- The Sun Sentinel / Orlando Sentinel "Med spas unmasked" investigation (published Feb 19, 2026 by Cindy Krischer Goodman and David Fleshler) made Florida med-spa supervision a public-attention story. Even where the article didn't change the law, it changed which complaints get prioritized.
- SB 1728 / HB 1429 (the Medical Spa Prescription Drug Oversight Act) is dead — killed in the Florida House Health Professions & Programs Subcommittee on March 13, 2026. No new statute. The existing rules (§ 458.348 supervision, AHCA HCC, GFE, OIG/LEIE, FAC 64E-16 biomedical waste) are the enforcement lever.
- FDA enforcement on exosomes, regenerative products, and peptide compounding pharmacies has accelerated through 2025–2026 and is increasingly cited in Board of Medicine complaints — clinics offering "stem cell," "exosome," or "regenerative" services without FDA clearance carry meaningfully more risk than they did 18 months ago.
- The NYC Council OID inspection report (Dec 2025, n=15) shows what an aggressive municipal medical-spa inspection looks like in practice — license display, on-site prescriber presence, safety records, insurance proof. Florida agencies read this report when drafting their own 2026 priorities, even though the sample is small and NYC-specific.
The four 2026 data points that shape the year
Four distinct signals — one peer-reviewed survey, one municipal inspection report, one newspaper investigation, and one dead state bill — define what Florida med-spa enforcement looks like as of May 2026. None of them, individually, changed the statute. Together, they changed the climate around the statute, which is how enforcement priorities actually shift.
A peer-reviewed systematic survey of independent Florida med-spa directorship found that 84% of Florida med-spa providers are nonphysicians, only 22% of clinics have core-specialty MD supervision, 77% of directors lack specialty training, 42% lack board certification, and approximately one-fifth of directors supervise more than one clinic outside their main practice. It is the first peer-reviewed dataset specifically describing the structure of Florida med-spa medical directorship — and the numbers are the empirical backbone of every other 2026 regulatory conversation.
journals.lww.com/plasreconsurg →
What it means for you. If your medical director supervises more than one clinic, expect more scrutiny on the supervisory protocol's specificity, the 25-mile attestation, and the quarterly chart review record.
Inspectors visited 15 NYC medical spas and found: 93% failed to properly display licenses, 100% offered medical procedures without required licensure or oversight, 86% were missing required safety records, 73% had no medical professional on site, 63% had chemical or fire safety violations, and 60% lacked proof of liability insurance. The sample size is small (n=15) and the inspection is NYC-specific — Florida is not bound by these findings, and we cite them with that caveat. But the report is the most concrete picture available of what a serious municipal med-spa inspection looks like in practice, and Florida agencies read it.
council.nyc.gov OID report (PDF) →
What it means for you. The seven categories the NYC inspectors flagged are the same seven any aggressive AHCA or DOH-led inspection in Florida would check. Walk your own clinic against that list this week.
A joint investigation by Sun Sentinel and Orlando Sentinel reporters Cindy Krischer Goodman and David Fleshler, published February 19, 2026. The reporting examined patient injuries, supervision practices, and the regulatory gap in Florida's med-spa industry — the kind of long-form investigative work that typically follows a quiet enforcement wave. We don't reproduce the article (it's paywalled at sun-sentinel.com and orlandosentinel.com) and we don't name specific clinics that appeared in it. The relevant point for an owner-operator: this is the first time a major Florida outlet has framed med-spa supervision as a public-safety story, and that framing rarely disappears without consequence.
Paywalled · sun-sentinel.com / orlandosentinel.com
What it means for you. Expect more patient complaints to AHCA and DOH this calendar year — not because compliance got worse, but because patients now know who to call.
