What a Med Spa Service Menu Tells a Regulator: Florida Law and Federal Exposure, Service by Service

This summer a private research firm read the service menus on 14,748 med spa websites. More than half listed at least one service the researchers class as a medical intervention, including medical weight loss, IV therapy, hormone replacement, NAD+ and peptides. Among the states it ranked, Florida finished second for medical weight loss, a tenth of a point behind Utah. This is a market study of what websites say. It is not a law, a rule, an enforcement action or a prosecution, and it does not say any practice did anything wrong. But if a researcher can read your menu, so can an investigator, and the menu is your own written statement of what you do.

The service menu is the practice's own written statement of what it does, and anyone can read it.

Key Takeaways

• Whelth Research reviewed 14,748 med spa websites. Its report describes published menus, not clinical conduct, and it is not law.
• Florida ranked second among ranked states for medical weight loss. Under Fla. Stat. 456.065, advertising licensed services without a license is an offer to practice.
• Compounded GLP-1 drugs must fit 21 U.S.C. 353a or 353b. Outside them, 21 U.S.C. 331 applies, and the misdemeanor requires no intent.
• Testosterone is a Schedule III controlled substance, and the prescriber needs a DEA registration.
• Rewriting or deleting pages after a subpoena or an investigator's call can be a separate felony. Preserve first and call counsel.

What the Report Counted, and What It Did Not

Whelth Research published The State of America's Med Spas, 2026 in September. It reviewed 14,748 med spas in its directory that showed at least one service on the practice's own website, using data collected from July 18 to September 7, 2026. An industry news release summarized it on September 22. Of those practices, 8,444, or 57.3 percent, listed at least one service the report defines as a medical intervention.

Among states with at least 100 reviewed med spas, Utah led on medical weight loss at 48.6 percent, then Florida at 48.5, Arkansas at 48.4 and Arizona at 48.1.

What a Regulator Does With a Service Menu

Reading a public website takes no subpoena and no notice to the owner, so it comes first. Each service page states what the practice says it does and what the product is.

Each service page states what the practice says it does and what the product is. An investigator can read it before anyone knows to look.

The usual sequence follows: a complaint to a licensing board or the Department of Health's unlicensed activity program, a pharmacy or FDA inquiry into where the product came from, and subpoenas for supplier invoices and prescribing records. Where testosterone is on the menu, DEA can inspect the registrant's records. Archived copies of a site show what a page said on a given date, whatever it says today.

Five Service Lines: Florida Law First, Then Federal

Medical weight loss

Start with the prescriber. Fla. Stat. 456.47 permits a telehealth evaluation and holds the provider to the in-person standard of practice. Then the drug. Compounded semaglutide and tirzepatide are not FDA-approved, and they escape the approval requirement only within 21 U.S.C. 353a, which covers a licensed pharmacist or physician compounding for an identified patient on a valid prescription, or 21 U.S.C. 353b for registered outsourcing facilities. FDA states that neither drug is on its shortage list, and section 353a does not protect compounding, regularly or in inordinate amounts, of what is essentially a copy of a commercially available drug. Distributing a compounded drug that fits neither section can violate 21 U.S.C. 331. Under 21 U.S.C. 333(a), a violation is a misdemeanor with no proof of intent and a felony with intent to defraud or mislead.

IV therapy

Florida's practice acts contain no section written for IV hydration clinics, and a 2024 bill on IV vitamin treatment died in committee. Under Fla. Stat. 464.003, a registered nurse administers medications as prescribed or authorized by a licensed prescriber, so every infusion needs a prescriber's order behind it. A standing order from a prescriber who never sees a chart invites the question whether anyone ordered anything. Board of Nursing rule chapter 64B9-12 limits what a licensed practical nurse may do with an IV. Mixing additives into a bag on site can be compounding as Fla. Stat. 465.003 defines it.

A pharmacy or FDA inquiry starts with where the product came from, and the supplier invoices answer it.

Hormone replacement

Testosterone is a Schedule III controlled substance under Fla. Stat. 893.03 and 21 CFR 1308.13, and the prescriber needs a DEA registration. A prescription is effective only if issued for a legitimate medical purpose in the usual course of professional practice, 21 CFR 1306.04. One that fails that test can be charged as distribution under 21 U.S.C. 841(a), where the Supreme Court held in 597 U.S. 450 (2022) that the government must prove the prescriber knowingly or intentionally acted in an unauthorized manner. 21 U.S.C. 829(e) generally requires one in-person evaluation before internet prescribing, a requirement a temporary DEA rule relaxes through December 31, 2026.

NAD+ and peptides

Section 353a allows compounding from a bulk substance only if it has a USP or NF monograph, is a component of an FDA-approved drug, or appears on the list at 21 CFR 216.23, and neither NAD+ nor any peptide is on that list. FDA's May 14, 2026 update keeps NAD+ in Category 1 of its interim policy, under which the agency says it does not intend to act against compounders who meet its conditions. That is enforcement discretion, and discretion can end. Many peptides stand on weaker ground: FDA publishes safety concerns for BPC-157, CJC-1295 and others, and its advisory committee took up seven peptides in July 2026. A research use only label fixes nothing. FDA reports warning companies that sold GLP-1 products falsely labeled "for research purposes," and injecting a patient is the human use that label disclaims.

