Evidence reviewed to Aug 2026

Who Is Legally Allowed to Inject Botox and Filler — and What a "Medical Director" Actually Does

Why a prescription and a device pull a licensed clinician into the room

Two facts about the products explain almost everything about who may inject them.

Botulinum toxin is a prescription drug. HIGH · FDA label Botox Cosmetic and its siblings are prescription-only biologics regulated by the U.S. Food and Drug Administration (FDA). The FDA prescribing information describes the drug as producing muscle relaxation through local chemical denervation — it blocks the release of acetylcholine at the neuromuscular junction — and it is dispensed only on the order of a licensed prescriber [1]. A prescription drug requires someone with prescribing authority to order it for a specific patient after evaluating that patient. That requirement does not disappear because the setting is a spa.

Dermal fillers are regulated medical devices, most of them Class III. HIGH · FDA The FDA regulates soft-tissue fillers as medical devices; hyaluronic-acid fillers are Class III devices — the FDA's highest-risk class, cleared only through the agency's premarket approval (PMA) process [9] — and are approved for use in adults over 21 [2]. The most serious risk the FDA names for fillers is accidental injection into a blood vessel, which can cause tissue death, vision problems including blindness, and stroke [2]. A product that can blind someone if placed in the wrong vessel is not, in the eyes of most state medical boards, a cosmetic service anyone may provide.

Put together: the toxin needs a prescriber, and both products carry medical risk that has to be managed by someone qualified to manage it. That is why nearly every state treats these injections as the practice of medicine [3].

What "the practice of medicine" means for who holds the syringe

"Practice of medicine" is not a slogan; it is a legal category. When a task falls inside it, only certain licensed people may do it, and often only under defined supervision. For aesthetic injectables, the American Med Spa Association (AmSpa) and med-spa compliance attorneys describe a consistent structure across most states: a physician (MD or DO) sits at the top with full authority; PAs and NPs may perform or be delegated the injection within their own licensure and any required supervision; and registered nurses (RNs) may typically inject only under the order and supervision of a prescriber, because an RN cannot write the prescription that authorizes the drug in the first place [3][4].

Below that line, people commonly seen in a spa — estheticians, cosmetologists, and medical assistants — are generally not licensed to inject in states that treat this as medicine. Their training and licenses cover skin care and cosmetology, not the administration of a prescription drug or a Class III device. Whether they may even assist, and with what, is exactly the kind of detail that varies by state [3][5].

The key word underneath all of this is delegation. In many states a physician does not have to personally inject every patient, but the physician (or an authorized mid-level provider) must first establish a legitimate provider–patient relationship — a real evaluation of you — before the drug can be ordered and a qualified person can be delegated to inject it under appropriate supervision [3]. A good-faith exam of the patient is the step improvised operations skip.

What a "medical director" actually does

Many med spas advertise that they have a "medical director." Here is what that role is supposed to mean, stripped of marketing. The medical director is the licensed clinician — in most states a physician, though some states allow other licensed prescribers — who is legally accountable for the medical services the spa provides. On paper, that person is responsible for things like establishing the protocols under which treatments are given, ensuring that whoever injects is qualified and appropriately supervised, and standing behind the medical decisions made in the building [3][4].

The gap between the paper role and the real one is where regulators focus. Enforcement write-ups describe a recurring "ghost" or absentee medical director: a licensed clinician who lends a name and a signature to a spa's paperwork in exchange for a fee, but who is rarely or never on site, does not supervise the people injecting, and does not evaluate patients [5]. When that is the arrangement, the legal supervision that is supposed to protect you exists only in a filing cabinet. State medical and nursing boards — among them the Medical Board of California, the Texas Medical Board, and others — have pursued med spas over precisely this: improper or nonexistent supervision, mid-level providers working beyond their scope, and the unlicensed practice of medicine [5].

How the rules differ by state: three worked examples

Because scope of practice is set state by state, the same job title can carry different authority depending on where you stand. These three states show the range. They are illustrations of how the rules differ — not a ranking, and not a recommendation of any state or provider.

The lesson is not that one of these states is "safer." It is that the phrase "we have a nurse who does the injections" means different things in California, Arizona, and Iowa, and that you cannot infer the legal chain from a job title alone. The reliable move is to ask who prescribes, who evaluates you, and who supervises — and to remember that in a state with independent NP practice, "no supervising physician" can be entirely lawful, while in California the same setup would not be.

Med spa vs. dermatologist vs. plastic surgeon: what actually differs

These labels describe different things, and it helps to keep them separate.

