Medical spa policies and procedures are the written rules a practice uses so every visit follows the same steps. They cover who may do which task, what the client agrees to, how devices are used and cleaned, what gets recorded, and what happens when something goes wrong. A binder that sits unread does not do that job. A short manual that staff can find and follow does.
This checklist is a starting outline, not legal advice. Scope of practice, ownership rules, consent language, and record rules change by state and by the service offered. Have a qualified attorney and the appropriate clinical leadership review every policy before you rely on it.
What Medical Spa Policies and Procedures Should Cover
Think of the manual as a map of the visit, not a stack of forms. A new team member should be able to open it and see who does what, in what order, and where the record lives. Owners use the same pages when they add a device or a new service.
Nine areas belong in almost every manual. You can split them into more documents later. Start with one owner and one review date for each area.
| Policy area. | What the page should answer. | Who usually reviews it. |
|---|---|---|
| Staffing and scope. | Who may perform, assist, or supervise each service. | Clinical leader and employment counsel. |
| Consent. | What the client is told, and what they sign. | Clinical leader and attorney. |
| Device use. | Labeled use, operator list, and settings log. | Clinical leader and vendor trainer. |
| Sanitation. | Hand hygiene, surface cleaning, and sharps. | Safety lead and clinical leader. |
| Records. | What is written, stored, and who may see it. | Privacy lead and attorney. |
| Incidents. | How to report an injury, exposure, or complaint. | Clinical leader and safety lead. |
| Training. | What new hires learn, and when skills are rechecked. | Clinical leader. |
| Legal review. | Who signs off, and how often it is revisited. | Attorney and owner. |
Keep each page to one decision. “Who may perform microneedling in this practice” is a policy. A 20-page essay on skin science is not. Link out to protocols and device instructions instead of pasting them into the manual.
How to Organize the Manual
Name one owner for the manual. That person does not have to write every page. They do have to know which version is current and where staff can find it.
Give every policy the same header so updates stay traceable:
- Policy name and a short purpose line.
- Owner and the clinical or legal reviewer.
- Effective date and the next review date.
- Related forms, such as consent or an incident report.
- Where the retired version is archived.
Store one controlled copy where the people doing the work can open it during a visit. A desktop folder that only the owner can see is not a manual. If you keep paper in the treatment room, mark it with the same date as the digital file so the two copies cannot drift apart.
Review the set at least once a year, and also when you add a device, change a service, hire a new role, or move to a new state. Write the trigger in the policy so the review is not a memory test.
Staffing and Scope of Practice
This section answers a practical question: for each service on your menu, who may consult, who may treat, and who must be on site or available. The answer is not the same in every state, and it is not the same for every device. Do not copy another practice’s chart.
Build a one-page matrix instead of burying the rule in a job description. Rows are services. Columns are roles you actually employ, such as physician, nurse practitioner, registered nurse, or licensed esthetician. Each cell says perform, assist, or not permitted, plus any supervision note your counsel confirms.
Also write down:
- Which license the practice verifies before day one.
- Who checks that a license stays current.
- What staff do when a request sits outside their role.
- How supervision is documented on the treatment day.
Scope rules are why a startup plan and a policy manual are different documents. A roadmap such as how to open a med spa helps you plan licensing questions before you open. The policy manual is what the team uses on a Tuesday afternoon when a client asks for something new.
When you add a modality, update the matrix before the first paid visit. Adding radiofrequency microneedling is a good example: the clinical pathway and the supervision model should be settled before the device is booked. Our guide on how to add RF microneedling to your medspa covers that launch sequence. The policy page should then name who may operate the device in your state after counsel reviews it.
Consent and Client Communication
A consent policy describes the conversation, the form, and the refusal path. It should say what the client is told about the service, the expected course, the alternatives you offer, and the risks your clinical leader wants disclosed. It should also say what happens if the client declines.
Match the form to the service. A facial consultation and a microneedling visit do not need identical paperwork. Note which services require a new consent, which can use an annual renewal, and who may obtain the signature. If photos are part of the visit, use a separate photo release and say where those images may and may not appear.
Write the handoff in plain steps. The person who consults confirms the client understands the plan. The person who treats confirms the form is signed and the planned service matches the form. If the plan changes mid-visit, the policy says whether treatment stops until the form is updated.
Do not promise outcomes in the consent or in the script that introduces it. Consent is permission after a clear explanation. It is not a marketing claim.
Device Use and Sanitation
Device policy and cleaning policy belong next to each other because the team experiences them as one workflow. The device page should point to the manufacturer’s current instructions and to your internal rules for who may touch the device.
For each device, record four facts:
- Model name, and where the current instructions are filed.
- People approved to operate it, matching the scope matrix.
- How settings and single-use items are logged.
- Who may change a protocol, and how that change is dated.
Follow the labeled use. If a question about indications comes up, the policy should send the team to the instructions and to the clinical leader, not to a group chat. Browsing our technologies can help a practice see which systems it owns or is considering. The policy still has to name the exact model on site.
