Documenting Your Medical Director Arrangement
Published September 24, 2026 · 6 minute read · General information, not legal advice. Your licensing regulators decide what applies to you.
The signed agreement records what the practice and the prescriber agreed on the day they signed. A reviewer, an insurer, or a regulator asking about oversight will also want the logs that show what happened afterward.
This guide is for the owner who keeps that file. It lists the pages to hold and the logs to keep current. What your regulators expect the arrangement to include is the thing to check first, and the regulator directory shows where to look.
The identity page
Start with who the prescriber is. Full name, license type, license number, issuing authority, expiration date, and the date the license was last verified and by whom. If the prescriber holds licenses in more than one place, list each, and note which one covers the practice's location.
Add the prescriber's malpractice carrier, the policy period, and whether the policy is claims-made or occurrence. Record the date someone confirmed the policy covers supervision of this practice's services. If it is claims-made, note who pays for tail coverage when the arrangement ends, because that question is much harder to settle at exit.
If other prescribers act under the arrangement (a backup physician or a collaborating nurse practitioner), each gets the same entry.
Services covered
List every service the practice offers, then mark which ones the arrangement covers. This sounds redundant until a practice adds a service and nobody updates the agreement. A service on the menu with no mark in this column has no prescriber behind it.
Where a separate arrangement covers a service, such as a telehealth platform prescribing one line, note that here and cross-reference its own record. Platforms of that kind often cover less than owners assume, so check what a telehealth prescriber covers before you mark the column.
Delegation and supervision per service
For each covered service, keep two separate entries, for the reasons set out in delegation vs. supervision vs. orders.
Delegation. Which tasks the prescriber delegates, to which license types or named individuals, and under what conditions. Delegation is specific: a nurse delegated to perform IV therapy has not thereby been delegated to operate a laser.
Supervision level. Whether the prescriber must be on site, immediately available, or generally available for this service, in your regulator's own terms. The field is blank in any template because the answer comes from your regulators and the prescriber.
How orders are issued
Record whether the practice works from patient-specific orders, standing orders, protocols, or some combination, and for which services. Where standing orders or protocols are used, reference the signed document and its version. Where orders are patient-specific, describe how the prescriber issues them (in person, through the record system, or by telehealth evaluation) and how the order is documented in the chart.
Availability and backup
How staff reach the prescriber during treatment hours, and the expected response. What happens when the prescriber is unavailable: who covers, how staff know who is covering today, and how that coverage is recorded. Coverage only counts if the backup has agreed to it in writing and knows the practice.
Authority to suspend
Keep a signed page giving the prescriber written authority to suspend a service, a device, a protocol, or an individual delegation immediately, without waiting for the owner to agree. Note how a suspension is recorded and how staff are told. If the prescriber cannot stop something they are accountable for, the arrangement has a hole in it.
Chart review
The method (random sample, targeted review, or all charts for a new service or new staff member), the frequency, and what the prescriber looks at. These fields are blank for the prescriber to set and sign. Below them, a log: date of each review, which charts, findings, and actions taken. The log is what shows review is happening.
Protocol sign-off log
Every clinical protocol the practice uses, each with a version number, the date the prescriber signed it, and the date it is next due for review. When a protocol changes, the new version is signed and logged, and the superseded one is kept with a note of when it stopped applying. A protocol with no signature in this log should not be in use.
Adverse event notification pathway
What counts as an adverse event for notification purposes, who notifies the prescriber, how, and how fast. What the prescriber does on receiving notice, and where that response is documented. Include how events are reported onward where reporting to a manufacturer, insurer, or regulator applies.
Meeting log
Dates the prescriber met with the practice owner or clinical staff, who attended, what was discussed, and what was decided. Short entries are fine. The log shows a pattern of contact.
Annual re-verification
Once a year, and whenever something material changes: re-verify the prescriber's license and malpractice coverage, re-read the services list against the current menu, re-confirm delegation and supervision entries against what your regulators currently say, and record the date and the person who did it.
Termination
What notice either party gives, what happens to services during the notice period, who holds the records afterward, who pays for tail coverage, and how protocols signed by the departing prescriber are handled until a successor signs them. A practice that has not written this down will be working it out under time pressure. The handover itself is walked through in when your medical director leaves.
Who keeps the file
Name one person in the practice who is responsible for the file: usually the owner or a clinical lead, not the prescriber. That person keeps the logs current, chases missing signatures, and puts the annual re-verification on the calendar. The prescriber should have a copy of everything they have signed, and access to the logs that record their own activity, because if the arrangement is ever questioned they will need to show their side of it too.
The file can be paper or electronic, but it should live in one place that a successor prescriber or an inspector could be sent to without a search. Put the signed agreement at the front and the logs behind it in date order. The prescriber's side of the same arrangement, including what they should refuse, is in what a medical director is accountable for.
The records described here are in the Medical Director Oversight Module, blank for your prescriber to complete.
This week
- Check the prescriber's license expiration date and malpractice policy period, and write both on the identity page.
- Compare your current menu against the services-covered list and mark any service with no prescriber behind it.
- Find the date of the last chart review. If there is no log entry, ask your prescriber to schedule one.
- Ask your prescriber whether their policy is claims-made, and if so, agree in writing who pays for tail coverage.
- Medical Director Oversight Module, $34
- Staffing and Competency Module, $29
- Intake and Screening Module, $29
Questions this guide answers
What should be in a med spa medical director agreement?
A workable agreement covers the prescriber's identity and license, the services covered, the delegation and supervision for each service, availability and backup, chart review, protocol sign-off, adverse event notification, the prescriber's authority to suspend a service, and what happens at termination. The agreement is then supported by logs that show the arrangement working.
How often should a medical director review charts?
The method and frequency are for the prescriber to set, in line with what your regulators expect. The record should leave those fields blank for the prescriber to fill and sign, then log each review as it happens.
Is a signed medical director contract enough documentation?
The contract records what was agreed. It does not show that chart review happened, that protocols were signed, or that the prescriber was reachable. Those need their own logs.