Written by: Ellie Pranckevicius, FNP-BC, Aesthetic Nurse Practitioner & Aesthetic Injector | Facial Restoration & Regenerative Injectable Specialist, Mirror Plastic Surgery
Key Takeaways
- Florida medical spas must operate under an active MD or DO medical director who provides real oversight, documented protocols, and on-site availability.
- Non-physicians may own a med spa business entity, but every medical procedure still requires physician supervision and proper licensing.
- Injectables, lasers, and peptide therapies count as medical treatments. Only licensed clinicians working under physician protocols may perform them, and peptides must come from licensed compounding pharmacies.
- Facilities must follow OSHA, HIPAA, and emergency protocols with written plans, staff training, and quarterly drills to avoid substantial fines.
- Verify compliance before treatment, then schedule a consultation at Mirror Plastic Surgery to receive care in a fully compliant, physician-supervised setting.
Florida Medical Director Responsibilities in 2026
Under Florida Statute Chapters 458 and 459, only an MD or DO with an active, unrestricted Florida medical license may serve as the medical director of a med spa or any facility providing services that constitute the practice of medicine. The role includes creating and signing treatment protocols, verifying staff training and competency, authorizing or performing good-faith exams, reviewing charts, and staying genuinely available for consultation and emergencies.
Regulators define real supervision as documented chart review, signed and current treatment protocols, on-site visits with written records, and availability for clinical questions during operating hours. A physician who only lends a name to a facility without active engagement often becomes an enforcement target. Florida’s 2026 regulatory posture is moderate, with permissive ownership and delegation paired with active enforcement and complaint-driven inspections by AHCA and the Department of Health after a high-profile crackdown.
For remote or off-site oversight, Florida’s training standards generally require a board-certified or board-eligible physician in dermatology or plastic surgery. For on-site supervision, specialty requirements are less rigid. A February 2026 petition from the Florida Society of Plastic Surgeons and the Florida Academy of Dermatology seeks to require med spas to prominently display the supervising physician’s name, specialty board certification, contact information, and other supervised med-spa locations on the website and in the waiting room.
Non-Physician Ownership of Florida Med Spas
Florida does not enforce a strict corporate-practice-of-medicine doctrine, so a registered nurse, nurse practitioner, esthetician, or non-clinical investor may own a med spa business entity outright. Ownership does not grant authority to perform, order, or supervise medical treatments beyond the owner’s own license. Non-physicians may participate in Florida medical spa ownership structures but must avoid improper control over medical decision-making. Common structures include management agreements, revenue-sharing models, and physician supervision arrangements.
Under Florida’s Health Care Clinic Act, an entity that provides health care services and bills third-party payors generally must hold a Health Care Clinic license from AHCA and operate under a designated medical or clinic director, with a vacant director role creating potential license suspension risk. Operating an unlicensed clinic can trigger enforcement actions under Florida law.
RN and NP Ownership Structures in Florida
A registered nurse may own the business entity of a Florida med spa outright. The clinical services offered inside that business still require physician oversight. For Florida med-spa operations involving NP participation, the clinical entity must be physician-owned or qualify for the AHCA Health Care Clinic Act wholly-physician-owned exemption. NPs typically participate through a friendly-PC and NP-owned MSO structure in which a physician owns the clinical entity and the NP owns an administrative management company connected by a Management Services Agreement.
The Management Services Agreement must limit the NP-owned MSO to strictly non-clinical services, set the management fee at fair market value, and avoid any language granting the MSO control over clinical judgment or a percentage split of medical revenue. An RN who owns a med spa and attempts to supervise medical procedures independently, without a qualifying physician medical director, risks scope-of-practice violations and AHCA enforcement action.
At Mirror Plastic Surgery, board-certified FNP Ellie Pranckevicius leads peptide and non-surgical aesthetic protocols within a physician-supervised structure anchored by Harvard-educated, Johns Hopkins-trained plastic surgeon Dr. Akash Chandawarkar. This model reflects the compliant NP-in-practice structure Florida regulators expect.
Explore Ellie’s physician-supervised approach and discuss a medically guided peptide or aesthetic plan within a fully compliant clinical framework.
Who Can Perform Injections, Lasers, and Peptide Therapies?
In Florida, Botox and dermal fillers may be injected by a physician, an ARNP under protocol, a PA under delegation, or an RN under physician order and supervision, as long as a good-faith exam occurs before treatment. Estheticians and unlicensed staff may never inject. A good-faith exam must be performed by a Florida-licensed physician, an ARNP under a written supervisory protocol, or a PA. An RN, esthetician, or licensed medical aesthetician may not independently perform the exam.
Laser and light-based hair removal counts as the practice of medicine in Florida and is overseen by the Department of Health Electrolysis Council. Non-physicians generally need an electrologist license with laser qualification, physician supervision under Chapter 458 or 459, and an electrology facility license.
