Written by: Dr. Akash Chandawarkar, Board Certified Plastic Surgeon, Mirror Plastic Surgery | Last updated: September 9, 2026
Key Takeaways
- Medical spa peptide therapy must use licensed 503A or 503B compounding pharmacies, active physician supervision, and documented good-faith exams.
- Enforcement in 2026 has intensified, with multiple FDA warning-letter waves, pending PCAC recommendations, and state boards targeting paper medical directors and improper sourcing.
- Five core compliance pillars apply at federal and state levels: licensed sourcing, active medical-director oversight, good-faith exams, rigorous recordkeeping, and informed consent.
- Peptide-specific regulatory status changes frequently, so clinicians must verify current FDA bulks-list eligibility before prescribing any compounded peptide.
- Schedule your consultation at Mirror Plastic Surgery to receive compliant, physician-supervised peptide therapy tailored to your health goals.
Medical spas offering peptide therapy face a rapidly tightening regulatory landscape. This guide explains the compliance requirements that keep your practice safe and legal in 2026, from sourcing and supervision to recordkeeping and consent.
Why 2026 Is A Turning Point For Peptide Enforcement
The regulatory environment for compounded peptides has shifted more dramatically in 2026 than in any prior year. The FDA issued three major waves of enforcement against compounded GLP-1 marketing: roughly 80 warning letters and 40 untitled letters in September 2025, 30 warning letters in March 2026, and 25 warning letters in June 2026. The June 2026 wave focused on telehealth companies making false or misleading claims about compounded semaglutide, tirzepatide, and liraglutide, alleging violations of the FDCA misbranding provisions under Sections 502(a) and 502(bb).
At the July 23–24, 2026 Pharmacy Compounding Advisory Committee (PCAC) meeting, the committee recommended six of seven reviewed peptides (BPC-157, KPV, TB-500, MOTS-c, Semax, and Epitalon) for inclusion on the Section 503A bulks list and rejected DSIP (emideltide). All votes went against the FDA review staff’s position that none should be added. However, a PCAC recommendation remains advisory and non-binding, so it does not equal FDA approval or make these peptides legal to compound today, because formal FDA notice-and-comment rulemaking typically takes 12 months or more.
The FDA removed tirzepatide from the drug shortage list on October 2, 2024 (reaffirmed December 19, 2024) and semaglutide on February 21, 2025, which ended shortage-based authorization for compounding these substances under both pathways. On April 30, 2026, the FDA proposed formally excluding semaglutide, tirzepatide, and liraglutide from the 503B bulks list, citing no clinical need for outsourcing facilities to compound these drugs from bulk API. In 2026, state medical boards and related agencies in Florida, California, Texas, Ohio, and New York increased investigations into med spa peptide programs. They now focus on paper medical directors, missing good-faith exams, and improper sourcing, using different mechanisms by state, and a coordinated multi-state initiative involving these states launched in May 2026.
The Core Regulatory Framework: Federal And State Requirements
Sections 503A and 503B were added by the Drug Quality and Security Act of 2013 after the 2012 New England Compounding Center meningitis outbreak, which killed 64 people and sickened 753 due to contaminated compounded methylprednisolone acetate. State medical boards govern the practice of medicine, including physician supervision, delegation, and patient relationships, while state boards of pharmacy oversee 503A pharmacies. Medical spas must follow both federal pharmacy law and state medical board rules at the same time.
When clinics use peptides to diagnose, treat, mitigate, or prevent a condition, the FDA regulates them as drugs regardless of marketing language, and that use counts as the practice of medicine. A compliant peptide program rests on five foundational elements:
- Sourcing from licensed 503A/503B pharmacies
- Active medical director supervision
- Documented good-faith exams
- Rigorous recordkeeping and inventory controls
- Informed consent for unapproved peptides
Sourcing Peptides: The 503A Vs. 503B Rule
Under 21 U.S.C. 353a, a licensed pharmacist in a state-licensed pharmacy or federal facility, or a licensed physician, must perform compounding for an identified individual patient based on a valid prescription order. Roughly 7,500 503A compounding pharmacies operate nationwide, compared with only 93 registered 503B outsourcing facilities as of July 2025.
503B facilities undergo mandatory FDA inspections at least every two years and must test every batch for sterility, endotoxins, and potency before release, while state boards of pharmacy primarily inspect 503A pharmacies. Only 503B outsourcing facilities may legally supply medications for office use without a patient-specific prescription, and 503A pharmacies cannot legally supply office stock.
On April 22, 2026, the FDA removed twelve peptide bulk substances from Category 2 of the 503A bulks list after nominators withdrew their submissions, and this removal did not authorize compounding under Section 503A. The FDA’s published position states clearly that “Removal from Category 2 does not render these bulk drug substances eligible for compounding under section 503A.”
To keep your sourcing compliant, follow these five steps:
- Verify the pharmacy’s license with the state board of pharmacy and confirm 503A or 503B status.
- For 503B facilities, confirm FDA registration and review inspection history for Form 483s.
- Request certificates of analysis and batch testing documentation for every peptide lot.
