Nearly six years have passed since a day spa in Albuquerque, New Mexico, was closed following a state health department investigation into the facility's unregulated practice of 'vampire facials'.

A report released this week by the US Centers for Disease Control and Prevention now details five suspected cases of HIV traced to unsanitary procedures carried out at the spa by its unlicensed operator, demonstrating the importance of rapid contact tracing and regulation of invasive treatments.

In the summer of 2018, the New Mexico Department of Health (NMDOH) opened an investigation into a report of a woman who tested positive on a rapid HIV antigen/ antibody kit while traveling abroad.

With no history of drug use, recent sexual contact outside of her relationship, or blood transfusions, the source of her infection was traced to a facial procedure at an unlicensed spa.

Commonly referred to as a vampire facial when applied to the face, the process involves separating platelets from several tablespoons of blood drawn from a vein and reinjecting them using microneedling into areas of the skin such as scalp, cheeks, and brow.

Though there's little scientific evidence to support the procedure's benefits, it's claimed the concentration of platelets accelerates healing and reduces wrinkles, scar visibility, and other blemishes associated with aging.

By the spring of 2023, the NMDOH had identified four female clients of the spa and a male sexual partner of one of the women as having received a positive test result for HIV infection, the earliest in 2016. One who had received a vampire facial in 2018 was hospitalized three years later with an illness commonly associated with AIDS.

The investigation had uncovered a number of practices at the spa, including unlabeled tubes of blood and injectables such as botox being stored in a kitchen refrigerator alongside food, and unwrapped syringes in drawers, counters, and regular waste disposal. There was also no sign of a regulation steam-based sterilizing system in the facility.

Practitioners in the US are required to have a medical license to draw and separate the blood and re-inject the platelet-rich plasma.

Not only did the spa owner not have any of the mandated licenses, but they also did not have an adequate system for recording appointments or client details.

This not only makes it hard to know exactly how the infections spread, it makes it difficult to know just how many clients may have been affected. The NMDOH resorted to testing all 198 clients on record for HIV in the course of their investigation.

"Incomplete spa client records posed a substantial challenge during this investigation, necessitating a large-scale outreach approach to identify potential cases, as opposed to direct communication with all clients," the CDC discusses in its report.

"Requiring maintenance of sufficient client records to ensure adequate traceback by regulated businesses that provide injection services could ensure adequate capability to conduct traceback."

Spa owner Maria de Lourdes Ramos De Ruiz pleaded guilty to five counts of practicing medicine without a license in 2022, resulting in a jail sentence and a requirement to pay restitution to those infected.