A New Virtual Frontier: How Med Spa & Telehealth Compliance Intersect
Telehealth has created a new virtual frontier that now includes med spas. Some businesses marketed as medical-spa or wellness platforms operate primarily through virtual consultations and medication-based programs, while procedural medical-spa services generally retain an in-person component. Many other operators use hybrid models combining virtual consultations and follow-up with in-person examinations or procedures when clinically or legally required.
Telehealth has opened new opportunities for growth, but the compliance complexity behind virtual care is often underestimated. As med spas expand across states and incorporate services involving prescriptions and compounded medications, regulatory requirements can quickly become difficult to navigate.
Building compliance into the model from day one helps create a stronger foundation for sustainable growth and reduces the challenges of trying to retrofit compliance later.
The Rise of Virtual-First Med Spa Care
Medical spas are no longer limited to in-person aesthetic procedures. As patient expectations change, many med spas are expanding into virtual-first care models that include telehealth consultations, medical weight management programs, hormone replacement therapy (HRT), wellness services, and ongoing follow-up care.
During the Compounding Pharmacy Compliance Conference 2026, Amy Summers, CEO of Restore Health Consulting, led a discussion on the virtual frontier where telepharmacy, direct-to-patient care, and the changing regulatory landscape for compounding intersect. One of the clearest themes from the discussion was that telehealth has dramatically changed how patients access personalized care.
Over the past several years, telehealth adoption has accelerated due to convenience, accessibility, and consumer demand. Patients are increasingly seeking treatments they may not be able to access through traditional healthcare settings, and virtual care has created new opportunities to connect them with personalized therapies.
For med spas, this shift is significant. Many operators today are no longer thinking only in terms of procedures. They are thinking in terms of recurring care, remote access, digital follow-up, medication-driven programs, memberships, and long-term patient value. Some operators are expanding beyond a traditional procedure-focused medical-spa model into hybrid or virtual-first healthcare programs. The extent and legal structure of that expansion vary by jurisdiction, service line, provider type, and business model.
Technology may expand the tools available for remote patient education, screening, treatment planning, and follow-up. However, the availability of new technology does not alter applicable licensure, scope-of-practice, informed-consent, privacy, standard-of-care, or in-person examination requirements.
For other medical spas, a fully virtual experience is neither possible nor clinically appropriate. A hybrid model may allow consultations and follow-up to occur remotely while procedures requiring hands-on assessment or treatment are performed in person. Whether a particular service may be delivered remotely depends on the applicable law, the practitioner’s scope of authority, the information needed for clinical decision-making, and the standard of care.
Why Med Spas Are Entering Telehealth
The convergence of med spas and telehealth is not accidental. The two models complement each other in ways that address both patient demand and business growth.
Traditional med spas often have strong local brand equity, an established patient base, and high levels of trust. Telehealth, on the other hand, offers reach, convenience, recurring programs, remote follow-up, and scalable communication systems.
This creates opportunities for med spas to expand into:
Virtual weight management programs (including GLP-1s)
Virtual, personalized HRT consultations
Remote aesthetic and wellness programs
Preventive and longevity-focused wellness care
Follow-up care conducted through telehealth
Long-term patient engagement programs
The result is a broader care model where med spas can offer personalized services beyond isolated in-person treatments. However, this expansion also introduces a new layer of regulatory and compliance complexity.
Compliance Challenges: Where Telehealth and Med Spa Regulations Intersect
Compliance requirements do not disappear simply because care is delivered virtually. In many cases, they become more complex as med spas integrate telehealth into their operations. These businesses must navigate overlapping requirements involving state med spa regulations, telehealth practice standards, HIPAA privacy obligations, clinical documentation, provider-patient relationships, and prescribing requirements.
For med spas offering telehealth consultations that involve compounded medications, additional considerations arise around medication sourcing, prescribing practices, and compliance with 503A pharmacy and 503B outsourcing facility requirements.
Understanding how these regulatory frameworks intersect is essential for building a compliant virtual care model that can scale across jurisdictions.
State-by-State Regulatory Complexity
As telehealth adoption grows, so does regulatory scrutiny. One of the most memorable points from the Compounding Pharmacy Compliance Conference came from Jeff Mesaros, who stated:
“If you know one state, you know one state.”
Although referring to telehealth more broadly, this statement captures one of the biggest challenges facing med spas with multi-state virtual care models: compliance in one state does not guarantee compliance in another.
