What the investigation actually found
"Med spas unmasked: Lack of oversight puts customers at risk" was published in the Sun Sentinel and Orlando Sentinel on February 19, 2026, reported by Cindy Krischer Goodman and David Fleshler. The article is paywalled at sun-sentinel.com; you can verify its existence and reporters via the Orlando Sentinel's own Threads post announcing it. ProofOps does not quote the article verbatim on this page beyond its title; everything below is paraphrase plus our operational reading.
The reporting documents a consistent pattern across multiple Florida medical spas: the medical director listed on the supervisory paperwork is rarely or never physically present at the clinic. In several cases the director's primary practice is hundreds of miles away. In several cases the same director is the legal supervisor for multiple clinic locations operating simultaneously. In multiple cases the relationship is a monthly retainer — a flat fee in exchange for the director's name on the paperwork, with minimal expectation that the director actually walks the floor, reviews charts in real time, or is reachable for an in-progress complication.
The reporters also documented at least one patient-burn settlement following a laser hair removal procedure where the supervising physician was not on site. The clinical pattern around laser injury — non-physician operators, no real-time physician availability, no pre-procedure Good Faith Exam by a qualified prescriber, no documented post-incident workflow — is the canonical med-spa risk profile, and the settlement the reporters surfaced is one published example of it crystallizing into a damages award.
The empirical record under the article is the Plastic and Reconstructive Surgery systematic survey of independent Florida medical-spa directorship, published January 2025. Of the Florida independent med-spa providers surveyed, 84% are nonphysicians, only 22% of clinics have core-specialty MD supervision, 77% of medical directors lack specialty training, and 42% lack board certification. The Sun Sentinel investigation is not a study; it is reporting that uses the study's findings as the empirical floor under its named cases. The American Medical Association's position — that the person providing medical care at a med spa "is not usually a physician" — is the policy-level statement of the same picture.
A Florida plaintiff's law firm, Rafferty Domnick Cunningham Yaffa, published a press release on February 20, 2026 — the day after the Sun Sentinel article — calling for stronger oversight of the state's med-spa industry. The GlobeNewswire release is the secondary corroboration: when a plaintiff's bar publicly says "the industry outpaces regulation," the case theory they're building has already crystallized. For a clinic owner, that is not a threat — it is a signal about how a deposition would go if a future complaint landed.
Why this is the moment, not a passing news cycle
Florida medspa supervision has been a slow-moving regulatory story for years. Industry press has covered it. The Board of Medicine has spoken to it. The Plastic and Reconstructive Surgery survey landed in January 2025 and the AMA's statement predates that. What changed on February 19, 2026 is the medium the story is now living in:
- First sustained major-market FL journalism on medspa supervision. The Sun Sentinel and Orlando Sentinel are large general-circulation newsrooms with Pulitzer-history beats. When a story moves from industry trade press to general newspapers with subscribed-reader bases of legislators, regulators, and plaintiffs' counsel, the audience changes. So does the political incentive for the agencies named in the story.
- National enforcement playbook is forming. In December 2025, the New York City Council's Oversight & Investigations Division inspected 15 New York City medspas and reported that 93% failed to properly display licenses, 86% were missing required safety records, 73% had no medical professional on site, 63% had chemical or fire safety violations, and 60% lacked proof of liability insurance. The sample is small; the inspection protocol is the one other large municipalities — including those in Florida — will copy.
- SB 1728 died, but the underlying rules didn't. SB 1728 / HB 1429, the Medical Spa Prescription Drug Oversight Act, would have introduced statutory language around medical-director presence, GFE timing, and adverse-event reporting. The bill died in subcommittee on March 13, 2026 — roughly three weeks after the Sun Sentinel investigation. The death of SB 1728 does not soften the operational picture; it concentrates it. The existing rules (§ 458.348, AHCA HCC, GFE Rule 64B8-9.009, FAC 64E-16, 42 USC § 1320a-7a) are the enforcement lever — and every documentation requirement SB 1728 would have introduced is already enforceable under those rules. See our SB 1728 explainer.
- Plaintiff's bar attention is publicly on the record. The Rafferty Domnick Cunningham Yaffa press release on February 20, 2026 is the kind of public statement plaintiffs' counsel issue when their case-theory inventory is full. That is not a regulatory prediction; it is an observable fact about who is paying attention.
The honest read on all of the above is not "Florida is about to overhaul medspa regulation." It is: the existing rules just got a much larger audience. The owner-operator's job this week is to make their evidence retrievable in minutes against those rules — not to predict which agency moves first.
The 8-point response to run this week
What follows is an operational checklist, not legal advice. Each item names the rule it serves, what "complete" looks like in evidence form, and an approximate time estimate for a clinic with organized records. (Estimates double or triple for clinics where the records have to be reconstructed from email and shared drives.)
Confirm your § 458.348 supervisory agreement is current.
