It’s a Tuesday night and you’re writing next month’s promo. The post practically writes itself: “Boost your immunity and melt fat this fall with our new semaglutide drip.” You schedule it, queue the reminder texts, and go to bed. That one sentence just put three regulators in a position to fine you, and the drip you named may not be legal to compound anymore.
Here’s the honest answer up front: your clinic’s words are regulated by the FTC, your prescribing and compounding by the FDA, your client data by HIPAA or state privacy law, and your texts by TCPA rules and carrier 10DLC registration. None of it is optional, and “I didn’t know” is not a defense. This guide walks each one in plain English, shows how a clinic trips each wire, and gives you compliant copy to paste in tonight. It is general information, not legal advice, so run high-stakes copy past your attorney.
Table of contents
- What a compliance slip actually costs you
- The four rules that govern what you can say
- Rule 1: FTC health-claim substantiation
- Rule 2: GLP-1 marketing after the shortage ended
- Rule 3: HIPAA versus state privacy for cash-pay clinics
- Rule 4: TCPA and 10DLC for your text messages
- Steal this: compliant rewrites of real clinic copy
- Solo, mid-size, and multi-location: how the rules change
- Common objections, answered honestly
- Frequently asked questions
What a compliance slip actually costs you
The growth of your niche is exactly why regulators are paying attention. The IV hydration therapy market is projected to grow from about $2.8 billion in 2025 to $3.0 billion in 2026, reaching $5.7 billion by 2033 (Grand View Research), and the medical spa industry has eclipsed $17 billion across more than 11,000 locations (AmSpa). Fast-growing, cash-rich, loosely policed categories are where enforcement shows up.
US IV hydration therapy market size, in billions of dollars (2033 projected). Source: Grand View Research.
The FTC can seek civil penalties that now top $50,000 per violation once it has put a company on formal notice (FTC), demand refunds, and ask a court to stop your campaign. Dispensing a compounded drug that no longer qualifies puts your prescriber and pharmacy partner at risk. And carriers block texts from unregistered senders, so reminders quietly stop arriving with no error to warn you.
Most owners never get a dramatic lawsuit. They get a warning letter with a 48-hour response window, a scramble to pull every post that repeats the claim, and a lawyer’s bill. Avoiding it is cheaper than cleaning it up.
The four rules that govern what you can say
Think of your marketing as passing through four separate gates, each run by a different authority. You can clear three and still get stopped at the fourth.
- The FTC gate decides whether your claims are substantiated: every ad, email, social post, and testimonial.
- The FDA gate decides what you can offer and name, especially compounded GLP-1 drugs now that the shortage is over.
- The privacy gate (HIPAA or your state’s law) decides how you store and share client information, including what goes in a message.
- The telecom gate (TCPA plus carrier 10DLC rules) decides whether your texts are legal to send and will actually arrive.
Rule 1: FTC health-claim substantiation
The single biggest mistake is believing the FTC only cares about the product. It cares about the sentence. If your copy says or implies a treatment produces a health result, that is a claim, and you need evidence before you publish, not after someone complains.
In December 2022 the FTC replaced its 1998 supplement advertising guide with broad Health Products Compliance Guidance covering all health-related claims. The standard is “competent and reliable scientific evidence,” and for a claim that a product treats, prevents, or mitigates a condition, that generally means randomized, controlled human clinical testing (Covington). Hedges like “helps” and “may” are usually inadequate.
This matters to you because the FTC has aimed at this niche twice. In 2020 it warned more than 160 companies, one round targeting clinics promoting IV vitamin C, peptide, and ozone therapies as immune boosters or COVID defenses (FTC). In 2023 it put more than 670 health marketers on formal notice (Haynes Boone).
The phrases that get clinics in trouble feel harmless because everyone uses them:
- “Boosts your immune system”
- “Melts fat” or “burns fat while you sleep”
- “Detoxes” or “flushes out toxins”
- “Cures hangovers” or “cures migraines”
- “Reverses aging”
How it breaks: a clinic runs a Myers’ cocktail promo that says “boost immunity before flu season.” A competitor reports it. The claim implies the drip prevents illness, which needs clinical trial evidence the clinic does not have. Now every place that sentence lives, the website, the email, the Instagram caption, has to come down, and the owner is answering a federal agency instead of seeing clients.
The fix is not to stop marketing. It is to describe what the service is and what a client experiences, and to attach health outcomes only where you have real evidence. “Hydration and electrolyte support in about 45 minutes” is a description. “Boosts immunity” is a claim. The same rule covers testimonials and influencer posts: edit or remove any review on your site that states a medical outcome you cannot back up.
Rule 2: GLP-1 marketing after the shortage ended
If your weight-loss marketing still leans on “beat the shortage” or names compounded semaglutide like it’s the same thing as the brand, that copy is out of date and risky. The ground moved in early 2025, and many clinic sites never caught up.