HB 1429 died in the Florida House Health Professions & Programs Subcommittee on March 13, 2026; without a House vehicle, SB 1728 stalled on the Senate side. The bill would have introduced explicit statutory definitions for "med spa," required AHCA registration, codified supervision and Good Faith Exam timing, and added adverse-event reporting. None of that became law. The result: the existing framework — § 458.348, AHCA HCC, FAC 64B8-9.009, OIG/LEIE, FAC 64E-16 — remains the only enforcement lever, and the political appetite to revive the legislation in 2027 is real but unscheduled.
flsenate.gov/Session/Bill/2026/1728 →
What it means for you. The bill dying doesn't mean less scrutiny — it means scrutiny stays anchored in the rules you already have to follow. The existing framework is already strict; many clinics simply hadn't been treating it that way.
Timeline of 2026 events
The dated sequence below is the order a regulator — or a careful reader — would walk through to reconstruct the year. Every entry is sourced; nothing here is speculative.
"The Shifting Face of Aesthetic Care: A Systematic Analysis" appears in the January 2025 issue of Plastic and Reconstructive Surgery. The dataset becomes the most-cited empirical source for every subsequent Florida med-spa regulatory conversation. Primary source →
Florida's Stem Cell Therapy Act becomes effective, authorizing MDs and DOs to use non-FDA-approved stem cells for orthopedic, wound-care, and pain-management indications — but only at facilities accredited by AABB, AATB, NMDP, or WMDA, and only with the statutory informed-consent disclosure. Embryonic and abortion-derived sources are banned. Critical caveat: SB 1768 does not preempt federal enforcement — clinics operating under the new state authorization remain fully exposed to FDA action if the underlying product fails 21 CFR 1271 (minimal manipulation, homologous use, etc.). State permission is not federal permission. flsenate.gov/Session/Bill/2025/1768 →
What it means for you. If you're considering a stem-cell offering under SB 1768, verify the facility's AABB/AATB/NMDP/WMDA accreditation status, retain the statutory consent template, and confirm with counsel that the specific product clears 21 CFR 1271 — the state authorization will not save you from an FDA warning letter.
FDA opens a wide enforcement campaign against compounded GLP-1 products — targeting advertising of "generic Ozempic," "semaglutide pills," and "vitamin-enhanced" or "B12-blended" GLP-1 claims, plus 503A compounding without a documented patient-specific clinical need now that the official shortage designation has lifted for semaglutide and tirzepatide. The wave establishes that post-shortage 503A compounding requires individualized, charted medical-necessity rationale — not a generic standing order. WSGR enforcement analysis →
What it means for you. If you offer compounded semaglutide or tirzepatide, pull the source pharmacy's 503A documentation, the patient-specific clinical rationale in each chart, and every public claim you've made — anything implying brand-equivalence, weight-loss averages, or "FDA-approved active ingredient" is the kind of language being cited.
FDA issues a warning letter to New Life Medical Services concerning umbilical-cord-derived regenerative products marketed under the names Restor+, Regain, and Renyte. The agency found the products failed the 21 CFR 1271.10 minimal-manipulation criterion and therefore required full biologic licensure that the firm did not hold. The action is part of the continuing 2024–2026 enforcement campaign on stem-cell, exosome, and birth-tissue regenerative claims. fda.gov warning letter →
What it means for you. If you offer any product marketed as "stem cell," "exosome," "umbilical cord," "placental," or "amniotic," obtain the manufacturer's 21 CFR 1271 status documentation in writing — verbal or marketing-deck assurances aren't enough when the warning letter arrives.
The New York City Council's Oversight & Investigations Division releases its inspection report of 15 NYC medical spas. Sample is small and NYC-specific; we cite that caveat every time. The seven categories of failure documented in the report (license display, on-site prescriber presence, safety records, insurance proof, fire/chemical safety, licensed procedures, oversight) become a template for what an aggressive municipal medical-spa inspection actually checks. Report (PDF) →
The Federal Trade Commission approves a final consent order against telehealth GLP-1 provider NextMed: $150,000 civil penalty for advertising an average "53-pound" or "23% body-weight" loss claim without maintaining contemporaneous outcome records sufficient to substantiate the figure. The order establishes that the FTC will demand the underlying substantiation file — not just a post-hoc explanation — when a quantified weight-loss claim is made. ftc.gov press release →
What it means for you. If your marketing quotes any average weight-loss number, your substantiation file (signed patient charts, before/after weights, treatment dates, source records) needs to live in a folder you can hand over inside one business day — verbal-only "we've seen great results" claims do not survive an FTC inquiry.