State requirements may differ in areas such as:
Whether synchronous (real-time) or asynchronous (store-and-forward) visits are permitted
Requirements for initial patient evaluations or good faith exams
Provider licensure and cross-state practice rules
Prescribing restrictions for specific medications
Dispensing and shipping requirements
Medical-practice ownership and corporate-practice-of-medicine restrictions
The permissible division of responsibilities between a professional practice and a management services organization
Supervision, delegation, and ordering requirements for medical-spa procedures
Telehealth consent, patient-location verification, privacy, recording, and emergency-referral requirements
Fee-splitting, referral, advertising, and patient-acquisition restrictions
Professional and controlled-substance registrations in addition to professional licensure
Pharmacy licensure, nonresident permits, dispensing, office-use, and patient-shipping requirements
For a nationwide model, this requires a jurisdiction-by-jurisdiction analysis that may include the 50 states, the District of Columbia, and any territories in which patients are located or medications are dispensed, administered, or shipped. Expanding into new states requires understanding the specific regulatory environment, adapting workflows where needed, and ensuring providers and operational teams are prepared to meet state-specific requirements.
For additional guidance on broader med spa compliance considerations, see our resource: Med Spa Compliance: Key Trends, Risks & Guidance for Owners.
Synchronous vs Asynchronous Good Faith Exams
One important area of variation is the evaluation required before a medical treatment is ordered, prescribed, or performed. “Good faith examination” (GFE) is not a uniform statutory term used in the same manner nationwide. Depending on the jurisdiction, profession, and service, the required evaluation may need to occur in person, through synchronous audio-video technology, or through another modality that permits the practitioner to establish a valid provider-patient relationship and satisfy the applicable standard of care.
Asynchronous tools may be permissible for some services in some jurisdictions. However, an online questionnaire or store-and-forward review may be insufficient when the governing law or standard of care requires real-time interaction, a physical examination, verification of information, or additional clinical data. The analysis should focus on the applicable statute, board rules, practitioner type, treatment risk, and information reasonably required for sound clinical judgment, not on a generalized assumption that one modality is valid nationwide.
For example, Oklahoma permits a physician-patient relationship to be established through telemedicine, subject to profession-specific rules and prescribing restrictions. That does not mean every medication, modality, or medical-spa service may be provided without an in-person encounter.
California recognizes telehealth as a mode of practicing medicine and applies the same standard of care to telehealth and in-person care. California does not establish a universal rule that every medical-spa evaluation may be completed asynchronously. Before prescribing, a practitioner must conduct an appropriate examination and obtain sufficient information to support the treatment and medical indication. Whether an in-person, synchronous, or asynchronous modality is sufficient is fact- and service-specific. A questionnaire alone should not be characterized as automatically satisfying California’s examination requirement.
This is another area where state-specific knowledge is essential. A process that is compliant in one state could create compliance risk in another.
Out-of-State Providers
For licensure and professional-practice purposes, telehealth is generally treated as occurring where the patient is physically located at the time of the encounter. The workflow should therefore verify and document the patient’s location at each encounter and confirm that the practitioner is authorized to provide the particular service in that jurisdiction before care is delivered.
Many states have established pathways that allow qualified out-of-state providers to deliver telehealth services, including interstate licensure compacts, telehealth registration processes, and limited practice exemptions. However, these pathways often come with specific requirements and limitations, such as restrictions on the number of patients treated, types of services provided, or renewal obligations.
Because requirements vary significantly by state, med spas and telehealth operators should evaluate provider licensure requirements in every jurisdiction where patients are served and establish processes to maintain compliance as regulations change.
A multi-state telehealth model requires a state-by-state review of provider authorization, scope of practice, prescribing rules, and documentation requirements. Authorization to practice may require more than a professional license. Depending on the service and jurisdiction, the practitioner may also need a state controlled-substance registration, DEA registration associated with the appropriate practice location, prescribing or dispensing authority, collaborative or supervisory arrangements, and compliance with professional-entity requirements.
Controlled Substances
DEA and HHS have extended certain federal telemedicine flexibilities for prescribing controlled medications through December 31, 2026. Subject to the conditions of the temporary rule, qualifying DEA-registered practitioners may prescribe certain controlled medications through telemedicine without first conducting an in-person medical evaluation.
The federal extension does not displace state licensure, scope-of-practice, controlled-substance registration, prescription-monitoring, documentation, or prescribing requirements. Providers must comply with both federal and applicable state law; the existence of a federal flexibility does not, by itself, authorize a prescribing workflow that state law restricts.
