How FDA and DOJ Are Building Med Spa Cases in 2026: DSCSA Supply Records, Medicare Claims, and the Florida Exposure

How FDA and DOJ Are Building Med Spa Cases in 2026: DSCSA Supply Records, Medicare Claims, and the Florida Exposure

Picture a med spa owner in Texas opening an FDA warning letter this April. The agency had been quiet since its multi-day inspection four months earlier. In the meantime, FDA investigators called the prescription drug manufacturer, pulled the spa's purchase history, and matched it against the patient treatment records. The numbers did not line up. That gap is the case. It is also the first Drug Supply Chain Security Act warning letter the FDA has ever issued to a dispenser, and it is the new template for how federal med spa enforcement runs now.

A separate DOJ healthcare fraud track is running in parallel, using Medicare and Medicaid claims data the same way. The follow-up to our May 2026 series on peptide prosecutions is short. It got worse. It got more organized. And Florida med spas are sitting in one of the most aggressive federal enforcement districts in the country.

The paper case was built before any agent walked through the front door. That is what the first DSCSA dispenser warning letter means for every med spa in the country.

What Actually Happened

Three things to track from the last sixty days.

On April 1, 2026, the FDA issued a warning letter to a Texas med spa for violating 21 U.S.C. § 360eee, the recordkeeping and trading-partner core of the DSCSA. The agency had inspected the clinic for several days in December 2025. It then obtained sales records directly from the prescription drug manufacturer and laid them next to the spa's chart documentation. The mismatch between authorized purchases and documented administrations was the warning letter's spine.

On the same day, a Utah-licensed osteopathic physician was indicted for selling misbranded, non-FDA-approved peptides to more than 200 patients. A week later, on April 7, 2026, a Massachusetts med spa owner pled guilty to administering thousands of injections using counterfeit Botox and fillers imported from China and Brazil. Also in early April, the FDA published seven warning letters in a single day against online peptide sellers. The agency's 2026 warning-letter output on GLP-1 and peptide products is already running at roughly three times the 2024 pace.

Layer in the parallel Medicare track. A California physician was indicted on a $45 million Medicare Botox fraud scheme. DOJ separately seized $2 million from a Pasadena clinic that allegedly billed $46.6 million in fraudulent skin graft claims over seven months, a case the government built from claims-data analytics. These are not unrelated events. They sit on the same enforcement chassis.

The FDA obtained manufacturer sales records and matched them against patient charts. The mismatch was the case.

What the Government Is Actually Building

Federal med spa enforcement has shifted from reactive to data-driven. Three mechanics are running at once.

The FDA is using DSCSA as a record-tracing tool. The agency now asks manufacturers for sales records, places those records next to a med spa's chart documentation, and treats unexplained gaps as evidence that the spa is sourcing prescription drugs from unauthorized trading partners. The paper case can be built before any agent walks through the front door. By the time the warning letter lands, the spine of the file is already done.

DOJ healthcare fraud units are running Medicare and Medicaid claims through the same kind of algorithms that built the telemedicine and pill mill cases of the last several years. When a med spa bills federal payors for services with a peptide or compounded GLP-1 component, or stacks Botox into Medicare reimbursement codes, the paper trail surfaces in the data before the clinic knows it has been flagged.

FDA and DOJ are coordinating. The same compound, the same patient, the same clinic can produce parallel files in two agencies. That coordination is what makes 2026 different from prior enforcement cycles.

Exposure and Charges

The statutory stack has four main lanes. None are minor.

DSCSA and misbranding charges run through 21 U.S.C. § 331 (prohibited acts) and 21 U.S.C. § 333 (penalties). Knowingly receiving or distributing misbranded prescription drugs with intent to defraud or mislead is a felony carrying up to ten years per count. Section 360eee of Title 21 codifies the recordkeeping and authorized trading-partner obligations the Texas warning letter cited.

Healthcare fraud charges run through 18 U.S.C. § 1347. Ten years per count standard, twenty if the conduct causes serious bodily injury, life if it results in death. Conspiracy is charged separately under 18 U.S.C. § 1349 and the statutory maximum matches the underlying offense. Federal grand jury subpoenas in these cases routinely sweep up patient records, supplier emails, payment ledgers, and text messages.

The Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), criminalizes paying or receiving anything of value to induce referrals for items or services reimbursed by federal healthcare programs. Influencer fees, marketing kickbacks, and referral incentives stacked on Medicare-billed services all sit on AKS exposure that most clinic owners do not see until a target letter shows up.

The False Claims Act, 31 U.S.C. § 3729, is the civil sledgehammer running in parallel. Treble damages plus per-claim penalties currently north of $13,500. FCA cases get filed under seal by qui tam relators, which means a former employee or a competitor can be building a file for months before the clinic knows the case exists.

Round out the stack with 18 U.S.C. § 1001 for false statements to federal agents, 18 U.S.C. § 1519 for obstruction or document destruction, and 18 U.S.C. §§ 1956 and 1957 for money laundering on the proceeds. This is the standard federal package for a coordinated med spa case.

