Top Telehealth Regulations for Med Spas in 2025

The telehealth landscape for med spas underwent major changes in 2025 as pandemic-era flexibilities expired. Providers now face stricter rules, including:

Geographic Restrictions: Medicare telehealth services are limited to rural areas or approved facilities.
In-Person Visit Requirements: Prescriptions for controlled substances often require prior in-person evaluations.
State-Specific Licensing: Cross-state telehealth services are complicated by varying state laws.
HIPAA Compliance: Full adherence to privacy standards is mandatory, requiring secure communication tools and proper documentation.
Provider-Patient Relationships: Real-time video consultations are necessary to establish valid relationships.

These regulations highlight the need for med spas to prioritize compliance in areas like licensing, documentation, and secure technology. Falling behind can lead to claim denials, penalties, or operational disruptions.

HIPAA Compliance and Federal Privacy Requirements

HIPAA

Med spas offering telehealth services must now adhere to strict federal privacy standards. The flexibility provided during the COVID-19 public health emergency ended at 11:59 p.m. on August 9, 2023, making full HIPAA compliance mandatory once again. This shift emphasizes the need for secure telehealth operations that meet federal privacy requirements.

Encrypted Communication and Secure Data Storage

Protecting patient data requires implementing administrative, physical, and technical safeguards. Among these, technical safeguards play a crucial role. Key measures include using unique user IDs, enabling auto log-offs, encrypting data both in transit and at rest, and maintaining audit controls to track system activity. Consumer tools must be configured correctly to align with HIPAA standards. Additionally, med spas are required to secure Business Associate Agreements (BAAs) with all technology vendors before transmitting electronic protected health information (ePHI).

For example, Microsoft Office365 provides BAAs for healthcare providers using Skype or Teams, with plans starting at approximately $30 per month per user. If the system lacks automatic logging capabilities, consultations should be recorded manually.

Before providing telehealth services, providers must obtain and document patient consent - either verbal or written - in the medical record. All related documentation, including policies, procedures, and risk assessments, must be retained for at least six years from the date of creation or last effect. Providers are also required to follow the "minimum necessary" rule, ensuring patient data is accessed and shared only for specific clinical purposes. Regular risk analyses are essential to identify and address any potential vulnerabilities.

Ryan Haight Act for Controlled Substances

Ryan Haight Act

Prescribing controlled substances via telehealth remains tightly regulated under the Ryan Haight Act. While certain telemedicine prescribing flexibilities have been extended through late 2025, in-person evaluations will generally be required after these extensions expire. The DEA has proposed new rules to allow providers to prescribe Schedule II substances via telehealth without a prior in-person visit, provided they obtain a special registration and are located in the same state as the patient. Another proposed rule would permit a six-month supply of buprenorphine through telehealth, followed by a mandatory in-person visit.

Adopting secure data practices not only ensures compliance with federal regulations but also strengthens the trust essential for effective provider-patient relationships. Strong privacy measures form the backbone of compliant and trustworthy telehealth services.

Establishing Provider-Patient Relationships

Adhering to strict HIPAA regulations, forming a valid provider-patient relationship has become a cornerstone of compliance and safe medical care. This relationship is essential before prescribing treatments like neurotoxins. In many states, telehealth is now an accepted method for establishing this connection, as long as the provider verifies the patient's identity, confirms their location, and obtains informed consent. For instance, Arkansas explicitly prohibits creating such relationships solely through online questionnaires, email, text, or fax. These rules align with broader discussions on technology standards and reimbursement policies, which are covered in later sections.

Synchronous Video Consultation Requirements

Telehealth guidelines outline specific methods for establishing valid provider-patient relationships. Federal regulations emphasize the necessity of real-time interactions for this process. Prescriptions must be issued through an "interactive telecommunications system" - typically, a platform that supports live audio and video communication. In Texas, for example, initiating a provider-patient relationship requires synchronous video consultations. This means everyday apps like FaceTime don’t meet professional medical standards. Instead, med spas must use HIPAA-compliant video platforms with a signed Business Associate Agreement (BAA).

"A physician providing telehealth medical services shall owe to the patient the same duty to exercise reasonable care, diligence, and skill as would be applicable if the service or procedure were provided in person." - Alabama State Medical Board

To ensure the legitimacy of these relationships, practitioners must conduct Good Faith Examinations (GFEs), which include reviewing medical histories and performing physical exams. Med spas are also required to perform annual GFEs to account for any changes that could impact treatment plans.