New Jersey Executive Order 415 ended state emergency waivers effective February 16, 2026, which temporarily reinstated in-person examination requirements for most Schedule II controlled-dangerous-substance prescriptions. On July 8, 2026, Assembly Bill 4852 was approved as P.L.2026, c.40 and revised those requirements.
Current New Jersey law retains an initial in-person examination and subsequent in-person visits every three months as the default for Schedule II prescribing through telehealth, but establishes exceptions for specified circumstances. These include certain prescriptions for minors receiving Schedule II stimulants with parental or guardian consent; patients receiving specified cancer, hospice, palliative, or long-term care; certain other statutorily identified patients; medications used to treat substance use disorder; and Schedule II stimulants prescribed to adults.
For an adult receiving a Schedule II stimulant, the initial examination may occur in person or through telehealth. When the initial examination is remote, an in-person visit is required within 30 days. Follow-up contact is required at least every three months, and an in-person visit is required at least annually. Schedule II telehealth prescribing must use interactive, real-time, two-way audio and visual technology and comply with federal and state law and the applicable standard of care.
Additional exemptions apply to certain patient populations, including those receiving cancer, hospice, palliative, long-term care, or substance use disorder treatment.
For med spas and telehealth operators, the broader takeaway is that prescribing requirements can vary significantly by state. Controlled substance workflows must be designed with state-specific requirements in mind and continuously updated as regulations evolve.
Indiana Senate Enrolled Act 282
Indiana Senate Bill 282 is no longer pending. It was enacted as Senate Enrolled Act 282/Public Law 136 in March 2026. Among other provisions, the law requires medical spas to register with the Indiana Medical Licensing Board beginning January 1, 2027 and establishes related regulatory requirements.
Because the medical-spa registration provisions have been enacted but are not yet effective, operators should distinguish between requirements currently in effect and obligations that begin January 1, 2027.
HIPAA Compliance
HIPAA applicability depends on the roles of the organizations involved. Not every medical spa or technology company is automatically a HIPAA-covered entity or business associate. The Office for Civil Rights’ COVID-era telehealth enforcement discretion ended after a transition period on August 9, 2023. Covered entities and business associates should use telehealth technologies, vendors, configurations, and safeguards that comply with the applicable HIPAA Privacy, Security, and Breach Notification Rules and should enter into a Business Associate Agreement when required. Organizations that are not subject to HIPAA may nevertheless be subject to other federal and state privacy, security, breach-notification, consumer-protection, and professional-confidentiality requirements.
FDA Warnings
The FDA has warned telehealth companies that promoting compounded medications, including compounded GLP-1 receptor agonists, with false or misleading claims may violate federal law and put patients at risk. The agency has issued warning letters to companies for marketing practices that could prevent patients from making informed healthcare decisions. The precise legal significance of a warning letter is fact-specific, and FDA notes that matters described in a warning letter may be affected by subsequent interactions with the recipient. The article should therefore describe the agency’s stated concerns without implying that every similarly worded communication has already been adjudicated unlawful.
The FDA specifically cautions telehealth companies against:
Implying they are the compounder when they are not
Marketing compounded drugs as generic versions or the same as FDA-approved medications
Claiming compounded drugs are FDA-approved or have been evaluated for safety, effectiveness, or quality
Claiming compounded drugs are clinically proven to provide the same outcomes as FDA-approved products
Stating that compounded medications come from FDA-approved pharmacies or FDA-licensed outsourcing facilities, as FDA does not approve or license compounding facilities
The FDA emphasizes that compounded drugs are not reviewed by the agency before marketing for safety, effectiveness, or quality, and companies must ensure promotional materials accurately reflect the regulatory status of compounded medications.
Education and Engagement
Regulators may closely scrutinize emerging healthcare business models to determine whether existing licensure, pharmacy, prescribing, ownership, advertising, and patient-safety requirements are satisfied.
For medical spas expanding into telehealth, clear documentation and an accurate description of the clinical, pharmacy, technology, and management roles can facilitate an informed regulatory review. Proactive communication does not replace compliance with applicable law or create a regulatory safe harbor.
Operational documents and communications should clearly identify who owns and controls the clinical practice, who exercises independent clinical judgment, who prescribes, who dispenses or compounds medications, and who is responsible for quality complaints, adverse events, recalls, and patient follow-up.
The Bottom Line
This is not an exhaustive list of state-specific regulations but a glimpse at some critical changes that may affect medical spas offering telehealth services in 2026.
It’s clear that states keep adding specific requirements, and the rules are changing fast. We emphasize the importance of having an ongoing plan to monitor updates, as conducting a single review is not sufficient anymore.
