Med Spa Legal Roundtable: Ghost Medical Directors, Compliance Pitfalls & Competitor Reports

Welcome to Med Spa Success Strategies, hosted by Ricky Shockley with Med Spa Magic Marketing. This is where medical spa and aesthetics practice owners come to discover strategies and tactics that help them better market and manage their practices so they can grow, improve profitability, and have a greater impact for their teams, patients, and communities.

In this compliance roundtable, host Ricky Shockley is joined by two leading healthcare attorneys from Lengea Law: Samara Bell and Sara Shikhman.

Together, Samara and Sara bring a combination of legal expertise and operator experience to help medical providers navigate the complex legal landscape of growing and scaling a healthcare business.

Meet the Experts

Samara Bell,

Samara is a healthcare attorney at Lengea Law focused on transactional and strategic work, with a specialty in mergers, acquisitions, and partnerships for physicians, dentists, veterinarians, and other medical providers. She earned her Bachelor of Arts from Colgate University and her law degree from Suffolk University Law School.

Sara Shikhman,

Sara is an experienced healthcare lawyer and entrepreneur with more than 16 years of experience. She and her team at Lengea Law have guided over 1,000 clients through contracts, intellectual property, funding, and regulatory hurdles. Sara has also led several multi-million-dollar ventures herself—including serving as General Counsel and Director of Sales for a medical spa practice that grew from a single room to over 12 locations generating more than $13 million a year, as well as leading an e-commerce business to over $13 million in revenue in 24 months. She earned her law degree from the University of Pennsylvania Law School.

1. The Evolving Landscape of Medical Supervision

Regulatory oversight surrounding medical supervision in med spas across the United States is rapidly intensifying. Medical boards, nursing boards, and state health authorities are actively enforcing supervision guidelines, targeting practices operating under nominal or non-existent oversight.

Medical Directorship Standards: Common Pitfalls vs. Compliant Practice

The Era of the “Ghost Medical Director” Is Over

Historically, many aesthetic practices operated under informal arrangements: a medical director signed a contract, licensed their face or credentials for a website bio, collected a small monthly fee, and was never seen again inside the practice.

Regulators across the country are shutting down these arrangements. Medical supervision requires meaningful, active engagement. Practice owners can no longer treat medical directorships as a passive line item.

The 3 Core Pillars of Compliant Supervision

While specific regulations vary by state (especially depending on whether procedures involve specialized lasers or medical devices), three fundamental requirements form the baseline for compliant medical supervision across the country:

1. Regular Site Visits & On-Site Presence: Medical directors should physically visit the practice on a routine schedule—ideally once per month, or at a minimum once per quarter. Every visit (whether in-person or via structured tele-supervision where permitted) should be explicitly documented—for example, by sending a confirmation email after each visit saying, “Thank you for coming by today” or “Thank you for meeting with us on Zoom today,” creating a clear paper trail for auditors.
2. Routine Chart Audits: Medical directors must actively review patient medical records. A standard rule of thumb across the industry is auditing at least 10% of patient charts per quarter. While state statutes rarely mandate an exact percentage (e.g., 9% vs. 10%), demonstrating a consistent pulse on charting and protocols is vital during a regulatory audit, especially in states without full practice authority for Nurse Practitioners or where the Corporate Practice of Medicine (CPOM) is prohibited.
3. Emergency Availability & Protocol Oversight: The medical director must be immediately reachable by phone or video during operating hours to handle adverse events, clinical complications, or patient emergencies. Furthermore, they must actively assist in drafting, reviewing, and approving clinical operating protocols.

The “Race to the Bottom” Danger

On social media and industry forums, practice owners often ask: “Where can I find the cheapest medical director in my state?” Some directorship matching platforms offer bargain rates ($200 to $300 per month) alongside referral incentives (e.g., “$50 credit for every friend you sign up”).

When regulatory investigators inspect a med spa contract and see a medical director being paid $200 or $300 a month, it serves as an immediate red flag. Regulators understand that no physician can realistically provide legal oversight, conduct 10% chart reviews, assist with emergency calls, and perform quarterly site visits for $300 per month.

Restructuring Your Directorship Relationship

When business owners consult AI tools like ChatGPT for legal guidelines, they often receive four conflicting answers, or rely on bad advice from peers (“My friend told me I don’t need a medical director for this”).

If your practice currently relies on a low-cost or distant medical director, take proactive steps:

• Initiate an Honest Conversation: Blame your legal counsel if necessary. Explain that updated compliance standards require documented visits, routine chart reviews, and documented emergency protocols.
• Adjust Compensation to Reflect Real Work: Expect fees to adjust to fair market value ($600 to $1,000+ per month depending on scope and state guidelines).
• Formalize Written Contracts: Never rely on handshake deals or invoice receipts. Ensure a formal Medical Director Agreement is drafted by experienced healthcare legal counsel.

2. Audits, Competitor Complaints, and Online Cyber Harassment

Many practice owners operate under a false sense of security, assuming regulatory audits are rare. In reality, state regulatory interventions occur daily through several common triggers.