- Confirm the pharmacy compounds only peptides that remain legally eligible under current FDA bulks-list status.
- Document all sourcing decisions in writing, including the clinical rationale for compounded versus FDA-approved alternatives.
“Research grade” APIs are not acceptable for human use outside a clinical trial and create significant safety and compliance risk. This risk exists because the FDA evaluates intended use through a totality-of-context inquiry that examines labeling, marketing materials, customer-base composition, bundled-product offerings, community-forum participation, and distribution circumstances. A substance sold with implicit or explicit therapeutic-use signaling falls into the unapproved-new-drug category regardless of disclaimer text.
Once you have secured a compliant source for your peptides, the next pillar involves proper medical oversight.
Medical Director Supervision: What “Active” Really Means
In most states, a medical spa that administers prescription peptides must have a licensed physician serving as medical director. This physician must establish protocols, supervise clinical staff, review patient charts, and remain reachable for clinical questions. State medical boards frequently target nominal medical directors who sign paperwork but never appear on-site.
Active medical director supervision for peptide therapy clinics includes approving standing orders and treatment protocols, overseeing clinician onboarding, setting consultation and lab thresholds, reviewing adverse events, conducting quality audits, and supervising or collaborating with NPs and PAs where state law requires it.
State-specific rules add further layers. Florida Statute § 458.348 requires supervising physicians to maintain a primary practice location within 25 statutory miles or in the same or a contiguous county as the clinic and bars out-of-state medical directors for Florida med spas. California requires a supervising physician who genuinely directs care, and SB 351 sharpened scrutiny of paper medical director arrangements. Texas generally prohibits the corporate practice of medicine, and a “medical director” who lends a signature but never reviews protocols, evaluates patients, or remains reachable in an emergency does not satisfy Texas Medical Board rules.
The Good-Faith Exam Requirement
A valid good-faith patient examination for peptide therapy is a real clinical encounter, conducted in person or via synchronous telehealth, that a licensed provider completes before a patient starts a peptide protocol. The provider documents medical history, contraindications, and prescribing rationale before the first vial or injection ships.
A wellness intake questionnaire that the patient completes alone does not satisfy a good-faith exam requirement in states that mandate a licensed exam, because the exam must involve a licensed provider’s clinical assessment. The exam must also be peptide-specific. GLP-1 candidates require screening for medullary thyroid cancer and MEN2 family history, and immune-modulating peptides require assessment of active infections or autoimmune flares.
Chart notes must document the date, method (in-person or synchronous telehealth), exam duration, contraindications reviewed by name, the peptide, dose, and route prescribed with rationale, provider signature and license number, and a follow-up interval. Adding a new peptide to a patient’s protocol resets the good-faith exam clock in many states, because each addition changes the contraindication profile and requires a fresh exam before the first dose of the new peptide.
Recordkeeping And Inventory Controls
Patient-record retention periods depend on state law: Florida requires 5 years, Texas 7 years, New York 6 years, and California 7 years for adult records. HIPAA compliance records must be retained for six years from the date they were created or last in effect, under 45 CFR 164.316(b)(2)(i).
To keep inventory compliant, clinics must track every product from intake to administration. This includes logging each vial with its lot number and expiration date at intake, monitoring temperature-controlled storage, documenting each administration with date, dose, route, site, and administrator, retaining all sourcing documentation, and conducting regular reconciliations so records match physical stock.
Informed Consent For Unapproved Peptides
Most peptides used in medical spas are not FDA-approved for their intended uses. A compliant informed consent for peptide therapy must list the peptide name, source (compounding pharmacy name and license number), lot number, route of administration, and dosage, and must clearly state that the peptide is not FDA-approved for any indication and has not completed human clinical trials.
Informed consent must also address:
- Expected benefits and known risks, including allergic reactions, infection at the injection site, and unknown long-term effects
- Alternative therapies considered
- The documented medical indication supporting the prescription
- For GLP-1s, the boxed warning on thyroid C-cell tumors, common GI effects, and the likelihood of weight regain after discontinuation
Informed consent must be written, signed by the patient, and maintained in the medical record, and clinics must refresh it whenever the treatment protocol changes, when the regulatory status of the peptide changes, or at least annually for ongoing therapy. Verbal discussions and checkbox-only forms rarely withstand board investigations.
State-By-State Variations: Key Examples
State requirements vary significantly, so clinics must understand the rules in their own jurisdiction before launching peptide services. In Florida, med spas performing medical procedures generally require a licensed medical director, and most also need either an AHCA Health Care Clinic license under § 400.9905 or a written AHCA exemption determination on file. Operating an unlicensed clinic when one is required is a third-degree felony under § 400.9935. SB 1728 / HB 1429, the Medical Spa Prescription Drug Oversight Act that would have consolidated Florida med-spa regulation into a single licensure regime, died in committee on March 13, 2026, and a similar bill is widely expected in the 2027 session.
California takes a different approach and requires med spas offering medical procedures to be owned through a physician-controlled professional corporation, with non-physician investors limited to an MSO role that must stay out of clinical decisions. SB 351, effective January 1, 2026, tightened these corporate-practice-of-medicine rules, and RNs can perform delegated treatments only after a good-faith exam by a physician, NP, or PA and under a patient-specific order, while licensed vocational nurses, medical assistants, and estheticians cannot inject under any circumstances.