Licenses, Ownership and the Page Itself

Fla. Stat. 456.065(2)(d)1 makes it a third-degree felony, with a one-year mandatory minimum, to practice or offer to practice a health care profession without an active Florida license. It treats holding oneself out, by any means of communication, as able to provide services that require a license as an offer to practice. For a person with no license, the web page can be the charged offer. Subsection (2)(a) only authorizes cease and desist notices and is not a crime.

Section 458.327 contains no felony for aiding unlicensed practice. The aiding provision is section 458.331(1)(f), a ground for license discipline. A criminal case against an owner or medical director would run through Fla. Stat. 777.011, the principals statute, where knowledge and intent are contested. The Health Care Clinic Act generally does not reach a cash-only practice: section 400.9905(4) defines a clinic as an entity that tenders charges for reimbursement.

The page is also advertising. Fla. Stat. 501.204 declares deceptive acts or practices in trade or commerce unlawful, Fla. Stat. 456.072(1)(a) makes misleading representations a ground for discipline, and the federal counterpart is 15 U.S.C. 45. The FDCA goes further: 21 U.S.C. 352(bb) deems a compounded drug misbranded if its advertising or promotion is false or misleading in any particular, and FDA lists a claim that a compounded drug is the same as an approved drug among its red flags.

Wire fraud, 18 U.S.C. 1343, requires a scheme to defraud and intent. A false statement on the site about what the product is or who administers it, made to get the patient's money, could support a charge. A menu that got ahead of the paperwork, without more, could not. Conspiracy is charged under 18 U.S.C. 1349 or 18 U.S.C. 371.

The Anti-Kickback Statute, 42 U.S.C. 1320a-7b(b), reaches only items and services payable by a federal health care program, so most cash-pay med spa work is outside it. Florida's Patient Brokering Act, Fla. Stat. 817.505, is not limited by payor on its face, and a violation is a felony. It exempts payment practices "not prohibited by" the federal statute, and I would not call the reach of that exemption settled.

Exposure tracks role and knowledge. Owners and non-physician investors choose the menu and the suppliers, medical directors and prescribers sign the orders, and injectors and IV nurses carry them out and answer to their boards.

The First-Week Mistake

The mistake to avoid is rewriting or deleting pages after a subpoena or an investigator's call.

Once an inquiry is pending or expected, the pages, the charts and the invoices are records to preserve, not to fix.

A Website-to-Operations Audit for Florida Med Spa Compliance

For each service on the menu, write down four answers.

1. Who orders it, and after what evaluation.
2. Who administers it, under what license and whose supervision.
3. Where the drug comes from: the pharmacy or outsourcing facility, the invoices and the lot numbers.
4. Whether each claim on the page can be supported.

Why Timing Matters

With nobody asking, the audit is a few days of work. After a Department of Health investigator calls, or a federal grand jury subpoena or a letter from a United States Attorney's Office comes in, each gap becomes an interview question, and whether to speak is a decision for after counsel has seen the invoices, the charts and the archived pages. The rules are moving too: FDA proposed in April 2026 to keep semaglutide and tirzepatide off the outsourcing facility bulk list, and the DEA telemedicine rule is set to expire December 31, 2026.

Common Questions

Is Your Menu Ahead of Your Paperwork, or Has an Inquiry Begun?

AMC Defense Law represents med spa owners and investors, physicians and medical directors, APRNs, PAs, injectors, IV nurses, and peptide and compounding professionals in Department of Health and licensing board investigations, FDA and DEA inquiries, and federal investigation defense in med spa and peptide and compounded drug matters. Aaron M. Cohen is a federal criminal defense attorney in Boca Raton and a white collar defense attorney who handles matters in Palm Beach County, in the Southern and Middle Districts of Florida, and in federal districts nationwide. If you believe you are under federal investigation, or a federal grand jury subpoena or a target letter has arrived, consultations are confidential. AMC Defense Law, 1200 N. Federal Highway, Suite 300, Boca Raton, Florida 33432. 561-542-5494. amc@amcdefenselaw.com.

Aaron M. Cohen, AMC Defense Law, Boca Raton.

If you or your loved ones have been arrested or are under federal investigation, call Aaron M. Cohen, 24 hours a day to get help.

This article is provided for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with AMC Defense Law. Statutes, regulations, agency policies and enforcement practices change, and the application of law depends on the specific facts of each matter. The report discussed above is a private market study of published website content and is not law. This article describes no pending charge or enforcement action against any person and does not suggest that any practice included in the report violated any law. Anyone facing a criminal investigation or charge should consult a licensed attorney about their own circumstances.