If your med spa gets inspected today, inspectors will want proof fast: current licenses, dated training records, current policy sign-offs, safety drill logs, equipment checks, and SDS access. If even one item is missing or expired, you could face citations, fines, or follow-up action.

Here’s the short version: I’d check five areas first before inspection day.

  • Staff files: active licenses, role-matched credentials, BLS/ACLS if needed
  • Training records: OSHA, HIPAA, infection control, role-based skill checks
  • Policy sign-offs: staff signatures tied to the current SOP version
  • Safety records: drill logs, exposure response training, CPR/AED dates
  • Logs and binders: device service logs, fridge temps, eyewash checks, SDS access, mock inspection notes

A few dates matter right away:

  • OSHA bloodborne pathogens records: keep for 3 years
  • HIPAA training records: keep for 6 years
  • Medication fridge/freezer temps: check daily
  • Eyewash stations: weekly activation plus annual inspection
  • Mock document retrieval target: under 90 seconds

Bottom line: I’d treat inspection prep like a file-and-log check, not just a staff training task. Your team should be able to show records on the spot, explain exposure steps from memory, and point to current written procedures without hunting through old folders.

The article breaks this down into a simple review order so you can find gaps before an inspector does.

Med Spa State Inspection Checklist: 5 Key Areas Inspectors Check

Med Spa State Inspection Checklist: 5 Key Areas Inspectors Check

Staff Files: Credentials, Training Records, and Policy Sign-Offs

When one person owns readiness, staff files get a lot easier to manage. Review them in the same order inspectors usually do: credentials, training records, then policy sign-offs.

Training Records and Credential Verification

“Current” means active, unexpired, and matched to the person’s role.

A nurse injector’s RN or APRN license should be active in your state. A laser operator should have the certification your state requires for that device. Your medical director’s license should be checked directly with the issuing board, and that check should be kept in the file as a dated PDF or screenshot.

Attendance by itself doesn’t cut it. Each training record should show:

  • Date
  • Topic covered
  • Trainer name and qualifications
  • Employee signature or electronic attestation

That level of detail shows the employee was trained on the procedures they actually perform. Annual refreshers for OSHA, HIPAA, infection control, and role-based competencies should be logged the same way. Make sure each file shows a clear last completed date so overdue items stand out right away.

Keep OSHA bloodborne pathogens records for 3 years and HIPAA training records for 6 years.

Use the table below to check each record, where it’s stored, and who verifies it.

Required Record Storage Location Responsible for Verification
Active state license or certification Staff file, digital or physical Practice manager or compliance lead
Onboarding training log (date, topic, trainer, signature) Staff file Clinical supervisor
Annual OSHA/bloodborne pathogens refresher OSHA compliance folder Compliance lead
Annual HIPAA/privacy training record HIPAA training file Practice manager
Infection control and role-specific competency Staff file Clinical supervisor
BLS/ACLS certification, if applicable Staff file Practice manager

Policy Acknowledgments and SOP Sign-Offs

A signature only counts if it matches the current version. Every sign-off should point to the exact version number or effective date of the document the employee reviewed.

Here’s the simple test: if your infection control procedure changed in March, staff should be signing the March version, not last year’s copy.

Inspectors often check for signed acknowledgments tied to current:

  • Clinical protocols
  • Privacy policies
  • Emergency response procedures
  • Exposure response steps
  • Documentation standards
  • Service-specific SOPs

In a med spa, that usually includes injection protocols, laser safety procedures, adverse event escalation steps, and consent workflows. Keep a sign-off log that shows who signed each policy and when it was last reviewed.

Policy Name Version/Effective Date Signed By Last Review Date
Infection control protocol Current version / current effective date All clinical staff Date reviewed
HIPAA privacy policy Current version / current effective date All staff Date reviewed
Emergency response procedure Current version / current effective date All staff Date reviewed
Exposure response steps Current version / current effective date All clinical staff Date reviewed
Injection safety SOP Current version / current effective date Injectors only Date reviewed
Laser safety procedure Current version / current effective date Laser operators Date reviewed

Track who reviewed each file type and when.

Safety Training: Infection Control, Injection Safety, and Emergency Response

After opening a med spa and reviewing the files, the next step is simple: check whether staff can do the work safely. Inspectors don’t stop at job titles or signed policies. They want proof that people know what to do and can do it the right way.

Infection Control and Injection Safety Training

For each clinical skill, use two things together:

  • a signed training record
  • a competency check

That combo matters. A training record shows the person was taught. A competency check shows they can actually perform the task.

For clinical staff, training records should cover hand hygiene, correct PPE use, room turnover between patients, skin antisepsis, cleaning and disinfection of treatment areas and devices, and regulated medical waste segregation and disposal.

If the practice offers injectable services, the file should also include documented training on aseptic technique, safe sharps handling, single-use needle and syringe rules, and multidose vial handling. Needles, cannulae, and syringes are single-use sterile items and cannot be reused for another patient. Multidose vials should be discarded if sterility is in doubt.