For peptide therapies, peptides used to diagnose, treat, or prevent disease are classified as prescription drugs under federal law and therefore fall under state medical-practice oversight rather than supplement rules. Compounded peptide products for patient use must come from a licensed 503A compounding pharmacy for patient-specific prescriptions or a 503B outsourcing facility for office-use supply, under FDA compounding rules. Purchasing peptides from unregulated online vendors or research-use-only distributors and administering them to patients counts as administering an unapproved drug under FDA rules.
OSHA, HIPAA, and Infection-Control Rules for Med Spas
Florida has no state OSHA program, so federal OSHA enforces all workplace safety standards, including the Bloodborne Pathogens Standard, for med spas. Med spas with employees exposed to blood or other potentially infectious materials must follow OSHA’s Bloodborne Pathogens Standard (29 CFR 1910.1030). Requirements include a written Exposure Control Plan reviewed and updated annually, universal precautions, PPE at no cost, a Hepatitis B vaccine series offered free within 10 days of assignment, engineering controls such as sharps containers, and exposure incident documentation. In 2026, willful or repeated OSHA violation penalties reach $165,514.
A medical spa becomes a HIPAA-covered entity when it employs a licensed injector, collects health histories or allergy information, retains clinical notes, or processes even a single insurance claim for a procedure. In 2026, HIPAA penalties for medical spas range from $145 per violation for violations the entity did not know and could not have known, up to $73,011 per violation for willful neglect that is not corrected, with an annual cap of $2,190,294 for repeated violations of the same provision.
Florida’s Information Protection Act (FIPA, § 501.171) imposes a 30-day breach notification deadline to affected individuals, shorter than HIPAA’s 60 days, plus Florida Attorney General notification within 30 days for breaches affecting more than 500 Florida residents. Med spas must also execute signed Business Associate Agreements with every vendor that accesses, stores, or processes protected health information.
Emergency Preparedness and Incident Reporting
Florida med spas must maintain minimum emergency protocols covering vascular occlusion, anaphylaxis, syncope, adverse reactions, and a 911 escalation policy. Many med spas lack written emergency protocols, and practices without SOPs that experience an adverse event may face a higher risk of regulatory action.
Every med spa must conduct quarterly practice drills for all staff covering simulated anaphylaxis scenarios with actual epinephrine draw-up, role assignment verification, equipment checks with expiration date documentation, and evacuation route practice. All clinical staff must maintain current Basic Life Support (BLS) certification renewed every two years.
In December 2025, the Iowa Board of Medicine levied a $10,000 fine against a medical director for inadequate supervision. Enforcement actions like this show that regulators nationwide now scrutinize documented evidence of actual supervision, not just signed agreements. Beyond supervision and emergency readiness, Florida med spas that offer peptide therapies face additional sourcing and prescribing requirements that carry significant compliance risk.
Peptide Therapy Regulations and Sourcing Risks
Beyond the general medical director requirements discussed earlier, a Florida hormone and peptide therapy clinic’s physician should understand compounding pharmacy oversight and FDA scrutiny of peptides such as BPC-157 and TB-500. Florida requires out-of-state 503B outsourcing facilities to obtain a nonresident sterile compounding permit from the Florida Board of Pharmacy before shipping compounded sterile products, including peptides, to Florida residents.
Off-label use of an FDA-approved peptide requires the provider to exercise independent medical judgment supported by credible scientific rationale such as peer-reviewed literature, plus clear informed consent explaining the off-label nature, risks, benefits, and alternatives. Wholly unapproved peptides or those labeled “not for human consumption” carry high legal risk and may only be accessed through IND applications, IRB-supervised research, or formal expanded-access programs.
Mirror Plastic Surgery sources peptides from reputable providers with documented batch testing and operates under physician-supervised protocols reviewed by Dr. Chandawarkar. Ellie Pranckevicius conducts in-depth lab panels before starting any protocol so each patient’s treatment is based on individual clinical data rather than a generalized menu.
Schedule a lab-based peptide consult with Ellie to receive a batch-tested, physician-supervised protocol tailored to your goals.
How to Verify a Safe Medical Spa Before Treatment
Before scheduling any procedure, patients can use the following eight-step verification protocol to confirm that a Florida med spa operates under genuine physician oversight, maintains required safety programs, and sources treatments from licensed suppliers. This due-diligence checklist helps protect against unlicensed injectors, unapproved peptides, and facilities operating without AHCA authorization.
- Confirm the facility holds an AHCA Health Care Clinic license or a written AHCA exemption determination, and ask to see the document.
- Verify the medical director is an MD or DO with an active, unrestricted Florida medical license by searching the Florida Department of Health license lookup.
- Ask whether the medical director is physically present and engaged, not a remote or paper-only arrangement. Regulators require documented chart review, signed protocols, and on-site visit records.
- Confirm that any injector is a physician, ARNP under protocol, PA under delegation, or RN under physician order. Estheticians and unlicensed staff may never inject.
- Confirm that the required good-faith exam will be performed by a qualified provider before any injectable or laser treatment.
- For peptide therapies, confirm that products come from a licensed 503A or 503B compounding pharmacy, not an unregulated online vendor.
- Verify that the facility has a written emergency protocol for anaphylaxis, vascular occlusion, and syncope, and that staff hold current BLS certification.