In-Person Visit Mandates for Certain Services

For specific treatments, such as controlled substances, in-person evaluations remain mandatory. The Ryan Haight Act stipulates that a valid prescription usually requires at least one in-person medical evaluation before issuing controlled substances. State laws vary widely: Alabama, for instance, mandates at least one in-person visit within the past 12 months for all controlled substances prescribed via telehealth, while Louisiana enforces a similar requirement. Additionally, Alabama requires patients seen via telehealth more than four times in a year for the same unresolved condition to have an in-person visit or be referred for in-person care.

Accurate Documentation Standards

Proper documentation is another critical element. Providers must record their identity, credentials, and specialty. States like Delaware and Connecticut also require either providing patients with a written summary of the visit or documenting the patient’s consent to share records with their primary care provider. When prescribing controlled substances, it’s mandatory to check the Prescription Drug Monitoring Program (PDMP) for both the provider’s and the patient’s states.

State-Specific Licensing and Practice Restrictions

State-by-State Med Spa Telehealth Licensing and Practice Requirements 2025

Navigating the patchwork of state-specific telehealth regulations can be a daunting task for med spas, especially when operating across multiple locations. While federal guidelines establish a baseline, states enforce their own unique rules around ownership, licensing, and delegation authority. These variations make it essential for med spas to understand the specific requirements in each state where they operate or serve patients. Let’s break down some of the key differences and challenges.

The Corporate Practice of Medicine (CPOM) doctrine is a prime example of state-specific regulations. States like California, Texas, Ohio, Colorado, Iowa, Illinois, New York, and New Jersey require physician ownership of medical practices. For instance, California mandates that physicians own at least 51% of a medical practice, with other specified medical licensees allowed to own up to 49%.

Geographic restrictions add another layer of complexity. Florida and Arizona, for example, permit out-of-state telehealth registration but prohibit opening physical offices or providing in-person services under such registration. Florida law explicitly states that telehealth providers registered out-of-state "may not open an office in this state and may not provide in-person health care services to patients located in this state". Additionally, these providers must carry professional liability insurance that covers telehealth services in those states.

Some states also impose limits on the frequency of telehealth visits. In Alabama, if a patient is treated via telehealth more than four times in a 12-month period for the same unresolved condition, they must either be seen in person or referred for in-person care. Georgia, on the other hand, generally prohibits treatment via telehealth unless a history and physical examination have been conducted by a Georgia-licensed provider. The American Med Spa Association (AmSpa) underscores the importance of conducting a "good faith exam", with the law firm ByrdAdatto referring to it as the "Medical Spa Widow-maker".

State-by-State Comparison of Licensing and Delegation Rules

Here’s a quick overview of how licensing, ownership, and practice limitations vary by state:

State	Ownership Requirements	GFE via Telehealth	Key Practice Limitations
California	Physician must own 51%+; CPOM enforced	Allowed; must meet in-person standard of care	Direct supervision by MD, NP, or PA required for medical procedures
Texas	Physician-owned or MSO structure; CPOM enforced	Allowed; requires established relationship	MD supervision required; specific certifications needed for laser treatments; 72-hour PCP notification rule
Florida	MD-owned or MSO; allows non-physician ownership	Allowed; must meet standards	Out-of-state registrants cannot open physical offices; specific laser/IPL training required
Colorado	MD-owned or MSO; CPOM enforced	Allowed; MD must be available in-state	MD can delegate to unlicensed individuals (Rule 800) with proper training and protocols
New Jersey	MD-owned; CPOM enforced	Allowed; must be MD-performed	Procedures affecting living tissue must be performed by a licensed physician
Alabama	Moderate CPOM enforcement	Allowed	"4-visit rule": In-person care required after 4 telehealth visits for the same condition in 12 months

To ensure compliance, providers must verify the patient’s physical location at the beginning of each telehealth session. This step is crucial in adhering to the licensing laws of the state where the patient is located. Tools like the Interstate Medical Licensure Compact (IMLC) and Nurse Licensure Compact (NLC) can simplify multi-state practice, but it’s important to note that not all states participate in these agreements.

Eligible Providers and Scope of Remote Services

Under the 2025 regulations, only certain professionals - MDs, DOs, PAs, NPs, clinical nurse specialists, and nurse-midwives - are authorized to provide Medicare telehealth services. Federal law has extended these telehealth flexibilities through January 30, 2026. To practice, providers must hold active licenses in both their home state and the state where the patient resides. These licensing requirements ensure that remote consultations maintain consistent care standards across state lines.

