Good faith exam med spa: requirements, who qualifies, and documentation

Key Takeaways

A good faith exam (GFE) is a formal medical evaluation by a licensed provider required before prescription aesthetic treatments like injectables.

Three triggers require a GFE: new patients, new treatment categories, and significant health status changes.

RNs and estheticians cannot perform GFEs in most states; the exam must be conducted by a physician, NP, or PA.

Pabau’s digital forms and compliance tools help med spas capture GFE documentation, consent, and patient history in a single audit-ready record.

Most med spa liability claims trace back to one missing document. According to Quarles & Brady healthcare attorneys, failure to conduct a proper good faith exam exposes med spas to license revocation, civil malpractice suits, and state medical board investigations. The good faith exam med spa requirement isn’t a formality. It’s the legal foundation for every injectable treatment you perform.

This guide covers what a GFE is, when you need one, who can perform it, and how to keep your documentation audit-ready. Whether you’re opening your first location or tightening an existing compliance process, the detail here maps directly to what state boards actually check.

What Is a Good Faith Exam at a Med Spa?

A good faith exam med spa requirement refers to a formal medical evaluation performed by a licensed healthcare provider before a patient receives a prescription aesthetic treatment. It isn’t a sales consultation. It isn’t a quick intake chat. It’s a clinical assessment that determines whether a patient is medically suitable for the treatment being requested.

The American Med Spa Association (AmSpa) defines a GFE as a medical evaluation completed prior to a patient receiving a treatment for the first time. Once that initial exam is on file, you don’t need to repeat it at every subsequent visit, provided the patient’s health status and treatment category haven’t changed.

The distinction from a general consultation matters legally. A consultation is advisory. A GFE creates a documented clinical record that a licensed provider has assessed the patient and deemed them eligible for a specific treatment. Without it, administering prescription injectables is operating outside the law in most states.

Why Is a Good Faith Exam Required at a Med Spa?

Treatments like neurotoxins and dermal fillers are prescription drugs. Administering them without proper medical oversight isn’t just bad practice. It creates direct regulatory exposure for the entire business. Your med spa compliance checklist should treat the GFE as a non-negotiable gatekeeping step, not an optional add-on.

Three legal rationales drive the requirement:

• Patient safety: Prescription treatments carry contraindication risks. Pregnancy, autoimmune conditions, and certain medications make some patients unsuitable candidates. A licensed provider catch these before a needle is picked up.
• Prescriber accountability: State medical boards require that a qualified provider establish a patient-provider relationship before ordering or administering prescription drugs. The GFE creates that relationship on paper.
• Liability protection: A documented GFE is evidence that your clinic followed standard of care. Without it, any adverse event becomes indefensible in litigation.

Non-compliance consequences range from fines and corrective action plans to license revocation and criminal exposure, depending on the state. Healthcare attorneys at Quarles & Brady note that civil liability follows independently of regulatory action, meaning a single lawsuit can proceed alongside a medical board investigation simultaneously.

When Is a Good Faith Exam Required?

The good faith exam med spa requirement doesn’t reset at every appointment. It triggers on three specific clinical events. Understanding the difference saves your team from unnecessary friction while keeping you protected on the events that actually matter.

Keeping up with medspa compliance requirements across multiple trigger scenarios is one of the more operationally complex parts of running a med spa.

The health status change trigger is where practices get caught off guard. A returning patient who has started a new blood thinner or been diagnosed with a coagulation disorder since their last visit needs a fresh GFE before their next filler appointment, even if they’ve had the same treatment a dozen times before.

Who Can Perform a Good Faith Exam?

This is where most med spas create compliance gaps. The provider performing the good faith exam med spa assessment must hold prescriptive authority, which eliminates a large portion of the staff you might assume could handle it. Understanding nurse practitioner as medical director roles helps clarify where clinical authority actually sits in your practice structure.

