IV therapy has moved from hospital bays and urgent care centers into strip malls, gyms, med spas, and mobile "IV bar" fleets. Patients love the convenience. Investors love the margins. Regulators, in 2026, are moving faster than either group expected.

This isn't a hypothetical trend. It's already reshaping the industry in real time — and understanding why makes the checklist below feel a lot less like paperwork and a lot more like risk management.

Why This Isn't Optional Anymore

Texas offers the clearest case study. In September 2025, the state's House Bill 3749 — now known as Jenifer's Law — took effect after a patient died following an infusion at a Texas med spa. The board investigation that followed found a medical director based 100 miles from the facility, no established administration protocols, treatment given by an unlicensed individual, and no meaningful physician supervision. The bill passed the legislature almost unanimously and now sets binding requirements for IV clinics statewide.

Texas isn't alone. In February 2026, Kansas regulators issued a joint statement warning that IV therapy clinics operating in the state may be violating the law, specifically calling out arrangements where prescriber involvement is effectively bypassed by letting patients direct their own care. South Carolina's medical and nursing boards issued similar joint guidance on retail IV therapy, and Rhode Island's health department has done the same for medical spas and IV businesses. Industry coverage has noted that more state-level rules are expected to follow throughout 2026.

The technical bar is rising too. USP Chapter 797 sterile compounding standards — originally written for hospital pharmacies — are increasingly being enforced as baseline requirements for retail IV clinics, and several states now expect a real-time clinical encounter with a qualified prescriber before a nurse can even prepare an infusion. California has begun conducting random audits specifically to confirm that a clinic's medical director is providing the active oversight promised in their contract, rather than functioning as a "paper" director in name only.

None of this means IV therapy is going away. It means the clinics that treat compliance as a core operating discipline — not an afterthought — are the ones that will still be operating five years from now. This audit is built the way a regulator, a plaintiff's attorney, or an accreditation surveyor would actually evaluate your clinic: not as a list of nice-to-haves, but as evidence. Either you can produce the document, the log, or the signature when asked, or you can't.

Work through all 30 points. Mark each one honestly, and assign a real owner and deadline to anything that isn't a clean yes.

1. Licensing, Ownership & Corporate Structure

1. Medical director agreement is current, specific, and enforceable. Pull the actual signed agreement. Confirm it names your clinic specifically, defines the scope of oversight — chart review frequency, availability for consults, on-site requirements if any — and hasn't quietly lapsed because the medical director moved on. Under Jenifer's Law and similar statutes emerging in other states, a medical director doesn't need to be physically on-site, but the relationship does need to be active, documented, and real.

2. Corporate practice of medicine (CPOM) structure is sound. If a non-physician owns the business, your structure needs to comply with your state's CPOM doctrine — typically an MSO paired with a physician-owned professional corporation. Regulators are now scrutinizing whether the MSO is influencing clinical decisions (for example, pressuring providers to hit infusion volume targets). That line is being actively enforced in 2026, not just written into statute.

3. Standing orders or protocols are signed, dated, and formula-specific. A blanket order that says "IV therapy per nurse judgment" won't survive scrutiny. Every formula you offer should have its own protocol, signed by the medical director, specifying indications, contraindications, dosing, and monitoring requirements.

4. Business, facility, and waste-disposal licenses are active. Check state health department licensure, local business permits, and your medical/biohazard waste disposal contract. Confirm renewal dates are tracked somewhere other than someone's memory.

5. Malpractice and general liability insurance actually cover what you do. Confirm your policy explicitly covers IV administration and any compounded or injectable products you use — not just generic med spa coverage, which can exclude infusion therapy entirely.

2. Staff Credentialing & Scope of Practice

6. Every person starting an IV line holds an active, verifiable license. Check each license against your state board's public lookup tool yourself. Licenses lapse or get restricted without an employer necessarily hearing about it.

7. A qualified provider — not the nurse alone — conducts the Good Faith Exam. A Good Faith Exam (GFE) is the clinical check performed before treatment to confirm IV therapy is appropriate for that patient. In most states, this requires an MD, DO, NP, or PA — an RN generally cannot perform it independently, since it requires clinical judgment and prescribing authority. This is one of the single most commonly violated requirements in the industry right now.

8. Scope-of-practice alignment matches your state's nurse practice act. In many states, LPNs cannot independently assess a patient or push certain medications without direct RN or physician supervision. Map your actual staffing model against what your state legally allows for each license type.

9. IV certification and competency are documented, not assumed. Look for a documented initial competency assessment plus an annual re-check. A certificate from an online course years ago is not evidence of current competency.

10. BLS/ACLS certification is current for all clinical staff, and credentialing files are complete. Every clinician should have a single file containing license copies, certifications, background check results, and a signed job description. If you can't produce this in five minutes for a random staff member, that's a documentation gap.

3. Medical Screening & Patient Safety

11. A documented health history precedes every first infusion. This should flag allergies, kidney and cardiac history, pregnancy status, and current medications, especially ones that interact with high-dose vitamins or electrolytes.

12. A licensed provider — not just front desk staff — reviews and signs off on screening. Intake forms filled out by a receptionist and never reviewed by a clinician are a documentation gap that surfaces immediately in any adverse-event investigation.

13. High-risk additives have their own contraindication protocols. Potassium, high-dose glutathione, NAD+, and similar ingredients carry real risk profiles and need documented screening criteria.

14. Vital signs are taken and recorded before and after infusion. This is standard of care, particularly for new patients or higher-risk formulas.