To simplify multi-state licensing, tools like the Interstate Medical Licensure Compact (IMLC) are available to physicians. However, not all states participate in this program, which can create additional hurdles for providers.

Roles of MDs, DOs, NPs, and PAs

MDs and DOs are the primary professionals authorized to deliver telehealth services. They have full authority to diagnose, prescribe medications, and establish provider–patient relationships remotely. Additionally, they may act as medical directors, overseeing other healthcare practitioners and non-physician staff. NPs and PAs are also permitted to provide telehealth services under Medicare, but their scope of practice depends on state-specific delegation rules.

These providers must adhere to the same standards of care for telehealth as they would for in-person visits. This includes conducting thorough assessments, maintaining accurate documentation, and obtaining informed consent. The Drug Enforcement Administration (DEA) has also extended its flexibility for prescribing Schedule II-V controlled substances via audio–video consultations through December 31, 2025, even if no prior in-person examination has occurred.

While MDs, DOs, NPs, and PAs have broad telehealth authority, other roles are subject to stricter limitations.

Oversight and Restrictions on RNs and Aestheticians

Registered nurses (RNs) have more limited roles in telehealth. Medicare does not recognize RNs as independent distant site providers, which means they typically cannot diagnose or prescribe medications remotely. For example, in Texas, RNs may only provide telemedicine services under the supervision and delegation of a licensed physician. The Texas Medical Board also sets limits on the number of healthcare professionals a single physician can supervise through telemedicine.

"A health professional providing a health care service or procedure as a telemedicine medical service... is subject to the standard of care that would apply to the provision of the same health care service or procedure in an in-person setting." – Texas Occupations Code

Some states, however, grant RNs more leeway. In Maine, for instance, RNs can use telehealth to perform nursing assessments or physical examinations, provided they secure and document timely informed consent.

Aestheticians face even tighter restrictions. They are generally prohibited from offering independent medical telehealth services and must work under direct medical supervision for any procedures involving living tissue.

Technology and Documentation Mandates

Technology systems play a critical role in safeguarding data and fostering trust and transparency in provider-patient relationships. For med spas offering telehealth services, adhering to stringent technical and administrative standards is essential to comply with federal regulations. As of August 9, 2023, all standard HIPAA Security Rule requirements are fully applicable.

HIPAA-Compliant EHR and CRM Integration

To meet HIPAA compliance, technology platforms must prioritize robust data protection by implementing administrative, physical, and technical safeguards. On the technical front, this includes role-based access with unique logins, two-factor authentication, and audit trails to ensure that only authorized users can access sensitive information. Additionally, transmission security measures are required to prevent unauthorized access during data transfer.

"Covered health care providers and health plans must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements." – HHS.gov

Looking ahead, proposed 2025 DEA regulations will require prescriptions issued via telehealth to be transmitted using Electronic Prescribing for Controlled Substances (EPCS). Providers will also need to conduct Prescription Drug Monitoring Program (PDMP) checks in the patient's state, the provider's state, and any states with reciprocity agreements. Furthermore, technology systems must support identity verification processes, which may include securely storing a patient verification photo.

Federal law mandates that all HIPAA-related documentation, such as policies, procedures, and assessments, be retained for a minimum of six years from either the date of creation or the date it was last in effect. Additionally, most states require medical professionals to obtain and document either verbal or written consent for telehealth services. This documentation should include:

Verification of the patient’s identity and location
Disclosure of telehealth limitations
Consent to share protected health information with other clinicians

"A regulated entity must maintain documentation required for written policies and procedures implemented to comply with the Security Rule... until six years after the later of: 1) the date of the document's creation or 2) the date the document is last in effect." – Office for Civil Rights

EHR and CRM systems can streamline compliance by automatically capturing and storing informed consent forms within patient records. These systems should also maintain audit logs to track who accessed patient records and when, a HIPAA requirement that supports daily operations and audit practices.

Standard Operating Procedures (SOPs) and Audits

Every med spa should establish clear Standard Operating Procedures (SOPs) for handling telehealth consultations, documenting patient interactions, and protecting electronic Protected Health Information (ePHI). A key requirement of the HIPAA Security Rule is conducting a comprehensive risk analysis to identify vulnerabilities that could compromise the confidentiality, integrity, or availability of ePHI. This analysis should cover both technical systems and physical security measures, such as using headphones during telehealth calls to prevent unauthorized listeners.