• "Med spa" describes a business model, not a credential. It tells you the setting, not who is legally responsible or who will inject you. A med spa can be tightly run by a board-certified physician, or it can be an operation with an absentee director — the label alone does not distinguish them. That is why the questions below matter more than the sign on the door.
• "Dermatologist" and "plastic surgeon" describe physicians with specialty training in skin and in surgical/aesthetic procedures respectively — and, when they are board certified, verified training and examination in that specialty. A physician in these fields sits at the top of the supervision chain by default and can prescribe the drug and manage complications directly.
• The credential to verify is the person's, not the building's. Whether you are in a dermatology office or a strip-mall spa, the protective facts are the same: the license and scope of the individual who evaluates and injects you, and the real involvement of whoever holds prescribing authority.

A future guide on this site walks through exactly how to look up an injector's license, board certification, and any discipline history in the public record. This page's job is narrower: to make the legal chain visible so you know what you are verifying.

What can go wrong when the chain is missing

This is not abstract. In 2024, U.S. public-health agencies documented what happens when injections occur outside a lawful medical chain — by unlicensed or untrained people, in non-healthcare settings, sometimes with counterfeit product.

The supply chain is regulated too, and that regulation is enforced. The Drug Supply Chain Security Act (DSCSA) exists to keep counterfeit and diverted drugs from reaching patients. On April 1, 2026, the FDA issued a warning letter to a Texas med spa after a December 2025 inspection found discrepancies between the number of Botox units the spa had purchased from authorized manufacturers and the number it had documented as administered — the kind of gap that raises the question of what, exactly, was being injected [8]. The legal chain is not bureaucratic decoration; each link is one of the checks that stands between a patient and a counterfeit or mishandled drug.

Questions to ask — and answers that should give you pause

These are questions a legally run practice can answer without hesitation. You can screenshot or print this list. They equip your own judgment; they do not replace a licensed clinician's.

• Who will evaluate me before anything is injected, and what is their license? A real evaluation by a qualified provider should happen before a prescription drug is ordered for you.
• Who is your medical director, are they on site, and are they reachable if there is a complication? A name with no presence is the pattern regulators pursue.
• Who specifically will perform my injection, and are they a physician, PA, NP, or RN? The title should match what your state allows for that procedure.
• Under whose prescription is this product being used, and can you show me the vial and its labeling? Legitimate product comes through an authorized supply chain and can be shown.
• If I have a serious reaction tonight, who do I call, and what is the plan? A vascular-occlusion or systemic-spread plan is a mark of a practice operating inside the medical system, not outside it.

What we don't know

Scope-of-practice law is a moving target. States revise their rules, boards issue new guidance, and the authority a given license carries can change — sometimes within a single year. The three states above are examples of the range as of this page's review date, not a current legal opinion for any of them, and they do not describe the other 47 states. Nothing here tells you what is lawful in your state today; only your state's medical and nursing boards can do that. We also cannot tell you whether any particular provider is operating lawfully — this site names and recommends no provider. What we can do is make the legal chain visible so that, together with a licensed clinician and the public license record, you can ask the right questions.

References

1. U.S. Food and Drug Administration. BOTOX Cosmetic (onabotulinumtoxinA) prescribing information. accessdata.fda.gov (2018 label PDF).
2. U.S. Food and Drug Administration. Dermal Fillers (Soft Tissue Fillers). fda.gov.
3. Quarles & Brady LLP. Med Spa Compliance Series: Scope of Practice and Supervising Physician Compliance. quarles.com.
4. American Med Spa Association (AmSpa). Medical aesthetics legal and regulatory resources. americanmedspa.org.
5. Holt Law. Legal Actions Against Medical Spas for Lack of Medical Oversight. Survey of state medical-board enforcement against improper supervision and "ghost" medical directors.
6. Medical Board of California. Guidance on physician supervision and medical spa procedures. mbc.ca.gov.
7. U.S. Centers for Disease Control and Prevention. Harmful Reactions Linked to Counterfeit or Mishandled Botulinum Toxin ("Botox") Injections (press release and outbreak page, April 2024). cdc.gov/botulism/outbreaks.
8. American Med Spa Association (AmSpa). FDA Warning Letter to Texas Medical Spa — Drug Supply Chain Security Act (DSCSA) discrepancies, warning letter dated April 1, 2026. americanmedspa.org.
9. U.S. Food and Drug Administration. Regulation of Dermal Fillers. States that soft-tissue (dermal) fillers are Class III devices approved through the premarket approval (PMA) process. fda.gov (PDF).

Update log

• 2026-08-05 — First published. Evidence reviewed to August 2026.
• 2026-08-05 — Editorial fact-check: corrected the CDC counterfeit-toxin figures to the agency's stated "as of April 15, 2024" tally, matching the other articles that cite the same investigation.