Qualified providers in most states include:

• Physicians (MD or DO): Universally qualified across all states. The GFE can be performed in-person or, where state law permits, via telehealth.
• Nurse Practitioners (NP/APRN): Qualified in most states with full or collaborative prescriptive authority. Scope varies significantly by state, so verify your state’s Nurse Practice Act before assigning GFE responsibilities to an NP.
• Physician Assistants (PA): Qualified in most states under physician supervision or collaborative agreements. PA authority for independent GFE performance varies by state law.

Who cannot perform a GFE: registered nurses (RNs), licensed practical nurses (LPNs), medical assistants, and estheticians. These roles lack prescriptive authority regardless of their clinical skill level. Delegating a GFE to these staff members, even under a supervising physician’s name, creates a fraudulent record and multiplies your legal exposure.

For practices without a physician on staff, hiring a medical director for your med spa is the standard solution. Your medical director can perform GFEs directly or, depending on state rules, supervise NPs and PAs who carry out the assessment.

What Does a Good Faith Exam Include?

A complete GFE for aesthetic treatments covers six clinical areas. Each one creates documentation that goes into the patient record. Skipping any element leaves gaps an attorney or state investigator will find immediately.

• Medical history review: Current and past diagnoses, surgeries, hospitalizations. Focus on conditions that affect healing, clotting, or immune response.
• Current medications list: Anticoagulants, immunosuppressants, and certain supplements (fish oil, vitamin E) are contraindicated or require dose adjustment around injection procedures.
• Allergy screening: Documented allergy history relevant to treatment materials, including lidocaine (present in many fillers) and bacterial proteins (relevant for neurotoxins).
• Contraindication assessment: The provider explicitly documents whether known contraindications are present and how they affect treatment eligibility.
• Treatment goals discussion: Documents the patient’s requested outcomes and the provider’s clinical assessment of realistic results and risks.
• Eligibility determination and signature: The provider’s written or electronic determination that the patient is or is not a suitable candidate, with their credential and signature on file.

Most GFEs take 7 to 15 minutes when structured correctly, according to Fresh Clinics. The time investment is minimal compared to the liability protection it creates.

State-by-State good faith exam requirements: a summary

State regulations vary considerably. The table below covers the largest med spa markets. For state-specific detail, always verify against your state medical board and current Nurse Practice Act before making staffing or workflow decisions. California and Texas in particular have seen regulatory updates in recent years; check the current California med spa licensing laws and Texas med spa licensing laws before relying on any general summary.

All state requirements are subject to change. The American Med Spa Association publishes state-specific compliance updates and is the most reliable ongoing resource for med spa regulatory changes.

Telehealth good faith exam options: what’s permitted

Telehealth GFEs have become a practical option for med spas that want to give patients a convenient pre-visit assessment without requiring an in-clinic appointment. Most states now permit virtual good faith exams if specific conditions are met. No state universally prohibits them, though requirements vary considerably.

Pabau supports telehealth consultations that capture GFE data directly within the patient record, which means the documentation from a virtual assessment lives in the same system as the treatment record. That matters for audit trail integrity. For telehealth GFE delivery using external platforms, check out our guide to telehealth platforms for clinics.

Core conditions that make a telehealth GFE valid in most states:

• The provider holds a current license in the patient’s state (not just the clinic’s state)
• The platform meets minimum security and privacy standards (HIPAA-compliant video)
• The patient provides documented informed consent to receive a telehealth evaluation
• The provider can conduct a meaningful clinical assessment via video (adequate lighting, patient cooperation, real-time audio)
• A complete GFE record is generated and stored, identical in content to an in-person exam

Where telehealth GFEs get practices into trouble: using asynchronous messaging (text or email) as a substitute for a real-time evaluation, or having a provider in one state evaluate a patient in a state where that provider isn’t licensed. Both are common shortcuts that state boards treat as non-compliance.

Good faith exam documentation: what your med spa must keep on file

A GFE that wasn’t documented didn’t happen. State boards treat documentation gaps as compliance failures regardless of whether the clinical exam was actually performed. Your HIPAA compliance obligations for med spas extend to GFE records, which must be stored securely and retained for the period your state mandates (typically five to seven years, with some states requiring longer retention for records involving minors).