New York imposes specific documentation requirements for telehealth prescribing of compounded medications as of May 2025, and out-of-state compounding pharmacies must register with the New York State Board of Pharmacy before shipping to New York patients. Clinics should contact their state medical board and board of pharmacy directly before launching or expanding peptide services and should consult healthcare regulatory counsel.
Peptide-By-Peptide Regulatory Status
This table reflects the regulatory landscape as of September 2026. Status changes frequently, so always verify current FDA bulks-list status before prescribing.
The compliance pillars above, including licensed sourcing, active supervision, good-faith exams, and informed consent, guide how a safe peptide program operates in practice. Mirror Plastic Surgery applies each of these safeguards in its own protocols.
How Mirror Plastic Surgery Ensures Compliance And Safety
Mirror Plastic Surgery’s peptide program aligns with the compliance architecture described throughout this guide. Every protocol is designed and supervised by a board-certified plastic surgeon whose training spans MIT, Harvard Medical School, Johns Hopkins, and Stanford’s Biodesign Innovation Fellowship. The physician remains actively involved, personally reviewing each patient’s labs, designing individualized protocols, and staying available via text or scheduled telemedicine appointments for ongoing support.
Mirror Plastic Surgery sources peptides from reputable providers that perform rigorous batch testing. Every product is verified for purity, quality, and accurate dosage, which reduces the risks associated with unregulated online suppliers. New patients receive an in-depth consultation that may include lab panels covering thyroid, liver, kidney, diabetes markers, and hormone levels to identify root causes and rule out contraindications before any peptide is prescribed.
Mirror Plastic Surgery offers advanced peptide therapies for inflammation, autoimmune conditions, weight management, and anti-aging concerns. Book an appointment with Ellie to explore how tailored peptide protocols can help you pursue your health and wellness goals safely and effectively.1
Frequently Asked Questions
Can A Med Spa Sell Peptides Legally?
Yes, under strict conditions. Peptides must be sourced from licensed 503A or 503B compounding pharmacies based on valid patient-specific prescriptions. Medical spas cannot purchase from research-grade suppliers, overseas vendors, or gray-market channels, and they cannot maintain 503A-compounded office stock for use across multiple patients. The medical spa must operate under active medical director supervision with documented good-faith exams and signed informed consent for every patient. Any peptide used therapeutically, regardless of labeling, is regulated as a drug by the FDA and counts as the practice of medicine, which triggers both federal pharmacy law and state medical board oversight.
What Are The New Peptide Regulations For 2026?
Several significant regulatory changes took effect in 2026. As noted earlier, the FDA removed 12 peptides from Category 2 of the 503A bulks list in April 2026 after nominations were withdrawn, leaving those substances in regulatory limbo. The Pharmacy Compounding Advisory Committee recommended six peptides (BPC-157, KPV, TB-500, MOTS-c, Semax, and Epitalon) for the 503A bulks list in July 2026, but formal rulemaking remains pending and typically takes 12 to 36 months. The FDA also proposed excluding semaglutide, tirzepatide, and liraglutide from the 503B bulks list in April 2026 and issued three major waves of warning letters targeting misleading GLP-1 marketing, as detailed above. GHK-Cu in topical form moved to Category 1 in May 2026, making it eligible for compounding, while injectable GHK-Cu remains off-limits pending a separate PCAC review expected in early 2027.
Do I Need A Medical Director To Offer Peptide Therapy?
Yes. In most states, a medical spa offering prescription peptides must have a licensed physician serving as medical director who actively supervises the program by setting protocols, reviewing charts, and remaining available for clinical guidance. Active supervision means the physician genuinely directs the clinical program, approves standing orders, oversees clinician onboarding, reviews patient charts at required intervals, and conducts quality audits. Paper medical directors who sign contracts but never review charts or see patients are a primary enforcement target for state medical boards in Florida, California, Texas, and New York. State-specific rules add further requirements, such as Florida’s 25-mile practice-location rule, California’s physician-controlled professional corporations, and Texas’s physician-only ownership with hands-on delegation protocols reviewed annually.
What Are The Risks Of Buying Peptides Online Without Medical Supervision?
Buying peptides from online retailers without medical supervision creates significant legal and health risks. Many products lack third-party testing for quality, purity, or accurate dosing, and may contain contaminants, incorrect active ingredient concentrations, or harmful substances. Using research-grade peptides labeled “not for human consumption” is illegal for patient administration, because the FDA’s intended-use analysis examines the totality of circumstances rather than relying on label disclaimers alone. From a legal standpoint, administering pept
1 Results may vary from person to person. Editorial content, before and after images, and patient testimonials do not constitute a guarantee of specific results.
Peptide therapy is intended for wellness and optimization purposes and is not prescribed to diagnose, treat, cure, or prevent disease unless specifically stated. Many peptides are not FDA-approved and may be used off-label. Some have limited long-term safety data, with a potential for unknown risks, complications, or desensitization with prolonged use.
