AHCA Inspection Preparation for Florida Med Spas — the 9-step checklist, what inspectors actually ask for, and how to be ready in 90 minutes (2026)

Q: How often does AHCA inspect Florida med spas?

Inspections may be (a) routine — typically an initial post-licensure survey followed by periodic surveys; (b) complaint-driven — triggered by a patient, former employee, or peer complaint; or (c) follow-up to a previously issued corrective action plan. AHCA does not publish a fixed routine interval that med spas can rely on, so the defensible operating assumption is that inspection-ready documentation must be assemblable on short notice at any time.

The 30-second answer. If AHCA shows up tomorrow morning, here is what they will ask for: (1) your current AHCA HCC license or exemption-determination letter, posted at the entrance; (2) your § 458.348 supervisory agreement; (3) staff roster with current FL DOH MQA licenses; (4) OIG / LEIE staff screening from the last 30 days; (5) GFE records for the last 12 months; (6) FAC 64E-16 biomedical waste manifests; (7) complaint log with 20-day response evidence; (8) HIPAA Notice of Privacy Practices and vendor BAAs; (9) malpractice declarations page naming the supervising physician. The nine-step operational checklist below is what each one looks like in practice.

What AHCA actually inspects — and what it doesn’t

AHCA is the Florida Agency for Health Care Administration. It licenses and inspects Health Care Clinics under § 400.9905 / Chapter 400-X (and Rule 59A-33 of the Florida Administrative Code). A med spa that meets the statutory HCC definition — generally, an entity billing third-party payors for healthcare services, or that meets the other criteria in the Health Care Clinic Act — needs either an HCC license or an exemption-determination letter (see our AHCA HCC explainer).

AHCA’s inspection role is administrative compliance: license posting, supervisory documentation, staffing rosters, complaint records, biomedical-waste manifests, signage. AHCA does not measure clinical practice quality, and it is not the body that investigates standard-of-care complaints. The Florida regulatory map a med spa lives under breaks out cleanly:

AHCA — administrative compliance, license posting, supervisory documentation, complaint logs, waste manifests.
Florida Board of Medicine (FL DOH MQA) — clinical-practice complaints, chart review, Good Faith Exam quality, standard of care under § 458.331(1)(t), 20-day response window under § 456.073.
DEA — controlled-substance registration, recordkeeping, storage, and disposal for any DEA-scheduled drug (testosterone for TRT, ketamine, anabolic steroids).
Office for Civil Rights (HHS) — HIPAA breach response, security-rule compliance, BAA enforcement.
FDA — compounded drugs (peptides, compounded GLP-1s, compounded anesthetics) under the 503A/503B framework, and regenerative products including PRP, exosomes, and stem-cell-adjacent therapies.

An AHCA inspector who notices a clinical-practice issue (a sloppy GFE, a missing supervisory visit log) may refer it to the Board of Medicine, but the inspector’s primary job is paperwork. The 9-step checklist below covers what AHCA will ask for directly.

The 9-step AHCA inspection preparation checklist

Each step pairs the operational task with the statute or rule behind it, what “complete” looks like, the time to assemble, and the format inspectors prefer. Total time to assemble all nine, working from a clean source-of-truth: approximately 90 minutes.

Confirm and post your AHCA Health Care Clinic license or exemption-determination letter

Source: Rule 59A-33; § 400.9905 · Time: 5 minutes

Locate your current AHCA Health Care Clinic license, or if you operate under a statutory exemption, the exemption-determination letter AHCA issued. Confirm both the entity name and the address on the license match your current operation. Confirm the license is unexpired. The license must be visibly posted at the clinic entrance — a license held in a binder behind the front desk is a recurring deficiency cited under Rule 59A-33.

What “complete” looks like: Original license framed and posted at the patient entrance, with the entity name and address matching the operation, and the expiration date in the future.
Format inspectors prefer: Original physical license in plain view. A scanned copy on file is supplementary — not a substitute.

Locate your § 458.348 supervisory agreement with the 25-mile attestation

Source: § 458.348 · Time: 10 minutes

Pull the written supervisory protocol between the supervising physician and the ARNP or PA performing delegated procedures. The agreement must be signed and dated by both parties, include both Florida license numbers, enumerate the delegated procedures and any drug classes, and include the geographic attestation under § 458.348 that the supervising physician is available consistent with the standard of care — commonly operationalized as the 25-mile attestation. See our § 458.348 supervision explainer for the full anatomy of a defensible protocol.

What “complete” looks like: Signed, dated, current agreement listing both parties’ Florida license numbers, the delegated procedures, and the geographic attestation.
Format inspectors prefer: Original signed agreement in a tabbed binder section, with the most recent supervisory visit log behind it.

