Fentanyl. Propofol. Suspected counterfeit Botox sitting next to sharps containers that still held used needles. That is the part of New York's med spa crackdown that made the news, and it deserved to.
Here is the part that did not: most of what actually got written up had nothing to do with a needle.
The numbers
The New York Department of State, working with the Department of Health and local law enforcement, inspected more than 200 med spas statewide and cited 87 of them. A smaller pilot the year before looked at 15 med spas across the five boroughs and found violations at every single location. Not most of them. All of them.
Read the citation categories from that pilot and a pattern shows up fast.
- 86% failed to maintain basic safety records
- 65% had chemical or fire safety violations
- 60% carried no liability insurance
- 53% had sanitation or hygiene deficiencies
- 26% had unlicensed or expired practitioners on staff
Only one line on that list, the unlicensed practitioner one, is what most people picture when they hear "med spa violation." The rest is documentation, chemical handling, and cleanliness. Housekeeping, in the most literal sense of the word.
That is most of the list, and it is the part a regulator can settle in about four minutes with a clipboard, while a clinical malpractice question drags through a hearing for months. Enforcement follows the path of least resistance, and the path of least resistance runs straight through your supply closet.
Why this is the story and not the sidebar
A med spa can have a board-certified injector doing everything correctly and still get shut down because nobody can produce a cleaning log from March.
Insurance underwriters read citation reports the same way. So do the attorneys on the other side of a client's first bad reaction. In all three rooms, the question is not whether the space was clean. It is whether you can demonstrate it was, on a specific date, months after the fact.
"We think it's clean" is not a defense. It is not even a sentence that means anything. It is a description of a feeling somebody had about a room.
The gap nobody prices in
There is a difference between a room that looks clean and a room a health inspector, an insurer, or a plaintiff's attorney would call clean. Almost every practice that gets cited was operating in that gap without knowing the gap existed.
Bleach kills nearly everything on the EPA's List N. That sentence is true, and it is also the reason a lot of rooms that get wiped down every night still fail. Wrong dilution, wrong contact time, wrong order of operations, no record that any of it happened. We wrote about the four ways that goes wrong because it is the single most common failure we find.
Order matters more than people expect. A room cleaned in the wrong sequence looks exactly like a room cleaned in the right one, right up until someone asks for proof. Cleaning a counter before the shelf above it guarantees the counter gets recontaminated, and nothing about the finished room reveals which way it was done.
Then there is fragrance, which is the most effective disguise in the industry. A citrus note reads as sanitized to almost everyone, and it is a claim about a smell, not about a surface. Scent is not a measurement. It is marketing that happens to be airborne.
What actually holds up under a citation
Three things, and none of them are a slogan.
- A measured result, not an impression. ATP bioluminescence testing, the same chemistry that makes a firefly glow, reads live organic residue on a surface in under a minute. It returns a number in relative light units. Under 100 RLU is the common industry line and we hold our own cleans to under 25. What that number does and does not tell you is worth understanding before you quote it to anyone, because it speaks to cleaning effectiveness rather than to disinfection or to regulatory status.
- A photo-timestamped record for every visit. This is what turns "safety records" from a sentence you hope nobody asks about into a folder you hand over. The pilot found 86% of practices could not produce those records. That is the single easiest citation to avoid and the single most common one to receive.
- The same team on every visit. A rotating crew is how "we clean it every night" quietly becomes "someone was supposed to." Institutional memory about a specific room lives in a person, not in a checklist, which is the mechanism behind the 90-day quality fade that shows up after the sales crew rotates off your account.
The dwell time problem, specifically
Of everything on the citation list, chemical and contact-time failures are the ones practices are most surprised by, because the work genuinely was done.
EPA-registered disinfectants carry a labeled contact time, usually somewhere between one and ten minutes, during which the surface has to stay visibly wet. A surface sprayed and immediately wiped dry has been cleaned, not disinfected. It will look better than a properly disinfected matte surface sitting next to it. The chemistry underneath that is the part most crews were never taught, and it is not intuitive: the fastest-looking job is frequently the one that failed.
This is also why "we use hospital-grade products" resolves nothing. The product was never the variable. The variable is whether anyone timed it.
What this means if you operate in Central Ohio
New York's sweep is not an Ohio enforcement action, and nobody should read it as a warning shot aimed at Columbus. Read it instead as a free, unusually detailed look at what inspectors find when they actually go looking, in a market with the same equipment, the same procedures, and the same vendors as yours.
The findings transfer cleanly. So does the fix. For a med spa, a dental practice, or a wellness clinic in Dublin, New Albany, or the Short North, documented and verified cleaning is the part of this that is entirely within your control before anyone shows up.
It is also worth separating this from the other standard your practice is being graded against. Regulators judge protocol and paperwork. Clients judge the ceiling vent above the treatment chair. Those two judges rarely agree, and passing one does not settle the other.
If your current vendor cannot produce a dated log for an arbitrary Tuesday four months ago, that is the finding. You do not need an inspector to tell you.
What I would do this week
Pick a date from last quarter. Ask your cleaning company what was done that night, with what product, and for how long it sat. Then ask for the photo.
Whatever comes back, or does not, is the answer to how you would perform in the four minutes an inspector spends on that question.
If you want a second set of eyes, I will walk your space for 30 minutes at no cost, swab your highest-touch surfaces, and hand you the readings. The numbers are yours to keep whether you ever hire us or not. Our wellness and med spa work is built around exactly this problem, and how we prove clean lays out the full method.
A share of every contract supports Columbus organizations serving Franklin County children facing homelessness and poverty. Clean is the product. It is not the point.
Frequently Asked Questions
What were med spas actually cited for in the New York inspections?
In the New York City Council pilot that preceded the statewide sweep, 86% of inspected med spas failed to maintain basic safety records, 65% had chemical or fire safety violations, 60% carried no liability insurance, and 53% had sanitation or hygiene deficiencies. Only 26% involved an unlicensed or expired practitioner. Most of the list is documentation and cleanliness rather than clinical practice.
Can a med spa be cited for cleaning problems even if its clinical care is fine?
Yes. Sanitation, hygiene, chemical storage, and record-keeping are inspected separately from clinical scope of practice. A practice with a fully licensed injector doing everything correctly can still be written up if surfaces, chemical labeling, or cleaning records do not hold up. Those items are also the fastest for an inspector to verify on site.
What cleaning documentation should a med spa be able to produce on request?
A dated log of what was cleaned and when, the disinfectant used with its EPA registration and labeled contact time, and evidence the work happened, which in practice means timestamped photos or a measured verification result. The useful test is whether you can hand over a specific date from several months ago without preparing anything first.
Does ATP testing prove a surface is disinfected?
No. ATP bioluminescence measures organic residue, so it tells you how effectively a surface was cleaned. It does not measure disinfection and it does not establish regulatory compliance. Its value is that it replaces an opinion with a number: under 100 RLU is the common industry line, and we hold our own cleans to under 25 RLU.
How should a med spa prepare its facility before an inspection?
Preparation that starts when an inspector arrives is already too late, because most of what gets cited is a record that either exists or does not. The durable version is a fixed cleaning sequence, labeled chemicals stored correctly, and a log written the same day the work happens, so the documentation is a byproduct of normal operation rather than a project.
Sources
- New York Department of State warns consumers after med spa investigations, January 8, 2026
- Medical Spa Compliance Under the Microscope, Holland & Knight
- NYC Council Report Reveals Med Spa Safety Violations, American Med Spa Association
- Joint NYC Council and State investigation into medical spas finds violations of state law, NYC Council