Is My Medspa Legal? What the Law Actually Requires Before You Get a Needle

The person who approved your injections may have never set foot in the room with you.

That's not a hypothetical. It's how a lot of medspas actually operate: a five-minute video call, a signature on a form, and a green light to proceed — all before anyone who's actually licensed to diagnose or prescribe has laid eyes on your skin in person. Most patients have no idea that's what happened, or that it might not be legal in their state.

Here's what the law actually requires, and why the gap between "looks professional" and "is legal" is bigger than most people think.

Nursing is not the same license as prescribing

A registered nurse (RN) and a nurse practitioner (NP) are often treated interchangeably at the front desk, but their licenses allow very different things. An RN's scope is assessment, monitoring, patient education, and carrying out a treatment plan someone else already wrote. An RN cannot evaluate a new patient, decide on a treatment plan, and carry it out entirely on their own — in any state.

A nurse practitioner is also a nurse, but licensed at an advanced level: they can diagnose, order treatment, and prescribe within their state's scope-of-practice law. That's the license that allows someone to legally perform a Good Faith Exam — the initial history, physical assessment, and treatment plan every new medspa patient is supposed to get before any medical procedure. A physician or physician assistant can also perform it. An RN, aesthetician, or medical assistant cannot, no matter how many injections they've done.

If a medspa skips straight from a form you filled out online to a treatment chair, with no physician, NP, or PA ever assessing you in person or by an adequate exam, that's not a shortcut — it's the law being skipped.

Telehealth Good Faith Exams: legal, but not all created equal

Some medspas outsource the Good Faith Exam to a low-cost telehealth service: an NP in another state reviews your intake and signs off after a brief video call. To be clear, that's legal in most states — a telehealth exam isn't automatically a workaround of the law.

But legal and adequate are two different questions, and telehealth Good Faith Exams span a real range. Some are a genuine, if limited, safety check — enough of an assessment to catch an obvious red flag before it becomes a problem. Others are closer to a formality: a three-to-five-minute call that satisfies the requirement on paper without meaningfully evaluating your skin. As nurse practitioner and legal educator Jamie Weiland — who goes by The Legal NP — put it when we discussed this on the Medspa Confidential podcast: cameras flatter people, and skin texture doesn't translate well over video.

The practical takeaway: for someone to actually make a sound clinical decision about your treatment — not just clear the legal bar — they generally need to see and feel your skin in person. A telehealth Good Faith Exam can be a legitimate part of a medspa's process. It's a poor substitute for an in-person one when it's the entire process. (That distinction deserves its own closer look at some point — for now, the short version is: legal doesn't automatically mean thorough.)

Skill is not the same thing as knowledge

One of the more useful legal distinctions Weiland draws is between having a skill and having the knowledge behind it. You can teach almost anyone to physically perform an injection in a weekend course. What you can't teach in a weekend is the anatomy, the pattern recognition, and the judgment to know when something is about to go wrong — recognizing a vascular occlusion before it becomes permanent disfigurement, or knowing that a patient's autoimmune condition changes the risk calculus for a routine laser treatment.

That's why the law generally requires that delegated treatments still trace back to a licensed provider who did the initial assessment. Delegation rules vary significantly by state — in most, the person actually performing the treatment has to be a licensed nurse at minimum, but in a handful of states, a physician can legally decide who's qualified to inject, full stop, with no nursing license required at all. MedSpa Board doesn't believe that's a safe standard, regardless of what a particular state permits — it's exactly the skill-without-knowledge gap described above. That's why our national certification guidelines set a higher bar than the legal minimum: no one without at least an RN license is permitted to inject at a MedSpa Board–certified spa, in any state. Delegation is not the same as no oversight, and it never removes the requirement for a real exam up front.

The legal test isn't "could a doctor do this" — it's "must a doctor do this"

A lot of the confusion around scope of practice traces back to a 1983 Missouri Supreme Court case, Sermchief v. Gonzales, where two nurse practitioners were accused of practicing medicine without a license for providing basic family-planning care in a rural clinic, working from protocols written by their supervising physician. The state medical board argued that some of what they were doing was simply medicine, and therefore off-limits to them. The court disagreed — not because the tasks were trivial, but because the real legal question isn't "could a doctor do this." Nearly anything clinical could, in theory. The actual question is "must a doctor do this, specifically." Because these nurse practitioners were working under written protocols and had a supervising physician they could consult when something fell outside routine care, the court found that what they were actually doing — basic, protocol-guided primary care, with a doctor available for questions — was safe for them to perform independently. That test — legal authority, training, a real protocol, and access to physician backup, not just "is this technically medical" — still governs how scope-of-practice disputes get decided today, and it's exactly why the same procedure can be legal for one provider and illegal for another, depending on their license, their protocols, and their state.

A signature is not informed consent

Even when the right person is doing the right procedure, there's a separate legal requirement that gets skipped constantly: a genuine conversation about risk. Lack of informed consent is the single most common basis for litigation in medical aesthetics. A signed form proves a patient signed a piece of paper — it doesn't prove anyone actually discussed the risks out loud. Legitimate practices document that the conversation happened, not just that the form was collected.

For filler specifically, that conversation has to include the risk of vascular occlusion — a complication serious enough that certified medspas are required to keep enough hyaluronidase on hand to treat one immediately, not order it after the fact.

What to ask before you say yes

Before any medical spa treatment, it's reasonable — and it's your right — to ask:

Who is the medical director, and how often are they actually on-site? Who performed your Good Faith Exam, and what's their license? Who is performing the actual procedure, and what's their license? If you don't get a straight answer to any of those, that's the answer.

MedSpa Board certifies medspas that can answer those questions correctly: verified medical oversight, licensed staff, and real product sourcing, not a rented license and a rubber-stamp exam. If you're considering a treatment, check whether your medspa is certified at medspaboard.com — and if it isn't yet, that's worth asking them about too.