An FDA expert panel publishes a Federal Register Request for Information recommending that testosterone be removed from Schedule III of the Controlled Substances Act. The public comment period closed February 9, 2026. As of May 22, 2026 no final rule has been issued. If descheduling proceeds, the DEA-registration burden on TRT-only clinics would substantially fall away — but practitioners must continue treating testosterone as a Schedule III controlled substance under § 893.03 until the rule is final. federalregister.gov 2025-22466 →
What it means for you. If TRT is a meaningful service line, plan for both outcomes — keep your DEA registration current and your controlled-substance handling protocols active, but model what your unit economics look like if the registration burden goes away.
FDA issues a warning letter to Dynamic Stem Cell Therapy — the latest action in the continuing 2024–2026 regenerative-medicine enforcement campaign. The pattern is identical to the New Life Medical Services action five months earlier: products marketed for indications outside the 21 CFR 1271 minimal-manipulation and homologous-use criteria, without an investigational new drug application on file. fda.gov warning letter →
What it means for you. The FDA is not slowing down on regen-medicine. If you offer any service that touches the regenerative category, the enforcement risk is now a recurring, scheduled feature of the operating environment — not a one-time campaign that will pass.
Cindy Krischer Goodman and David Fleshler publish the joint investigation. The reporting examines patient injuries, supervision practices, and the regulatory gap in Florida's med-spa industry. The story runs in print and online in both Sentinel properties and is widely picked up. Paywalled at sun-sentinel.com and orlandosentinel.com. We don't reproduce or quote the article and we don't name the specific clinics that appeared in it.
The plaintiff's firm Rafferty Domnick Cunningham & Yaffa issues a GlobeNewswire release on February 20, 2026 — the day after the Sun Sentinel investigation — calling for stronger oversight of the Florida med-spa industry. The release frames the existing regulatory framework as one that has "outpaced regulation." The AMA's existing position statement on med spa supervision (also linked below) gets renewed circulation through industry channels in the same window. GlobeNewswire release → · AMA position statement →
The Florida House Health Professions & Programs Subcommittee declines to advance HB 1429 before the subcommittee's effective deadline. Without a House vehicle, SB 1728 stalls on the Senate side and the 2026 session adjourns with both bills dead. The bill would have introduced explicit statutory definitions for "med spa," AHCA registration, codified supervision and Good Faith Exam timing, and adverse-event reporting. Nothing was enacted. The existing § 458, § 456.47, AHCA HCC, and Board of Medicine rules remain the entire regulatory framework. See our SB 1728 explainer for a deeper breakdown of what the bill would have done. flsenate.gov/Session/Bill/2026/1728 →
FDA issues parallel warning letters to Gram Peptides and Prime Sciences targeting the "research use only" labeling defense that peptide retailers have leaned on for years. The agency's position — now in writing — is that selling RUO-labeled peptides alongside bacteriostatic-water diluent, syringes, dosing calculators, or human-dosing instructions constitutes misbranding under the Federal Food, Drug, and Cosmetic Act regardless of the RUO disclaimer. The disclaimer does not cure the intended use. fda.gov Gram Peptides letter →
What it means for you. If you've sourced peptides from any vendor that ships "research use only" product with dosing instructions or injection supplies, that supply chain is now an enforcement target — and the RUO disclaimer will not protect the buyer either. Pull every peptide vendor relationship into a documented review this week.
FDA issues a warning letter to Pure Indulgence Aesthetics — the first DSCSA (Drug Supply Chain Security Act) enforcement action ever brought against a medical spa. FDA cross-referenced AbbVie's authorized-trading-partner Botox sales data against the clinic's patient administration records, identified material variance indicating purchases from unauthorized trading partners, and cited a Section 582(d)(3) violation. The practical implication is that every medical spa is now, by FDA's own reading, an auditable "dispenser" under DSCSA — subject to the same trading-partner verification, transaction information, and product-tracing requirements as a pharmacy. fda.gov Pure Indulgence letter →
What it means for you. This is the single most important medspa-specific enforcement development of 2026. Every Botox, filler, and Rx-drug vendor you use must be on the manufacturer's authorized-trading-partner list, and your purchase volumes must reconcile against your administered volumes. Item #10 in the checklist below is now non-optional.
