Med spa laws by state: Ownership, licensing, and compliance guide

Key takeaways

Thirty-six states have no med spa statute, so compliance rests on the state medical practice act and board guidance.

MDs and DOs can own a med spa in every state. NPs can own independently only where they hold full practice authority.

Most states require a medical director, and the agreement must name delegated procedures, supervision frequency, and oversight scope.

Pabau’s digital consent forms and compliance tools keep every treatment documented and your records audit-ready as state rules change.

Thirty-six of the 50 US states have no statute governing how a medical spa must operate. That silence does not make the rules optional. Compliance rests on whoever reads the state medical practice act, the cosmetology board rules, and the relevant medical board’s guidance. Get it wrong, and the penalties run from fines to license revocation.

Med spa laws by state cover four separate questions. They are ownership, supervision, scope of practice by credential, and facility permits. This guide works through all four. Start with the section for your credential. That holds whether you are an RN opening your own practice, an NP checking full-practice-authority rules, or a physician running several locations.

Use this as your reference, then consult a healthcare attorney licensed in your state before making ownership or staffing decisions.

Why the regulatory patchwork exists

According to the American Medical Association, 36 states have no specific regulatory framework governing medical spas. No federal law defines what a med spa is or who may own one. Every state handles it through three overlapping legal sources. Those are the state medical practice act, the cosmetology or esthetics board statutes, and rulings from the relevant state medical board.

State medical boards classify treatments by whether they constitute the “practice of medicine.” Injecting neuromodulators or operating a laser typically meets that definition. Once a treatment crosses into medical practice, the rules tighten. They restrict who may perform it, who must supervise it, and who may profit from it.

A small number of states have written med spa-specific rules, which leaves less room for interpretation. California is not among them. Its reputation for strictness comes from aggressive CPOM enforcement rather than a dedicated med spa statute. The remaining 36 states create compliance risk through ambiguity.

• No single federal agency licenses or regulates medical spas
• State medical boards govern what constitutes the “practice of medicine”
• Cosmetology boards govern esthetics treatments that do not cross into medicine
• Many treatments sit in the gray area between the two
• Board opinions and advisory letters are updated often, so rules that applied last year may not apply today

Who can legally own a med spa?

Physicians can own a med spa in every state. For every other credential, the answer depends on your license and on whether your state enforces the corporate practice of medicine. The table below summarizes the general pattern. Individual state rules override these categories, so verify with your state medical board or a healthcare attorney.

The corporate practice of medicine doctrine and MSO structures

The corporate practice of medicine (CPOM) doctrine holds that a non-physician entity cannot employ physicians or own a medical practice. In strict CPOM states such as California, New York, and Texas, the med spa must be owned by a physician or a physician-owned professional corporation.

Non-physician investors and operators who want to participate use a management services organization (MSO). The MSO is a separate entity that contracts with the physician-owned practice. It provides management, staffing, and administrative services for a fee.

MSO structures are widely used, but they have to be built carefully. A structure that splits fees or looks like a sham arrangement to circumvent CPOM invites enforcement. About half of all states do not enforce CPOM, and those states allow more flexible ownership. Working the questions in order shows which route your own credential and state leave open.

Medical director requirements for med spas

Most states require a med spa performing medical treatments to have a licensed physician as medical director. What the role demands varies widely. Some states mandate on-site physician presence for certain procedures. Others permit remote supervision under a formal collaboration agreement.

Finding a willing physician is the easy part. The agreement itself must specify the scope of delegated procedures, the frequency of chart reviews, and the oversight mechanism for new staff. It also has to set the protocol for emergencies. A one-page boilerplate agreement rarely satisfies a state medical board.

Whether a nurse practitioner can hold the role is a separate question. The answer depends on state law and on the treatments the practice offers.

