AHCA Health Care Clinic license for Florida med spas — when you need one, when you're exempt, and the exemption letter process.

The Health Care Clinic Act, in one paragraph

The Florida Legislature passed the Health Care Clinic Act in 2003 in response to substantial health insurance fraud being committed through unlicensed clinics — particularly in personal-injury, auto-insurance, and PIP-billing contexts. The Act, codified at Chapter 400, Part X, requires entities that provide health-care services for compensation to be licensed by the Agency for Health Care Administration (AHCA) under a "Health Care Clinic" license, unless an exemption applies. Implementing rules sit in Florida Administrative Code Rule 59A-33. The Act has been amended several times since, and the licensure obligation now reaches a wide range of outpatient clinical settings — including medical spas that perform injectable, IV, laser, and similar services for compensation.

Who is required to be licensed?

Section 400.9905(4), Florida Statutes, defines a "clinic" subject to licensure as an entity at which health-care services are provided to individuals and which tenders charges for reimbursement for those services, unless the entity falls within a listed exemption. The statute also defines specific categories that are excluded from the definition of "clinic" entirely, and other categories that may operate without a license but should obtain a written exemption determination from AHCA on request.

For a Florida med spa, the practical question splits along ownership lines:

• Wholly owned by Florida-licensed physicians. A clinic that is wholly owned by one or more health-care practitioners licensed under chapters 458, 459, 460, 461, 462, or 463 (MD, DO, chiropractor, podiatrist, naturopath, optometrist) — and that is engaged in the practice of those licensed professions — is generally exempt under § 400.9905(4).
• Wholly owned by other licensed practitioners. Some non-physician practitioner categories qualify under specific provisions; others do not. The most common confusion is with ARNPs and PAs, who do not generally trigger the practitioner-owned exemption in the same way physicians do.
• Owned, in whole or part, by non-clinicians. An entity owned by a non-clinician — a business operator, an investor, an LLC with mixed ownership — generally requires an HCC license, regardless of whether the medical work is performed by licensed practitioners under contract or employment.
• Owned by a corporate entity that includes both clinical and non-clinical members. The "100%" language matters. A practice that is 99% physician-owned and 1% owned by a non-clinician spouse can fall outside the practitioner-owned exemption.

These ownership rules are why so many Florida med spas — especially the ones built by an aesthetician or RN founder, or backed by an investor partner — sit in the "license required" bucket without realizing it. The default safe path for any non-physician-owned med spa in Florida is to either pursue HCC licensure or, if a specific exemption may apply, to obtain a written exemption determination from AHCA.

The exemption letter: how it works in practice

Florida § 400.9905(4) is self-executing — meaning a qualifying entity is exempt by operation of law, not by AHCA approval. But "self-executing" is cold comfort during an inspection. The defensible practice in 2026 is to request a written exemption determination from AHCA, also referred to in industry parlance as an "exemption letter."

The exemption letter request is a short letter to AHCA's Bureau of Health Facility Regulation (the bureau within AHCA that handles HCC licensure). The letter typically includes:

• The legal name of the entity and the federal EIN;
• The street address and county of the clinic;
• The legal form (LLC, corporation, sole proprietorship);
• A complete list of owners, with their ownership percentage, and for each licensed-practitioner owner, their Florida license number;
• A description of the services provided;
• The specific statutory exemption being claimed (e.g., the wholly-physician-owned exemption under § 400.9905(4));
• A signed declaration by the owner(s) attesting to the ownership facts.

AHCA reviews the request and, if the exemption is supported, issues a written determination that the entity is exempt from HCC licensure. That determination is the document inspectors ask for. ProofOps stores it as a primary record on the clinic file, with an annual review reminder — because if ownership changes (an investor buys in, a co-owning spouse divorces out, a partner is added), the exemption determination may no longer be accurate.

The HCC application, when licensure is required

For clinics that need an HCC license, AHCA's application is administrative but substantial. Items typically required include:

• The completed AHCA Form 3110-1024 application;
• Proof of legal entity formation and good standing;
• Identification of the medical director and verification of their Florida license;
• Background screening (Level 2) for owners, controlling persons, and the medical director;
• Fingerprinting through Livescan;
• Application fee (varies by clinic size and license class);
• A description of services provided and the practice setting;
• Certificate of occupancy and proof of physical premises;
• Liability insurance documentation;
• Health and safety policies, infection control plan, and quality assurance program;
• Proof of compliance with the Health Care Clinic Act's organizational and recordkeeping rules.