Florida Healthcare Law Firm and other industry observers publish post-mortems concluding that the policy concerns SB 1728 was responding to haven't gone away. The expectation in knowledgeable circles is that a similar bill will be filed for the 2027 session, with adjustments to address the committee's objections to SB 1728. Nothing is scheduled; this is a forecast, not a calendar entry. Florida Healthcare Law Firm coverage →
FDA publishes a Federal Register notice removing twelve peptides from § 503A Category 2 — the list previously cited by 503A pharmacies as eligible for compounding. The affected compounds are BPC-157, TB-500, GHK-Cu, Melanotan II, MOTs-C, Epitalon, Semax, KPV, Cathelicidin LL-37, Dihexa, PEG-MGF, and DSIP. FDA did not place them on Category 1 (approved) or Category 3 (banned) — leaving them in regulatory limbo. The Pharmacy Compounding Advisory Committee (PCAC) review is scheduled for July 23–24, 2026. Until that review concludes, every 503A pharmacy compounding these peptides is operating in a status FDA has explicitly described as unsanctioned, and every clinic administering them is exposed. fda.gov human-drug compounding →
What it means for you. If you administer any of the twelve listed peptides, pull the source pharmacy's compounding authority documentation in writing, refresh the patient-specific medical-necessity rationale in every active chart, and prepare for a likely Cat 3 designation in the second half of 2026. The "we've always done it" defense is gone.
Filed December 10, 2025 for the 2026 Florida session, SB 860 would impose new compounding-pharmacy quality standards specifically for weight-loss compounds — requiring API source documentation, certificate-of-analysis testing data, FDA-inspected facility sourcing, and incoming-quality testing. Violations carry a $1,000-per-dose civil penalty. The bill is pending in the 2026 session and would take effect upon becoming law. Unlike SB 1728, the legislative path here is narrower (pharmacy-quality, not med-spa supervision) and the political opposition is correspondingly thinner. flsenate.gov/Session/Bill/2026/860 →
What it means for you. If GLP-1 compounding is in your product mix, ask your source pharmacy for the API documentation, COA data, and facility-inspection record now — if SB 860 passes, you will need every one of those documents from your supplier to keep dispensing without per-dose penalty exposure.
No new statute. Existing rules still in force, still under-enforced relative to their text, but with elevated public attention. Industry insurers are reportedly tightening underwriting questions on med-spa renewals (anecdotal — not yet quantified in any published source we'd cite). The Board of Medicine continues to process complaints on the timeline it always has. AHCA continues to conduct biennial Health Care Clinic surveys. The 2026 enforcement story is not a new rulebook — it's the existing rulebook being read more carefully by more people.
What FL clinics should be doing right now
Treat the ten items below as a Friday-afternoon checklist. Every one of them is the kind of thing an inspector, a plaintiff's lawyer, or a Board of Medicine investigator will ask for in the first 48 hours of any complaint. The point is not to be perfect — it's to be defensibly organized before the question gets asked. Items #9 and #10 are the 2026 additions reflecting the regen-medicine enforcement wave and the April 1 Pure Indulgence DSCSA action.
- Confirm the § 458.348 supervisory agreement is signed, dated, and on file — with the 25-mile attestation, the procedure list, the quarterly chart-review cadence, and backup-coverage arrangement specified. The agreement should name the supervising physician, the supervised practitioner, the procedures delegated, and the duration. If the supervising physician changed in the last year, the agreement needs to reflect that. See our § 458.348 explainer for the full structure.
- Verify the current AHCA Health Care Clinic license — or, if your clinic qualifies for the wholly-physician-owned exemption, the AHCA exemption-determination letter on file. Confirm the license number, the address (which must match your operating address), and the expiration date. AHCA HCC licenses run on a biennial cycle; expired licenses are the single most common Form 3020 finding. See our AHCA HCC explainer.
