The first week after a med spa signs a medical director, the requests start. The toxin rep wants an NPI. The IV supplier wants a DEA number. Someone wants a copy of the license “with our address on it.” And sometimes a distributor sends a template letter for the physician to sign on letterhead.
Most of these requests are routine. One of them can put a license at risk. This post sorts them out.
Why suppliers ask for the physician at all
Prescription drugs and devices can only go to people the law allows to have them. Federal law says a prescription drug “shall be dispensed only” on the prescription of a licensed practitioner [21 U.S.C. 353(b)(1)]. The drug supply-chain law defines an authorized buyer, for a dispenser, as one “having a valid license under State law” [21 U.S.C. 360eee(2)(D)].
A med spa owned by a nurse, an esthetician or a business owner usually holds no license that lets it buy prescription products. So the account rests on the physician’s credentials, and the supplier checks them. That is the reason for every request below.
What the director usually provides
| Request | What it proves | Public already? | Notes |
|---|---|---|---|
| NPI number | Identity of the prescriber | Yes. CMS publishes NPPES data, including practice locations [CMS] | Safe to share. Keep NPPES current within 30 days of a change [45 CFR 162.410] |
| State medical license number or copy | Authority to prescribe in that state | Number is public on the board site | Suppliers verify it online. A copy is a convenience |
| DEA registration | Authority to handle controlled substances | No | Only needed if controlled substances will be ordered, stored or administered at that site |
| Signed account application or physician certification | The physician accepts responsibility for the account | No | Read it. This is where responsibility is assigned |
| Ship-to address verification | That the delivery site belongs to the physician’s practice | n/a | The one to be careful with. See below |
Distributors don’t publish a single checklist. McKesson’s public material, for example, covers controlled-substance ordering. Since January 1, 2025, Schedule II orders must go through electronic Form e222 (CSOS), and each purchaser needs a personal CSOS certificate [McKesson]. Expect each supplier to have its own form.
DEA is per location, not per physician
A DEA registration attaches to a place. Federal rules require “a separate registration” for each principal place of practice where controlled substances are dispensed or administered [21 CFR 1301.12(a)]. There is a narrow exception for an office where the practitioner only prescribes and no controlled substances are kept [21 CFR 1301.12(b)(3)].
So a director’s DEA number from another clinic does not cover your back room. If your menu includes a controlled substance stocked on site, the site needs its own registration. Most aesthetic and IV menus don’t include one. Toxin, filler, B12, saline and most vitamins are not controlled. Ask whether you need a DEA number before asking for one. More at DEA registration by location.
“A copy of your license with our address on it”
A state medical license is issued to the person, not to the clinic. The board lists the physician’s address of record and practice location. It doesn’t print a license for each location.
In Florida, the physician “is solely responsible” for keeping the Department of Health informed of the current mailing address and place of practice [Fla. Stat. § 456.035]. Practitioner profile updates are due “within 15 days” after the change [Fla. Stat. § 456.042]. Florida also limits how many offices a supervising physician may oversee. A dermatology or skin-care office counts against a separate, smaller cap [Fla. Stat. § 458.348(3)]. We found no Florida filing that adds a clinic as a “secondary location” on the license itself.
What the clinic can reasonably get:
- The license number and a printout of the public license verification.
- Confirmation that the physician has updated the profile or NPPES where the clinic really is a practice location.
- For display in the lobby, whatever your state requires. Rules differ, so check your own board.
The letter you should not sign as written
Some distributors send a template like this when the ship-to address doesn’t match the physician’s records: “I am the medical director for [address]. This is my practice location. I treat patients here.”
If those three sentences are true, sign. If the physician supervises the site remotely and never sees a patient there, the last sentence is false. Florida lets the board discipline a physician for “making deceptive, untrue, or fraudulent representations in or related to the practice of medicine,” and for “making or filing a report which the licensee knows to be false” [Fla. Stat. § 458.331(1)(k), (1)(h)]. Most states have a similar ground.
The false letter also creates paper that contradicts the physician’s own address of record and, for controlled substances, the per-location DEA rule. If the account is ever investigated, it is the first document anyone reads.
What to do instead:
- Write the letter so it is true. For example: “I am the medical director for [clinic] at [address]. Clinical services at this location are provided by [licensed staff] under my supervision and written protocols.” Many suppliers accept a letter like this.
- Ask the supplier what it actually needs. Often it is confirmation that the physician is responsible for the account, not a claim that the physician works there daily.
- List the location where it is real. If the clinic is a genuine practice location, update the board profile and NPPES so the records agree.
- Put licensed staff on the account where allowed. Some suppliers accept an APRN or PA at the site as the licensed purchaser, with the director named as supervising physician.
A director who signs whatever the clinic sends is the profile boards describe in straw medical director cases. See the North Carolina board on straw directorships and your personal license is the collateral.
Who owns the account
Decide this before the first order:
- Whose name is on the account. If it is the physician’s, the physician is answerable for every order on it.
- Who places orders. Name the people. Order history is evidence of who controlled the product.
- What happens at termination. Accounts opened on a director’s credentials should be closed or transferred when the director leaves. The director agreement should say so, with a short deadline.
- Where product comes from. Compounded products follow different rules from manufacturer products. See 503A vs 503B sourcing.
What this means for you
Give suppliers what is public and true: the NPI, the license number and a verification printout. Supply a DEA number only where controlled substances will actually be kept at that site. Read every physician certification before it is signed. Never sign an address letter that says the physician treats patients somewhere they don’t. Rewrite it so it describes the real arrangement, and keep a copy. Put account ownership and closing at termination in the agreement. For the rest of the opening paperwork, see documents you need to open a med spa.
Related reading
Frequently asked questions
Is it safe for a medical director to share their NPI number?
Yes. CMS already publishes NPI data, including practice location addresses, through NPPES, so sharing the number reveals nothing private. The physician should keep NPPES accurate and update it within 30 days of any change, and list a clinic as a practice location only where it really is one.
Does a med spa need its own DEA registration?
Only if controlled substances will be stored, administered or dispensed at that location. Federal rules require a separate registration for each such location. A director’s DEA registration at another site does not cover yours. Most toxin, filler and vitamin menus involve no controlled substances.
Can a medical director’s license list the med spa’s address?
A medical license is issued to the physician, not to each clinic. The physician keeps an address of record and practice location with the board. In Florida, profile changes are due within 15 days. The clinic can get the license number and a public verification printout.
Should a medical director sign a letter saying “I treat patients here”?
Only if it is true. If the director supervises remotely, the statement is false. Florida, like most states, can discipline a physician for untrue representations related to the practice of medicine. Rewrite the letter to describe the real supervision arrangement.
What happens to supplier accounts when the medical director leaves?
Accounts opened on the departing director’s credentials should be closed or moved to the new director’s credentials promptly, because the departing physician stays answerable for orders placed in their name. The director agreement should say who closes each account, by when, and who keeps the order history.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.