Business lawyers advising the high-velocity mergers and acquisitions landscape of aesthetic medicine often find themselves peeling back the “retail” veneer of a target asset to expose the underlying medical reality. Medical spa (“medspa”) owners and investors are frequently lulled into a false sense of security by the industry’s luxury atmosphere, erroneously believing they operate in a regulatory gray area.
However, a Utah grand jury’s indictment of a licensed physician on April 1, 2026, demonstrates that this is a fiction that speaks to enforcement priorities and not legal differences. The jury indicted the physician for the alleged introduction of peptides that were not Food and Drug Administration (“FDA”) approved, including Semaglutide and Tirzepatide, Retatrutide, Cagrilintide, BPC-157, TB500, Ipamorelin, CJC-1295, GHK, GHK-Cu, and NAD+, into interstate commerce. The jury found probable cause that these products were sourced from China and sold to unwitting patients. This action, coupled with the referral of telehealth company Hims and Hers to the Department of Justice in February for potential violations of the Federal Food, Drug, and Cosmetic Act, signals a paradigm shift in how federal agencies view the medspa supply chain and the rising interest in unapproved peptides.
For counsel performing due diligence or providing corporate governance advice to medspas, understanding these four commonly overlooked areas of regulatory compliance is essential to mitigating client risk.
The Sterile Compounding Trap
Counsel advising along the medspa value chain, or conducting due diligence in this space, should actively review the “backroom” preparation of intravenous (“IV”) hydration therapies and peptides. Such preparations may inadvertently render the doctor’s office an unlicensed pharmacy.
- Sterile Compounding Definition: Pharmacy boards in California, Ohio, and Kentucky have specifically called out that the mixing of IV bags constitutes “sterile compounding” and must adhere to appropriate sterility and stability practices. Such practices include strict pharmacy permits and adherence to USP Chapter <797> standards, including ISO-certified air environments.
- Supply Chain Integrity: Facilities should source premixed products from authorized 503A pharmacies or 503B outsourcing facilities. This ensure the longer term sterile and stable products are not adulterated or misbranded, rather than mixing in-house outside of a sterile hood, which would have a higher risk of products being adulterated or misbranded.
Scope of Practice and the “Standing Order” Fallacy
Medspa owners may confuse their facilities to be the equivalent of luxury spas, where treatments may be chosen by the individual entering the facility from a menu of options. This is compounded by the fact that some prescribers have been known to leave “standing orders,” which allow for nonprescribers to simply dispense a drug consistent with said standard order without any additional oversight. Such standing orders bypass critical medical-legal requirements. To protect investments into medspas, it therefore benefits investors to confirm the following:
- The Good Faith Exam: Every patient must receive a documented, individualized examination by an appropriately licensed prescriber (MD, DO, NP, or PA) before prescription drugs or fluids are administered.
- Nursing Limitations: It is important that clinicians act within the scope of their practice. Accordingly, registered nurses must execute valid provider orders, cannot independently diagnose or prescribe, and cannot allow patients to self-diagnose. Boards in states such as Arizona and Mississippi are increasingly targeting “scope creep.”
“Sham” Directorships and Corporate Practice of Medicine
Consistent with state law, medications must be provided subject a prescription from an appropriately licensed prescriber. Some prescribers may take on a role as a “Medical Director” and then effectively “rent” their license by providing a “blanket” authorization to enable nonprescribers to dispense medication consistent with a standing order and without appropriate oversight. This makes the medical directors figureheads, and corporate counsel must look beyond the existence of a medical director agreement to evaluate its functional substance. As previously discussed, nursing boards have expressed a continuing concern around scope creep by nursing professionals who take on a prescribing function without the appropriate license.
Jurisdictions such as Oregon and Iowa pointedly call out such behavior and caution that physicians must provide active, documented supervision to a business entity. In the event of nonphysician investors, and consistent with state corporate practice of medicine regulations, states such as Washington caution that nonphysician owners are prohibited from overriding a clinician’s judgment.
Failure to follow these rules such that the physician has no actual role in clinical decision-making may render the facility, physician, and/or related management services agreement fraudulent vehicles for unauthorized practice.
Marketing Fraud
Aggressive marketing of compounded GLP-1 weight-loss drugs has cultivated a high-risk environment for consumer fraud litigation. Clinics selling such drugs by associating them with the brand names of approved GLP-1 drugs have already caught the attention of branded drug companies who are actively policing their trademarks. State attorneys general in Ohio and Connecticut are investigating medspas that falsely claim to provide “generic Ozempic” or imply that their products are FDA-approved.
Heightened Legal Scrutiny
While regulators in the past did not see this as a high enforcement priority, the FDA, FBI, and FTC are now unified in directing greater attention to the legal obligations of medspas and weight-loss clinics as medical practices.
This multi-agency heightened scrutiny coincides with a strategic pivot at the Department of Justice, emphasizing its treatment of compliance as a nonnegotiable seat at the M&A table.
In March 2026, the DOJ announced a department-wide Corporate Enforcement Policy. This policy, consistent with the DOJ’s “Evaluation of Corporate Compliance Programs” guidance, underscores the expectation that acquiring entities perform rigorous, proactive due diligence to identify and remediate misconduct within target assets. Acquiring entities that perform such due diligence may be offered a specific “Safe Harbor” if they voluntarily self-disclose criminal conduct discovered during the M&A process within six months of closing. This is a clear signal that the government expects “compliance-first” deal-making in the highly regulated healthcare and aesthetics sectors.
Business counsel must therefore integrate robust regulatory vetting into the deal cycle to avoid the full weight of a unified federal enforcement apparatus that now leverages interagency data analytics and a record-setting $6.8 billion False Claims Act recovery pipeline to root out fraud.
Conclusion
The recent federal indictment in Utah and the tightening grip of state boards should serve as a definitive market correction. Business lawyers advising medspas or potential acquirers must recognize that the perceived “regulatory gray area” inhabited by many medspas was always part of enforcement discretion and not a different regulatory mechanism. Failure to follow state and federal requirements, such as avoiding backroom IV mixing or nurse-led “menu” selections, carries risks of prosecution as felony misbranding and the unauthorized practice of medicine.