15. There's a clear, written escalation pathway for abnormal findings. If a patient's blood pressure is elevated at intake, does staff know exactly what to do, who to notify, and whether treatment should be held? "We'd figure it out" is not a policy.

4. Medication & Supply Management

16. All fluids, vitamins, and additives come from licensed, traceable suppliers. You should be able to produce an invoice and lot number for anything currently in your storage.

17. Compounded medications come from a licensed 503A or 503B pharmacy. In-house compounding without proper pharmacy licensure is one of the most serious violations found in enforcement actions against IV clinics.

18. Expiration dates and lot numbers are actively tracked and enforced. Physically check your storage. A tracking spreadsheet nobody updates is functionally the same as no tracking system.

19. Cold-chain and storage requirements are followed and logged, and sterile compounding meets current USP <797> standards. Medications requiring refrigeration need a documented temperature log. Any on-site mixing of vitamin blends needs to meet the sterile compounding requirements now being enforced as baseline law in many states, not treated as an optional hospital-pharmacy guideline.

20. Controlled substances, if used, are logged, counted, and secured. DEA and state pharmacy board rules require a documented chain of custody — this is a common target of surprise inspections.

5. Infection Control & Clinical Technique

21. Hand hygiene and aseptic technique are observed and documented. The gold standard is periodic direct observation audits, not a laminated poster on the wall.

22. Single-use supplies are genuinely single-use. Confirm there's no reuse of tubing, needles, or partially used bags between patients, even under time pressure.

23. Sharps disposal and biohazard handling meet OSHA and state requirements. A documented medical waste disposal contract with pickup records is the evidence a regulator will ask for.

24. Site preparation and dressing protocols are standardized. A documented skin antisepsis procedure should be followed consistently before every venipuncture, regardless of who's working that day.

25. An infection and adverse-event tracking log exists. Catch a pattern internally before it's surfaced by a state complaint or a cluster of bad reviews.

6. Emergency Preparedness

26. An emergency/anaphylaxis kit is stocked, checked, and accessible. Epinephrine, diphenhydramine, and other reaction-management medications should be checked on a documented monthly schedule.

27. A written emergency response protocol exists — and staff can actually explain it. Cover allergic reaction, vasovagal syncope, infiltration, and cardiac events. Ask a random staff member to walk you through it; if they can't, the protocol isn't real yet.

28. Emergency drills are conducted and logged periodically. Recurring, documented drills are what separate a policy binder from a functioning safety culture.

7. Documentation, Marketing & Recordkeeping

29. Informed consent is specific, signed, and retained per state law. Consent forms should name the specific formula and its risks, not a generic "IV therapy" waiver, and be retained for whatever period your state requires.

30. Patient records are complete and HIPAA-compliant, and marketing language stays within scope. Records should include screening, vitals, the specific formula and lot number administered, adverse events, and a provider signature. Separately, review your marketing: regulators are actively watching for language that implies treatment of a specific medical condition rather than general wellness support. Framing IV therapy as "wellness" doesn't change its legal classification as a medical procedure, and boards have cited clinics specifically over marketing claims.

How to Actually Run This Audit

A checklist is only as useful as the process behind it.

• Assign one owner. Diffuse accountability is how open items stay open for years. One person should track every gap to a close date.
• Pull real charts, not hypothetical ones. Randomly select 5–10 recent patient records and trace each one end-to-end: screening, GFE, consent, administration, lot number, post-care documentation.
• Interview, don't just inspect. Ask a staff member to walk you through what they'd actually do if a patient became lightheaded mid-infusion.
• Repeat quarterly. Regulations are changing state by state throughout 2026. A one-time audit is a snapshot. A recurring one is a safety culture.

A Note on Scope

This checklist is a starting point for internal review, not a substitute for legal advice specific to your state. Regulatory approaches vary widely and are moving quickly — what was a gray area eighteen months ago may now carry real enforcement risk. Before finalizing any compliance program, have it reviewed by a healthcare attorney familiar with your state's nurse practice act, pharmacy board rules, and medical spa regulations.

Don't Navigate Compliance Alone

Running through this checklist probably surfaced at least one item you're not fully confident about — a Good Faith Exam process that needs tightening, a consent form that hasn't been updated in years, a marketing claim that's edging into risky territory. That's normal. IV therapy regulation is moving faster in 2026 than most operators can track solo, and even well-run clinics fall behind.

The American IV Association (AIVA) exists to close exactly those gaps. As the industry's leading professional association, AIVA gives IV clinics direct access to the expertise most operators are otherwise navigating alone:

Compliance Corner — Bring your hardest compliance questions to AIVA's expert attorneys and get real answers, live, every week. No guessing, no generic legal disclaimers.

Certification & Training — Keep your clinical team credentialed, competent, and audit-ready with programs built specifically for IV hydration providers.

Legal & Regulatory Guidance — State rules on IV therapy are shifting constantly in 2026. AIVA members get the updates before they become a problem, not after.

Group Purchasing Power — Deep discounts on medical supplies, equipment, and software, because compliance shouldn't come at the expense of your margins.

A Real Network — Connect with clinic owners, medical directors, and nurses who've already solved the problem you're facing right now.

Already an AIVA Member?

Put your Compliance Corner access to work — get your open items answered by our attorneys this week.

Submit Your Compliance Question →

Not a Member Yet?

Stop piecing together compliance guidance from scattered blog posts and outdated PDFs. Join the association built to keep IV clinics safe, compliant, and thriving.

Join AIVA Today →