Pull the executed supervisory agreement between the clinic and the supervising physician. Confirm it is signed by both parties, dated within the current calendar year, and lists the specific delegated medical acts (botulinum toxin, fillers, laser, IV therapy, GLP-1, microneedling). Confirm the 25-mile attestation on file — the supervising MD's primary practice address must be within 25 miles of the clinic, or the clinic must use the alternative arrangement explicitly permitted under the rule.
Verify your MD has not added supervisory load in the last 90 days.
One of the patterns the Sun Sentinel investigation documents is the same supervising MD running multiple clinic locations simultaneously. Reach out to your medical director in writing and confirm how many independent supervision arrangements they are currently a signatory to. If the count has grown in the last 90 days, document the protocol-level review of their capacity — the calendar arrangement, the chart-review cadence, the after-hours availability — in a memo signed by both parties. This is not about telling your MD how to practice; it is about creating the evidence record that you, the owner, asked the question.
Pull OIG/LEIE screening for every staff member within the last 30 days.
The federal exclusion list (OIG's List of Excluded Individuals/Entities) is screenable by name, NPI, or license number at the OIG LEIE site. Employing or contracting with an excluded individual is a per-item civil penalty of up to $20,000 under 42 USC § 1320a-7a, plus assessed damages. Screen every staff member — injectors, RNs, estheticians, front desk, contract MDs, contract ARNPs/PAs, billing contractor, IT contractor — and save the dated screenshot for each. Repeat monthly.
Verify every staff Florida DOH MQA license is current and active.
Run every clinical staff member's license number through the Florida DOH MQA practitioner search. Confirm the license is active (not expired, not under disciplinary action, not restricted) and that the discipline matches the delegated medical acts the staff member is actually performing. An expired license is the cleanest, fastest finding an inspector can write up — it is also the cleanest, fastest finding to fix.
Audit the last 12 months of GFE records by patient and procedure.
Pull the last 12 months of completed procedures from your EMR. Sort by patient and by procedure category (botulinum toxin, dermal filler, laser, IV therapy, GLP-1, microneedling). For each procedure, confirm that a Good Faith Exam is on file, authored by a qualified prescriber (MD/DO, ARNP, or PA operating under § 458.347 / § 458.348), specific to the procedure type, and dated before the procedure. Flag any procedure without a covering GFE for medical-director review. This is the audit the Board of Medicine performs under Rule 64B8-9.009 when it samples charts in a complaint investigation — running it yourself first means you find what they would find before they do.
Verify your current AHCA HCC license or exemption-determination letter.
The Florida Health Care Clinic Act (§ 400.9905; AHCA Ch. 400-X) requires an HCC license unless the clinic qualifies for a documented exemption — most commonly the wholly-physician-owned exemption. Either you have a current HCC license (verify the expiration date on the certificate) or you have a written exemption-determination letter from AHCA on file. Anything else is exposure. The Sun Sentinel investigation focuses on supervision, not licensure, but the AHCA licensure question is the one inspectors ask first — and the one the FAQ above is written to.
Confirm FAC 64E-16 biomedical-waste manifests are current.
Florida Administrative Code 64E-16 governs biomedical-waste handling, storage, and transport. Pull your last 12 months of biomedical-waste pickup manifests from your transporter (Stericycle, Daniels, etc.). Flag any pickup interval greater than 60 days as a danger finding — biomedical waste cannot be stored on site indefinitely. Confirm that the operating plan, the employee training record, and the transporter's registration certificate are on file with the manifests. An NYC Council–style inspection report flagged 86% of inspected clinics missing required safety records; biomedical-waste manifests are the easiest such record to surface — or to fail.
Confirm malpractice declarations and that your supervising MD is named.
Pull the current malpractice declarations page from your carrier. Confirm the policy is in force, the limits are appropriate to your procedure mix, and that the supervising MD's coverage is named on the policy (either as the clinic's named insured if they are a W-2 medical director, or as an additional insured if they are an independent contractor). A non-Florida-based MD with no in-state policy is a quiet finding that becomes a loud one the first time a complaint lands. This is also a good moment to pull the supervising MD's individual malpractice declarations page and file it alongside.
What the regulatory picture actually looks like post-SB-1728
SB 1728 / HB 1429 — the Medical Spa Prescription Drug Oversight Act — died in subcommittee on March 13, 2026, roughly three weeks after the Sun Sentinel investigation. The bill would have introduced explicit statutory language around medical-director presence, GFE timing, and adverse-event reporting at Florida medical spas. Its death does not change the operational picture, because every documentation requirement the bill would have introduced is already enforceable under existing Florida law: § 458.348 supervision (with the 25-mile attestation and the written supervisory protocol), the AHCA Health Care Clinic Act and Ch. 400-X licensure layer, Board of Medicine Rule 64B8-9.009 (Good Faith Exam standards and recordkeeping), Florida Administrative Code 64E-16 (biomedical waste), 42 USC § 1320a-7a (federal exclusion screening), and the case-law standard of care under § 458.331(1)(t). AHCA, the Florida Board of Medicine, and DOH MQA enforce what is already on the books.