The FDA declared the tirzepatide shortage resolved effective December 19, 2024, and ended compounding enforcement discretion on February 18, 2025 for 503A pharmacies and March 19, 2025 for 503B facilities. It declared the semaglutide shortage resolved on February 21, 2025, with 503A compounding to stop by April 22, 2025 and 503B by May 22, 2025 (AmSpa; FDA).
In plain terms: the legal basis that let pharmacies mass-compound copies of Ozempic and Mounjaro was the shortage listing. That basis is gone. Narrow, patient-specific compounding lanes remain, but “the brand is in shortage” is not one of them. If your marketing implies a cheaper compounded version because of a shortage, the rules no longer support that offer.
Two habits to retire. First, shortage urgency: “get semaglutide while supplies last” describes a situation that ended more than 18 months ago. Second, brand-equivalence: naming “compounded semaglutide” beside a brand logo, or implying your injection equals Wegovy for less, invites both FDA and FTC scrutiny. Market your supervised weight-management program and let your prescriber make the call per patient.
How it breaks: a clinic keeps a landing page that says “FDA-approved semaglutide, compounded to save you money, while the shortage lasts.” Every clause is a problem. It implies the compounded product is FDA-approved (it is not), leans on a shortage that is over, and markets a drug rather than a program. A single complaint can pull in two agencies at once.
The compliant version markets the program and the supervision, not the molecule and the discount. For retention, see our playbook on how to keep GLP-1 clients from quitting.
Rule 3: HIPAA versus state privacy for cash-pay clinics
A lot of IV-bar owners have been told “you’re cash-pay, so HIPAA doesn’t apply,” and build their whole marketing stack on that. It is a trap. The exemption is narrower than the rumor, and even when it holds it does not leave you with zero privacy duties.
HIPAA applies to “covered entities,” mostly providers that transmit health information electronically for standard transactions like insurance billing. A pure cash-pay clinic that never bills insurance may fall outside that definition. But the moment you bill a single insurer or share records electronically with a covered-entity partner like a lab or a referring physician, you are very likely pulled in. And even fully outside HIPAA you are not off the hook: every state has privacy and breach-notification laws, and several now have consumer health data statutes (Washington’s My Health My Data Act is the loud example) that reach exactly the cash-pay clinic HIPAA might miss. Treat client health information as protected either way.
For your automation, that means three things: keep diagnoses and treatments out of message previews (“Your semaglutide dose is ready” on a lock screen is a disclosure); get and record real consent before you text health information; and lock down who can see client notes.
How it breaks: a clinic assumes it is HIPAA-exempt and runs a re-engagement blast that says “Haven’t seen you since your hormone pellet insertion, come back for a refresh.” That one message discloses a specific treatment to a phone that might be shared or sitting on a lock screen. HIPAA issue or state privacy issue, it is a disclosure the client never consented to. We go deeper in our guide to HIPAA-aware SMS.
Rule 4: TCPA and 10DLC for your text messages
Texting is the highest-ROI channel a clinic has and the one most likely to get silently switched off. Two things govern it: the TCPA, federal law about consent, and 10DLC, the carrier system that decides whether your messages get delivered.
Consent first. The TCPA requires prior express consent before marketing texts, and it has to be clear, specific, and recorded. A pre-ticked checkbox does not count, nor does consent buried in terms. You need a clean opt-in that says what the person agrees to receive, plus an easy way to reply STOP.
Then 10DLC, short for 10-digit long code. US carriers (AT&T, T-Mobile, Verizon) now require senders to register a brand (your legal identity and EIN) and each campaign (the use case, like appointment reminders) through The Campaign Registry (The Campaign Registry). Across 2024 and 2025 carriers moved from filtering unregistered traffic to blocking it, so an unregistered clinic can send texts that never arrive, with no bounce to warn you. Healthcare draws extra scrutiny: registrations get rejected for protected health information in sample messages, a privacy policy with no SMS disclosure, or consent language that ignores TCPA or HIPAA, so your copy has to be clean the first time (MyTCRPlus).
How it breaks: a clinic switches texting tools, never completes 10DLC registration, and keeps sending reminders. Delivery quietly drops, no-shows climb, and the owner blames the front desk. The real cause is a registration box nobody checked. For the money texting makes back, see our breakdown of missed-call text-back.
Steal this: compliant rewrites of real clinic copy
Here is the part you can use tonight. Below are claims clinics actually publish, why each is a problem, and a compliant version that still sells. Copy the right-hand column.
| What clinics write (risky) | Why it’s a problem | Compliant rewrite you can use |
|---|---|---|
| “Boost your immunity with our IV drip” | Disease-prevention claim; needs clinical evidence | “Hydration, vitamins, and electrolytes delivered in about 45 minutes” |
| “Melt fat fast with our weight-loss shot” | Unsubstantiated outcome claim | “A medically supervised weight-management program tailored by our provider” |
| “Detox and flush out toxins” | Vague, unsupported health claim | “Replenish fluids and feel refreshed after a long week” |
| “FDA-approved compounded semaglutide” | Compounded drugs are not FDA-approved | “Medications prescribed by our licensed provider when clinically appropriate” |
| “Beat the semaglutide shortage” | The shortage ended in early 2025 | “Book a consult to see if our weight-management program is right for you” |
| “Cure your hangover in 30 minutes” | Treatment/cure claim | “Rehydrate and recover with fluids and B-complex” |
Now the two pieces of copy nobody writes until a registration gets rejected: your SMS consent line and your PHI-safe reminder.
