Good Faith Exam for Med Spas: Requirements and Documentation

Found our content helpful?

Key takeaways

A good faith exam (GFE) is a formal medical evaluation by a licensed provider, required before prescription aesthetic treatments like injectables.

Three triggers require a GFE: a new patient, a new treatment category, and a significant change in health status.

RNs and estheticians cannot perform GFEs. The exam has to come from a physician, NP, or PA.

A telehealth GFE is valid in most states, provided the provider is licensed where the patient is.

Practice management software like Pabau keeps GFE documentation, consent, and patient history in one audit-ready record.

A good faith exam is the medical evaluation that has to happen before a med spa administers injectables. It is what makes the treatment lawful, and it is the first record a state board asks to see. Without one, the practice is exposed to license action, malpractice claims, and a board investigation.

This guide covers what a GFE is, when you need one, who can perform it, and how to keep the documentation audit-ready. The detail maps to what state boards check, whether you are opening a first location or tightening an existing process.

What is a good faith exam at a med spa?

A good faith exam is a formal medical evaluation performed by a licensed healthcare provider before a patient receives a prescription aesthetic treatment. A sales consultation does not count, and neither does a quick intake chat. The provider has to reach a clinical judgment on whether this patient is suitable for the treatment requested.

The American Med Spa Association (AmSpa) defines a GFE as a medical evaluation completed before a patient receives a treatment for the first time. Once that exam is on file, you do not repeat it at every visit. That holds as long as the patient’s health status and treatment category stay the same.

The distinction from a general consultation matters legally. A consultation is advisory. A GFE creates a documented clinical record that a licensed provider assessed the patient and found them eligible for a specific treatment. Without one, administering prescription injectables puts the practice outside the law in most states.

Why state law requires the exam

Neurotoxins and dermal fillers are prescription drugs. Administering them without medical oversight creates regulatory exposure for the whole business. Your med spa compliance checklist should treat the GFE as a gatekeeping step rather than an optional add-on.

Three legal rationales drive the requirement:

• Patient safety: Prescription treatments carry contraindication risks. Pregnancy, autoimmune conditions, and certain medications rule some patients out. A licensed provider catches those before anyone picks up a needle.
• Prescriber accountability: State medical boards require a qualified provider to establish a patient-provider relationship before ordering or administering prescription drugs. The GFE creates that relationship on paper.
• Liability protection: A documented GFE is evidence that your practice followed the standard of care. Without one, an adverse event is very hard to defend.

Penalties range from fines and corrective action plans to license revocation and criminal exposure, depending on the state. Civil liability runs on its own track. A lawsuit can move forward while a medical board investigation is still open.

When is a good faith exam required?

A GFE does not reset at every appointment. It triggers on three clinical events. Knowing the difference saves your team unnecessary friction and keeps you covered on the visits that matter.

The health status change trigger is where practices get caught out. A returning patient who started a blood thinner since their last visit needs a fresh GFE before their next filler appointment. So does a patient newly diagnosed with a coagulation disorder, even after a dozen identical treatments.

Who can perform a good faith exam?

A GFE has to be performed by a provider who holds prescriptive authority. In most states that means a physician, a nurse practitioner, or a physician assistant. That rules out a large share of the staff you might expect to handle it.

Qualified providers in most states include:

• Physicians (MD or DO): Qualified in every state. The exam can be in person or, where state law permits, by telehealth.
• Nurse practitioners (NP/APRN): Qualified in most states with full or collaborative prescriptive authority. Scope varies a lot, so check your state’s Nurse Practice Act before you assign GFEs to an NP.
• Physician assistants (PA): Qualified in most states under physician supervision or a collaborative agreement. Whether a PA can perform a GFE independently depends on state law.

Registered nurses, licensed practical nurses, medical assistants, and estheticians cannot perform a GFE. These roles carry no prescriptive authority, however skilled the clinician is. Delegating the exam to them under a supervising physician’s name creates a false record and multiplies your legal exposure.

The split between those two groups is worth pinning to the schedule before anyone books a first-time injectable patient.

For practices without a physician on staff, hiring a medical director is the standard fix. Your medical director can perform GFEs directly, or supervise the NPs and PAs who carry them out, depending on state rules.

What the exam has to include

A complete GFE for aesthetic treatments covers six clinical areas. Each one produces documentation that goes into the patient record. Leave one out and an attorney or state investigator will find it.

• Medical history review: Current and past diagnoses, surgeries, and hospitalizations. Focus on conditions that affect healing, clotting, or immune response.
• Current medications list: Anticoagulants, immunosuppressants, and some supplements such as fish oil and vitamin E need a dose adjustment or rule the treatment out.
• Allergy screening: Documented allergy history relevant to treatment materials. That includes lidocaine, present in many fillers, and the bacterial proteins in neurotoxins.
• Contraindication assessment: The provider documents whether known contraindications are present, and how they affect treatment eligibility.
• Treatment goals discussion: The patient’s requested outcomes, plus the provider’s assessment of realistic results and risks.
• Eligibility determination and signature: The provider’s written or electronic decision on whether the patient is a suitable candidate. Their credential and signature go on file.

Most GFEs run 7 to 15 minutes once the intake form has done the groundwork. That is a small time cost against the protection the record gives you.

State-by-state requirements: a summary

State rules vary considerably, so the table below covers the largest med spa markets. Always verify against your state medical board and current Nurse Practice Act before you make staffing or workflow decisions.

California and Texas have both revised their rules in recent years. Check the current California med spa licensing position before you rely on any general summary.

