Full Florida compliance audit. Every area an inspector opens.

Is your supervising MD's primary practice location within 25 statutory miles of your medspa, or in the same/contiguous county? AND do you have a written supervisory protocol on file?

Is your medspa one of the following?

• a.100% physician-owned — qualifying for the AHCA HCC exemption.
• b.Holding an active AHCA Health Care Clinic license.
• c.Holding an active AHCA HCC exemption-determination letter.

Has your supervising MD filed their annual § 458.320 financial-responsibility statement (typically by maintaining ≥$100K malpractice coverage or qualifying for an exemption)? AND does the practice carry general-liability + malpractice insurance with current declarations on file?

Do you have current FL licenses (MD, DO, ARNP, PA, RN, LPN, esthetician, etc.) on file for every clinical staff member, with active monitoring for expiration, suspension, or disciplinary action via the FL DOH MQA verification portal?

Before every prescription injectable (botulinum toxin, dermal filler, GLP-1, testosterone, ketamine), is a documented Good Faith Exam performed by an MD/DO/ARNP/PA — with full patient identifier (name + DOB or MRN, not initials) — recorded in the chart?

For every prescription product / procedure your non-MD staff perform (Botox, dermal filler, IV vitamin drips, GLP-1 administration, B12 shots, etc.), do you have signed, dated standing orders from your supervising MD on file, refreshed within the last 12 months and when the MD or product changes?

Does every patient sign a procedure-specific informed consent before each new product / procedure (not a generic "I consent to treatment" form), AND a separate before/after photo + marketing consent before any clinical photo is taken or used?

Are all patient records (charts, GFE notes, consents, photos, billing) retained for at least 5 years from the last date of patient contact per 64B8-10.002, with documented chain-of-custody for any records released to patients, attorneys, or insurers?

Do you screen every employee, contractor, and vendor against the OIG List of Excluded Individuals/Entities (LEIE) every month, with documented logs retained 6 years?

Do you have both of the following?

• a.A signed Business Associate Agreement with every vendor that touches patient data (EMR, scheduling, billing, hosting, SMS, email).
• b.A written breach-response plan that addresses Florida's 30-day FIPA notification clock.

Have you completed an annual HIPAA Security Risk Assessment (and after every material change) covering every ePHI system, with a written Risk Management Plan that assigns owners and deadlines to each finding? OCR Phase 3 audits started December 2024 and this is their #1 focus area.

Does every workforce member complete annual HIPAA Privacy, Security, and Breach Notification training (with sign-in roster) AND do you have a current Notice of Privacy Practices posted + acknowledgment log on file for every patient?

Do you have a written Exposure Control Plan reviewed annually with documented non-managerial staff input, annual BBP training for every at-risk worker (with sign-in roster), and a Hep B vaccine offer/declination form on file for every at-risk employee within 10 working days of assignment?

Do you maintain a Sharps Injury Log per calendar year (retained 5 years, type/brand of device documented, confidentiality preserved) AND a documented annual safer-sharps device evaluation with input from non-managerial staff who use the devices?

Do you have all four of the following?

• a.A current FAC 64E-16 Biomedical Waste Operating Plan.
• b.State biomedical-waste registration or permit (renewed annually Oct 1 – Sep 30).
• c.A contracted FL DOH-registered transporter with manifests retained 3 years.
• d.Initial + annual refresher training records for all staff handling waste, retained 3 years.

Do you have both of the following?

• a.An in-date anaphylaxis kit (epinephrine, antihistamine, oxygen) checked monthly with logged expirations.
• b.A written adverse-event / incident log + procedure for any § 458.351-reportable office-surgery event (e.g. complication requiring transfer).

For every GLP-1 / phentermine / weight-loss Rx, do you document all three of the following?

• a.BMI eligibility at initiation per Rule 64B8-9.012 (BMI ≥30, OR BMI >27 + 1 comorbidity, OR body fat ≥25% M / 30% F).
• b.A signed Weight-Loss Consumer Bill of Rights.
• c.Quarterly re-evaluations documented in the chart.

For every TRT patient, do you have all three of the following?

• a.DEA Form 224 registration + biennial inventory + per-patient drug log for Schedule III.
• b.Documented hypogonadism diagnosis (two AM total T <300 ng/dL plus LH; testing protocol consistent with AUA SOC).
• c.A per-Rx attestation that the indication is NOT muscle-building or athletic enhancement under § 458.331(1)(ee).

For every IV bag / IV-administered drug, do you do all three of the following?

• a.Source from a FL-registered 503A or 503B pharmacy with the appropriate attestations on file.
• b.Track lot numbers + expirations per administration.
• c.Maintain USP <797>-compliant records if any in-house compounding occurs.

For every PRP / exosome / peptide / stem-cell product, do you document the 21 CFR 1271 four-prong analysis (minimal manipulation, homologous use, no combination, autologous + same-day), maintain per-vial chain-of-custody, AND obtain a signed FDA-status disclosure + experimental-treatment consent from the patient?

If you operate laser or IPL devices, do you have all four of the following?

• a.FDA 510(k) clearance on file per device.
• b.A signed electrologist-physician laser protocol (with physician primary practice within 150 miles).
• c.A laser safety officer designation + eye-protection log + annual calibration.
• d.Patch-test records per patient.