Full Florida medspa compliance audit

Section 1 · Foundation · Question 1 5%

Start Which best describes your clinic?

Check all that apply — we'll tailor the last section of the audit to your vertical(s).

Medspa is the default if you're not sure.

Med spa — aesthetic injectables (Botox, fillers), laser/IPL, body contouring, microneedling, facials. IV therapy / hydration — IV vitamin drips, NAD+, glutathione, Myers' cocktail. Weight-loss / GLP-1 — semaglutide, tirzepatide, phentermine, medical weight-loss programs. Hormone / TRT — testosterone replacement, BHRT, pellet therapy, Schedule III prescribing. Regenerative medicine — PRP, exosomes, peptides, stem cells, HCT/Ps.

Q01 Medical Director supervision

Fla. Stat. § 458.348(1)(f)

Is your supervising MD's primary practice location within 25 statutory miles of your medspa, or in the same/contiguous county? AND do you have a written supervisory protocol on file?

Yes — confirmed within 25 miles or same/contiguous county, written protocol on file. No — my MD is in a non-contiguous county more than 25 miles away. MD is local, but I don't have a current written supervisory protocol on file. Not sure / haven't verified.

Q02AHCA licensure or exemption

Fla. Stat. § 400.9905 (Health Care Clinic Act)

Is your medspa one of the following?

a.100% physician-owned — qualifying for the AHCA HCC exemption.
b.Holding an active AHCA Health Care Clinic license.
c.Holding an active AHCA HCC exemption-determination letter.

Yes — one of the three applies and the documentation is current. No — non-physician owners and no AHCA HCC license / exemption letter on file. I had a letter or license but I'm not sure it's still current. Not sure of ownership structure or licensure status.

Q03MD financial responsibility filing

Fla. Stat. § 458.320 (annual)

Has your supervising MD filed their annual § 458.320 financial-responsibility statement (typically by maintaining ≥$100K malpractice coverage or qualifying for an exemption)? AND does the practice carry general-liability + malpractice insurance with current declarations on file?

Yes to both — MD § 458.320 filing current, practice malpractice + GL declarations on file. One of the two — either the MD's annual § 458.320 filing is unverified, or our policy declarations aren't current. Neither — haven't formally checked the MD's § 458.320 status, and our insurance paperwork isn't centralized. Not sure where to find that documentation.

Q04Staff license tracking

FL DOH MQA · Fla. Stat. § 456.013 · Rule 64B8-9.012

Do you have current FL licenses (MD, DO, ARNP, PA, RN, LPN, esthetician, etc.) on file for every clinical staff member, with active monitoring for expiration, suspension, or disciplinary action via the FL DOH MQA verification portal?

Yes — centralized license file with expiration alerts at least 60/30/7 days out, and MQA status checks done at least quarterly. We have licenses on file, but no proactive expiration alerts or MQA status monitoring. No centralized license file — copies are scattered across email and HR folders. Not sure if anyone's actively tracking licenses.

Q05Good Faith Exam

Rule 64B8-9.009 + § 458.331(1)(t); telehealth under § 456.47

Before every prescription injectable (botulinum toxin, dermal filler, GLP-1, testosterone, ketamine), is a documented Good Faith Exam performed by an MD/DO/ARNP/PA — with full patient identifier (name + DOB or MRN, not initials) — recorded in the chart?

Yes — documented GFE for every patient before first injection, full identifier in the chart. Sometimes — for most patients, or only at first visit but not at every new product. No formal GFE protocol — we rely on the MD's verbal OK or a standing order. Not sure how my injectors document it.

Q06Standing orders

Fla. Stat. § 458.348 + Rule 64B9-4 (ARNP) / 64B8-9.009 (MD delegation)

For every prescription product / procedure your non-MD staff perform (Botox, dermal filler, IV vitamin drips, GLP-1 administration, B12 shots, etc.), do you have signed, dated standing orders from your supervising MD on file, refreshed within the last 12 months and when the MD or product changes?

Yes — signed/dated standing orders on file for every product, refreshed within 12 months. Some products covered, but the orders are over 12 months old or pre-date our current MD. No formal standing orders — staff operate from verbal MD direction or generic clinic protocols. Not sure what's signed vs. what's in a binder somewhere.

Q07Informed consent + photo consent

Fla. Stat. § 766.103 (informed consent) + § 458.331(1)(p) + 45 CFR 164.508 (photo/marketing)

Does every patient sign a procedure-specific informed consent before each new product / procedure (not a generic "I consent to treatment" form), AND a separate before/after photo + marketing consent before any clinical photo is taken or used?

Yes to both — procedure-specific informed consent + separate photo consent on every chart. Generic consent only — or photo consent is bundled with treatment consent rather than separate. No formal consent process beyond the new-patient intake form. Not sure exactly what's being signed.

Q08Records retention

Rule 64B8-10.002 (5-year minimum) + Fla. Stat. § 456.057

Are all patient records (charts, GFE notes, consents, photos, billing) retained for at least 5 years from the last date of patient contact per 64B8-10.002, with documented chain-of-custody for any records released to patients, attorneys, or insurers?