Pull staff roster + current FL DOH MQA license for every staff member

Source: FL DOH MQA · Time: 10 minutes

Print or export a staff roster listing every licensed staff member — physicians, ARNPs, PAs, RNs, LPNs, estheticians, LMAs — with their full legal name, role, FL DOH MQA license number, and current license status. Verify within the last 24 hours that every license is active and in good standing using the FL DOH MQA public look-up. A license that lapsed last week is the kind of finding inspectors document first.

What “complete” looks like: One-page roster with names, roles, license numbers, status (Active / Clear), and a dated note that the look-up was performed within 24 hours.
Format inspectors prefer: Printed roster on letterhead, signed and dated by the medical director or owner.

Pull OIG / LEIE screening evidence from the last 30 days

Source: 42 USC § 1320a-7 · Time: 5 minutes

Print or export the OIG List of Excluded Individuals and Entities (LEIE) screening report covering every staff member, owner, and vendor with payment authority. Federal guidance recommends monthly screening. A positive exclusion match that goes unscreened carries civil monetary penalties up to $20,000 per item under 42 USC § 1320a-7, plus repayment of any federal-payer revenue paid through an excluded person.

What “complete” looks like: Dated screening report (within 30 days), covering each individual by full legal name and date of birth, with a clear “No Match” result for each entry.
Format inspectors prefer: PDF export of the OIG LEIE search results, one page per individual, dated and filed.

Pull the last 12 months of GFE records

Source: Rule 64B8-9.009; § 458.331(1)(t) · Time: 20 minutes

Export Good Faith Exam records for every patient treated in the last 12 months from your EMR (Aesthetic Record, Boulevard, Symplast, PatientNow, Nextech, Mangomint). Each chart must identify the patient by full legal name plus date of birth — initials-only logs are routinely cited as below the standard of care. Each GFE must name the supervising or prescribing practitioner with their Florida license number, and must document the procedure-specific rationale. Template-only GFEs that are identical across 200 charts are an enforcement risk. See our Good Faith Exam in Florida explainer for the anatomy of a defensible GFE.

What “complete” looks like: Sampled GFE records (often 10–20 charts) showing patient full legal name + DOB, practitioner identification and license number, history-taking, targeted exam, risk-benefit discussion, and authorization — in the practitioner’s own words, not template-only.
Format inspectors prefer: EMR-exported PDFs or a sampled paper subset, indexed by patient identifier.

Pull the last 12 months of FAC 64E-16 biomedical waste manifests

Source: FAC 64E-16 · Time: 10 minutes

Pull every biomedical waste pickup manifest from the prior 12 months. Each manifest under Florida Administrative Code Chapter 64E-16 must show: manifest number, transporter name, transporter’s Florida permit number, pickup date, waste category, and destination facility. A gap of more than 30 days between manifests is the operational warning; more than 60 days is what inspectors document. Stericycle, Daniels Health, Medical Waste Services, and BioMed are the carriers most med spas use; the manifest format is the same across all of them.

What “complete” looks like: Chronological binder of manifests covering the prior 12 months, no gap longer than 30 days, every field on the manifest filled in.
Format inspectors prefer: Original carrier manifests in chronological order, tabbed.

Pull the complaint log + 20-day response evidence

Source: § 456.073 · Time: 10 minutes

Pull the written complaint log for the prior 12 months. Every patient complaint must be logged with date received, nature of complaint, action taken, and date closed — including verbal complaints, social-media complaints, and complaints routed through review platforms. For any complaint that became a § 456.073 Board of Medicine inquiry, include evidence of the response sent within the 20-day statutory window (printed certified-mail receipt, dated cover letter, response packet).

What “complete” looks like: Spreadsheet or log printout with one row per complaint, with closure date and brief description. Behind it: tabbed copies of the 20-day responses for any Board of Medicine inquiries.
Format inspectors prefer: Printed log followed by tabbed response packets in date order.

Pull HIPAA Notice of Privacy Practices + vendor BAAs

Source: 45 CFR Parts 160 + 164 · Time: 10 minutes

Confirm a current HIPAA Notice of Privacy Practices is posted in patient-visible space and available on the clinic website. Pull executed Business Associate Agreements (BAAs) for every vendor that handles PHI: EMR vendor, payment processor, communications platform (email and SMS), cloud storage, transcription or scribe-service vendors. A BAA must be signed by both parties, current, and on file for every covered vendor under 45 CFR Parts 160 and 164. OCR enforcement (not AHCA) handles HIPAA breach response, but AHCA inspectors will note the absence of an NPP or visible BAAs as part of administrative compliance.

What “complete” looks like: Current NPP posted in waiting area; NPP available on the public website; signed BAA on file for every vendor handling PHI.
Format inspectors prefer: Printed NPP behind a tab; BAAs in a separate tab, indexed by vendor name.