Solo, mid-size, and multi-location: how the rules change
The four gates apply to everyone, but what you prioritize depends on size.
Solo cash-pay IV bar or single-nurse clinic. Your biggest exposure is FTC claims, because you write your own copy fast, plus the privacy-exemption trap. Do two things first: scrub “immunity,” “detox,” and “melts fat” from everything you have published, and complete your 10DLC registration so reminders land. You do not need a compliance department, just to stop publishing five phrases and check one box.
Mid-size weight-loss or hormone clinic, two to three locations. Staff and contractors posting for you multiply your FTC exposure, because each can publish a claim in your name. Your GLP-1 copy is the live wire. Put one person in charge of approving marketing language, retire every shortage-era page, and make sure testimonials do not state medical outcomes. If you bill any insurance, assume HIPAA applies. This is also where a nurse practitioner’s ownership questions intersect with what you can advertise.
Larger multi-service group. Build a claims-review step into your marketing calendar, keep a consent and registration record per location, and audit your message templates quarterly so an old campaign does not resurrect a banned phrase. Your risk is scale: one non-compliant template sent across every location is bigger than a solo owner’s single post. Centralize the templates.
Common objections, answered honestly
“Everybody in my area says ‘boosts immunity.’ Why come after me?”
Enforcement is not evenly applied, true. But “everyone does it” is not a defense, and you do not control who reports you. A single complaint from a competitor, a former employee, or an unhappy client starts a letter. Compliant copy costs one editing session. A warning letter costs lawyer hours and a scramble to pull content. Choose the small known cost.
“I already pay for expensive software. Doesn’t it handle compliance?”
Booking and charting software stores your data. It does not write your marketing, approve your claims, or register your texts. Some tools help with the privacy and 10DLC pieces, but none stop you from typing “melts fat” into an email. Compliance is a process you own, not a feature you buy and forget.
“Won’t softening my copy hurt conversions?”
Specific and honest usually beats vague and hyped. “Hydration and electrolytes in 45 minutes, booked online in 60 seconds” tells a buyer exactly what they get. “Boost your immunity” tells them nothing real and puts you at risk. Clear mechanics convert, and they do not draw complaints.
Frequently asked questions
Does the FTC actually fine small wellness clinics, or just big brands?
Its biggest actions target large companies, but its warning letters have gone to hundreds of smaller health marketers, and its 2020 letters specifically named clinics promoting IV and injection therapies. Most small clinics get a warning letter rather than a lawsuit, but that still forces you to pull content and often involves a lawyer. The risk is real even if the headline cases are not about you.
Can I still offer compounded semaglutide or tirzepatide in 2026?
There are still narrow, patient-specific compounding situations, but the broad 'the drug is in shortage, so we can compound copies' basis ended in early 2025 when the FDA declared both shortages resolved. You cannot market compounded GLP-1 on the strength of a shortage anymore, and should not imply it is FDA-approved. Talk to your prescriber and pharmacy about what is permissible per patient, and market the supervised program, not the drug.
I'm a cash-pay IV bar and never bill insurance. Am I exempt from HIPAA?
Possibly, but do not build on it. The moment you bill insurance or share records electronically with a covered-entity partner like a lab or a referring physician, you are likely a covered entity. Even outside HIPAA, state privacy and breach-notification laws still apply. Treat all client health information as protected.
What is 10DLC and do I have to register?
10DLC is the US carrier system for business texting from standard 10-digit numbers. You register your business as a brand and each use case as a campaign through The Campaign Registry. Since 2024 and 2025, carriers block unregistered business traffic rather than filter it, so your reminders only arrive if you register. Keep protected health information out of your sample messages.
Who is responsible if a client testimonial makes a medical claim?
You are. The FTC treats endorsements on your channels as your own claims, so you need the same substantiation you would need yourself. If a review on your site says a treatment cured a condition, edit or remove it unless you can back the claim with competent and reliable scientific evidence. Never pay someone to imply an outcome you cannot prove.
Back to that Tuesday-night promo. Rewritten, it reads: “Fall hydration drips are back. Vitamins, electrolytes, and fluids in about 45 minutes, booked online in 60 seconds.” No immunity claim, no banned drug language, and the reminders go out from a registered number with consent on file. Same promo, same booking link, none of the exposure. The whole job: say what is true, describe what you do, protect what clients tell you, register your texts.