How to Build a More Defensible Med Spa Telehealth Model Today
One-Size-Fits-All Models Don’t Work
A one-size-fits-all approach does not work in a multi-state telehealth environment. While a med spa may operate under one brand, one website, and one patient experience, the compliance requirements behind that experience can vary significantly by patient location.
Different states may require different workflows, consent processes, telehealth visit requirements, prescribing pathways, and provider considerations. This means med spas must balance operational consistency with the flexibility to meet state-specific regulatory requirements. The required variations may also involve professional-entity ownership, management-services arrangements, supervision and delegation, fee-splitting, patient-location verification, controlled-substance registration, pharmacy licensure, and medication-shipping pathways.
The challenge is building a scalable model that provides a consistent patient experience while adapting the underlying compliance framework for each jurisdiction.
Compliance Cannot Be an Afterthought
Compliance should be built into your business model from the beginning. Yet, many companies make the mistake of trying to retrofit compliance after they have already scaled.
For med spas expanding into telehealth, this is a critical lesson: the businesses best positioned for sustainable growth are those that integrate compliance into their workflows, technology, and operations from day one rather than treating it as an afterthought.
A compliance-first approach creates a foundation that allows businesses to scale more confidently while reducing the risk of costly operational changes later.
A Defensible Model Starts with Licensure and Quality
A strong virtual care model requires alignment between regulatory requirements, clinical operations, and quality systems. For med spas expanding into telehealth, this foundation begins with understanding where and how care is delivered and establishing processes that account for the requirements of each jurisdiction.
A defensible model requires clarity around:
Who owns and controls the clinical practice, and who has authority over diagnoses, prescribing decisions, treatment protocols, provider hiring, and other clinical matters?
Who is diagnosing and evaluating the patient?
Who is making the prescribing decision?
Who is dispensing or compounding the medication?
Under which federal and state regulatory pathway is the medication being compounded, dispensed, distributed, administered, or shipped?
Who is responsible for medication quality questions?
How are adverse events handled?
The risk for med spas is that these roles can become blurred, especially when the patient experience makes it appear that the med spa itself is providing the medication. Clear delineation of responsibilities between the med spa, healthcare providers, and pharmacy partners is essential for maintaining appropriate clinical oversight and regulatory compliance.
A defensible model also includes:
Regulatory alignment: Providers must be appropriately licensed, credentialed, and practicing within their authorized scope in each state where patients are located. The analysis should also address professional-entity ownership, corporate-practice restrictions, supervision and delegation, fee-splitting, controlled-substance registrations, telehealth consent, patient-location verification, pharmacy licensure, and medication dispensing and shipping requirements.
Clinical consistency: Clear standards should guide the entire patient journey, including patient evaluations, documentation, prescribing decisions, treatment protocols, and follow-up care. These systems should support consistent care delivery while allowing for state-specific variations.
Operational transparency: Responsibilities across providers, the med spa, technology platforms, and pharmacy partners should be clearly defined. For organizations using compounded medications, this includes transparent medication sourcing processes and accurate patient communications regarding treatment options.
Quality oversight: Ongoing monitoring, internal review, and continuous quality improvement (CQI) processes help identify gaps, address issues, and strengthen care delivery over time.
As telehealth programs expand, these systems provide the structure needed to support growth across multiple jurisdictions while adapting to changing regulatory expectations.
How Med Spas Should Vet Telehealth and Pharmacy Partners
As med spas expand into telehealth and incorporate compounded medications, relationships with telehealth platforms, prescribers, and pharmacy partners become a critical part of the compliance framework.
These relationships should not be treated as simple vendor arrangements. A pharmacy partner is part of the patient-care ecosystem, and the organizations involved must have clearly defined roles, shared expectations, and aligned quality standards.
A defensible model requires asking important questions before establishing a partnership:
Is the pharmacy properly licensed and authorized to operate in the applicable jurisdictions?
What is the pharmacy’s inspection history and quality record?
What quality systems are in place, including applicable USP standards and accreditation status?
How are adverse events, patient concerns, and medication quality questions handled?
What processes exist for shipping validation, product storage, recalls, and documentation?
Does the proposed prescription, dispensing, office-use, administration, and shipping pathway comply with both federal and applicable state law?
Is the pharmacy licensed or otherwise authorized in every state into which it will dispense or ship?
Are the financial arrangements structured to avoid prohibited fee-splitting, referral payments, or interference with independent clinical or pharmacy judgment?
Does the marketing accurately identify the prescriber, pharmacy, compounder, regulatory status, and material differences between compounded and FDA-approved drugs?