• On-site requirement: States such as Florida require a physician to be on-site when certain procedures are performed
• Remote supervision: Many states permit telemedicine-style oversight with chart review and availability by phone
• Collaboration agreement: The written agreement must name specific delegated procedures and oversight frequency
• Physician credentialing: The medical director must hold an unrestricted license in the state where the med spa operates

Scope of practice: What each provider type can perform

Scope of practice decides every staffing and treatment call at a med spa. An RN may administer Botox under physician delegation in Texas but cannot administer it autonomously in California. A PA may inject fillers with supervising physician authorization in some states and need direct physician presence in others. The table below reflects general patterns, so verify it against your state’s medical and nursing board guidance.

Med spa laws by state: Key jurisdictions explained

This section covers the jurisdictions where the rules are strictest and where mistakes cost the most, rather than all 50 states. The American Med Spa Association maintains state-by-state legal summaries and updates them regularly.

California and Texas

California is the strictest state for med spa ownership, and CPOM enforcement is the reason. The Medical Board of California requires a med spa offering medical treatments to be owned by a physician or a physician-owned professional corporation. Non-physician investors must route their participation through an MSO. NPs and PAs cannot own independently. Our guide to California med spa licensing covers the detail.

Texas takes a different route. The Texas Medical Board permits NPs and PAs to perform delegated acts, but a licensed physician must order and delegate every injectable treatment. RNs may administer under a physician’s standing delegation order. CPOM restricts ownership by non-physicians. Our breakdown of Texas med spa licensing has the board’s framework in full.

Florida, New York, and other high-scrutiny states

Florida requires a physician on site when certain medical procedures are performed, and it sets specific rules for laser facilities. New York enforces strict CPOM. It requires a physician or licensed professional to hold a beneficial ownership interest in any entity providing medical services.

Illinois and Georgia enforce actively against unlicensed practice. Their boards focus on who may administer neuromodulators and who qualifies as a supervising physician under state law.

Botox and injectable regulations by state

Botox is a prescription-only medicine in every US state, so a licensed prescriber must issue the order everywhere. What varies is who may administer it once it is prescribed.

• Physicians (MD/DO): Can prescribe and administer in all states
• NPs (full-practice-authority states): Can prescribe and administer independently, including in Oregon, Colorado and Washington
• NPs (restricted states): May administer under physician delegation, but cannot prescribe independently
• PAs: May administer under supervising physician authorization in most states
• RNs: May administer under a valid physician delegation order, but cannot prescribe
• Estheticians and unlicensed staff: Cannot administer Botox in any state

Georgia and Illinois have both updated their injectable regulations in recent years, after patient safety incidents at unlicensed facilities. Several states are reviewing whether to tighten prescriber-present requirements. Monitor your state medical board for advisory opinions and rule changes.

Laser and energy-based device regulations by state

Laser rules are the most inconsistent of any med spa regulation. Alabama and Mississippi require a physician to perform or directly supervise every laser treatment. Colorado and Oregon let trained RNs operate lasers autonomously under a standing order system.

Licenses and permits you need to open a med spa

Opening a med spa takes more than a business license. The stack varies by state but generally covers the categories below. Our guide on who can legally open a med spa covers credential eligibility state by state.

• Business license: Required in all states, and issued by city, county, or state depending on jurisdiction
• Medical facility permit or practice registration: Required in states that regulate medical facilities, and the terms vary widely
• Professional licenses: Every practitioner must hold an active, unrestricted license in the state
• Laser facility permit: Required in states with specific laser safety regulations, such as California and Florida
• DEA registration: Required if the med spa will store or administer controlled substances, such as certain injectable sedatives. Standard topical numbing agents like lidocaine and prilocaine are not controlled substances
• State cosmetology board registration: If esthetic services run alongside medical treatments, the facility may need dual registration

HIPAA compliance for med spas

A med spa is a HIPAA covered entity once it transmits protected health information electronically in connection with payment. That is the standard set out in HHS guidance on covered entities. In practice, almost every med spa that accepts insurance or bills electronically qualifies.

Cash-pay med spas may also be covered. Digital intake forms, electronic treatment records, and record sharing with referring providers all bring HIPAA’s Privacy and Security Rules into play.