Initial application processing typically runs 60–120 days from a complete filing to license issuance, depending on inspection scheduling. The renewal cycle is biennial. Operating during the application window without an issued license is generally not permitted unless a specific provisional pathway applies. Plan timelines accordingly.

The medical director, under the HCC framework

A licensed Health Care Clinic is required by § 400.9935 to designate a medical director. The medical director is responsible for, among other things:

• Reviewing billing, coding, and claims practices for compliance and medical necessity;
• Supervising clinical operations consistent with the standards of practice for the services offered;
• Reporting allegations of fraudulent billing or unlicensed activity to AHCA;
• Ensuring that all licensed health-care professionals at the clinic are appropriately licensed and practicing within their scope.

The HCC medical director is not a passive role. AHCA expects the named medical director to be operationally engaged with the clinic, and the documentation of that engagement is what inspectors sample during a survey. ProofOps tracks the named medical director's license, the dated designation letter, the chart-review log, and any AHCA-required reporting separately from the § 458.348 supervisory protocol — because the two roles, while overlapping, answer to different statutes.

What AHCA actually inspects

AHCA Health Care Clinic surveys are administrative and clinical. Common items requested during an inspection include:

• The current AHCA license, posted in a conspicuous location on the premises;
• The medical director designation, with the medical director's current Florida license;
• The supervisory protocols for ARNPs, PAs, and any other mid-level practitioners (this is where § 458.348 enters — see our § 458.348 explainer);
• Patient records for a sampled set of patients (typically the most recent month or two);
• Documentation of Good Faith Exams for delegated medical procedures;
• OSHA Bloodborne Pathogens documentation: training records, exposure-control plan, sharps log, hepatitis B offer letters (see our OSHA BBP checklist);
• Sharps and biohazard waste vendor manifests, generally for the prior 12 months;
• Infection control policy and the date of last review;
• Employee files: licenses, background screenings, BBP training acknowledgments;
• Controlled substance handling records, where applicable (Schedule III botulinum toxin under § 893.03 — see our Florida GFE explainer);
• Quality assurance program documentation;
• Patient complaint log and the responses;
• Liability insurance certificate.

A typical inspection samples documents rather than auditing exhaustively. Surveys are unannounced for routine inspections and announced for some follow-up types. AHCA inspectors generally provide a statement of deficiencies on a Form 3020 if items are found, with a corrective-action timeline.

The most-cited deficiencies, 2024–2026

Reviewing AHCA Form 3020 statements of deficiencies issued to Florida med spas over the past two years, the same fact patterns appear repeatedly. ProofOps is built explicitly to address each:

1. Missing or expired exemption letter. The clinic claims to be exempt but cannot produce a written AHCA determination. Resolution: file the exemption letter request, store the determination, set an annual review reminder.
2. Outdated medical director designation. The named director left, the spa kept operating, the designation was never updated with AHCA. Resolution: track license status weekly, designation changes within 10 days as required.
3. Missing supervisory protocols for ARNPs / PAs. § 458.348 protocols are required to be in writing and on file. Resolution: store the executed protocol with re-signature on anniversary.
4. OSHA BBP gaps. Annual training records missing, exposure-control plan more than a year old, no sharps log. Resolution: monthly OSHA section in the inspection-ready PDF.
5. No quality assurance program. The Health Care Clinic Act expects a documented QA program; many med spas lack any QA records. Resolution: a quarterly QA meeting log with named participants and topics reviewed.
6. Patient-record sampling gaps. Charts pulled in inspection lack a documented GFE or are missing consent forms for the procedure performed. Resolution: GFE tracker integrated with EMR, consent forms required at booking.

Penalties for unlicensed operation

Florida § 400.9935(1) makes it a third-degree felony to operate an unlicensed health care clinic when one is required. AHCA has civil enforcement authority and refers cases for criminal prosecution where appropriate. In addition to the criminal exposure, civil penalties may apply, and any third-party payor who reimbursed the clinic during the unlicensed period may seek recoupment. Health insurance fraud charges layered on top of unlicensed operation are possible where billing was involved. The practical enforcement risk is real but uneven across Florida — the consistent through-line is that AHCA opens an inquiry after a complaint or an adverse event, not on routine sweep.