Required documentation for every GFE:

• Provider credentials on file: Full name, license type, license number, and issuing state
• Patient medical history: Completed and dated, with patient signature confirming accuracy
• Medications and allergy list: Current at time of exam
• Contraindication notes: Explicit statement of whether contraindications were identified and how they affect eligibility
• Signed informed consent: Patient’s written consent to the treatment following GFE disclosure
• Treatment plan summary: What was agreed, at what dosage/volume, and by which provider
• GFE date, time, and provider signature: Electronic signatures are legally valid in most states if the system creates a tamper-evident audit trail

Using digital intake forms that feed directly into a patient’s clinical record eliminates the transcription errors and filing delays that create documentation gaps. Paper forms that sit in a folder are also harder to produce quickly during an inspection.

Consequences of skipping the good faith exam

Med spas that bypass GFE requirements don’t just face administrative penalties. The consequences operate on multiple legal tracks simultaneously, and they escalate quickly once a complaint is filed.

• State medical board investigation: Any patient complaint or adverse event triggers a review. Missing GFE documentation immediately converts an investigation into a probable violation finding.
• License suspension or revocation: For the medical director or supervising physician, a sustained violation can end their ability to practice. This shuts down the entire med spa’s ability to offer prescription treatments.
• Civil malpractice liability: If a patient suffers harm from a treatment for which they weren’t properly screened, the absence of a GFE is direct evidence of negligence. Juries respond predictably to that fact.
• Criminal exposure: Administering prescription drugs without proper physician oversight can constitute unlicensed practice of medicine in some states, which is a criminal offense.

The management structure for med spas matters here too. In MSO arrangements where business management is separated from clinical operations, both entities can face consequences if GFE requirements aren’t clearly assigned and executed within the clinical side of the structure.

How med spa software streamlines good faith exam compliance

This is the area competitors don’t address, and it’s where med spas lose the most time. Manually tracking which patients need GFEs, chasing paper forms, and maintaining a compliant record across a busy schedule creates administrative load that scales badly when you’re running multiple providers or locations.

Pabau’s medical spa software handles GFE documentation as part of the standard patient intake workflow, not as a separate system you have to remember to use. When a new patient books, the intake sequence captures medical history, medications, allergies, and consent forms before they arrive. That data flows into the patient record that the provider reviews and signs off on during the GFE itself.

Key workflow advantages for good faith exam med spa compliance:

• Automated intake sequences: New patient bookings trigger the GFE intake form automatically, so nothing falls through the scheduling cracks.
• Provider credential storage: License numbers, types, and states are stored in the system and linked to every GFE record they sign.
• Electronic signatures with timestamps: Every GFE record carries a tamper-evident signature, date, and time, creating the audit trail state boards expect to see.
• Triggered re-evaluation flags: When a patient updates their medical history with a new medication or diagnosis, the system can flag that a new GFE may be needed before the next treatment.

Using compliance management tools built into your practice management system means GFE documentation is never separated from the treatment record. There’s no export step, no separate folder, and no lag between the exam and the record. That single-system approach is what makes audits manageable rather than panicked.

See how Pabau handles GFE compliance end to end

Pabau automates new patient intake, captures GFE documentation, stores provider credentials, and creates a timestamped audit trail. Book a demo to see how it works for your med spa.

Book a demo

Conclusion

Good faith exam compliance is one of the areas where med spas either build a defensible practice or accumulate invisible risk. The clinical act itself takes 15 minutes. The documentation behind it is what protects your license, your medical director’s credentials, and your business from the consequences of a single complaint.

Pabau’s digital forms and automated patient intake workflows keep GFE documentation in the same place as every other patient record, so nothing is missing when an inspector asks for it. If you want to see how that works in practice for your specific setup, book a demo with the team.

Continue your research

Need a compliance checklist for your entire med spa operation? Medical spa compliance checklist covers the full regulatory landscape beyond GFEs.

Wondering whether your practice needs HIPAA documentation protocols? HIPAA compliance for medical offices outlines the documentation requirements that apply to med spas.

Planning to open a med spa or add a location? How to start a med spa covers licensing, staffing, and compliance setup from the beginning.

Frequently Asked Questions