interpretation of § 458.348 specific to your clinic, consult your Florida healthcare attorney and your medical director. Source: Florida Statutes Chapter 458 (Medical Practice Act), Florida Administrative Code Title 64B8-9.009, and Florida Department of Health investigative reports as of May 2026.