Understanding med spa laws and regulations

The med spa industry is gaining rapid momentum, with forecasts it will reach more than $110 billion by 2030. As this demand grows, so too does the need for compliant med spa businesses. It’s an achievable goal, but one that requires time and patience.

When starting out, it’s important to know the exact classification of your business. As soon as medical treatments are involved (such as cosmetic injectables), it transitions from beauty clinic to a legally recognized medical clinic. As such, budding owners must understand the ins and outs of the corporate structures, delegation laws, and federal guidelines that regulate med spa businesses.

It’s an exercise that takes time and ongoing training. But when done right, your med spa business can be a sustainable, long-term investment. This guide walks you through the non-negotiables of US med spa law, and how to automate your compliance workflow from day one.

Key takeaways

• To be compliant, your med spa must follow both federal and local state regulations
• Non-compliance can result in fines in excess of $500,000, depending on the violation
• Med spa laws shape all facets of your business, including setup, staff, training, marketing, and documentation

Which industry bodies govern med spas in the US?

Which industry bodies govern your med spa business will change depending on your location and treatments. There are two categories: federal baselines (that apply to all med spas nationwide) and state-level regulators (which change depending on your local state).

Federal regulators

To protect patient privacy, workplace safety, and health information, there are compliance requirements that all med spas must adhere to across the US. These are the governing bodies enforcing those rules:

• Occupational Safety and Health Administration (OSHA): dictates workplace safety, the OSHA Bloodborne Pathogens Standard, and hazard communication (following OSHA standards is essential)
• Health Insurance Portability and Accountability Act (HIPAA): mandates Patient Health Information (PHI) protection within your med spa’s electronic medical records (EMR)
• Food and Drug Administration (FDA) and Drug Enforcement Administration (DEA): oversee the sourcing and tracking of medical devices and prescription substances (such as injectables)

Federal regulations are clear in their requirements. It gets murkier for state-enforced laws; however, there are key regulators to follow.

State-level regulators

Since state-level rules and regulations vary considerably, it’s best to do your due diligence here. The main regulator you need to know is your local State Medical Board. They will determine who can own your business, who can diagnose, and who can perform procedures.

To help understand your local regulations, check the American Med Spa Association (AMSPA) and the cosmetology or esthetics board.

Here’s a quick breakdown of the above for ease of reference:

• Federal – HIPAA: governs patient data, intake forms, patient photos, and electronic medical record security. Non-compliance: serious data-breach fines, loss of patient trust.
• Federal – OSHA: governs sharps and disposal boxes, clinical sanitation, and needlestick safety. Non-compliance: staff liability lawsuits, workplace safety fines.
• Federal – FDA / DEA: governs sourcing and tracking of approved medical devices and injectables. Non-compliance: criminal charges, product seizures.
• State – State Medical and Nursing Boards: govern who legally owns the clinic, who can diagnose, and who performs treatments. Non-compliance: immediate shutdown, loss of license, criminal charges.

These are your main business regulators, so it’s a good idea to understand what rules will impact your med spa. There’s also legalities around med spa ownership, and these rules vary state to state too.

The legalities around med spa ownership and business structure

The first thing you’ll need to know before starting your med spa is how ownership works. It’s not always linear, and setup will depend on your state laws and whether you’re a licensed physician who can practice medicine.

First, let’s take a look at local state laws. The main consideration here is whether your state enforces the Corporate Practice of Medicine (CPOM).

What is CPOM?

CPOM is a doctrine that restricts med spa ownership to licensed physicians (or physician-owned professional corporations). It’s designed to protect patients from decisions based on commercial or corporate interests. Since injectables are medical procedures, a med spa is legally a medical practice, which is why CPOM may come into play for your business.

CPOM rules around med spa ownership change from state to state. Even if your state doesn’t enforce CPOM, you’re still governed by general laws around the practice of medicine, nursing, and your med spa’s operations. So it’s best to learn what’s expected of you and your med spa.

Considerations for non-physicians opening a med spa

Owning a med spa is relatively straightforward for licensed physicians who can practice medicine. But what about registered nurses (RNs), estheticians, and business entrepreneurs? It’s still possible, but you’ll need to have the right business structure.