- Pull OIG/LEIE exclusion screening for every staff member within the last 30 days — every MD, ARNP, PA, RN, LMA, esthetician, and front-desk staffer who touches a patient or a claim. Exclusion screening is monthly under federal guidance and the screening must be documented — a print-out of a "no match" result, dated, with the staff member's name visible. Missing OIG/LEIE screening is one of the few items that can trigger a federal claims issue independent of any state regulator.
- Verify every staff member's current Florida DOH MQA license — through flhealthsource.gov, with the print-out dated and on file. Confirm name, license number, license type, status (active, no restrictions, no discipline), and expiration. License lapses that go undetected for weeks are a frequent finding; the fix is a monthly verification cycle and a documented record of who did it and when.
- Last 12 months of Good Faith Exam records sorted by patient + procedure — legible, identifiable (full legal name + DOB or MRN, not initials), signed by a qualified examiner (MD/DO, ARNP, or PA — not RN), with the substantive elements documented (history, exam, risk-benefit, authorization). Template-only or copy-paste GFEs across many charts fail Board of Medicine review. See our Good Faith Exam in Florida page.
- Last 12 months of FAC 64E-16 biomedical waste manifests — every pick-up, every manifest signed by the transporter and the generator, every certificate of destruction filed. Florida's biomedical-waste rule requires a written operating plan, a written training record for every staff member who handles waste, and the manifest chain. Missing manifests are a frequently cited finding in AHCA surveys, often because the prior office manager kept them in a drawer that no one inherited.
- Current HIPAA Notice of Privacy Practices on display and on file — plus a vendor BAA refreshed within the last 12 months with every business associate handling PHI (EMR vendor, payment processor, marketing software, CRM, IT support, document-shred vendor, anyone else who touches patient data). The 2024 HIPAA Security Rule update made vendor-management gaps a more visible audit finding, and OCR is increasingly willing to pursue small-clinic actions where the gap is documentable.
- Current professional liability insurance declarations page — covering the clinic entity, the medical director individually, and each non-physician practitioner. Confirm the carrier, the policy number, the limits ($1M/$3M is the FL norm for med-spa procedures), the retroactive date, and the renewal date. The NYC inspection found 60% of clinics lacked proof of liability insurance; even though it's a small NYC sample, the underlying point — that many clinics can't produce proof of coverage in five minutes — is generalizable. Keep a current dec-page in the same binder as your AHCA license.
- Regenerative-services file (PRP / exosomes / peptides / NAD+ / stem-cell-adjacent). If your clinic offers PRP, exosomes, peptides, NAD+, any stem-cell-adjacent product, or any service marketed as "regenerative," pull (a) the experimental / off-label consent template currently in use, (b) the chain-of-custody log for every regen product handled in the last 6 months, (c) the FDA-status disclosure log given to each patient, and (d) the supervising MD's regenerative-medicine credentialing. Confirm vendor Business Associate Agreements and the § 1271.10 / § 503A status in writing for every regen product currently on premises. This is the 2025–2026 enforcement category that grew the fastest — New Life Medical Services (Sept 2025), Dynamic Stem Cell Therapy (Feb 2026), Gram Peptides + Prime Sciences (Mar 2026), and the April 2026 § 503A reclassification.
- DSCSA authorized-trading-partner verification — post-Pure Indulgence. Verify that every Botox, filler, and Rx-drug vendor you use is on the manufacturer's authorized-trading-partner list — AbbVie for Botox; Allergan for fillers; Galderma for Restylane and Dysport. Confirm purchase-volume vs administered-volume reconciliation for the last 12 months. The April 1, 2026 Pure Indulgence Aesthetics warning letter established every medical spa as a DSCSA "dispenser" subject to Section 582(d)(3) — and FDA cross-references manufacturer sales data against patient administration records to find unauthorized-trading-partner purchases. This is now the single highest-leverage compliance item on the page.
