Client rights policy template: Free PDF download
The 7 core client rights: confidentiality, informed consent, refusing treatment,...
July 23, 2026
Key Takeaways
Meeting med spa requirements means stacking several approvals before you open: a business license, spa professional licenses, a seller’s permit, a building permit, a certificate of occupancy, and HIPAA certification.
Most states require a licensed physician to own or supervise a medical spa, though a few allow nurse practitioner ownership under physician oversight.
Non-physicians can still open a med spa by structuring the business as a Management Services Organization (MSO) with a physician partner.
HIPAA compliance covers staff training and patient data handling, including how your practice uses client photos and testimonials on social media.
Requirements vary by state, so confirm the specifics with your state’s medical board and licensing office before you sign a lease.
Getting your medical spa requirements in order before you open separates a smooth launch from a costly delay.
Miss a license, permit, or compliance step, and you risk fines or a failed inspection. Your launch date could slip by months.
The list runs from business licenses and building permits to HIPAA certification and physician oversight. And if you aren’t a licensed physician yourself, plan for a few extra steps too.
This guide walks through exactly what you need, state by state, so nothing catches you off guard.
What is a medical spa?
A medical spa blends medical treatments with spa services. Think anti-wrinkle injections, laser hair removal, and chemical peels alongside massages and facials.
Med spas generally fall into one of two business models: aesthetic spas and medical aesthetic spas.
Aesthetic spas focus on noninvasive treatments like anti-aging facials and relaxation massages, and typically don’t require a physician on-site.
Medical aesthetic spas offer treatments that only physicians, nurses, or medical aestheticians can legally provide. These include anti-wrinkle injections, dermal fillers, and dermatological treatments.
Who can open a medical spa in the US?
In many states, you can’t own a medical spa unless you’re a licensed physician. The treatments a med spa offers — injectables, laser procedures, and skin treatments — count as the practice of medicine, so a licensed physician has to perform them or directly supervise the people who do.
That’s why most states bar non-physicians from owning a med spa outright, or from employing doctors to work under them. There are exceptions. In Alaska and Florida, a physician only needs to supervise the practice, not own it. In states like New York and Minnesota, a nurse practitioner can co-own a medical spa under physician oversight.
Here’s how ownership and treatment rights tend to break down by role. Rules vary by state, so confirm the specifics with your state medical board before you commit.
| Role | Can own a med spa? | Can perform medical treatments? |
|---|---|---|
| Physician (MD or DO) | Yes, in every state | Yes, the full range |
| Nurse practitioner (NP) | In some states, under physician oversight | Yes, under approved protocols |
| Physician assistant (PA) | Usually only through an MSO | Yes, under physician supervision |
| Registered nurse (RN) | Only through an MSO | Only under a prescriber’s direction |
| Esthetician | Only through an MSO | Surface-level treatments only |
Estheticians and other non-medical staff can work in a med spa, but in most states they’re limited to surface-level services like facials and microdermabrasion. They can’t administer injectables or operate lasers.
Licenses, permits, and certifications you need to open a medical spa: Checklist
Licensing requirements differ by state. Check your state’s official rules on who can legally open a medical spa before you commit to a location.
Business license for med spas
Every med spa needs a business license to operate legally, regardless of size. You can apply through your state department’s website or the U.S. Small Business Administration, providing your personal information, Social Security number, and business name.
Having a business plan ready before you apply speeds this up, since you’ll know your entity structure and ownership details.
Pro Tip
Keep digital copies of every business license, permit, and certification in your practice management software so you can pull them up instantly during an inspection, an insurance renewal, or a lease negotiation.
Spa professional licenses
Licensed, trained professionals must perform most spa treatments. Aestheticians and massage therapists, for example, need state licenses and training from accredited programs. They also need ongoing continuing education to keep those licenses active.
Licensed physicians
Physicians don’t need to personally perform every treatment. Most states require qualified medical professionals on staff to oversee how treatments happen.
Exact rules vary, but you’ll typically need a physician or board-certified plastic surgeon on staff. Their oversight role often shapes how you structure staff pay and commission.
Seller permits
If you plan to sell retail products alongside your services, most states require a seller’s permit. You can usually apply online through your state’s official website.
Building permits
Even minor renovations require a building permit and inspection. Apply for the permit with your local building department. Expect a visit from a fire or safety inspector before final approval.
Certificate of occupancy
You’ll need to schedule an inspection with your local property department or government agency to get this certificate.
The inspection checks that your location meets zoning rules and has the required square footage for your services. It also confirms proper water, electrical, and fire safety.
HIPAA certification
Similar to a medical practice, your med spa must meet HIPAA regulations. Train your staff on these requirements so they know how to protect patient information — ideally within a HIPAA compliant CRM — when dealing with clients.
