If you own a med spa in 2026, you've probably had the same conversation three times this month. A patient asks about semaglutide. Your injector wants to know if the program is still happening. Your medical director forwards you another email about compounding changes. And somewhere in your inbox is a message from your payment processor flagging a transaction.

This is the mess GLP-1 operators are living in right now. Patient interest is real. The regulatory picture keeps moving. Federal and state enforcement has picked up, and the gap between "my competitor is doing it" and "my attorney says we can do it" has never been wider.

What follows is an operator's guide, not a legal opinion. The goal is to give you a single reference you can bring to your medical director, your attorney, and your management team when deciding whether and how to offer GLP-1 services this year.

Short Answer: Can a Med Spa Offer GLP-1 Weight Loss in 2026?

In most states, yes. A med spa can offer semaglutide or tirzepatide in 2026 if it operates with the medical oversight your state requires, prescribing happens through a valid patient-provider relationship, drugs are sourced from an FDA-approved manufacturer or a properly licensed pharmacy, and marketing stays truthful and within the product's approved use.

The specifics depend heavily on your state. Compounded versions are the narrowest and riskiest path: shortage-era compounding of copies has ended, and what remains is patient-specific prescribing for a documented clinical need.

(Free download: Want a printable version of the pre-launch checklist and the marketing do and do-not list? Download the GLP-1 Med Spa Compliance Kit (PDF), or scroll to the checklist below.)

Where the Rules Stand Now

The FDA has declared the shortages of both drugs resolved, which ended the shortage-based permission to compound copies. A federal appeals court upheld those decisions in August 2026. FDA has proposed closing the last bulk-compounding route for outsourcing facilities. And 2026 brought new state-level oversight of med spas.

Here is the dated timeline worth knowing. Verify each item with primary sources before citing it in internal documents, because this space moves fast.

The practical point for operators: the compounded GLP-1 market that existed in 2023 and 2024 is not the market you're operating in now. If your program is still built on 2024 assumptions about sourcing, pricing, and marketing, it needs a refresh.

Sources: AmSpa compounded GLP-1 resources, FDA.gov drug shortage and compounding pages, published court filings.

Branded vs. Compounded: What Actually Changed

This is where most of the real risk sits. Branded Wegovy, Ozempic, Zepbound, and Mounjaro are FDA-approved finished products with full labeling and a defined supply chain. The list now includes the Wegovy pill, which FDA approved in December 2025 and which launched in early 2026. Compounded semaglutide and tirzepatide are not FDA-approved drugs. They are preparations made by a pharmacy, and the legal basis for making them has narrowed significantly since the shortages resolved.

A Few Things Worth Being Blunt About

Compounded is not "generic." There are no FDA-approved generic versions of semaglutide or tirzepatide on the US market, and generics are not expected until the 2030s. Connecticut's attorney general made this point directly in May 2026. Calling compounded product "generic semaglutide" in marketing or patient conversations is inaccurate and has drawn action from regulators in several states.

Sourcing matters more than price. The cheapest pharmacy is almost never the right answer. A pharmacy that sells to anyone with a credit card is a red flag. Patient-specific prescribing is the rule. 503A compounding is built around an identified patient with a valid prescription. "Office stock" compounded GLP-1s for walk-in administration do not fit that model and carry significantly more risk.

Before you work with any compounding pharmacy, run through a short vetting list:

1. State board of pharmacy license check: Look up the pharmacy in the licensing database of both its home state and your state. Confirm the license is active and in good standing.
2. 503A or 503B status: Know whether they operate as a 503A pharmacy or a 503B outsourcing facility, and what that status does and does not permit for these drugs.
3. Recent inspection and warning letter history: FDA posts warning letters publicly. A pharmacy with recent action against it is not your partner.
4. Source of the active ingredient: Ask where they obtain the API, and get it in writing. Reputable pharmacies won't flinch at this question.
5. Insurance and indemnification: Confirm their product liability coverage and what their agreement says about indemnifying your practice if something goes wrong.
6. Written protocols for your clinicians: The pharmacy should be able to support your prescribers with current protocols, not the other way around.

If a pharmacy can't produce clean answers to those six items in a day, that's your answer.

Who Can Prescribe, Supervise, and Administer?

This varies more by state than almost any other operational question in med spa work, and 2026 has added fresh scrutiny.

