Regulators Are Stepping Up Audits and Enforcement Against Medical Spas

State legislatures and federal agencies are tightening oversight on medical spas, meaning practice owners must immediately prepare for joint-agency audits and rigorous supply-chain tracking. On April 1, 2026, the FDA issued its first-ever Drug Supply Chain Security Act warning letter to an aesthetics practice, Pure Indulgence Aesthetics in Texas, after a December 2025 inspection revealed the clinic administered more Botox than it had legally purchased and possessed an unlabeled vial.

At the state level, lawmakers are passing dedicated statutes to directly police clinical oversight. Texas enacted House Bill 3749, known as Jenifer's Law, on September 1, 2025, following the July 2023 death of Jenifer Cleveland during an IV fluid treatment. In Indiana, Senate Enrolled Act 282 went into effect on July 1, 2026, requiring spas to register by January 1, 2027, or face $5,000 fines, and mandates reporting any qualifying serious adverse event to the Medical Licensing Board within 15 days. Rhode Island enacted its own Medical Spas Safety Act, setting a July 1, 2026 rulemaking deadline.

Enforcement is already active. Multi-agency sweeps in New York inspected over 200 medical spas, citing 87 for unlicensed practice and safety violations. Meanwhile, the FDA is targeting digital operations, issuing 25 warning letters to telehealth companies on June 8, 2026, for misleading marketing of compounded semaglutide and tirzepatide. Clinic owners should audit their purchasing pipelines, verify every provider's credentials, and establish strict adverse-event reporting protocols to withstand this new level of scrutiny.

Source: Holland & Knight, https://www.hklaw.com/en/insights/publications/2026/08/medical-spa-compliance-under-the-microscope