Yes — written retention policy, 5-year minimum, with a chart-release log. Records are retained, but no formal release log or chain-of-custody tracking. No formal retention policy — records sit in the EMR / file cabinet by default. Not sure about retention or release-log status.

Q09OIG / LEIE federal-exclusion screening

42 CFR 1001 + 42 USC § 1320a-7a

Do you screen every employee, contractor, and vendor against the OIG List of Excluded Individuals/Entities (LEIE) every month, with documented logs retained 6 years?

Yes — monthly screening, all staff + contractors + vendors, logged. We screen at hire or annually — not monthly. We don't screen against the OIG LEIE. Not sure if it's happening.

Q10HIPAA BAAs + FIPA breach response

45 CFR 164.504(e) + Fla. Stat. § 501.171 (30-day FL clock)

Do you have both of the following?

a.A signed Business Associate Agreement with every vendor that touches patient data (EMR, scheduling, billing, hosting, SMS, email).
b.A written breach-response plan that addresses Florida's 30-day FIPA notification clock.

Yes to both — BAAs on file with every PHI-touching vendor + a written FIPA-aware breach plan. One of the two — either BAAs are partial, or there's no written breach plan. Neither — we haven't formally addressed BAAs or breach response. Not sure what we have on file.

Q11HIPAA Security Risk Assessment

45 CFR 164.308(a)(1)(ii)(A) — annual

Have you completed an annual HIPAA Security Risk Assessment (and after every material change) covering every ePHI system, with a written Risk Management Plan that assigns owners and deadlines to each finding? OCR Phase 3 audits started December 2024 and this is their #1 focus area.

Yes — current SRA on file (within last 12 months) with a tracked Risk Management Plan. We have one from 2+ years ago but haven't refreshed it. We've never completed a formal Security Risk Assessment. Not sure if we've ever done one.

Q12HIPAA workforce training + NPP

45 CFR 164.530(b)(2) + § 164.520 (NPP)

Does every workforce member complete annual HIPAA Privacy, Security, and Breach Notification training (with sign-in roster) AND do you have a current Notice of Privacy Practices posted + acknowledgment log on file for every patient?

Yes to both — annual training with roster + current NPP + acknowledgment log. One of the two — training is informal/inconsistent, or NPP acknowledgment isn't logged. Neither — no annual training program and no formal NPP process. Not sure what training has been done.

Q13OSHA Bloodborne Pathogens

29 CFR 1910.1030 (BBP)

Do you have a written Exposure Control Plan reviewed annually with documented non-managerial staff input, annual BBP training for every at-risk worker (with sign-in roster), and a Hep B vaccine offer/declination form on file for every at-risk employee within 10 working days of assignment?

Yes to all three — ECP reviewed annually, BBP training current, Hep B forms on file. Some pieces in place — e.g. training happens but the ECP is out of date, or Hep B forms are missing for newer hires. We don't have a formal BBP program. Not sure what we have on file.

Q14Sharps Injury Log + safer-sharps evaluation

29 CFR 1910.1030(c)(2)(i) + (h)(5)

Do you maintain a Sharps Injury Log per calendar year (retained 5 years, type/brand of device documented, confidentiality preserved) AND a documented annual safer-sharps device evaluation with input from non-managerial staff who use the devices?

Yes to both — current Sharps Injury Log + most-recent safer-sharps evaluation on file. We have a log but no formal annual device evaluation (or vice versa). Neither — we don't track sharps injuries formally. Not sure what's documented.

Q15Biomedical waste

FAC 64E-16 · Fla. Stat. § 381.0098

Do you have all four of the following?

a.A current FAC 64E-16 Biomedical Waste Operating Plan.
b.State biomedical-waste registration or permit (renewed annually Oct 1 – Sep 30).
c.A contracted FL DOH-registered transporter with manifests retained 3 years.
d.Initial + annual refresher training records for all staff handling waste, retained 3 years.

Yes to all four — plan, registration, transporter manifests, and training records on file. Some pieces in place — e.g. we have a transporter but no formal Operating Plan, or training isn't refreshed annually. No formal biomedical-waste program — we put red bags out and hope for the best. Not sure what's in place.

Q16Anaphylaxis kit + adverse-event reporting

FL BoM standard of care + Fla. Stat. § 458.351 (office surgery)

Do you have both of the following?

a.An in-date anaphylaxis kit (epinephrine, antihistamine, oxygen) checked monthly with logged expirations.
b.A written adverse-event / incident log + procedure for any § 458.351-reportable office-surgery event (e.g. complication requiring transfer).

Yes to both — monthly anaphylaxis-kit check log + written incident/adverse-event procedure. One of the two — we have the kit but no formal check log, or vice versa. Neither — we'd be improvising if an event happened. Not sure where the kit is or when it was last checked.