Bloodborne pathogen training is required for any staff member who may come into contact with blood, used sharps, contaminated linens, body fluids, or contaminated surfaces. That includes injectors, nurses, medical assistants, estheticians who perform invasive services, cleaners who handle treatment rooms or waste, and other staff with exposure risk.

Keep the training log and competency check together for each role. That makes file review much easier and gives inspectors a clear paper trail.

Required Training Topic Required Staff Group Proof of Completion
Hand hygiene and PPE All staff Signed training record
Room turnover and disinfection Clinical and support staff SOP acknowledgment + competency check
Sharps handling and disposal Injectors, clinical staff Direct observation, policy sign-off
Aseptic technique for injectables Injectors Observed return-demonstration
Bloodborne pathogen training Exposure-risk staff Signed record, dated certificate
Multidose vial and medication handling Injectors, nurses Training record + competency validation

Next, verify that staff can respond to exposures and emergencies.

Emergency Drills and Exposure Response

Written policies alone won’t carry much weight. Inspectors look for documented drills because drills show whether the team can act under pressure.

At a minimum, your drill log should include fire, medical emergencies, chemical spills, needlestick or sharps injuries, and evacuation. Each log entry should list the date, the scenario practiced, which staff took part, any deficiencies found, and the corrective actions taken.

For exposure response, staff should be able to walk through the steps from memory: wash or flush immediately, report at once, notify a supervisor, and start medical evaluation. In a real incident, there’s no time to dig through a binder.

Designated responders also need current CPR/AED and first aid certification. Track both the issuer and the expiration date so nothing lapses without notice.

Drill Type Last Drill Date Participants Deficiencies Found Corrective Actions
Fire/evacuation [Date] All staff on shift [Note any gaps] [Actions completed]
Medical emergency [Date] Clinical staff [Note any gaps] [Actions completed]
Chemical spill response [Date] Clinical and support staff [Note any gaps] [Actions completed]
Needlestick/exposure incident [Date] All clinical staff [Note any gaps] [Actions completed]
CPR/AED response [Date] Designated responders [Note any gaps] [Actions completed]

Operational Logs: Equipment Records, SDS Access, and Hazard Communication

After staff files and training, inspectors turn to the logs that show what happens on a normal day. These records matter because they show whether the clinic is operating safely every day, not just when a survey is around the corner.

Equipment, Maintenance, and Safety Log Review

These logs should show that maintenance, testing, and follow-up actions are current. Track every device and system tied to patient safety, infection control, or treatment quality. That includes lasers/IPL, sterilizers, medication refrigerators, AEDs, oxygen, sharps, waste, and eyewash stations.

Each entry should include:

  • Equipment name and serial number
  • Location
  • Inspection or service date
  • Who completed the check
  • Any corrective action taken

Eyewash stations need extra attention. Checks should follow ANSI/ISEA Z358.1. That means activating plumbed eyewash stations weekly, completing an annual inspection, and recording the date, flow rate, spray pattern, and water temperature (60–100°F). Don’t just mark “passed.” Record the actual readings and the result.

Medication refrigerators and freezers need daily temperature logs. If a reading falls out of range, staff should document what happened and what they did next. Inspectors often find the same weak spots: missing service records for lasers and other energy-based devices, no recorded sterilizer validation or biological spore testing schedule, refrigerator logs with unexplained gaps, and expired emergency equipment.

A simple fix helps here: assign one person to review the full equipment log each month, flag anything overdue, schedule service right away, and document when the issue is closed.

Equipment Item Inspection Interval Last Service/Inspection Date Next Due Date Status
Laser/IPL device Annual preventive maintenance [Date] [Date] [Compliant / Overdue]
Autoclave/sterilizer Annual preventive maintenance + biological spore testing [Date] [Date] [Compliant / Overdue]
Eyewash station Weekly activation + annual inspection [Date] [Date] [Compliant / Overdue]
Medication refrigerator/freezer Daily temperature log [Date] [Date] [Compliant / Overdue]
AED/emergency kit Monthly functional check [Date] [Date] [Compliant / Overdue]

Once equipment records are in order, inspectors usually move straight into chemical access and hazard communication.

SDS Access and Hazard Communication

Hazard communication is one of those areas OSHA cites again and again, so inspectors look at it closely. The usual problems are missing SDSs, unlabeled secondary containers, and staff who freeze when asked where the SDS is.

Every hazardous chemical in the clinic, such as disinfectants, sterilants, topical anesthetics, and cleaning agents, needs a current SDS. Organize SDSs by product name and manufacturer, using the standard 16-section OSHA format. Access must be immediate. It also has to be unlocked and available on demand. A locked binder won’t cut it. Neither will a digital folder that staff can’t open when they need it. If your clinic uses a digital SDS library, keep a backup method ready in case the power goes out or the network drops.