In CPOM states, opening a standard LLC or salon to offer cosmetic injectables and dermal fillers as treatments is illegal and can carry significant penalties. What you’ll need instead is something called a Management Services Organization (MSO) model.

The Management Services Organization (MSO) framework

The MSO is the gold standard in med spa structures, as it gives non-physicians the legal capacity to own a med spa. This structure separates the clinical business (owned by a doctor or NP) from the operational/management side of the business (owned by you):

• Professional Corporation (PC/PLLC) (clinical): owned 100% by a doctor (or sometimes a nurse practitioner (NP) depending on the state), which employs the injectors and handles all clinical decisions
• The MSO (operational): owned by the entrepreneur, including the building, marketing, payroll, and leasing equipment to the PC in exchange for a management fee

At Fresh Clinics, we support MSO setups by simplifying operations through our practice management platform. We help isolate clinical charts for medical oversight, which preserves the legal requirement of a ‘clinical firewall’ to keep your business compliant.

Medical oversight is also heavily regulated, with requirements that dictate your med spa’s chain of command and who can administer and perform certain procedures.

Who can legally perform cosmetic procedures?

There is a typical chain of command for performing cosmetic procedures. While registered nurses (RNs) typically administer the injections, they cannot legally diagnose or prescribe medical substances. Instead, RNs must operate under the license, delegation, and supervision of an advanced practitioner (such as a medical director (MD), doctor, nurse practitioner (NP), or physician assistant (PA)).

The rules around who can perform what in your clinic vary state by state. For ease of reference, we’ve broken down the typical chain of command, including the role and their legal supervision requirements.

Med spa chain of command for cosmetic procedures

• MD/DO (physician): can perform GFEs: yes. Can administer injectables/fillers: yes. Supervision requirements: none. They oversee all clinical requirements.
• NP/PA (advanced practice): can perform GFEs: yes. Can administer injectables/fillers: yes. Supervision requirements: dependent on state law.
• RN (registered nurse): can perform GFEs: no. Can administer injectables/fillers: yes. Supervision requirements: strictly required. Must have a patient-specific order from an MD, NP, or PA.
• Esthetician (skin professional): can perform GFEs: no. Can administer injectables/fillers: no. Supervision requirements: generally not permitted to perform medical or invasive procedures, unless state laws allow.

There are also restrictions around who is allowed to perform Good Faith Exams (GFEs).

What is a Good Faith Exam (GFE)?

A good faith exam is an initial, face-to-face evaluation (in person or via telehealth) required by law before any new patient receives a prescription-only medication (like cosmetic injectables or dermal fillers). Only a licensed prescriber (such as a physician, NP, or PA) can perform these consultations, as it involves reviewing medical history and clearing the patient for treatment.

Every patient needs a patient-specific order generated by a genuine GFE. The rule here is strict: pre-signed ‘standing orders’ are not compliant and have real consequences if used instead of a proper GFE.

What does a GFE include?

The GFE requirements are strict to protect patient safety and privacy. They must include:

• Compiling medical history
• A physical aesthetic assessment
• Risk-benefit counseling
• The final clearance verdict

GFEs can be complex to manage, so many med spas use software to help. At Fresh Clinics, our integrated on-demand telehealth network removes bottlenecks by connecting patients with a qualified prescriber via video chat, without ever needing to leave the treatment room.

For beauty salon owners wanting to offer medical treatments, there are more compliance hurdles to clear before they can turn their salon into a med spa.

What’s legally required to turn a beauty salon into a med spa?

Whether you’re starting a med spa business from scratch or you’re looking to add medical treatments to your ‘beauty lounge’ menu, you’ll need a legally compliant medical space. Here are the strict OSHA and medical refrigeration standards you need to adhere to:

Your med spa’s physical setup

The first part of making your med spa suitable for medical treatments is your clinic’s physical setup. You must ensure all treatment rooms:

• Have non-porous surfaces
• EPA-approved medical disinfectants
• Point-of-use sharps biohazard containers
• Mandatory hand hygiene stations

Next, you’ll need to know how to keep and store your medical substances.

Cold chain management

Medical substances require consistent, unbroken refrigeration. As such, you must meet the proper medical storage mandates that maintain 34°F to 46°F, as outlined by the US Pharmacopeia (USP). Do not use household or mini beauty fridges, as they suffer from severe temperature fluctuations and put compliance at risk.