Each practice must appoint a Security Official responsible for developing and implementing HIPAA-compliant policies and procedures. Regular audits and periodic evaluations of telehealth workflows ensure that systems remain compliant with evolving regulations. These audits, along with contingency plans for backing up and restoring ePHI in emergencies, provide critical safeguards. Updating SOPs to reflect organizational changes or newly identified risks helps maintain alignment with current standards and ensures ongoing compliance.

Post-2025 Medicare and Reimbursement Changes

Medicare

Medicare's telehealth flexibilities are set to expire on January 30, 2026, ushering in stricter reimbursement rules. These changes often influence state medical boards, shaping guidelines around "good faith exams" and remote prescribing practices. For med spa providers, understanding these shifts is essential to staying ahead of regulatory trends and maintaining compliance. Let’s break down the key updates and what they mean for your operations.

Reinstated Geographic and Service Restrictions

Starting January 30, 2026, Medicare will only reimburse telehealth visits for non-behavioral health services under specific conditions. Patients must attend these visits from an approved clinical facility located in a rural Health Professional Shortage Area (HPSA) or outside a Metropolitan Statistical Area. This change rolls back the pandemic-era flexibility that allowed home-based care for many services.

The impact goes beyond Medicare reimbursement - it sets a precedent that state boards may use when assessing whether remote consultations for treatments like aesthetic procedures, weight loss prescriptions, or hormone therapy align with professional standards. Currently, there are more than 250 codes on the Medicare telehealth services list, and these restrictions could serve as a blueprint for compliance in other areas. Providers can use tools like the Medicare Telehealth Payment Eligibility Analyzer to check if a specific address meets the new criteria.

Unfortunately, many providers and compliance teams are still unprepared for these changes. This highlights the need for stronger compliance systems to adapt to the evolving regulatory landscape.

Audio-Only Telehealth and In-Person Requirements

The new rules also impose stricter guidelines on telehealth delivery methods. Starting in 2026, audio-only services will only be reimbursed if video is available but not used by the patient, and this decision must be clearly documented in the patient’s record.

Mental health services face additional requirements. Providers must conduct an in-person visit within six months of the initial telehealth service, with annual in-person follow-ups thereafter. This applies even if the provider already has an established relationship with the patient. If the original practitioner is unavailable, another provider in the same subspecialty and group practice can fulfill this requirement.

Here’s a quick comparison of policy changes:

Policy Feature	Status Through Jan 30, 2026	Post-Jan 30, 2026
Geographic Restrictions	None; patients can be anywhere	Limited to rural/underserved areas
Originating Site	Patient's home allowed	Clinical facility (with limited exceptions)
Audio-Only Modality	Broadly permitted	Only if video unavailable/refused
In-Person Requirement	Waived for most services	Required for mental health (6-month/annual)
Provider Types	Expanded (includes PT/OT/Speech)	Reverts to statutory list (MD/NP/PA/etc.)

Preparing for Compliance

Med spa providers should take proactive steps to prepare for these changes. Start by auditing the locations of your current patients to identify those receiving services outside approved originating sites. Additionally, update your consent forms to include language that documents when patients are offered video but choose audio-only alternatives.

If your practice offers medical weight loss or hormone replacement therapy involving controlled substances, keep a close eye on DEA rulemaking regarding "Special Registrations for Telemedicine." These updates are expected to tighten remote prescribing standards, making it essential to stay informed.

Prospyr's HIPAA-Compliant Tools for Telehealth Compliance

Prospyr

Telehealth regulations require technology that guarantees compliance. With the 90-day HIPAA transition period officially over, strict adherence to these rules is now mandatory. Considering that HIPAA violations can result in fines of up to $2 million, med spas need reliable systems that protect patient data while simplifying daily tasks. Prospyr offers tools that integrate seamlessly with operational workflows to ensure compliance at every level.

Integrated CRM and EMR for Secure Patient Management

Prospyr's integrated CRM and EMR system is designed to safeguard electronic protected health information (ePHI). It uses encryption and transmission security to protect data during network communications. Additionally, built-in audit controls track user activity, meeting HIPAA's stringent audit requirements.

Med spas are required to sign a Business Associate Agreement (BAA) with vendors to ensure compliance. Prospyr provides these agreements, committing to the proper safeguarding of ePHI. The platform also supports administrative safeguards such as risk analysis and access management. By limiting access to ePHI to only essential roles and maintaining documentation for six years, Prospyr ensures compliance across all telehealth operations.

