Medical Spa Requirements: How to Open & Operate Legally ?

The global medical spa market is projected to grow from approximately $23.3 billion in 2025 to $26.2 billion in 2026 — and that momentum is pulling in a wave of new operators: physicians, nurse practitioners, aestheticians, wellness entrepreneurs, and investors, each looking to capture a share of one of the fastest-growing sectors in healthcare services. What that figure does not capture is the regulatory complexity sitting underneath the opportunity.

A medical spa is not a beauty salon with better equipment. Because it delivers medical procedures — neurotoxin injections, dermal fillers, laser treatments, chemical peels, IV therapy, and similar services — it is classified as a healthcare practice under state law. That classification triggers medical licensing requirements, physician oversight obligations, corporate structure rules, and ongoing compliance obligations that catch uninformed operators off guard with alarming regularity.

The American Med Spa Association (AmSpa), the AMA, and state medical boards have made their position clear in 2025 and 2026: the era of minimal med spa oversight is over. Enforcement actions against non-compliant clinics have intensified across California, Texas, New York, New Jersey, and Florida. New York’s 2026 statewide enforcement sweep cited nearly 2 in 5 medical spas for violations.

This guide covers everything you need to open and operate a medical spa legally — ownership structure, medical director requirements, licensing, corporate compliance, and the clinical infrastructure that keeps the practice defensible when a regulator comes looking.

Who can legally own a medical spa

Ownership eligibility is the first question every prospective medspa owner must answer — and it is the question where most costly mistakes are made. There is no single federal rule governing medspa ownership. Instead, each state sets its own requirements, shaped primarily by that state’s Corporate Practice of Medicine (CPOM) doctrine, nurse practitioner scope-of-practice laws, and business entity regulations.

At the broadest level, ownership eligibility breaks down into three categories:

Physician owners (permitted in all states)

A licensed MD or DO can open a medical spa in every U.S. state. In states with strict CPOM enforcement, a physician or physician-owned professional corporation is the only fully unrestricted ownership pathway. Even in more permissive states, physician ownership is the cleanest legal structure because it requires the least number of additional compliance layers to satisfy clinical oversight requirements.

Nurse practitioner owners (permitted in select states)

Whether a nurse practitioner can own or co-own a medical spa depends entirely on the state. In states with full practice authority — including Arizona, Colorado, Minnesota, New Mexico, New York (with qualifying hours), and others — NPs may own medspas under defined conditions. Even in these states, however, NP ownership does not eliminate all physician oversight obligations. Botox, dermal fillers, laser treatments, and similar delegated procedures may still require a physician medical director’s authorization, standing orders, and protocol oversight regardless of the NP’s individual practice authority.

Non-physician / non-clinical owners (permitted via MSO structure)

Entrepreneurs, investors, aestheticians, and other non-clinical owners can participate in medspa ownership in most states — but not by directly owning the clinical practice entity. The solution is the Management Services Organization (MSO) model, which separates business operations from clinical services. The non-physician owner controls the MSO, which handles marketing, staffing, billing, and administrative functions. The clinical services are provided through a physician-owned Professional Corporation (PC). This structure allows non-physician participation while keeping medical decision-making authority with the physician.

CPOM and the PC/MSO structure explained

The Corporate Practice of Medicine (CPOM) doctrine exists in most U.S. states to ensure that medical decision-making remains in the hands of licensed physicians — not investors or business entities motivated purely by profit. Under CPOM, corporations and non-physicians are generally prohibited from employing physicians or owning medical practices in ways that could influence clinical decisions.

For medspas specifically, CPOM means that the entity performing and billing for medical services must be owned or controlled by a licensed physician (or, in some states, another licensed healthcare professional). This triggers a common structural solution: the PC/MSO model.

How the PC/MSO structure works

• Professional Corporation (PC) — a physician-owned entity that legally employs clinical providers, delivers medical services, and holds the facility’s medical license. The physician retains clinical and ownership control here.
• Management Services Organization (MSO) — a separate business entity (commonly an LLC) owned by the non-physician owner, investor, or entrepreneur. The MSO contracts with the PC to provide business services — billing, marketing, hiring administrative staff, leasing equipment and space — in exchange for a management fee.
• Management Services Agreement (MSA) — the formal contract between the PC and the MSO that defines the services the MSO provides, the fee it charges, and the boundary between business and clinical decision-making.