Confirm malpractice declarations page is current and your supervising MD is named

Source: Carrier requirement + standard of care · Time: 5 minutes

Pull the declarations page of your current professional liability (malpractice) policy. Confirm the policy period covers the date of inspection, the named insureds match the legal entity operating the clinic, and that the supervising physician (plus each ARNP and PA performing delegated procedures) is named on the policy or covered by a separate certificate of insurance. A lapse, a name mismatch, or a supervising physician who is not on the policy is a finding that travels to Board of Medicine fastest.

What “complete” looks like: Current declarations page, policy period spans the date of inspection, supervising physician named, ARNPs / PAs listed or separately certificated.
Format inspectors prefer: Carrier-issued declarations page, printed and tabbed.

What inspectors look for beyond the checklist

The nine documents above are the explicit asks. Inspectors also observe several “soft” signals during the walkthrough — they are not formally on the form, but they shape the deficiency narrative.

Signage. The AHCA HCC license must be posted at the entrance under Rule 59A-33. The OSHA workplace poster, the emergency-exit signage, and the patients’ rights notice should be visible. Missing signage rarely causes severe enforcement on its own, but it sets the tone: an inspector who walks past a missing license posting reads the rest of the clinic with sharper eyes.

Sharps containers. Sharps containers should be no more than three-quarters full, securely mounted, and dated with the “in-service” date. Overfull or undated containers are a recurring biomedical-waste finding.

Medication storage. Refrigerated medications (botulinum toxin, certain fillers, GLP-1 vials) should be in a locked refrigerator dedicated to medication storage, with a temperature log demonstrating storage within the manufacturer’s specified range. A refrigerator that also holds lunch is the configuration inspectors flag first.

Cleanliness of treatment rooms. Visibly clean treatment surfaces, single-use disposables in their packaging, sealed sterile instruments, and a written cleaning protocol with a dated log. Visual cleanliness sets the tone for the rest of the inspection.

Staff knowledge of where the paperwork lives. Inspectors routinely ask the front desk and the lead injector where the supervisory protocol is, where the GFE records are, and where the waste manifests are stored. A practitioner who cannot answer those questions is a documentation problem in waiting. A 15-minute walkthrough briefing the morning of an inspection — covering where each binder lives — meaningfully changes how the inspection plays out.

What to do if AHCA finds a deficiency

A deficiency notice is not a verdict. It is an opening — a window in which the clinic can document remediation and avoid a more severe sanction. The operational response that travels well:

Read the deficiency notice and identify the corrective action plan deadline. AHCA typically issues a written deficiency notice with a corrective action plan deadline — commonly 30 to 60 days depending on severity. The deadline governs everything else.
Respond in writing within the window. A written response that addresses each cited deficiency individually, with dates and the responsible party, is the foundation of the remediation file.
Document the remediation steps with dates and responsible party. Every step of the remediation gets a date, an owner, and a piece of evidence behind it (photo, signed protocol, vendor receipt, updated record).
Provide evidence of completion. Photographs of the now-posted license, copies of newly executed BAAs, updated supervisory protocols, vendor receipts for sharps containers — whatever the cited deficiency requires.
Engage a Florida-licensed healthcare attorney for any clinical-practice deficiency. AHCA enforcement and Board of Medicine enforcement are separate tracks with different procedural rules. A deficiency that touches clinical practice (sloppy GFE pattern, missing supervisory visits, medication-handling issues) may travel to the Board of Medicine separately. Your attorney handles the strategy across both.

What ProofOps does

We pre-assemble checklist items 1–9 daily, not the morning of an inspection — so the inspection-ready PDF is always within one tap of being current.
Your compliance desk verifies every staff license on a 24-hour cycle and alerts the medical director the day a license enters “pending” or lapsed status — reviewed by a real person before the alert fires.
We screen OIG / LEIE monthly with a self-disclosure letter scaffold ready for your attorney on any positive match.
We track every GFE at point of service, with patient identifier as full legal name + DOB, the prescribing practitioner’s Florida license number, and the procedure-specific rationale — human-in-the-loop on every chart flag.
We watch the biomedical-waste manifest interval — warning at >30 days since the last pickup, danger at >60 days — and route the alert to the practice administrator before it becomes a finding.
We assemble the AHCA inspection PDF on one tap — bound, indexed, dated, SHA-256 verified, ready to hand to the inspector while the practice administrator pulls the physical license off the wall.

Frequently asked questions

How often does AHCA inspect Florida med spas?

Inspections may be routine (typically an initial post-licensure survey followed by periodic surveys), complaint-driven (triggered by a patient, former employee, or peer complaint), or follow-up to a previously issued corrective action plan. AHCA does not publish a fixed routine interval that med spas can rely on, so the defensible operating assumption is that inspection-ready documentation must be assemblable on short notice at any time.

What is the difference between an AHCA HCC license and an exemption-determination letter?

