Medical Records for a Texas Med Spa

Texas med spa medical records retention runs on two separate systems: the patient chart and the facility file. Different clocks, different readers, different consequences.

Two record systems, one practice

Almost every aesthetic practice keeps records. Far fewer keep two sets deliberately, and that is where the trouble starts.

The first system is the patient chart: the clinical evaluation, the consent, what was injected or applied, by whom, in what quantity, at what settings, and what happened afterwards. The second is the facility file: contracts, protocols, device paperwork, training evidence and audit records. They answer to different readers. A chart is read when a patient or a regulator asks what happened to a person. The facility file is read when someone asks whether the practice was set up to do the thing at all.

Practices that run injectables tend to keep decent charts and a thin facility file. Practices that came from the aesthetics side often have the reverse. Both gaps are visible from outside.

How long patient records have to be kept

The Medical Board’s published position is direct: Physicians are required to retain medical records for at least seven years from the date of the last treatment.

Two words in that sentence do the work. At least means seven years is a floor rather than a target, and other considerations can extend it. Last treatment means the clock is not set by the date the chart was opened; it moves every time the patient returns. A patient treated across four years does not start their seven-year clock until the final visit.

The obligation is framed around the physician. In a med spa that runs on delegation, this is a question owners should settle explicitly rather than assume, because the practice holds the records while the physician carries the retention duty. That relationship belongs in the written arrangement, which we cover in the medical director agreement for a Texas med spa.

What the retention clock runs from

The practical failure is not deleting records early. It is losing the ability to prove when the last treatment was.

If a chart is archived by year of creation, a patient whose course spanned several years ends up filed under the wrong clock. If records live in a booking system that purges inactive clients on a rolling schedule, the schedule is making a retention decision nobody reviewed. And if the practice migrates to a new platform, the last-treatment date is exactly the field that tends not to survive the export.

Before any system migration, confirm that treatment dates and the identity of the treating provider come across intact. Those two fields are what the record is for.

Releasing records when a patient asks

Requests arrive rarely and then all at once, usually alongside a complaint. Handling them badly converts a records question into a conduct question.

The Medical Board states that State law entitles patients to receive a copy of their records—or have them sent to another provider or third party—if proper written authorization is provided, and that Physicians must respond within 15 business days of receiving the request. It also notes that This requirement also applies when a minor’s parent or legal guardian requests the records.

Business days, not calendar days, and the clock starts on receipt rather than on the date someone gets round to reading the email. Decide in advance who monitors the inbox that receives these, because a request sitting unopened for a fortnight is the common failure. Note also that responding is not the same as agreeing to every element of a request; what matters is that the response happens inside the window.

The facility records TDLR expects on site

For a registered laser hair removal facility, TDLR publishes a list of what is kept at the premises. Asked what records must be maintained, the department answers that Some of the required documents you must maintain on site are as follows and names them.

The list runs: A prescription order for the purchase of any lasers, Your manufacturer’s user manual, A copy of the consulting physician contract, Current laser devices inventory, Copy of yearly inventory audit, Training affidavits for all technicians, Records of quarterly audits conducted by consulting physician, and Written protocols to include procedures for safety and patient assessments.

Two of those catch practices out. The quarterly audit records assume the audits are happening on a cadence, so an empty folder is evidence about the oversight arrangement rather than about filing. And training affidavits have to cover everyone currently operating a device, which means the file needs updating when staff change, not annually. The wider registration picture is on Texas laser hair removal requirements.

Who holds the record when the physician changes

A physician transition is the moment records questions become urgent, because two parties suddenly have an interest in the same file.

Settle it in writing before it is live: the practice retains the patient records, the outgoing physician retains a right of access for the period they may need them, and neither party removes or alters what the other created. Charts written under a previous physician stay as written, because they record what was authorized at the time. Rewriting them to name a successor would misstate the record. The sequence around a change is covered in replacing a med spa medical director in Texas.

Charting that survives a review

The test for a chart is whether a reader who was not present can reconstruct the encounter without asking anyone.

That usually means the clinical evaluation that preceded treatment and who performed it, the specific product or device and its settings, quantities and sites, the identity and license type of the treating provider rather than initials, the consent that was actually given for what was actually done, and anything the patient reported afterwards. Records of what did not happen matter too: a declined treatment, a deferral, a referral out.

The evaluation itself has its own requirements, covered under good faith exams in Texas, and where an outcome went wrong the documentation expectations tighten further, which we cover under adverse event planning.

A file structure that holds up

Most practices do not need a document management system. They need a structure someone else could navigate on a bad day.

Keep the facility file in one place with a current index, so the executed physician contract, the protocols it references, device paperwork, training affidavits and audit records are reachable without a search. Keep patient charts in one system rather than split between a booking platform and paper. Date and version the protocols, because current is a claim you may have to demonstrate. Log records requests with the date received and the date answered.

None of this certifies anything. It is designed to support a practice that can answer questions from its own files rather than from memory. Where a request is contested or a record is incomplete, review the position with Texas healthcare counsel. If you want the structure reviewed alongside your oversight arrangement, talk to us.

This article is general information for Texas practice owners and is not legal advice. It is designed to support planning conversations, not to replace them. Rules change; review your own arrangement with Texas healthcare counsel before acting. Last reviewed August 2026.