All chemical containers, including secondary containers, must be labeled with:

  • Product identifier
  • Signal word
  • Hazard statements
  • Pictograms
  • Precautionary statements
  • Manufacturer information

Hazard communication training should happen during onboarding and again whenever a new chemical is introduced. Each session should have a signed training roster in the file.

Training isn’t just a box to check. Staff should be able to find the SDS fast and know what to do next. A good readiness test is simple: ask a staff member where the SDS binder is and how they would respond to a disinfectant splash in the eye.

Chemical Category Product Example SDS Location Trained Staff Group
Disinfectant Surface disinfectant spray Physical binder – nurse station All clinical and support staff
Sterilant High-level disinfectant solution Physical binder – nurse station Clinical staff, sterilization lead
Topical anesthetic Lidocaine cream Digital SDS folder – shared drive Injectors, nurses
Cleaning agent Multi-surface cleaner Physical binder – supply room Housekeeping, support staff

Build the Audit Binder and Run a Mock Inspection

With equipment logs and SDSs up to date, the last move is simple: make every record easy to find right away.

Audit Prep Binder and Digital Folder

Set up the binder and the matching secure digital folder with clear sections for credentials, training records, policy acknowledgments, drill records, equipment logs, SDSs, and corrective actions. Place an index sheet at the front that lists each section and where the digital version lives. Inside each section, keep the newest records on top so staff aren't digging through old paperwork when time matters.

A short status table at the front, updated on a regular basis, gives you a quick snapshot of what is done and what still needs work:

Document Status Owner
RN/NP/PA Licenses Verified, current through 12/31/2026 Clinical Director
Annual Bloodborne Pathogens Training Log Missing 2 staff signatures Nurse Educator
Laser Device Preventive Maintenance Log Complete through last month Lead Laser Technician
Emergency Drill Records Complete, filed under Emergency tab Compliance Lead
Policy Acknowledgments – Infection Control 1 new hire unsigned Office Manager

If you use Prospyr, turn these into tasks with automated reminders so expiring credentials and missing uploads get flagged early.

Once the binder is in order, put it to the test. The goal isn't just neat files. The goal is speed.

Run a Mock Inspection and Close Open Gaps

Have the compliance lead, medical director, or an outside reviewer follow the same request order inspectors tend to use: training records, licenses, exposure control plan, SDSs, emergency plans, and infection control documents.

Time each retrieval. If it takes more than 90 seconds to find a document, treat that as a gap that needs fixing before the actual visit. Rotate the questions between front desk staff, nurses, and leadership so access does not rest on one person. Staff should know where the SDS binder is kept, where emergency drill records are filed, and how to pull a specific training log without hesitation.

Write down every finding with:

  • the corrective action
  • the owner
  • the due date

Missing signatures, expired certifications, and incomplete logs are all fixable. But you have to spot them before an inspector does.

Final Checklist Before Inspection Day

In the days leading up to an inspection, review:

  • Credentials: Current licenses, verified expirations, supervision agreements
  • Training records: Annual training complete; rosters signed and dated
  • Policy sign-offs: All required policies signed by current staff, including new hires
  • Infection control and emergency drills: Dated, documented, and resolved
  • Equipment and SDS logs: Current, complete, and sorted by device and chemical
  • Corrective actions: Prior findings resolved with documented remediation

Assign one person to own this list and handle the inspection-day response. Fix any gap now. If a document is missing on-site, later clarification will not help.

FAQs

Who should own inspection readiness?

Inspection readiness is a team job. When everyone owns a piece of it, it’s much easier to spot gaps before they turn into problems.

The medical director has the final say. That role covers clinical oversight, policy approval, and sign-off on corrective actions.

A compliance or accreditation lead usually runs the day-to-day survey process. That often includes internal audits, survey coordination, and policy version control.

Clinical leads are usually responsible for equipment logs and competency checklists. Operations staff typically manage intake and record retrieval.

What records are inspectors most likely to ask for first?

Inspectors often start with records that show staff can work safely and are cleared to perform procedures. So have your paperwork easy to pull up.

That usually includes proof of staff training for bloodborne pathogens, infection control, and device-specific procedures. Keep attendance sheets, certificates, and competency checklists on hand.

Also keep these ready:

  • current facility and practitioner licenses
  • physician-approved SOPs
  • emergency and fire safety plans
  • equipment maintenance and calibration logs
  • SDS for all on-site chemicals

How often should we run a mock inspection?

Run mock inspections and safety drills on a set schedule so your team is ready when regulators show up.

A good rule of thumb is simple:

  • Do routine compliance audits monthly
  • Run emergency drills and simulation-based competency assessments annually
  • Do an immediate review or drill any time you add a new device, a new procedure, or updated guidance

That rhythm helps your team stay sharp instead of scrambling at the last minute.

Related Blog Posts