Key Triggers for Regulatory Inspections

• Anonymous Competitor Reports: In states that permit anonymous reporting to medical or nursing boards, competitors frequently submit complaints against neighboring practices to trigger formal investigations.
• Disgruntled Former Employees: Ex-employees possess internal knowledge of non-compliant practices (e.g., missing good faith exams, improper storage, or lack of supervision) and represent one of the single largest sources of regulatory tips.
• Blind Undercover Spot Checks: Municipalities and states are conducting unannounced, blind investigations. In New York City, for instance, undercover inspectors systematically walk into med spas to inspect operations, credentialing, and product storage on the spot.
• Patient Complication Complaints: If a patient suffers an adverse clinical reaction and files a complaint with the state board or hires a malpractice attorney, state investigators often issue immediate stop-use orders against the facility.

Penalties and Compliance Audits

Regulators rarely issue a gentle slap on the wrist. First-time administrative fines can exceed $100,000, particularly in cases involving unapproved compounds, where fines can be levied per vial found on-site. In severe instances, boards issue immediate temporary closure orders, locking the doors until full compliance is proven.

To protect your business, existing practices should conduct a proactive mini compliance audit:

• Are Good Faith Examinations (GFEs) being conducted properly before treatments?
• Is the medical director being paid a lawful flat fee rather than an illegal percentage split?
• Is practice and liability insurance tightly structured and up to date?

Who Should Draft the Medical Director Agreement?

In medical aesthetics, structural arrangements often involve a Physician Practice Corporation (PC) and a Management Services Organization (MSO) tied together by a Management Services Agreement (MSA). The party that hires the attorney is the one who controls the contract terms:

• If the Practice/MSO Hires the Lawyer: The contract will be structured to require maximum performance from the medical director (routine visits, thorough chart audits, strict availability SLAs).
• If the Medical Director Hires the Lawyer: The contract will often minimize their documented commitments to protect them across multiple practice directorships.

Regardless of who originates the document, operating on a handshake deal or relying on monthly invoice receipts as proof of an agreement leaves both parties completely unprotected.

What About Med Spa Accreditation?

While third-party accreditation companies have emerged in the aesthetic space, accreditation is only as good as the private company issuing it. There is currently no law requiring med spas to be accredited. While accreditation serves as a strong marketing asset and trust signal for consumers—much like third-party HIPAA compliance verification services—it is not a legal substitute for state board compliance.

Cyber Harassment and Social Media “Rage Baiting”

A growing trend on social media involves aesthetic providers posting call-out content, exposing clinical complications or perceived mistakes made by competing med spas for clout and views.

While “rage bait” content generates quick views and followers, it carries extreme legal risk:

1. Professional Ethics Violations: Medical and nursing boards enforce strict codes of professional conduct prohibiting online harassment, defamation, and bullying of colleagues.
2. Litigation Backfire: If a provider who posts critical call-out content subsequently experiences a patient complication in their own clinic, plaintiffs’ attorneys and regulatory boards will use those exact social media posts as evidence of legal liability, arguing: “You publicly stated that competent injectors never suffer this complication, yet it occurred under your care.”

3. GLP-1 Weight Loss Medications & Sourcing Integrity

The regulatory and legal landscape surrounding GLP-1 compounding (semaglutide, tirzepatide) has stabilized significantly compared to previous legal volatility, but compliance oversight remains essential.

The Post-Litigation Landscape

Following major federal court rulings where pharmaceutical manufacturers lost key litigation challenges against compounding practices, the wave of aggressive cease-and-desist letters from pharmaceutical brand attorneys has subsided. However, risk management has shifted from litigation defense to clinical documentation and sourcing integrity.

Vetting Your GLP-1 Compounding Pharmacy

Practice owners must avoid buying GLP-1s or peptides from the cheapest available supplier without independent verification:

• Verify State-Specific Pharmacy Licensure: Always request a copy of the compounding pharmacy’s active license to ship specifically into your state. Many nationwide distributors operate legally in their home state but lack valid shipping licenses for states like California, Texas, or Illinois.
• Beware Forged Certificates of Purity: While pharmacies supply certificates of analysis, fraudulent documentation exists in the grey market.
• Implement Third-Party Lab Testing: High-volume practices often send one vial out of every batch (e.g., a 100-vial order) to an independent third-party analytical testing lab to verify compound purity, concentration, and sterility.
• FDA Compounding Restrictions: The FDA is actively attempting to curtail the compounding of non-shortage GLP-1s (tirzepatide and semaglutide). Large nationwide 50-state distributors (such as Medvid and others) have faced major legal enforcement cases.

Clinical & Marketing Differentiation

Rather than engaging in a price war against online telehealth platforms selling $99/month GLP-1 subscriptions, brick-and-mortar med spas should pair GLP-1 prescriptions with comprehensive, in-person clinical wellness programs.

Incorporate monthly weigh-ins, lab monitoring, complementary aesthetic treatments, and nutritional/vitamin support. Highlighting your rigorous third-party drug testing protocols on your website and marketing materials builds immense patient trust and justifies premium pricing.

