GLP-1 Compliance for Medspas: What Owners Must Know Now

16 hours ago

4 min read

The GLP-1 gold rush funded two years of medspa growth. The enforcement wave right behind it is going to end the practices that treated it like a marketing play instead of a medical one.

Semaglutide and tirzepatide programs have been the single biggest revenue driver in the medspa industry since 2024, converting new patients at rates most owners have never seen from one service line. Roughly 40% of GLP-1 patients are brand new to the practice that treats them, and a meaningful share of those go on to become long-term aesthetics clients. That growth is real, and it is not over.

But 2026 is a different year for this category. The FDA has resolved the semaglutide and tirzepatide shortages that let telehealth-only operators treat compounding as a supply workaround instead of a clinical decision. The FDA, FTC, and FBI are now coordinating enforcement and treating medspas and weight-loss clinics as medical practices, not wellness brands. A joint New York City Council and state investigation closed out 2025 with 87 citations across hundreds of medspas. The opportunity in GLP-1 has not shrunk. What has shrunk is the room for operators who never built the clinical infrastructure to back it up.

For the compliance fundamentals every medspa needs regardless of service line, see our compliance blueprint. This post is the GLP-1-specific layer on top of that.

Why GLP-1 Enforcement Is Accelerating in 2026

Four things changed at once, and together they explain why GLP-1 is now the single most-watched category in medical aesthetics.

Shortage delistings closed the loophole. Once the FDA declared the semaglutide and tirzepatide shortages resolved, the legal basis for routine compounding as a supply-chain substitute went with it. Compounding is now a clinical decision that has to be justified per patient, not a standing workaround.
The legal ground is still moving. Court challenges from compounding pharmacy trade groups keep the status of compounded GLP-1s in flux. "The rules changed since I last checked" is not a defense, it is the exact problem regulators are targeting.
Enforcement is coordinated, not siloed. The FDA, FTC, and FBI are working from the same premise: a medspa running GLP-1 protocols is a medical practice first, and gets evaluated as one.
The citations are already public. The joint NYC Council and state investigation that closed 2025 issued 87 citations across hundreds of medspas, and telehealth-only prescribing with no patient-specific order was the single most common finding.

The Five Places Medspas Get GLP-1 Wrong

Almost every enforcement action traces back to one of five gaps. None of them are exotic.

All of them are fixable in a single review pass.

No patient-specific order. A template intake form filled out on a phone screen is not a documented exam. Every GLP-1 prescription needs a real, patient-specific clinical justification on file.
Unverified compounding sources. Sourcing from a pharmacy without a current, verified 503A or 503B license is one of the fastest ways to end up in a cease-and-desist letter.
Standing orders doing a medical director's job. A standing order that lets nurses or PAs prescribe or adjust GLP-1 protocols without real medical director oversight is scope creep, and it is exactly what CPOM enforcement is built to catch.
Marketing that oversells the drug. Guaranteed results, unapproved peptide claims, or language that blurs a compounded product with an FDA-approved one all draw regulator attention fast, and they are also just not true.
Consent and emergency protocols nobody has touched. If your GLP-1 consent form and emergency protocol have not been reviewed in the last year, they were written for a regulatory environment that no longer exists.

What Compliance-First GLP-1 Actually Looks Like

None of this requires exiting the category. It requires treating it like the medical service line it is.

A patient-specific order backed by a documented exam and medical history for every GLP-1 patient, not a template
A medical director who actively reviews protocols on a real schedule, not a name on a wall
Compounding sourced only from licensed 503A or 503B pharmacies, with the license verified in writing and refreshed periodically
Consent forms that name the real risks, side effects, and exactly what happens in an adverse event
Every piece of GLP-1 marketing copy reviewed against your state's advertising rules and current FTC guidance before it goes out, especially anything implying guaranteed results

The Business Case: Compliance Is Now the Competitive Advantage

2026 is on pace to be the biggest M&A year on record for medspas, with private-equity-backed platforms moving into recapitalization cycles and over 90% of medspas still independently owned. Buyers doing due diligence on a potential acquisition are reading GLP-1 protocols line by line, and a clean file is worth real money. We cover how that shows up in a practice's number in our 2026 valuation guide.

The retention math points the same direction. Those new-to-practice GLP-1 patients only convert into long-term, cross-sell aesthetics clients if the practice is still standing to keep them. Compliance is not overhead here. It is what buys the runway to capture the growth that GLP-1 already handed you.

A 30-Day Action Plan

Audit every active GLP-1 patient file for a documented, patient-specific order, not a template
Confirm your compounding pharmacy's current 503A or 503B license in writing this month
Sit down with your medical director and get real, dated sign-off on current protocols, not a standing signature from a year ago
Pull every live ad, email, and landing page touching GLP-1 and check it against your state's advertising rules and current FTC guidance
Update consent forms and emergency protocol documentation if either has not been touched in the last 12 months

GLP-1 is still one of the best revenue decisions a medspa can make in 2026. The practices that build the clinical infrastructure to match it are the ones that turn it into their highest-retention, highest-cross-sell service line. The ones that skip this review are the ones that show up in next year's citation list. Do the audit this month, not after a letter arrives.

If you need help with this, please reach out at carla@thebusinessofaesthetics.net. We are here to help.