DSCSA, healthcare fraud, Anti-Kickback, and False Claims Act run in parallel. The exposure stacks across criminal, civil, and administrative tracks.

Critical Mistakes People Make Early

Most of the damage happens before the indictment. It happens because clinic owners do things that feel reasonable in the moment and are not.

Talking to FDA investigators or HHS-OIG agents without counsel. Inspections feel administrative. They are not. A false or misleading statement during a knock-and-talk becomes 18 U.S.C. § 1001 exposure on its own, independent of the underlying conduct.

Producing records on request without a litigation hold or a strategy. Federal grand jury subpoenas and FDA Form 482 inspection demands are not the same thing and they require different responses. Once documents leave the building, the negotiation over privilege, scope, and authenticity is over.

Assuming the matter is not serious because no one has been charged. The Texas warning letter followed a multi-day inspection four months earlier. The clinic had four months of runway and did not use it. A subject of federal investigation who waits for charges is waiting in the wrong place.

Waiting for the indictment to retain a federal criminal defense attorney. By the time the indictment lands, the cooperation calculus is largely set, the loss amount is largely set, and the defense's leverage has thinned. Pre-indictment investigation is where the actual outcomes are made.

Trying to clean up the file. Backdating records, altering chart notes, deleting text threads, or coaching staff to say something other than what they remember turns a regulatory case into an obstruction case under 18 U.S.C. § 1519 within hours of discovery.

Strategic Defense Approach

Early intervention is not a slogan. It is the only place where the file is still movable.

Map the exposure across both agencies first. FDA-side exposure runs on supply records, chain-of-custody documentation, and labeling. DOJ-side exposure runs on claims data, intent evidence, and patient interviews. Those are different defenses, and conflating them is how cases that were defensible get lost.

Control the document production. A clinic that gets a target letter or a federal grand jury subpoena does not hand over everything in the file the next morning. Target letter response work involves privilege review, scope negotiation, and a strategy decision about what to assert at the agent's first interview. None of that happens by accident.

Make the cooperation versus litigation call deliberately. In a peptide or compounded GLP-1 case, the government typically wants the source higher up the supply chain. A clinic owner with clean intent evidence and a clear paper trail to the supplier has real pre-charge negotiation leverage. A clinic owner who has already given the agents a self-serving narrative has very little.

Set sentencing posture from day one. The Federal Sentencing Guidelines on healthcare fraud and FDCA violations are loss-driven. The loss figure is built during the investigation, not at the PSR phase. A defense that waits until sentencing to challenge the loss number is fighting the calculation with one hand tied behind it.

FDA-side and DOJ-side exposure require different defenses. Conflating them is how defensible cases get lost.

Why Timing Matters Right Now

The window to influence the outcome closes faster than most med spa owners expect.

Charging decisions are still genuinely fluid during pre-indictment investigation. Assistant U.S. Attorneys have wide discretion on whether to charge misbranding, healthcare fraud, or both. Whether to indict the owner individually, the entity, or both. Whether to bring a parallel False Claims Act action or fold the matter into a global resolution. Every one of those decisions is more responsive to defense input before the grand jury votes than after.

The DSCSA pattern is also accelerating. The Texas warning letter is the first public dispenser action, not the last. South Florida federal defense work on these cases starts before the file moves from the FDA field office to the U.S. Attorney's Office, because the Southern District of Florida runs one of the most institutionally capable healthcare fraud units in the country. The Middle District of Florida is not far behind. Tampa, Orlando, Jacksonville, Miami, Fort Lauderdale, and West Palm Beach all sit inside districts where federal med spa investigations are an active priority.

If the spa has not been contacted yet, this is the moment to harden the file. If a target letter has arrived, or agents have shown up unannounced, the time to retain a Florida federal criminal defense attorney was yesterday.

The window to influence the outcome is pre-indictment. After the grand jury votes, the levers shrink.

Facing a Federal Med Spa Investigation in Florida?

Federal med spa enforcement in 2026 is a coordinated, data-driven operation. Supply chain records and Medicare claims data are building cases before the clinic knows it is a target. The exposure stacks across criminal, civil, and administrative tracks. A clinic that thinks of itself as an aesthetics business is being looked at as a federal drug distribution and healthcare billing enterprise.

AMC Defense Law represents clients in federal investigations and prosecutions involving compounded drugs, peptides, GLP-1 distribution, DSCSA compliance, and healthcare fraud, in Florida and nationwide. The firm handles target letter response, federal grand jury subpoena response, FDA and HHS-OIG inspections, pre-charge negotiation, and indicted cases through trial and sentencing. Consultations are confidential.

This article is for informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship. Every case is different. If you are under federal investigation or facing charges, consult with a qualified federal criminal defense attorney about the specifics of your situation. Prior results do not guarantee similar outcomes.