What we're watching for the next monthly update
We refresh this page once a month. Between now and the next update (mid-June 2026), the forward-looking watchlist is:
- Whether SB 1728's substance returns in 2027. The committee that killed SB 1728 didn't dispute the policy problem; it disputed the bill's specifics. Industry observers expect a revised version to be filed in the 2027 Florida session, but no bill has been pre-filed and no committee assignment is on the calendar yet. We'll flag the first pre-filing the moment it appears on flsenate.gov.
- Whether AHCA's 2026–27 inspection priorities reflect the Sun Sentinel attention. AHCA does not publish a public year-by-year inspection priority list; the only way to see the shift is through the questions field inspectors actually ask in HCC surveys. Anecdotal reports from clinics that have been surveyed in March, April, and May 2026 will accumulate over the next two quarters. We won't speculate before the data arrives.
- FDA enforcement direction on regenerative and GLP-1 compounding. The FDA has continued sending warning letters on exosome and regenerative claims through 2025–2026, and compounding-pharmacy oversight of GLP-1 analogs has been a recurring topic since the FDA's removal of semaglutide and tirzepatide from the shortage list. We watch the FDA's warning-letter feed (fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters) and link relevant actions in the next update.
- Any named Florida Board of Medicine final orders that become public. Final orders are public records once issued. We don't speculate about pending complaints (which are confidential under § 456.073) and we don't name physicians or clinics that haven't had a final order entered. When a final order with med-spa relevance becomes public on the MQA portal, we'll add it to this page with the citation.
What ProofOps does
This page is Florida Compliance Intelligence — curated by ProofOps from public enforcement actions and regulatory updates. It exists because reading every Board of Medicine final order, every AHCA citation, every FDA warning letter, and every newspaper investigation is exactly the kind of administrative-overhead work that a med-spa owner has neither the time nor the inclination to do — and that ProofOps Medical, a HIPAA Compliant Business Associate with signed BAA, SRA, IRP, 7 admin policies, and a sub-processor BAA tracker available under NDA, handles for you. The connection between the tracker and the done-for-you service:
- We read these reports so you don't have to. The investigations, the OIG bulletins, the FDA warning letters, the Board of Medicine final orders, the FAC rule updates — every primary source on this page is also our daily reading list at your compliance desk. We summarize what's actionable and ignore the noise.
- We watch your readiness score at 7 AM Eastern, every morning. If your clinic goes red on any of the ten items above (or any of the 100+ underlying signals we monitor), it gets flagged and put in front of a real person — technology does the heavy lifting, and someone reviews it. If you stay red for three days in a row, the founder pages you personally. That's the only way an owner-operator who's running a clinic pays attention to a compliance pager.
- We assemble your inspection-ready binder before AHCA finishes coffee. The AHCA Form 3020 survey starts with documents the inspector wants to see in the first 30 minutes. We keep those documents — license, supervisory agreement, GFE samples, biomedical-waste manifests, OIG/LEIE screenings, HIPAA materials, OSHA training records, insurance declarations — assembled in one PDF, reviewed and current as of the last business day. When the call comes, you hit print.
- A named compliance partner is on your floor from day one. Not a helpdesk, not a ticket queue — a named person who knows your clinic, your medical director, your EMR, your front desk, your standing orders, and which Florida-licensed healthcare attorney you'd want a call with if a complaint arrives. The first week is white-glove onboarding; everything after that is a working relationship with the same person.
Get the free Florida audit
The fastest way to see whether the ten checklist items above are actually current at your clinic — without trusting your own memory — is to let us do a free audit. We pull the readiness score against the same 100+ signals our paying clients see every morning, and you get the report back within five business days. No commitment, no payment, no automatic renewal.
Take the 2-minute Florida audit · Talk to a strategist
This page is informational. It is not legal or medical advice and should not be relied upon as the basis for clinical or operational decisions. The events summarized here are described from publicly available primary sources, which are linked. For interpretation of any specific enforcement situation, consult your Florida-licensed healthcare attorney and your medical director. ProofOps Medical does not practice law or medicine. Tracker last verified: May 22, 2026. Next scheduled refresh: mid-June 2026.