Q17GLP-1 / weight-loss protocol

Rule 64B8-9.012 (FL weight-loss rule)

For every GLP-1 / phentermine / weight-loss Rx, do you document all three of the following?

a.BMI eligibility at initiation per Rule 64B8-9.012 (BMI ≥30, OR BMI >27 + 1 comorbidity, OR body fat ≥25% M / 30% F).
b.A signed Weight-Loss Consumer Bill of Rights.
c.Quarterly re-evaluations documented in the chart.

Yes to all three — BMI eligibility, Bill of Rights, quarterly re-evals, all documented. One or two of the three — e.g. we capture BMI but no Consumer Bill of Rights signature. None of the three — we prescribe based on patient request without Rule 64B8-9.012 documentation. Not sure what's in our weight-loss intake.

Q18TRT / hormone Rx

Fla. Stat. § 458.331(1)(ee) + DEA 21 CFR 1304 + AUA SOC

For every TRT patient, do you have all three of the following?

a.DEA Form 224 registration + biennial inventory + per-patient drug log for Schedule III.
b.Documented hypogonadism diagnosis (two AM total T <300 ng/dL plus LH; testing protocol consistent with AUA SOC).
c.A per-Rx attestation that the indication is NOT muscle-building or athletic enhancement under § 458.331(1)(ee).

Yes to all three — DEA records, hypogonadism diagnosis, § 458.331(1)(ee) attestation per Rx. DEA records are clean but our hypogonadism workup is light, OR we don't have a per-Rx muscle-building exclusion. We prescribe TRT based on symptoms; lab workup and per-Rx attestation aren't part of our process. Not sure of the documentation pattern.

Q19IV compounding + sourcing

USP <797> · FD&C Act §§ 503A / 503B · 64B16-27.797

For every IV bag / IV-administered drug, do you do all three of the following?

a.Source from a FL-registered 503A or 503B pharmacy with the appropriate attestations on file.
b.Track lot numbers + expirations per administration.
c.Maintain USP <797>-compliant records if any in-house compounding occurs.

Yes to all three — 503A/503B verified, lot tracking on every administration, USP <797> covered. Lot tracking is informal, or we haven't verified our supplier's 503A/503B registration recently. We buy from a supplier and don't formally track lots or registration status. Not sure of the sourcing chain.

Q20Regenerative medicine

21 CFR 1271 (HCT/Ps) + FDA biologics regulation

For every PRP / exosome / peptide / stem-cell product, do you document the 21 CFR 1271 four-prong analysis (minimal manipulation, homologous use, no combination, autologous + same-day), maintain per-vial chain-of-custody, AND obtain a signed FDA-status disclosure + experimental-treatment consent from the patient?

Yes to all three — 1271 four-prong on file, chain of custody, signed FDA-status disclosure. We do PRP/exosomes but our 21 CFR 1271 documentation is informal. We administer regenerative products without a formal FDA-status analysis. Not sure how the FDA position is documented.

Q21Laser / IPL operations

Rule 64B8-56.002 + 21 CFR 1040.10 (FDA performance standard) + Ch. 477

If you operate laser or IPL devices, do you have all four of the following?

a.FDA 510(k) clearance on file per device.
b.A signed electrologist-physician laser protocol (with physician primary practice within 150 miles).
c.A laser safety officer designation + eye-protection log + annual calibration.
d.Patch-test records per patient.

Yes to all four — 510(k), protocol, LSO + calibration, patch tests. Some pieces in place — e.g. calibration is documented but we don't run patch tests, or no LSO designation. We run laser/IPL without a formal protocol or LSO. Not sure what's documented for our devices. N/A — we don't operate laser or IPL devices.

Results render instantly in your browser. We don't see your answers unless you book a call.

Your readiness score is ready.

Your score is shown below. Unlock the complete report to see every prioritized finding, the rule it connects to and what ProofOps can handle for you.

Unlock your complete report

Where should we send your findings and remediation map?

Enter your clinic details to reveal the complete prioritized report on this page and receive a copy by email. Your submission also appears in the secure ProofOps lead view, so any follow-up is based on your actual answers—not a generic sales script.

Complete findings, not just a scoreMapped to what ProofOps handlesNo obligation to become a client

Your full report is ready. It includes critical and open findings grouped by area, the cited standard, the practical next step and the ProofOps action for closing the documentation gap.

Website (leave blank)

Clinic name *

Your name *

Email *

Phone (optional)

City (optional)

Anything to add? (optional)

By submitting, you agree ProofOps may email or call you about these audit findings. We do not sell your information.

Your complete findings are now unlocked.

Review the prioritized report above. A summary is also on its way to your email, and ProofOps can follow up with a focused plan based on these exact answers.

Something went wrong sending that. Please try again — or email info@proofopsmedical.com with your score and we'll get back to you.

Want help closing these?

A free 15-minute call with our compliance team walks through each finding. You walk away with a written deficiency report whether or not you sign with us.

Review my findings with ProofOps Take a look around ProofOps

Or browse on your own — features, pricing, FL compliance guide.

Find the documentation gaps that can become citations, fines or operating disruption.

Your readiness score is ready.

Where should we send your findings and remediation map?

Your complete findings are now unlocked.

Want help closing these?