What FDA Forms 483, warning letters, recalls, disciplinary actions, or other inspection and enforcement records exist, and how were the underlying issues addressed?
For compounded medications, understanding the pharmacy’s regulatory framework is especially important. Med spas may work with different types of compounding pharmacies depending on the medication, patient population, and intended use.
503A pharmacies generally compound medications based on individual patient prescriptions and primarily operate under state board of pharmacy oversight. Limited anticipatory compounding may occur under specified conditions. Non-patient-specific office stock generally does not qualify for the federal exemptions under section 503A, even when a state separately permits some form of office-use compounding or distribution. The federal and state analyses must therefore be considered independently.
503B outsourcing facilities may compound and distribute eligible compounded drugs without first receiving a patient-specific prescription. Their ability to supply a particular product for office use remains subject to the conditions of section 503B, applicable FDA policies, product-specific restrictions, and state licensure and office-use requirements. Registration as an outsourcing facility does not constitute FDA approval of the facility or its products.
Working with a 503B outsourcing facility requires documented due diligence. Medical spas should confirm whether the facility is currently registered with FDA, review its FDA and state inspection and enforcement history, verify applicable state licensure and authorization, understand the cGMP requirements applicable to its operations, and request appropriate product- and lot-specific quality documentation. Outsourcing facilities are subject to FDA inspection, but the phrase “regularly inspected” should be avoided because inspection timing is risk-based and does not itself establish current compliance.
Medication sourcing is only one part of the equation. A strong operational model also includes processes for:
Verifying product receipt, lot numbers, and expiration or beyond-use dates
Maintaining appropriate storage and handling conditions
Documenting medication administration when applicable
Establishing procedures for adverse event reporting and quality concerns
Confirming that each prescription, purchase order, office-use order, dispensing event, and patient shipment follows the appropriate legal pathway
Reviewing certificates of analysis and other product-specific release documentation, where appropriate
Maintaining traceability between the patient or administration record and the pharmacy, product, lot number, expiration date, and beyond-use date
Maintaining procedures for recalls, adverse events, product complaints, temperature excursions, and suspected quality defects
The relationship between telehealth providers, pharmacies, and med spas should ultimately support clinical collaboration. Telehealth companies should not view pharmacies as fulfillment vendors, and pharmacies should not view telehealth companies as simply patient acquisition channels. The same principle applies to med spas that integrate telehealth. Partnerships should be built around patient safety, clinical judgment, compliance, and shared accountability.
When partner relationships are structured this way, organizations are better positioned to provide consistent care while adapting to the regulatory complexity of telehealth and compounded medications.
For a more in-depth overview of this topic, read: Med Spa & Pharmacy Compounded Medication Due Diligence.
Compliance from Day One as a Growth Strategy
One of the most important questions med spas integrating telehealth should ask is what a defensible virtual care model looks like from both a compliance and clinical integrity perspective.
The answer is not a single policy or process. It is an operational framework built around appropriate licensure, quality systems, repeatable compliance processes, and continuous quality improvement (CQI). It also requires a clear understanding of where care can be delivered, where medications can be prescribed and shipped, and how state-specific requirements affect day-to-day operations.
For med spas entering telehealth, these considerations should be incorporated into the business model from the beginning. Regulatory requirements influence everything from provider networks and patient workflows to pharmacy relationships, technology platforms, documentation practices, and market expansion strategies.
As virtual care continues to grow, the organizations best positioned for long-term success will be those that treat compliance as a foundation for growth rather than an operational hurdle to address later.
Building a scalable telehealth model requires systems that can support complexity, adapt to changing regulations, and maintain a consistent standard of patient care across jurisdictions.
Restore Health Consulting supports medical spas and telehealth organizations in evaluating regulatory requirements, developing operational controls, and conducting pharmacy and quality due diligence. Services are tailored to the particular facts, jurisdictions, provider types, and medication pathways involved and do not replace advice from qualified legal counsel.
Disclaimer: This article provides general educational information concerning medical-spa and telehealth compliance in the United States as of July 25, 2026. It is not legal, regulatory, medical, clinical, or expert-witness advice. It does not establish a standard of care, create an attorney-client or consultant-client relationship, guarantee compliance, or express an opinion concerning any specific person, organization, product, pharmacy, transaction, dispute, or litigation. Requirements vary by jurisdiction and factual circumstances and may change after publication. Readers should consult qualified legal counsel and appropriate clinical, pharmacy, and regulatory professionals regarding their specific circumstances.