Most states require physician involvement in med spa operations, either through ownership of the medical practice or through a medical director or supervising physician who is responsible for the standard of care. The exact model varies. Nurse practitioners and physician assistants may prescribe within their state scope, often under a collaborative or supervisory arrangement, though some states give nurse practitioners broader authority. Registered nurses typically administer but do not prescribe. Aestheticians and estheticians do not prescribe or inject prescription medications.

The Complications In 2026

Ownership and MSO scrutiny is growing, but it is state-specific. Corporate practice of medicine rules vary widely. Some states restrict who may own a clinical practice, while others, including Arizona and Florida, are comparatively permissive. California's SB 351, effective January 1, 2026, prohibits private equity groups and hedge funds, including through management services organizations, from interfering with physicians' clinical decisions, and voids certain contract terms in management agreements.

A federal bill introduced in September 2026, the Stop Corporate Takeovers of Physicians Act of 2026, would set federal ownership and MSO requirements for medical practices. It has not been enacted.

The practical move is to have your healthcare attorney review your current medical director agreement, scope-of-practice policies, and MSO structure against your state's current position. If that document hasn't been reviewed in the past year, it may be out of date.

(Sources: Indiana SB 282 summaries from Holland & Knight and Lengea; the Florida Senate bill page for SB 1728; AmSpa legal updates; California SB 351 summaries from Foley & Lardner and Cooley.)

What You Can and Can't Say in Marketing

Enforcement here is real and growing. The FDA issued repeated waves of warning letters over compounded GLP-1 marketing, including 30 in March 2026 and 25 in June 2026, mostly to telehealth companies. The recurring problems: implying a compounded product is FDA-approved, claiming it has the same active ingredient as a branded drug in a way that suggests equivalence, and using branding that hides who is actually compounding the product.

The common thread is accuracy about what the product is. A working do and don't list:

Social media is where marketing problems tend to start. The reel that works for growth can be the same reel that draws regulator attention. Have one person on your team responsible for reviewing marketing before it goes out, and give them actual veto authority.

(Sources: Ohio Attorney General news release (April 16, 2025), Connecticut Attorney General press releases and coverage of the December 2025 cease-and-desist letters, Foley & Lardner coverage of the Connecticut action, FDA press announcements and law-firm summaries of the March and June 2026 warning letter waves.)

Payments and Insurance

Here's a line in your launch plan most people miss until they get an email from their processor: many payment processors restrict or refuse prescription medication sales. Stripe's own restricted-business FAQ, for example, says payments for prescription medication generally need to happen outside Stripe. If your booking or point-of-sale software includes built-in payments, ask which processor sits underneath your account.

Before you take a dollar for a GLP-1 program:

Ask your processor directly whether prescription weight-loss services are allowed on your account, and get the answer in writing. If your payments are built into your software, ask the software vendor too. Ask what their chargeback and reserve policies look like for this category. Have a backup plan. Processor policies can change, and a frozen account mid-launch is a bad time to look for a second option.

On insurance, call your carrier before you sell your first package. The question to ask isn't "do I have liability coverage," it's "does my current policy specifically cover prescription weight-loss services and GLP-1 medication administration?" Those are not the same question. If your policy predates your GLP-1 program, it may not contemplate it.

For a deeper look at the broader insurance side of running a med spa or spa, see our guide to salon and spa insurance.

Running the Program Day to Day

Most of what goes wrong with GLP-1 programs isn't a dramatic enforcement moment. It's the quieter stuff. The intake form missing a key question. The follow-up that didn't happen. A staff member discussing dosing with a patient over social media DMs.

Think of GLP-1 as a care journey, not a transaction. A good program has these pieces, and if any one of them is weak the whole thing wobbles:

Intake and screening: A medical history that actually screens for the contraindications on the label. Not a checkbox form the patient breezes through in the waiting room.

Patient-provider relationship: A real evaluation by a prescriber, documented. Depending on your state, this can include a well-run telehealth visit, but it needs to be a visit, not a form. Informed consent: Written, specific to the medication being prescribed (branded or compounded), including a plain-language explanation of what compounded means if applicable.

Documentation: Medical-grade documentation in an EMR, not general booking-software notes. If you ever get audited or sued, the chart is the case. Follow-up cadence: Scheduled check-ins at defined intervals, with weight, side effects, labs where appropriate, and dose adjustments documented.

Adverse-event handling: A written protocol for what happens when a patient calls at 9pm reporting severe GI symptoms. Who takes the call, what gets escalated, what gets documented. Check whether your state has adverse-event reporting requirements, as Indiana's new law does for serious events.