AI-Powered Tools for Documentation and Scheduling

Prospyr leverages AI to streamline documentation and scheduling. Its note creation and transcription tools automatically generate detailed records for each consultation. Meanwhile, AI-driven booking tools and conversation agents handle scheduling tasks while adhering to 2025 cybersecurity standards.

These automated features not only reduce administrative workloads but also maintain the necessary audit trails. By late 2025, 84% of healthcare providers admitted their compliance and IT teams lacked formal plans to address expiring telehealth flexibilities. Prospyr's tools help bridge this gap, ensuring compliance remains intact.

Digital Intake Forms and Communication Tools

Prospyr simplifies the consent process with digital intake forms that capture and securely store informed consent, including all required disclosures. Its email and SMS communication tools use secure, non-public-facing technology, a critical requirement following the end of COVID-19 enforcement discretion.

"Most states with telehealth consent guidelines require that medical professionals obtain and document verbal or written consent, documenting it in the patient's medical record." - American Academy of Family Physicians (AAFP)

Conclusion

Telehealth regulations now require strict adherence to HIPAA guidelines, thorough provider-patient verification, and detailed documentation practices. While temporary allowances for prescribing controlled substances remain in place for now, med spas must also contend with state-specific licensing rules and documentation standards to stay compliant.

Failing to meet these requirements can lead to serious consequences, including civil, criminal, and administrative penalties imposed by state medical boards and regulatory agencies. Alarmingly, as of late 2025, 84% of healthcare providers reported that their compliance teams lacked formal plans to address these regulatory changes, leaving many practices exposed to potential enforcement actions and operational setbacks.

To reduce these risks, adopting compliant technology is crucial. Advanced platforms, such as Prospyr, offer tools designed to help med spas meet both federal and state regulations. These platforms provide essential features like encrypted communication, secure data storage, automated documentation, and digital consent management. By incorporating these tools, practices can ensure telehealth encounters meet the same standards as in-person care while maintaining comprehensive audit trails.

Given the shift from temporary flexibilities to permanent regulations, med spas must act swiftly. Key steps include verifying cross-state licensing, updating consent forms to include telehealth-specific disclosures, and integrating compliant technology into daily operations. By taking these proactive measures and staying informed on regulatory updates, practices can continue delivering telehealth services while safeguarding patient trust and maintaining legal compliance.

FAQs

What are the main HIPAA requirements for med spas providing telehealth services?

Med spas that offer telehealth services need to prioritize compliance with HIPAA regulations to safeguard patient information. This means protecting protected health information (PHI) - like medical histories, treatment records, and photos - by using encrypted, secure platforms and ensuring that only authorized personnel have access.

To meet these requirements, med spas should also:

Establish Business Associate Agreements (BAAs) with any third-party technology providers they work with.
Obtain and properly document patient consent for telehealth services.
Give patients access to their medical records upon request.
Quickly report any breaches involving PHI to the relevant authorities.

These steps are essential for staying compliant and reinforcing patient trust while protecting their privacy.

How do state licensing laws impact med spa providers offering telehealth services across state lines?

State licensing laws require med spa providers to have a valid professional license in the state where their patient is physically located during a telehealth consultation. In most cases, the patient's location is treated as the "place of service." This means that if a provider is out-of-state, they must either secure a full license for that state, qualify for a limited-license exception, or participate in interstate licensure agreements to legally provide care.

For med spas, which often handle aesthetic treatments, prescriptions, or supervised procedures, many states also require that the provider-patient relationship be established by a licensed practitioner within the patient's state. Ignoring these regulations can lead to legal consequences and issues with reimbursement.

Platforms like Prospyr can assist med spas in maintaining compliance by monitoring licensure status, automating location verification, and managing documentation and consent requirements tailored to each state's regulations.

How can med spas prepare for the end of Medicare telehealth flexibilities in 2026?

Med spas should begin preparing for the expiration of pandemic-era telehealth flexibilities, which will come to an end on January 30, 2026. To ensure a smooth transition, there are a few key areas to focus on:

First, confirm that all providers conducting virtual visits are licensed in the same state as the patient. Additionally, make sure provider-patient relationships are properly established before prescribing any treatments. This is critical because the new rules will restrict remote care to medical facilities located in rural areas. Update consent forms, intake procedures, and documentation to align with these upcoming requirements.

Next, take a close look at your billing and coding practices. Starting in 2026, Medicare will only reimburse telehealth services delivered in approved rural medical facilities, and even then, only certain types of providers will qualify. To avoid payment denials, adjust your fee schedules, train your billing team on the new rules, and test claims processing ahead of time.