Find the gaps. Fix what matters. Keep it in line.
A new kind of compliance partner for medical spas.
Integrated compliance assessment — clinical, administrative, operational, privacy and security — built and maintained by a physician and a security practitioner working jointly on every engagement. We work for you, not the regulator: what we find is confidentially yours, and we help you fix it. Not a template pack. The work, done.
MedSpa Compliance
What we review
Verity looks beyond your four walls to evaluate how care is actually delivered.
- Licensure, scope & delegation
- Facility, room set-up & site readiness
- Credentialing, training & competency
- Medical director oversight & standing orders
- Laser, IPL & energy-device safety
- Medication storage, logs & expiration dates
- Emergency preparedness & adverse-event response
- Infection prevention & environmental safety
- Consent, charting & documentation
- Policies, procedures & corrective actions
- HIPAA compliance
- Cybersecurity risk
Two practice areas. One method.
Clinical care and patient data, on one file.
Physician-led · Chief Medical Officer
Clinical & Medical Compliance
- Licensure and service-by-service scope of practice
- Credentialing, training and competency
- Medical director oversight and standing orders
- Laser, IPL and energy-device safety
- Medication and product management
- Emergency preparedness and infection prevention
- Charting, informed consent and quality review
Chief Compliance Officer
Privacy, Security & State Law
- HIPAA Privacy, Security and Breach Notification Rules
- Security risk analysis
- Massachusetts WISP and other state privacy law
- Vendors and business associate agreements
- FTC advertising and Health Breach Notification
- Tracking technology and PCI DSS for deposits
- Incident response and breach decisions
Take either on its own, or both together. The same three steps apply.
What we do
Assess. Remediate. Oversee.
Step 1 · Fixed fee
Assessment
A scored, evidence-based baseline — a physician-led clinical audit, a HIPAA and state-law review, or both — every gap ranked by priority and costed to fix.
Assessments →Step 2 · By component
Remediation
The missing protocols, standing orders, consents, policies, risk analysis, vendor agreements, emergency and incident plans, and training — written for your practice and adopted by it.
Remediation →Step 3 · Monthly retainer
MedSpa Compliance Officer
A named compliance executive of record, with physician-led clinical oversight, who runs the program, the calendar and the reviews — and picks up when something happens.
vCCO →From first email to steady state.
Inquiry
A 30-minute scoping call. We score your practice in front of you and put a fixed fee in writing within a day.
Assess
Two to four weeks. An on-site clinical walk-through, a scored workbook, a ranked report and a costed plan, read out to the owner.
Remediate
Six to twelve weeks, in waves. We write what is missing; you adopt it; we keep the evidence.
Oversee
Monthly. Your MedSpa Compliance Officer runs the recurring work, clinical reviews included, tracks changes in your states and answers the phone.
Two industries. One file.
The problem is split in two. We cover both sides, and the middle.
Compliance for this sector comes from two industries that do not speak to each other.
One side
Trade associations, law firms and aesthetics consultants cover scope of practice, delegation, protocols and consent.
The other
IT providers and compliance software cover HIPAA, risk analysis and vendor agreements.
Verity was built to be both: our Chief Medical Officer leads the clinical side, our Chief Compliance Officer the privacy and security side, and every finding is cross-reviewed.
Everything below sits on the seam
Three regulators, one iPhone
Before-and-after photos on a personal phone: a consent question, a marketing-substantiation question, and protected health information in a consumer cloud account. No owner.
The booking page that took a deposit
That quietly made you a card-accepting merchant, with payment-page and scanning obligations nobody mentioned when the page went up.
The pixel on your treatment pages
Federal guidance on tracking technologies was partly vacated in June 2024, and the FTC's amended Health Breach Notification Rule took effect the same year. The rules moved. Most treatment pages did not.
AHA v. Becerra, N.D. Tex., Jun 2024 · 16 CFR Part 318The standing order nobody re-signed
An injector working from an order that lapsed last spring, for a product the practice no longer stocks. The treatment was fine. The authority for it was not, and that is the first thing an inspector asks for.
The occlusion at 9 p.m.
A vascular occlusion is a clinical emergency first: hyaluronidase within reach, a written protocol, a trained response. Then it is a chart entry, an adverse-event review, and photos texted to a personal phone.
The laser nobody owns
A device bought used, no service record, eyewear for the wrong wavelength, and operator training that lives in a sales rep’s email. Device safety, credentialing and vendor records, all at once.
87of 223 inspected
A state regulator inspected 223 med spas. It cited 87 of them.
New York's Department of State, working with the Department of Health and the State Education Department, announced the results of a statewide sweep on 8 January 2026 — a 39% citation rate, for issues including the unlawful practice of medicine. Inspectors found expired and suspected counterfeit products, controlled substances, used needles, and unlicensed individuals performing medical services.
Massachusetts is not New York. But the enforcement question it answers — could this practice show what it is allowed to do, and who is allowed to do it? — is the same one in every state.
That is why our clinical audit opens the drawers, the medication refrigerator and the emergency kit rather than relying on what staff tell us.
Source: NY Department of State, 8 Jan 2026 · claim verified 10 Sep 2026Why Verity
Built for practices without a compliance department.
A physician and a security practitioner
A physician on the clinical side; a security and privacy practitioner on the other. Every finding is looked at from both sides of the seam, and nothing leaves without a cross-review.
Cited and dated
Every claim we make carries its source and the date we last checked it.
What we will not do
- We are not a law firm and we do not give legal advice.
- We audit and strengthen your medical director’s oversight; we do not replace it, and we never take a fee for introducing one.
- We do not perform, supervise or delegate procedures, and our work creates no treatment relationship with your patients.
- We do not become your IT provider — doing both would destroy the independence of the risk analysis we sign.
- We take no commission on software, insurance or products.
- We do not certify compliance, because no consultant can. What we provide is a documented program and the evidence that it was maintained, which is what regulators and carriers actually evaluate.
Beauty you can see.
Standards you can prove.
Ducks in a row.
Find out where you actually stand.
A fixed-fee assessment — clinical, privacy and security, or both — tells you what you should have, what you do not, and what it costs to fix. Two to four weeks, four to six hours of your team's time.
Sources on this page. We cite everything we tell you, with the date we last checked it. If a claim here is out of date, it is a mistake — tell us and we will fix it.
New York Department of State, statewide med spa inspection sweep, 8 January 2026 — verified 10 Sep 2026 American Hospital Association v. Becerra, N.D. Tex., June 2024 (online tracking guidance partly vacated) — verified 10 Sep 2026 FTC Health Breach Notification Rule, 16 CFR Part 318, amended 2024 — verified 10 Sep 2026