An AHCA Health Care Clinic license under § 400.9905 / Ch. 400-X is required for clinics that meet the statutory definition — generally, an entity billing third-party payors for healthcare services, or that meets other criteria in the Health Care Clinic Act. A clinic that qualifies for a statutory exemption (for example, a wholly physician-owned practice meeting the precise exemption criteria) may apply to AHCA for an exemption-determination letter rather than a license. The letter is the affirmative paperwork showing AHCA has reviewed and granted the exemption. Confirm your specific configuration with your Florida healthcare attorney — the “wholly-owned-by-MD” exemption is the one most often misapplied in practice.

What happens if AHCA finds a deficiency?

AHCA issues a written deficiency notice with a corrective action plan deadline. The clinic must respond in writing within the window (typically 30–60 days depending on severity), document the remediation steps with dates and responsible parties, and provide evidence of completion — photographs, signed protocols, updated records, vendor receipts. For a clinical-practice deficiency, engage a Florida-licensed healthcare attorney; AHCA enforcement and Board of Medicine enforcement are separate tracks with different procedural rules.

Can AHCA fine a Florida med spa?

Yes. AHCA’s administrative enforcement authority under § 400.9935 and related provisions includes civil monetary penalties, license restrictions, license suspension, and license revocation. Specific penalty amounts depend on the nature of the deficiency, the prior compliance history, and the speed and completeness of remediation. ProofOps does not predict regulator action — confirm exposure for your specific situation with your healthcare attorney.

What is the response window for a § 456.073 Board of Medicine complaint?

Twenty (20) days. Under § 456.073, the practitioner has 20 days from receipt of a Board of Medicine investigatory letter to provide a written response. Missing the window forfeits the opportunity to put the practitioner’s version of the events into the investigative record before the probable-cause panel meets. The 20-day clock is one of the most missed deadlines in Florida med-spa compliance.

Does AHCA inspect controlled-substance handling?

No. AHCA’s inspection role is administrative compliance — license posting, supervisory documentation, staffing rosters, complaint records, biomedical-waste manifests, signage. Controlled-substance handling (DEA Schedule II–V drugs such as testosterone for TRT, ketamine, anabolic steroids) is inspected by the U.S. Drug Enforcement Administration under 21 CFR Part 1300 et seq. and by the Florida Department of Health under § 893. AHCA may observe an obvious controlled-substance compliance problem (visibly unsecured C-II vials, no DEA registration posted) and refer it, but the primary enforcement authority is DEA.

Does AHCA inspect compounded drugs?

No. Compounded drugs (compounded peptides, compounded GLP-1s, compounded local anesthetics) sit under the jurisdiction of the U.S. Food and Drug Administration — primarily through the 503A and 503B pathways — and the Florida Board of Pharmacy. AHCA inspects administrative compliance at the clinic, not the regulatory status of the compounded product itself. If a clinic is sourcing compounded product from a non-FDA-registered or non-503A/503B- compliant facility, that is an FDA and Florida Board of Pharmacy matter, not an AHCA matter.

If AHCA could show up tomorrow, get the audit today

ProofOps Medical is a Florida-only, done-for-you compliance back-office and a HIPAA Compliant Business Associate — BAA signed before any PHI moves, with SRA, IRP, 7 admin policies, and a sub-processor BAA tracker available under NDA. Your fractional compliance team covers 9 frameworks — AHCA, § 458.348, GFE, OIG / LEIE, OSHA BBP, HIPAA, FAC 64E-16, § 456.073, malpractice — and assembles the inspection PDF on demand. Three plans:

Lighthouse 5 — $0/mo for the first 30 days + $1,195 Historical Compliance Migration & Audit → a locked $599/mo founding rate on day 31. Designed for a single location getting its checklist binder in operational shape for the first time.
Managed Evidence — $999/mo + $1,795 setup. Full done-for-you operation across all 9 frameworks for a single location.
Multi-Location — $1,695/mo + $599/location + $2,495 setup. For operators running multiple Florida clinics.

The 48-hour free Florida audit is the fastest way to see where the binder is today. Take the 2-minute Florida audit — we review your specific Florida configuration and return a written gap list within 48 hours. Or apply for cohort access first.

This page is informational. It is not legal or medical advice and should not be relied upon as the basis for compliance decisions. For interpretation of AHCA inspection requirements specific to your clinic, consult your Florida healthcare attorney. Source: Florida Statutes Chapter 400, Chapter 456, Chapter 458; Florida Administrative Code Title 59A and Chapter 64E-16; 42 USC § 1320a-7; 45 CFR Parts 160 and 164; AHCA published guidance as of May 2026. ProofOps Medical is a documentation operations service, not a law firm.

AHCA inspection preparation — the 9-step checklist, what inspectors actually ask for, and how to be ready in 90 minutes.