How AHCA licensure interacts with the rest of the Florida stack

The HCC license is one document among many. It interacts with:

• § 458.348 supervisory protocols — sampled in inspections (see § 458.348 explainer);
• Florida Board of Medicine 64B8-9.009 — the rule layer above § 458.348;
• § 893.03 controlled substance handling — for Schedule III botulinum toxin and any other controlled substances, separate dispensing and recordkeeping rules apply;
• OSHA 1910.1030 Bloodborne Pathogens — federal, but inspected as part of AHCA surveys (see OSHA BBP checklist);
• HIPAA — enforced separately by HHS Office for Civil Rights, but AHCA expects patient confidentiality policies on file;
• § 456.073 — the 20-day complaint response window applies to the supervising practitioners individually and may surface clinic-level issues that AHCA then takes up.

SB 1728 and what it would have changed

SB 1728 / HB 1429 (2026) — the Medical Spa Prescription Drug Oversight Act — would have layered an additional licensure category and reporting regime on top of the existing HCC framework. The bill died in subcommittee on March 13, 2026, so the existing § 400.9905 framework remains the primary source of med-spa licensure obligation. A revived bill in 2027 may either tighten the HCC licensure pathway specifically for med spas, or create a parallel registration regime — either of which will be materially easier to comply with for clinics already operating with clean HCC documentation. See our SB 1728 explainer.

How ProofOps Medical handles AHCA HCC documentation

For each Florida clinic on file, ProofOps stores the AHCA HCC license or exemption determination as a primary record. License expiration is tracked on the dashboard with 60-day, 30-day, and 7-day reminders. Medical director designations are kept with the license; any change triggers a workflow that surfaces the AHCA notification requirement. The supervisory protocols, OSHA records, sharps manifests, QA meeting log, and patient-record samples are all bookmarked into the monthly inspection-ready PDF in the order an AHCA inspector typically asks for them.

Frequently asked questions

If my med spa is owned 100% by a Florida MD, do I still need to file anything with AHCA?

The wholly-physician-owned exemption is self-executing — but the defensible practice is to request a written exemption determination so you have it in the file. Costs are minimal; the protection from unnecessary inspection escalation is meaningful.

What if my med spa is owned by an MD and a non-MD spouse?

The exemption typically does not survive non-clinician co-ownership, even at 1%. Either restructure the ownership (the MD owns the clinic outright; the non-clinician spouse is an employee or has a consulting arrangement) or pursue HCC licensure. Consult your healthcare attorney for the case-specific path.

Does telehealth count toward HCC licensure?

Florida's HCC licensure scheme primarily addresses physical clinic locations. Telehealth-only arrangements have different licensure considerations under Florida's telehealth statutes and may require additional registrations. Mixed (in-person + telehealth) practices are evaluated on the in-person clinical site.

How long does the exemption letter take?

AHCA exemption determinations have historically been issued within 30–60 days of a complete request, though processing time varies. The defensible timeline is 60 days; plan ownership changes and clinic openings around that window.

What is the AHCA application fee?

Initial HCC application fees are set by AHCA rule and adjusted periodically. As of 2026, expect total initial costs (application fee + Level 2 background screening for each controlling person + Livescan fingerprinting) to land in the low four figures. Renewal fees are lower. Confirm current fees on the AHCA website at the time of filing.

What happens if I'm operating without a required HCC license?

Stop the clinical operations until licensure is sorted, retain a Florida healthcare attorney immediately, and document the timeline. Operating an unlicensed health care clinic is a third-degree felony under § 400.9935; voluntary disclosure and prompt curative action materially affect how matters resolve. ProofOps does not provide legal advice — but we do help reconstruct the documentary record your attorney will need.

How ProofOps Medical helps with AHCA HCC compliance

ProofOps centralizes every document AHCA asks for: the HCC license or exemption letter, the medical director designation, supervisory protocols, OSHA records, sharps manifests, QA logs, employee files, and the patient-record sample. Our AI agents track expiration dates and surface drift before inspectors do. Every month, you get a bookmarked PDF you can hand to AHCA, your insurer at renewal, or your healthcare attorney.

Get a free audit — see your specific FL gaps before you commit. Or watch the 6-minute demo.

This page is informational. It is not legal advice and should not be relied upon as the basis for licensure decisions. For interpretation of § 400.9905, AHCA Rule 59A-33, or the exemption framework specific to your clinic, consult your Florida healthcare attorney. Source: Florida Statutes Chapter 400, Part X, Florida Administrative Code Rule 59A-33, AHCA published guidance, and AHCA Form 3020 statements of deficiencies as of May 2026.