The core obligations are concrete. You need a signed business associate agreement with any vendor that handles patient data, including your practice management software. You also need a written privacy notice, a designated HIPAA security officer, and a documented breach response plan.

Published HHS enforcement actions show settlements above $100,000 for relatively modest breaches at med spas.

Consequences of non-compliance

State medical boards can revoke or suspend licenses, issue cease-and-desist orders, and levy civil fines. Criminal charges for unlicensed practice of medicine are possible where non-licensed individuals perform medical procedures. Civil liability from patient harm compounds those risks.

Insurance carriers increasingly audit ownership structures and scope-of-practice documentation before renewing malpractice coverage. A practice found out of compliance during an audit may face coverage denial. Even a board complaint that is ultimately dismissed carries a substantial financial and reputational cost.

Med spa compliance checklist: Staying audit-ready in any state

The checklist below covers the documentation and operational requirements that apply across most US states. Work through it once a quarter rather than once a year. Most of these items live or die on record keeping. That makes the choice of medical spa EMR software as consequential as the policy behind it.

• Written medical director agreement in place, specifying delegated procedures, supervision frequency, and emergency protocols
• All practitioner licenses verified as active and unrestricted in the operating state, with copies on file
• Signed consent forms for every treatment, including risk disclosures specific to each procedure
• Standing delegation orders documented for every procedure performed by non-physician staff
• HIPAA privacy notice posted and acknowledged, and BAAs signed with all relevant vendors
• Laser facility permit, where applicable, current and posted
• Business structure reviewed by a healthcare attorney against CPOM rules in your state
• Staff scope-of-practice documentation updated after any state medical board advisory changes

How Pabau helps med spas stay compliant across states

Software cannot replace legal counsel, but the right system removes the operational friction that turns a policy into a missed record. Practice management software like Pabau is built as software for med spas, so the consent and record workflows already match the treatments. Two areas matter most for state compliance: Documentation and consent capture.

Pabau’s digital consent forms let you build state-specific intake and consent workflows. Patients complete and sign before they arrive, the record is timestamped, and the consent stays linked to the treatment record. Its compliance tools cover audit-trail documentation, expiry tracking for staff licenses, and record retention periods you can set per state.

For a group operating in more than one state, that per-state configuration is the difference between one compliance regime and several. Staff credential expiry tracking then runs across every location from the same dashboard.

Keep compliance records audit-ready in every state

Pabau’s digital consent forms and audit trails document every treatment. Signed consents are captured before the procedure, and records stay in the shape state medical boards expect.

Book a demo

Conclusion

The practical move is to work out which of the four questions actually binds you. Ownership eligibility is settled by your credential and your state’s CPOM stance. It is the one question you cannot fix later with better paperwork. The supervision and scope questions downstream of it are documentation problems, and those you can fix.

The trade-off worth remembering is that ambiguity cuts both ways. In the 36 states with no med spa statute, no regulator will confirm that you are compliant. The burden of proof sits with your records. A practice that can produce a signed consent, a current license, and a standing delegation order for every procedure survives an audit in any state.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Consult a licensed healthcare attorney in your state before making ownership, staffing, or compliance decisions.

Book a demo to see how Pabau keeps consent forms, staff credentials, and treatment records audit-ready in every state you operate in.

Continue your research

Thinking about opening a second location in another state? Multi-location med spa management covers the operational and regulatory differences to plan for before you expand.

Still need to appoint a medical director? How to hire a medical director for a med spa walks through the search, the agreement, and the oversight terms that satisfy a board.

Not sure whether HIPAA applies to a cash-pay practice? Do med spas have to be HIPAA compliant? sets out when the Privacy and Security Rules bind you.

Weighing up a non-physician ownership structure? MSO structures for med spas explains how the management entity and the practice entity are meant to fit together.

Want the checklist in a working format? Medical spa compliance checklist turns these requirements into a document you can audit against each quarter.

Frequently asked questions