To catch problematic temperature changes, install continuous data loggers on your medical fridge to alert you when temperatures rise above or fall below the legal range.

At Fresh Clinics, we know the complexity of inventory compliance. That’s why our platform allows injectors to log batch numbers, lot numbers, and expiration dates digitally during patient charting. It automatically tracks your inventory and keeps it traceable in the event of an audit.

When that happens, you must have everything done properly and squared away: that includes critical documentation.

Critical documentation every med spa must have

Documentation is fundamental to capture processes, procedures, and medication handling. Critical documents required for all med spas include:

• Medical director responsibilities agreement
• GFE records
• Standing orders and protocols
• Delegation of authority
• Medical history intake forms
• Treatment notes
• Policies and procedures
• Licenses, training, and certifications
• Medical malpractice insurance policies

This is just to name a few. There are two types of documentation that are extremely important when it comes to legal safety and compliance: informed consent and emergency standard operating procedures (SOPs).

Informed consent documentation

The informed consent document is a form patients sign prior to receiving a treatment. It legally proves the procedure was properly explained and the patient understands the risks, benefits, and alternatives. The procedure cannot go ahead without it.

What you need to know about informed consent documentation:

• The patient’s consent must be derived from a documented, procedure-specific conversation. A signature on a generic document won’t hold up in court, so this is critical to protect your patients and your business.
• It must explicitly detail the realistic longevity of the product, alternative treatment paths, and rare but severe adverse side effects (such as necrosis, blindness, or stroke).
• All informed consent documents must be signed before treatment can begin.
• All informed consent documents must be safely archived in a secure ‘digital firewall’.

Emergency standard operating procedure documentation

A standard operating procedure (SOP) is a document used to explain how to do routine tasks step-by-step, safely, and legally. This can include baseline workflows such as facility sanitation, medical waste handling, and device maintenance tracking. All SOPs are important documentation.

But when emergency adverse events occur, your medical board and malpractice insurer will require signed, written protocols for handling these situations. This is why emergency SOPs are critical.

Every med spa in the US must have the following emergency SOPs as non-negotiable:

1. Vascular occlusion protocol: this must include detailed, step-by-step roadmaps for immediate action (such as identifying blanching/delayed capillary refill, high-dose pulsed hyaluronidase injection formatting, warm compresses, and clear specialist referral pathways)
2. Anaphylaxis protocol: this must include clear triggers for administering an Epinephrine auto-injector (EpiPen) and activating emergency services (911)

Remember, even the most robust emergency SOP is useless without stocking an active, in-date emergency reversal crash cart (multiple vials of hyaluronidase, adrenaline, aspirin, etc.) to support it.

This covers the documentation for the internal operations of your med spa. Now let’s look at how you can legally advertise your business to your market.

Rules around marketing your med spa

Marketing a medical spa is different from marketing a traditional beauty salon. Not only do you have to comply with general business advertising rules, but there is an additional layer that dictates what you say and how you say it.

Because treatments in a med spa involve FDA-regulated prescription devices and drugs, your marketing falls under both the Federal Trade Commission (FTC) oversight and state medical board advertising rules. An accidental misstep, such as a deceptive claim or an unvouched testimonial, can result in severe fines from the FTC.

The do’s and don’ts of med spa advertising

Medical marketing is a tough tightrope to walk, but knowing what not to do is half the battle. Here’s a quick overview of what you should and shouldn’t do:

Do:

• Keep advertising free from guarantees or misleading claims.
• Be genuine and speak to real results, within guideline allowances.
• Only use real patient reviews that are limited to their experience and not their opinions on treatment.

Don’t:

• Minimize risk or imply low risk of a medical procedure (for example, calling injections ‘completely risk-free’ or ‘remove wrinkles by lunchtime’, etc.).
• Use deceptive marketing claims.
• Use false or misleading photographs: all photos must be genuine and taken under identical lighting, angles, and framing. They also require conspicuous disclaimers stating that individual results may vary.
• Make guarantees or imply guaranteed results.
• Post patient reviews that make unsubstantiated or overpromised clinical claims.