If you’re unsure whether med spas have to be HIPAA compliant, this checklist breaks down when HIPAA applies. It also covers what you need to put in place.
Posting client photos or testimonials without proper consent is one of the most common HIPAA slip-ups at med spas. Read what you need to know about HIPAA compliance and social media before you post.
Operating a medical spa business if you are not a licensed physician
In states that require physician ownership, you can still open a med spa without being a doctor. Structure the business as a Management Services Organization (MSO) with a Management Service Agreement (MSA).
How it works
You sign an MSA with a licensed physician who becomes the legal owner of the practice. That physician takes responsibility for supervising, performing, and making decisions about treatments.
As the MSO, you handle the business side — bookkeeping, payroll, marketing, and HR. You work closely with the physician to keep day-to-day operations within state medical standards.
Med spa laws by state
Med spa laws by state vary significantly, and in some cases a specific service needs a specific license. It’s worth getting guidance from a local legal and financial expert before you launch.
Here’s a look at three states with stricter requirements.
Pro Tip
Get a signed release before posting any before-and-after photo or testimonial, even ones a client sends you unprompted — a written release protects both the client’s privacy and your practice.
Requirements for opening a medical spa in Florida
- In Florida, anyone can open a med spa business, but a licensed physician must supervise it. (Note: the supervising physician can oversee only one additional location apart from their primary practice.)
- Laser or light-based services require an electrologist license. A licensed physician or a supervised physician assistant can perform them. A nurse practitioner can also perform them under a physician-signed protocol.
- Nurse practitioners and physician assistants can order and administer anti-wrinkle injections. They must follow protocols that a licensed physician has reviewed and approved.
Requirements for opening a medical spa in California
- In California, licensed physicians must exclusively own medical spas. These spas must operate as professional corporations rather than limited liability companies (LLCs).
- A licensed physician must carry out any procedure categorized as a medical service. A registered nurse or physician assistant can also do so under close physician supervision.
- Licensed aestheticians and cosmeticians can perform surface-level microdermabrasion treatments.
Requirements for opening a medical spa in Texas
- In Texas, only licensed physicians can own medical spas.
- Medspas must obtain an operator’s certificate from the Texas Secretary of State, which lists them officially on the state’s website.
- Before any medical service, a licensed physician or physician assistant must assess the client and prescribe a treatment plan. They must also provide necessary oversight.
- Physicians cannot delegate treatments to estheticians, and estheticians cannot perform laser treatments.
If you want the specific requirements for your state, check with the American Med Spa Association.
Keep your medical spa compliant with Pabau
Staying on top of licensing requirements is easier with the right tools in place. Practice management software like Pabau helps you keep every patient record, form, and compliance document organized in one place.
Our medical spa software includes:
- Paperless client record management
- Robust electronic health records (EHR) and charting
- Pre-built and customizable intake forms
- Pre- and post-care forms
- Face plotting diagrams and before and after photography
- Online booking platform
so you can focus on patient care instead of paperwork.
Compliance is the foundation, but running the day-to-day well matters just as much. That includes scheduling, service menus, the packages you sell, and even patient compliance with aftercare and follow-up.
Frequently asked questions
What license do you need to open a medical spa?
There’s no single medical spa license. You’ll typically need a business license, a seller’s permit if you retail products, a building permit, and a certificate of occupancy, plus the state licenses your treatment providers hold. In most states, a licensed physician must also own or supervise the practice, which is the rule that catches new owners off guard.
Do med spas need a doctor?
In most states, yes. Because these treatments are medical procedures, a licensed physician has to own the practice or supervise it as medical director. A handful of states let nurse practitioners take on that role under physician oversight, but a qualified prescriber signing off on treatment protocols is almost always part of the setup.
Can a nurse open a med spa?
It depends on the state and the nurse’s qualification. In several states, a nurse practitioner can own a medical spa under physician oversight. A registered nurse usually can’t own one outright, but can open a med spa as a nurse by setting up a Management Services Organization with a physician partner who takes clinical responsibility.
The bottom line on medical spa requirements
Opening a med spa is exciting, but the requirements take careful planning. They vary by state, and most states require a licensed physician’s involvement because of the medical nature of the treatments.
At minimum, you’ll need a business license, a building permit, and HIPAA certification. The exact list depends on where you’re opening.
Research your state’s regulations early and get legal and financial guidance before you launch. Some states let nurse practitioners or other medical professionals own or operate a med spa.
Documenting patient records properly and running a well-organized practice matters just as much as the paperwork. That’s where a practice management vendor like Pabau earns its keep. Non-compliance carries costs, from fines to lost licenses that cut directly into what medical spa owners earn.
Check out what we consider the best medical spa software right now.
Ready to see how Pabau keeps your practice compliant while your team focuses on patients? Book a demo to see it in action.
Continue your research
List Item #1
List Item #2