Here is the hedge ProofOps insists on being honest about: as of the publication date of this page, we have not seen a public statement from AHCA, the Florida Board of Medicine, or DOH MQA committing to stepped-up enforcement in direct response to the Sun Sentinel investigation. Predicting which agency moves first, or when, is not something we do. What is publicly observable is: sustained major-market journalism on the supervision gap; a peer-reviewed empirical record (Plast Reconstr Surg, Jan 2025); a Florida plaintiff's firm publicly calling for stronger oversight (Rafferty Domnick, Feb 20, 2026); a recent municipal-inspection playbook (NYC OID, Dec 2025) that other large metros are likely to copy. That is enough information to act on the 8-point checklist above. It is not enough information to claim the regulators have moved — and we won't claim otherwise.
What ProofOps does for clinics in this moment
ProofOps Medical is a Florida-only done-for-you compliance back-office — a fractional compliance department on file from day one. Your named human compliance partner handles the documentation work continuously, with technology doing the heavy lifting and a real person reviewing and signing off across nine frameworks. In the context of the Sun Sentinel investigation, the relevant pieces are:
- We run the 8-point checklist above for you. § 458.348 supervisory agreement currency, MD load monitoring, OIG/LEIE monthly screening, DOH MQA license verification, GFE-to-procedure reconciliation, AHCA HCC status, FAC 64E-16 manifest cadence, and malpractice declarations — all tracked, all dated, all retrievable in minutes instead of weeks.
- A named human compliance partner is on the engagement from day one. Not a chatbot. Not a "compliance content library." A real person who answers their email and runs the readiness review with you monthly.
- Founder Score Watch. If the clinic's readiness score sits red for three consecutive days, the founder of ProofOps Medical (Casiani Gherlan) is paged personally. The Sun Sentinel investigation is exactly the kind of moment when the difference between "your readiness report shows red" and "your founder calls you" is the operational difference that matters.
- Inspection-pack is always current. A bound PDF — license certificates, supervisory protocol, GFE samples, OIG/LEIE screenings, biomedical-waste manifests, training logs, malpractice declarations — is regenerated continuously and ready to hand to a surveyor or an attorney without a scramble.
- Free Florida audit, 48-hour turnaround, no credit card. We map your current exposure across the 8 surfaces above and tell you, honestly, what is green, what is yellow, and what is the kind of red that should not wait. If you do not engage us after the audit, you still keep the audit.
- Pricing for the work itself. Managed Evidence is $999/month. The Lighthouse 5 founding cohort (first 30 days at no monthly fee, $1,195 Historical Compliance Migration & Audit, capped at five Florida clinics, then a locked $599/mo founding rate on day 31) is open while seats remain. Multi-Location is $1,695/mo for two locations plus $599/mo per additional location, $2,495 setup. See the pricing page for the full breakdown.
Honest disclaimer
ProofOps Medical is a documentation back-office, not legal advice. We do not replace your medical director, your malpractice carrier, your Florida healthcare attorney on substantive legal defense, or your obligation to operate within the standard of care. We do not predict what Florida regulators will do, when, or to whom. We do not make claims about the specific clinics, physicians, or patients named in the Sun Sentinel investigation. What we do is make the evidence your clinic already owes under existing rules retrievable in minutes instead of weeks, every month, with a named human on file. That is the entire product.
Run the 8 surfaces above against your clinic — and see where the gaps actually are.
We map your exposure across § 458.348 supervision, AHCA HCC, GFE Rule 64B8-9.009, OIG/LEIE, DOH MQA license status, FAC 64E-16 biomedical waste, malpractice declarations, and the supervising-MD capacity question the Sun Sentinel investigation made unavoidable. 48-hour turnaround. No credit card. No sales pressure. You keep the audit either way.
ProofOps Medical · 1211 Okeechobee Rd Ste 2 · West Palm Beach, FL 33401 · info@proofopsmedical.com
This page is informational. It is not legal or medical advice and should not be relied on as the basis for clinical, regulatory, or litigation decisions. ProofOps Medical does not practice medicine, does not practice law, and does not replace your medical director, malpractice carrier, or healthcare attorney. The 8-point checklist above is operational, not exhaustive; specific compliance obligations vary by clinic, procedure mix, and licensure posture. Confirm any specific question with your Florida healthcare attorney and your medical director. Sources: Sun Sentinel / Orlando Sentinel, "Med spas unmasked: Lack of oversight puts customers at risk," by Cindy Krischer Goodman and David Fleshler, Feb 19, 2026 (paywalled at sun-sentinel.com); Plastic and Reconstructive Surgery, "The Shifting Face of Aesthetic Care: A Systematic Review of Independent Florida Med-Spa Directorship," Jan 2025; American Medical Association, "Who's on site for care at medical spas? Not usually a physician"; Rafferty Domnick Cunningham Yaffa, GlobeNewswire press release, Feb 20, 2026; New York City Council Oversight & Investigations Division, Medical Spas Report, Dec 2025; Florida Statutes Chapter 458, Chapter 400; Florida Administrative Code Rules 64B8-9.009 and 64E-16; 42 USC § 1320a-7a.