Sanitation policy should be specific enough to train from. Name the cleaner or process for hand contact surfaces, the treatment bed, and reusable tools, and say what is single use. State when hand hygiene happens. For sharps and any blood exposure, do not invent a local rule that conflicts with OSHA. The OSHA bloodborne pathogens standard, 29 CFR 1910.1030, applies to occupational exposure to blood and other potentially infectious materials. It calls for an exposure control plan, engineering and work-practice controls, and a sharps injury log for percutaneous injuries from contaminated sharps. Read the standard on the OSHA bloodborne pathogens page, then have your safety lead adapt the practice’s plan. State plans can be stricter.
If a device has its own cleaning cycle, write that cycle into the room setup so staff do not skip it when the schedule is full. A self-sanitizing imaging hood, for example, only helps if the policy says it runs between clients.
Records, Incidents, and Training
Decide what a complete visit record contains before you argue about software. At minimum, most practices document the consultation findings they rely on, the service performed, the products or device settings used, who treated, and the aftercare instructions given. Say how corrections are made so old text is not silently overwritten.
Privacy rules depend on whether your practice is a HIPAA covered entity and on your state law. Do not assume a med spa is covered, and do not assume it is not. The Privacy Rule’s text is in 45 CFR Part 164, Subpart E. The eCFR page for 45 CFR Part 164 Subpart E shows who and what the rule covers. Ask counsel whether you are a covered entity, what your notice must say, and which vendors need a business associate agreement. Then write the daily rule in one page: who may open a chart, how screens are locked, and how a client requests a copy of their record.
Incident policy should be usable under pressure. Define what counts as an incident in your practice. Examples include a sharps injury, an unexpected skin reaction, a complaint, a privacy miss, or a device malfunction. For each type, name who is told, how fast, and what is written down. Include how a staff exposure is evaluated. OSHA treats an exposure incident as a specific eye, mouth, mucous-membrane, non-intact skin, or parenteral contact with blood or other potentially infectious materials during an employee’s duties. Your plan should say where that employee goes next, without guessing at medical treatment in the policy itself.
Keep incident notes factual. Record what was seen, what was done, and who was notified. Leave diagnosis and legal conclusions to the clinician and the attorney.
Training policy closes the loop. List the modules a new hire completes before working alone, including scope, consent, device operation, sanitation, records, and incidents. Record the date and the trainer. Recheck skills when you add a device or change a form. A signed roster from last year does not prove today’s team knows the current page.
Service-specific screening stays in its own protocol. For needling, point staff to a dedicated guide such as microneedling contraindications rather than copying clinical lists into the policy manual. The policy only needs to say that screening happens, who does it, and where the result is filed.
Legal Review Before You Rely on the Manual
A checklist from a device partner, a consultant, or a blog is a draft. It becomes your policy only after someone who knows your state’s rules reads it against the services you actually offer.
Ask counsel to confirm four points before the first version is issued:
- Who may own the practice, and who must supervise care.
- Which roles may perform each service you advertise.
- Whether HIPAA, state privacy law, or both apply.
- Which consent and photo releases match those services.
Bring your clinical leader to the same review. Counsel will not know how the room actually runs. The clinician will not always know which sentence creates a legal problem. The owner signs the version that both have reviewed and sets the next review date.
Insurance review is separate from the policy draft, but the two should match. If your manual says a nurse performs a given service, your coverage conversation should describe that same model. Our aesthetic device insurance guide lists questions to take to a licensed insurance professional. It is not a policy form and it does not replace that conversation.
Re-review when a law changes, when you add a service, or when an incident shows a gap. Retire the old file. Do not leave two “current” versions in the folder.
Contact Emage Medical to talk through the devices you are adding and the workflow questions that should sit in your manual.
Frequently Asked Questions
What are medical spa policies and procedures?
They are the written rules for how your practice delivers care and runs the visit. Typical sections cover staffing and scope, consent, device use, sanitation, records, incident response, and training. They are practice documents. They are not a substitute for your state’s laws or for the device manufacturer’s instructions.
How often should a med spa update its policy manual?
Review it on a set schedule, at least yearly, and sooner if you add a device, change who may perform a service, expand to a new state, or learn from an incident. Date every version and archive the old one so staff cannot follow a retired page.
Who should write medical spa policies?
The owner can draft the workflow, but a qualified attorney and the practice’s clinical leader should review it before anyone relies on it. Device trainers can confirm that your steps match the current instructions. They should not be the only reviewers.
Does every med spa have to follow HIPAA?
Not every business that offers aesthetic services is a HIPAA covered entity. Coverage depends on the Privacy Rule’s definitions and on how the practice operates. Confirm your status with counsel, then write your daily privacy steps to match that answer and any stricter state law.
What should a device policy include?
Name the model, file the current instructions, list who may operate it, and describe how settings and single-use items are logged. Say who may change the protocol. Point staff to the sanitation and incident pages so cleaning and exposures are not left to memory.