If influencer marketing is part of your strategy, you’ll need to handle this delicately. All reviews and ads must be clearly disclosed on their post (whether on TikTok, Instagram Reels, etc.) by using visible tags like #sponsored or #ad.

Risks and penalties for non-compliance

Handling compliance across all facets of your business (including staff, documentation, and training) will ensure your med spa operates as it should. Even those with good intentions will face significant consequences if regulations aren’t properly followed.

The ripple effect can be dire. For example, state medical boards don’t need to prove a patient was physically disfigured to issue an emergency cease-and-desist. The lack of an established medical delegation chain is enough to mandate an immediate operational freeze.

Potential penalties, triggers, and fines for non-compliance

• Unlicensed practice: triggered by delegating prescription injections to unqualified or unsupervised providers. Enforced by state medical boards and criminal courts. Penalties are set state by state and can range from $1,000-$5,000 (misdemeanor) and $10,000-$100,000+ (felony), plus a possible emergency cease-and-desist order.
• Medical director violations: triggered by collecting a retainer without documented active oversight. Enforced by state medical boards (e.g. Florida, AHCA). Varies by state. E.g. Florida: civil fine up to $5,000, with each day of continued violation a separate offense.
• HIPAA data breach and cyber liability penalties: triggered by storing patient data or unconsented photos on unencrypted or non-compliant platforms. Enforced by the US Department of Health and Human Services (HHS) and Office for Civil Rights (OCR). Up to $73,011 per violation category, up to $2M+/year for willful neglect, and $100,000+ typical remediation cost.
• Civil malpractice settlements for aesthetic care: triggered by adverse events (infections, burns, etc.) from providers working outside scope of practice. Enforced by civil courts / malpractice insurers. $215,000-$425,000 average settlement, and $500,000+ for severe/permanent damage (such as necrosis, visual impairment, etc.).

For med spa entrepreneurs, ticking all required compliance boxes is one of the biggest and most time-consuming parts of med spa setup. A task that can be made easier with the right guidance and support.

How Fresh Clinics can help you

Setting up a med spa takes time, dedication, and patience. When done right, it’s a long-term sustainable business that taps into growing demand. The penalties of non-compliance prove that running a compliant med spa is just as important for asset protection as it is for patient and workplace safety, privacy, and training.

Mitigate some of the financial risk of non-compliance with a practice management platform designed for it. With Fresh Clinics, your workflow is covered: from charting designed to help with HIPAA compliance and automated medical inventory management, through to a built-in telehealth network with licensed US prescribers for Good Faith Exams.

Join Fresh Clinics today to access our purpose-built platform and alleviate the burden of med spa compliance.

FAQ

What are the med spa legal requirements in the US?

Med spa legal requirements fall into two categories: federal laws that apply to every med spa in the US, and state-based regulations that change by location. These include (but are not limited to):

• OSHA workplace safety standards (federal)
• HIPAA patient data protection rules (federal)
• FDA/DEA rules around medical devices and prescription substances (federal)
• CPOM doctrine rules (state-based)
• Physician supervision requirements (state-based)

How does the Management Services Organization (MSO) model protect non-medical investors?

CPOM rules (which vary by state) restrict med spa ownership to licensed physicians. To remain compliant in CPOM states, the MSO model protects non-medical investors by legally splitting the business into two separate entities: the clinical side (which is owned by a licensed physician) and the operational company (owned by the non-medical investor). This ensures all medical decisions and compliance requirements sit under the physician’s control, while allowing the non-medical investor to invest in the med spa’s operations.

What are the legal consequences of violating the Corporate Practice of Medicine (CPOM) doctrine?

The CPOM restrictions around med spa ownership vary state by state, so it’s vital to know what’s required for your med spa. Violations of the CPOM doctrine can result in:

• Criminal prosecution for an unlicensed practice of medicine (with fines up to $100,000+ depending on the severity of the charge)
• Voiding corporate contracts, including MSO agreements that haven’t been properly set up
• Emergency cease-and-desist orders, which stop all business operations and can be issued without proof that patient harm has occurred

This information was accurate at the time of publication and does not constitute legal advice. Always seek advice from qualified experts such as a commercial lawyer and/or accountant.