4. The Unfiltered Truth About Peptides & RUO Labeling

Peptides (such as BPC-157, CJC-1295, and Ipamorelin) represent a major growth trend in wellness, but they currently carry significant legal and regulatory liability.

Peptide Labeling & Regulatory Risks

The “Ask Forgiveness” Risk Model

Despite widespread promotion on mainstream podcasts (including mentions by Joe Rogan and RFK Jr., as well as upcoming FDA hearings on peptide reclassification), many popular peptide compounds cannot be lawfully compounded by pharmacies or administered in clinics. Practice owners offering these treatments are operating purely on risk tolerance—banking on a lack of enforcement and taking an “ask forgiveness rather than permission” approach.

If a patient suffers a medical complication from an RUO or non-approved peptide, proving in court or before a medical board that the unapproved compound did not cause the injury is an almost impossible legal hurdle.

5. State-by-State Regulatory Watchlist

Because healthcare oversight is governed at the state level, med spa rules change rapidly across the country:

• New York (Nurse Practitioner Independence): Nurse Practitioners (NPs) in New York have been operating under temporary independent practice authority. With this temporary legislation set to expire on July 1st, NPs face potential regulatory shifts. If state lawmakers do not extend the law or make it permanent, NPs will immediately be required to pivot back to formal collaborative agreements with licensed physicians.
• Indiana (Mandatory On-Site Supervision): Indiana enacted regulations requiring a designated “responsible person” to be physically on-site at all medical spas during operating hours. Registered Nurses (RNs) cannot fill this role; the on-site supervisor must be an advanced practice provider, such as a Nurse Practitioner (NP) or Physician Assistant (PA).
• Georgia (Board Memos & Fast Backpedaling): The Georgia Composite Medical Board issued an advisory memo tightening standards around Management Services Organizations (MSOs), requiring medical directors to reside within the state, and enforcing strict protocols for Good Faith Examinations (GFEs). Following massive pushback from the medical aesthetics community, the board issued a follow-up statement within weeks announcing it was re-evaluating its stance.
• Pharmacy Board Interventions: State pharmacy boards are joining medical and nursing boards in issuing strict guidelines regarding off-label compounding, peptide distribution, and office-use compounding.

How to Keep Up With State Rules

Because regulatory updates originate from multiple state boards (Medical, Nursing, Pharmacy, and Health Departments), there is no single central government database tracking all changes. Practice owners should maintain ongoing relationships with specialized healthcare law firms, subscribe to legal blogs, and attend industry webinars to stay compliant.

6. The New Digital Threat: Website Privacy Laws & Cookie Tracking

Much like the wave of Americans with Disabilities Act (ADA) website compliance shakedown lawsuits that targeted med spas in recent years, plaintiff law firms are now using state privacy and anti-wiretapping statutes—most notably in California—to target healthcare business websites.

How Cookie Privacy Lawsuits Work

1. Automated Scanning: Law firms use automated software to scan med spa websites for tracking tools, such as the Meta (Facebook) Pixel or Google Analytics.
2. Improper Script Execution: If tracking cookies load and collect user data before the website visitor explicitly grants permission via a cookie banner, attorneys file wiretapping lawsuits or issue heavy demand letters.
3. Audience Upload Risks: Uploading patient email or phone lists into social media platforms to build lookalike advertising audiences creates severe privacy compliance liabilities under these emerging laws.

The Technical Script-Loading Flaw

Installing a cookie consent banner plugin (such as Termageddon or CookieYes) is often not enough to prevent legal liability.

Many standard website templates load tracking scripts in an improper order, executing tracking pixels seconds before the cookie consent banner blocks them. Practice owners should work with web developers and legal counsel to run technical audits ensuring that all tracking code is completely suppressed until explicit user opt-in occurs.

Summary Action Checklist for Med Spa Owners

1. Audit Your Directorship Agreement: Transition away from $200/month “ghost” directors. Ensure your medical director conducts routine site visits (monthly or quarterly), audits 10% of patient charts, and maintains documented 24/7 emergency availability.
2. Verify Drug Sourcing: Request state-specific shipping licenses from every compounding pharmacy you use. Consider third-party laboratory testing for bulk GLP-1 orders.
3. Eliminate RUO Peptides: Immediately audit your peptide inventory to ensure no “Research Use Only” compounds are being administered to patients.
4. Audit Website Cookie Compliance: Test your website to ensure tracking pixels do not fire before visitors explicitly accept your cookie consent banner.
5. Establish Formal Written Contracts: Ensure all PC, MSO, MSA, and Medical Director agreements are formally drafted by qualified healthcare legal counsel.

Connect with the Guests & Host

To consult with Samara Bell, Esq. and Sara Shikhman, Esq. or access legal templates for your practice:

• Website: lengealaw.com
• Instagram: @lengealaw
• Services: Free consultations for new clients and downloadable contract template libraries.

To scale your med spa’s patient volume and digital marketing with Ricky Shockley:

Services: Schedule a free 1-on-1 digital marketing strategy call.

Website: medspamagicmarketing.com