A complaint lands eighteen months after the visit. The treatment was appropriate, the patient did fine, and the clinician who saw them remembers the appointment clearly. None of that is what the board reads. The board reads the chart — and the chart has an intake form, a consent PDF, and a treatment note, but nothing that shows a qualified provider evaluated this patient and decided the treatment was right for them before the needle came out. The exam happened. The record can’t prove it.
I’m Tom. I run Zvia, a cash-pay med spa in Lakewood, Colorado, and I build the software the practice runs on. I’m not the person who signs the exam — a licensed provider does that. My job is the other half: making sure that when someone reads the chart cold, a year and a half later, the good-faith exam is right there on the page. Here’s what that takes. (This is how to think about documenting a GFE, not legal advice — the rules vary by state, and only a state board or HHS OCR ever determines compliance.)
What a good-faith exam actually has to establish
A good-faith exam (GFE) is the clinical evaluation that happens before treatment so a qualified provider can decide the plan is appropriate for this patient. It is a clinical act — the provider performs it and makes the call. But for compliance there is a second, separate act: the record that proves the first one happened. Clinics that get cited rarely skipped the exam. They skipped, or fumbled, the record.
A GFE that reads well establishes six things:
- Who the patient is — identity, current medications, allergies, relevant history.
- That a qualified provider evaluated them — in person, or by a telehealth modality the state actually allows for that service (some require synchronous audio-video; some require in-person for the first visit).
- What was screened — the specific contraindications checked for this treatment, not a single generic checkbox.
- That the treatment is medically appropriate — the clinical reasoning that links this patient to this plan.
- Informed consent — risks, benefits and alternatives, on the version of the form that was current that day.
- The authorization to proceed — the provider’s dated sign-off that turns an evaluation into an order.
Where the documentation breaks
The exam is usually fine. The paper trail is where clinics leave themselves exposed — and it’s almost always one of these:
- Consent that isn’t versioned. You updated your GLP-1 consent in March; the chart from January doesn’t say which version the patient signed, so you can’t show what they were actually told.
- A sign-off with no date, or the wrong signer. A supervising physician’s name on a standing protocol is not a record that this patient was evaluated on this day. The exam has to be attributed to the person who performed it, credential and timestamp attached.
- The exam performed by someone who couldn’t. Many states require a physician, NP or PA to perform the GFE; an MA or an RN can’t. If the delegation doesn’t match the state’s rule, the exam wasn’t the qualified provider’s to perform — and no amount of complete-looking documentation changes that.
- Copy-forward that doesn’t reflect the visit. Last quarter’s exam pasted into today’s chart reads as a template, not an evaluation.
- Consent signed after treatment. The timestamp order matters, and a reader can see it.
The five artifacts a board can still read
When a board, an attorney, or your own medical director reads the chart eighteen months out, five things make the exam legible:
- Who performed it — name and credential, not just a signature glyph.
- When — a timestamp on the exam and on the sign-off.
- What was screened — the actual contraindication list for that treatment, captured as discrete items rather than a paragraph nobody reads.
- The versioned consent — which version of which form, signed before treatment.
- The dated authorization — the provider’s sign-off releasing the plan.
None of these is exotic. They’re just hard to reconstruct after the fact if the workflow didn’t capture them in the moment — which is the whole point. You can’t chart a good-faith exam into existence a year later.
Building it into the flow
The reliable way to get all five, every time, is to make the GFE a required step in the patient flow rather than a form someone remembers to fill in — screening captured as structured items, consent pinned to the version in force that day, and the provider’s sign-off dated and attributed as it happens. This is the part I built ProtokolIQ to do: it captures a documented good-faith exam for every patient — versioned consents, the screening, and a time-stamped, per-patient sign-off — and surfaces the exam to the clinician for that signature. It documents; the clinician still performs the exam and makes the call.
That division is the whole discipline, and it’s worth saying plainly however you run your clinic: the clinician performs the exam and decides; the record’s only job is to prove they did — clearly enough that someone reading it cold, long after everyone has forgotten the appointment, can see exactly who evaluated whom, when, against what, and what the patient agreed to. Rules vary by state, and only a board or HHS OCR decides whether yours are met. Build the record so that when they read it, there is nothing missing to explain.