All state requirements are subject to change. The American Med Spa Association publishes state-specific compliance updates and is the most reliable ongoing resource for regulatory changes.

Telehealth exams: what is permitted

Most states now permit a virtual good faith exam when specific conditions are met. No state bans them outright, though the conditions vary considerably. That makes telehealth a practical way to run a pre-visit assessment without an in-person appointment.

Pabau supports telehealth consultations that capture GFE data directly in the patient record. The documentation from a virtual assessment then sits in the same system as the treatment record, which keeps the audit trail intact.

Core conditions that make a telehealth GFE valid in most states:

• The provider holds a current license in the patient’s state, not just the practice’s state
• The platform meets minimum security and privacy standards (HIPAA-compliant video)
• The patient provides documented informed consent to receive a telehealth evaluation
• The provider can conduct a meaningful clinical assessment by video, with adequate lighting, patient cooperation, and live audio
• A complete GFE record is generated and stored, identical in content to an in-person exam

Two shortcuts get practices into trouble. The first is using asynchronous messaging, by text or email, in place of a live evaluation. The second is a provider in one state evaluating a patient in a state where they hold no license. State boards treat both as non-compliance.

Documentation your med spa must keep on file

A GFE that was not documented did not happen. State boards treat a missing record as a compliance failure, whether or not the exam took place. GFE records have to be stored securely and retained for the period your state mandates, typically five to seven years. Some states require longer retention for records involving minors.

Required documentation for every GFE:

• Provider credentials on file: Full name, license type, license number, and issuing state
• Patient medical history: Completed and dated, with a patient signature confirming accuracy
• Medications and allergy list: Current at the time of the exam
• Contraindication notes: An explicit statement of whether contraindications were identified, and how they affect eligibility
• Signed informed consent: The patient’s written consent to the treatment, following GFE disclosure
• Treatment plan summary: What was agreed, at what dosage or volume, and by which provider
• GFE date, time, and provider signature: Electronic signatures are legally valid in most states, provided the system creates a tamper-evident audit trail

Digital intake forms that feed straight into the clinical record remove the transcription errors and filing delays behind most missing documentation. A structured form also stops a provider improvising fields under time pressure. Our med spa consultation form gives you a layout you can adapt.

Consequences of skipping the exam

Med spas that bypass the GFE face more than administrative penalties. The consequences run on several legal tracks at once, and they escalate quickly once a complaint is filed.

• State medical board investigation: Any patient complaint or adverse event triggers a review. A missing GFE record turns that review into a probable violation finding.
• License suspension or revocation: For the medical director or supervising physician, a sustained violation can end their ability to practice. That shuts down the med spa’s prescription treatments entirely.
• Civil malpractice liability: If a patient is harmed by a treatment they were not properly screened for, the absent GFE is direct evidence of negligence. That is hard to argue against in front of a jury.
• Criminal exposure: Administering prescription drugs without proper physician oversight can count as unlicensed practice of medicine, which is a criminal offense in some states.

Business structure matters here too. In a management service organization (MSO) arrangement, business management sits apart from clinical operations. Both entities can face consequences, so GFE duties have to be assigned and executed on the clinical side.

How med spa software streamlines GFE compliance

Tracking which patients need a GFE, chasing paper forms, and keeping a compliant record across a busy schedule adds administrative load. That load scales badly once you are running several providers or more than one location.

Pabau’s medical spa software handles GFE documentation inside the standard patient intake workflow. You do not have to remember to open a second system.

When a new patient books, the intake sequence collects medical history, medications, allergies, and consent before they arrive. The provider reviews and signs that record during the exam itself.

Key workflow advantages for GFE compliance:

• Automated intake sequences: A new patient booking triggers the GFE intake form automatically, so no booking skips the form.
• Provider credential storage: License numbers, types, and issuing states sit in the system and attach to every GFE record that provider signs.
• Electronic signatures with timestamps: Every GFE record carries a tamper-evident signature, date, and time. That is the audit trail state boards expect to see.
• Triggered re-evaluation flags: When a patient adds a new medication or diagnosis, the system can flag that a fresh GFE may be needed.

Compliance tools built into your practice management system keep GFE documentation attached to the treatment record. There is no export step, no separate folder, and no lag between the exam and the record. That single-system approach is what makes an audit manageable.

See how Pabau handles GFE compliance end to end

Pabau automates new patient intake, captures GFE documentation, stores provider credentials, and creates a timestamped audit trail. Book a demo to see how it works for your med spa.

Book a demo

Conclusion

The exam itself runs 7 to 15 minutes. The record behind it is what protects your license, your medical director’s credentials, and the business when a complaint lands.

If your GFE process lives in a paper folder or a separate app, move it. The change that pays for itself is keeping the exam record in the same place as the treatment record. State rules will keep shifting, and a single system absorbs that better than a filing cabinet.

Pabau’s digital forms and automated intake keep GFE documentation alongside every other patient record, so nothing is missing when an inspector asks. Book a demo to see how that fits your own workflow and state rules.

Continue your research

Need a compliance checklist for the whole operation? Medical spa compliance checklist covers the wider regulatory picture beyond the good faith exam.

Not sure how HIPAA applies to a med spa? Do med spas have to be HIPAA compliant explains which records fall under the rules and how long to keep them.

Working out who owns clinical decisions in an MSO? MSO for med spas sets out how the business and clinical sides divide responsibility.

Operating in Texas? Texas med spa licensing laws covers supervision, delegation, and the state-specific paperwork.

Planning to open a med spa or add a location? How to start a med spa covers licensing, staffing, and compliance setup from day one.

Frequently asked questions