HIPAA posture: If your practice is a HIPAA covered entity (confirm with counsel), your booking software, marketing platform, text-reminder tool, and DMs are all in scope, and state privacy laws may add requirements. Patient health information lives in more places than most operators realize.

Staff training: Everyone who touches the program, including front desk, needs training on what they can and can't say. "I'm not sure, let me have the provider call you" is a complete sentence.

Adjacent Services and Revenue

Patients who go through a GLP-1 program often develop new aesthetic concerns. McKinsey reports that skin laxity is the primary aesthetic concern for many GLP-1 patients, along with facial volume loss, and that roughly half of these patients had not considered aesthetics before their weight loss. The American Society of Plastic Surgeons' latest report does not establish a direct link between GLP-1 use and specific procedure increases, but surgeons report growing patient interest in skin laxity, volume loss, and excess skin after significant weight loss.

For med spas, that points to treatments such as skin tightening, biostimulators like Sculptra and Radiesse, microneedling with or without RF, body contouring, and facial filler for volume loss, depending on what is clinically appropriate.

Treat this as clinically appropriate care, not a bolt-on upsell. The patient who feels pushed into additional services during a weight-loss program is the patient who leaves a review you don't want.

A simple way to think about program economics, filled in with your own numbers:

(Sources: McKinsey, "GLP-1s are boosting demand for medical aesthetics"; American Med Spa Association coverage of the ASPS 2025 Statistics Report.)

Software That Actually Supports a GLP-1 Program

Running a compliant program is a documentation problem, a scheduling problem, and a communications problem all at once. The software stack matters.

A few categories to think about, independent of any specific vendor:

Electronic medical records: Not spa booking software with a notes field. An actual EMR that supports structured documentation, e-prescribing where applicable, and audit trails. HIPAA-compliant patient communication: Secure messaging and reminder tools with a signed BAA. If your current text platform doesn't offer one, that's a gap. Consent and intake management: Digital consent that time-stamps and stores the signed document against the patient record. Scheduling and follow-up automation: The follow-up cadence your clinical protocol requires should be automated, not left to someone remembering. Inventory and lot tracking: For both branded and compounded products, you want to be able to answer "which patients received which lot" within minutes, not days.

The selection criteria that matter more than feature lists: does the vendor sign a BAA, is the data exportable if you ever leave, and does it integrate with the other three or four tools you already use. If you're starting fresh, consolidate where you can. Running a GLP-1 program across six disconnected tools is a common way for documentation gaps to appear.

Pre-Launch Checklist

Before your first patient, you want these in hand. Not "in progress." In hand.

1. Medical oversight arrangement (medical director agreement, supervising physician, or your state's equivalent) reviewed by healthcare counsel in the last 12 months, specific to your state.
2. Scope of practice confirmation for every clinician who will prescribe, supervise, or administer, plus any state med spa registration or reporting requirements (for example, Indiana's registration, which opens January 1, 2027).
3. Pharmacy vetting file completed if you will offer any compounded product, with license verification and written sourcing information.
4. Payment processor written approval for prescription weight-loss services, plus a backup plan.
5. Insurance review confirming current policy covers the service, or a rider added if not.
6. Consent forms specific to the drug and the dispensing form (branded vs. compounded), reviewed by counsel.
7. Marketing review process with one named person responsible for approving all GLP-1 content against FDA and state attorney general enforcement themes.
8. Staff training completion documented for everyone from front desk to injectors.
9. Adverse event protocol written, posted, and rehearsed.
10. HIPAA audit of every tool that touches patient data.

(Take this checklist with you. The free GLP-1 Med Spa Compliance Kit (PDF) puts this checklist on one printable page, with a line to record when counsel reviewed it. It also includes the marketing do and do-not table from earlier in this guide, so your team has both in one place. It reflects the rules as of October 2026.)

Final Thoughts

Most of the operators who get into trouble with GLP-1 services didn't set out to break any rules. They built a program when the rules were one way, kept it running after the rules changed, and didn't have anyone whose actual job it was to notice.

That's the real work here. Not whether to offer GLP-1s. The clinical demand isn't going anywhere, and plenty of med spas are running clean, compliant, well-documented programs that help patients and make money. The question is whether you have the infrastructure, the medical leadership, and the attention span to run one in a space where the ground keeps moving under you.

If the answer is yes, build it carefully. If the answer is "I'm not sure," that's useful information too. There's no rule that says every med spa has to offer every service. Sometimes the best compliance decision is the one you make before you ever write the first prescription.