- Confirm the facility has a HIPAA Notice of Privacy Practices posted in the waiting area and that staff can explain how protected health information is stored and secured.
How Florida Compares to Other States
The table below shows how Florida’s permissive ownership rules and active enforcement posture compare with stricter corporate-practice states like California and New York, as well as Texas. This snapshot highlights that compliance requirements for ownership, medical direction, and peptide oversight vary widely by jurisdiction. Every data point is cited inline.
Frequently Asked Questions
Can a nurse practitioner serve as the medical director of a Florida med spa?
No. Florida medical director authority comes from Chapters 458 and 459 of the Florida Statutes, which govern MDs and DOs. Nurse practitioners are regulated under Chapter 464, the Nursing Practice Act, and Florida’s autonomous practice pathway for ARNPs does not extend to serving as medical director of a med spa or specialty practice. An NP may lead clinical protocols and perform procedures within their scope under a physician-supervised structure, but a licensed MD or DO with an active, unrestricted Florida license must fill the medical director role.
Are peptide therapies regulated in Florida, and what makes a provider compliant?
Peptides used to treat, diagnose, or prevent disease are classified as prescription drugs under federal law, which places them under state medical-practice oversight. In Florida, a compliant peptide therapy provider operates under a licensed physician’s supervision, sources products exclusively from licensed 503A or 503B compounding pharmacies with documented batch testing, performs a thorough good-faith exam and lab review before starting any protocol, and obtains informed consent that discloses the compounded and off-label nature of the treatment. Purchasing peptides from unregulated online vendors and administering them to patients counts as administering an unapproved drug. At Mirror Plastic Surgery, Ellie Pranckevicius conducts comprehensive lab panels and builds individualized protocols under physician oversight, with peptides sourced from reputable, batch-tested compounding pharmacies.
What are the red flags that a med spa may not be operating compliantly?
Several warning signs suggest a med spa may not meet Florida’s legal requirements. These include an inability to identify or produce documentation for a licensed physician medical director, injections or laser treatments performed by estheticians or unlicensed staff, no good-faith exam before prescription procedures, peptides sourced from online retailers rather than licensed compounding pharmacies, absence of a written HIPAA Notice of Privacy Practices, no posted emergency protocols in treatment rooms, and a medical director who is rarely or never on-site. Patients can use the Florida Department of Health’s license lookup and AHCA’s facility registry to independently verify credentials and licensing status.
What HIPAA obligations apply specifically to Florida med spas?
A Florida med spa becomes a HIPAA-covered entity when it employs a licensed injector, collects health histories, retains clinical notes, or processes any electronic health information. Obligations include implementing a written Privacy Rule policy, conducting an annual Security Rule risk assessment, executing Business Associate Agreements with every vendor that handles protected health information, providing HIPAA training to all staff before PHI access and annually thereafter, and maintaining training records for at least six years. Florida’s Information Protection Act adds a stricter 30-day breach notification deadline to affected individuals, compared with HIPAA’s 60-day window, and requires notification to the Florida Attorney General for breaches affecting more than 500 Florida residents.
How does Mirror Plastic Surgery’s model reflect Florida’s compliance standards?
Mirror Plastic Surgery operates under the direct oversight of Dr. Akash Chandawarkar, a Harvard-educated, Johns Hopkins-trained board-certified plastic surgeon, which satisfies Florida’s requirement for an active MD medical director. Ellie Pranckevicius, FNP-BC, leads peptide and non-surgical aesthetic protocols within a physician-supervised framework that aligns with Florida’s rules for ARNPs working under written protocols. Peptides are sourced from reputable providers with documented batch testing rather than unregulated online sources. Every patient receives an in-depth consultation that may include comprehensive lab panels, individualized protocol design, and ongoing concierge support, which aligns with Florida’s good-faith exam requirements, informed consent standards, and genuine-supervision expectations.
Summary: Choosing Compliant Medical-Spa Care in Florida
Florida’s 2026 medical-spa regulatory framework requires verified physician medical directors, proper AHCA licensing, scope-of-practice compliance for every procedure, licensed compounding pharmacy sourcing for peptide therapies, and documented OSHA and HIPAA programs. Enforcement is active: AHCA administrative fines reach $10,000 per violation per day, OSHA willful-violation penalties reach $165,514, and HIPAA penalties can reach millions for systemic breaches. Patients who apply the eight-step verification checklist above can separate compliant, medically supervised operations from under-regulated alternatives before receiving any treatment.
Mirror Plastic Surgery’s concierge model, which is physician-supervised, lab-reviewed, and sourced from batch-tested compounding pharmacies, reflects the compliance standards Florida regulators expect and patients deserve.
Schedule your compliant aesthetic or peptide consultation with Ellie at Mirror Plastic Surgery in St. Petersburg, Florida.
Peptide therapy is intended for wellness and optimization purposes and is not prescribed to diagnose, treat, cure, or prevent disease unless specifically stated. Many peptides are not FDA-approved and may be used off-label. Some have limited long-term safety data, with a potential for unknown risks, complications, or desensitization with prolonged use.