When structured correctly, the PC/MSO model is fully compliant. When structured carelessly — with the MSO exerting control over clinical decisions, the physician serving as a nominal figurehead, or the management fee set at a percentage of clinical revenue rather than a flat service rate — it collapses into a CPOM violation and can result in the forced restructuring or closure of the practice.

LocumTele’s 51-state compliant PC infrastructure service is designed specifically to provide this structure correctly — with a physician-owned PC in every state your medspa operates, paired with an MSO arrangement that maintains genuine separation of business and clinical functions.

Medical director requirements

A qualified, actively engaged medical director is required in virtually every U.S. state for any medspa offering physician-grade services. This is not an administrative formality — it is a legal prerequisite that must be in place before the first patient walks in the door.

The medical director’s core responsibilities in a medspa context include:

• Drafting and signing clinical protocols and standing orders for all services — injectables, laser treatments, chemical peels, IV therapy, and any other delegated procedures
• Supervising and credentialing all clinical providers — NPs, PAs, RNs, and medical aestheticians performing delegated treatments
• Conducting regular chart reviews to verify documentation quality and protocol adherence
• Being reachable for urgent provider consultations and managing adverse event response
• Ensuring the medspa operates within the scope-of-practice delegation rules of its state, including any proximity or on-site requirements for specific procedures

2026 enforcement note: State medical boards in California, Texas, New York, New Jersey, and Florida have all intensified enforcement against passive medical director arrangements in the past 18 months. Physicians found to be nominal directors — lending their license without genuine engagement — have faced license suspensions and civil penalties. The clinics they supervised have faced closure. A medical director agreement without documented, active oversight is not compliant.

For medspas expanding into multiple states, each state requires its own physician with an active, unrestricted license in that jurisdiction. LocumTele’s medical director oversight service provides engaged, credentialed physicians across all 51 U.S. states, with protocol development, standing order authorization, and chart review infrastructure built in.

Licenses and permits you need

Beyond the medical director and ownership structure, opening a medspa requires navigating a stack of business and clinical licenses. The specific requirements vary by state, county, and municipality, but the following are universally applicable:

Clinical compliance: protocols, standing orders, and HIPAA

Licenses and corporate structure get your medspa open. Clinical compliance keeps it open. These are the ongoing operational requirements that every medspa must maintain — not just at launch, but continuously as the practice evolves.

Written clinical protocols for every service

Every treatment your medspa offers must be supported by a written clinical protocol signed by the medical director. The protocol defines patient eligibility criteria, contraindications, pre-treatment assessment requirements, dosing parameters, informed consent standards, and emergency response procedures for that specific service. These documents are the foundation of your compliance defense in any adverse event or regulatory investigation.

Standing orders for delegated procedures

If your clinical team includes NPs, PAs, or RNs performing treatments, their authority to do so depends on valid, physician-signed standing orders. A standing order is a written directive authorizing a specific provider to perform a specific procedure under defined clinical conditions without requiring the physician to be present for each encounter. Without current standing orders, your non-physician providers are likely practicing outside their legally authorized scope every time they treat a patient.

HIPAA compliance

Medical spas are covered entities under HIPAA. This means maintaining signed Business Associate Agreements with all technology vendors handling patient data, training staff on HIPAA’s minimum necessary standard, implementing access controls for electronic health records, maintaining breach response procedures, and conducting regular internal compliance audits. HIPAA violations carry civil penalties starting at $100 per violation and escalating significantly for willful neglect.

Provider credentialing and ongoing oversight

Track renewal dates for all clinical licenses proactively — an expired license discovered during a state inspection can trigger an immediate investigation. Verify that every provider’s state license remains active and unrestricted, that the medical director’s credentials and engagement remain current, and that your compliance documentation reflects your actual current operations rather than the structure you launched with.

Read More :- Physician Collaboration in Medical Weight Loss Programs

State-by-state ownership snapshot

Because medspa ownership rules vary so dramatically by state, here is a quick reference for several of the most commonly searched jurisdictions. Always verify current requirements with your state medical board and a qualified healthcare attorney before forming your business entity.

Related reading from LocumTele

• Aesthetic Clinic Medical Director: Requirements, Duties & How to Find One
• Compliant PC Infrastructure — 51-state professional corporation structure for medspas
• Medical Director Oversight — physician governance for medspa and aesthetic clinics
• Aesthetic Therapy — LocumTele’s oversight service for aesthetic clinics

Frequently asked questions

Q.1 What licenses do you need to open a medical spa?

At minimum: a state business license, a medical facility or clinic license from the state health department, individual professional licenses for every clinical provider, DEA registration if prescribing controlled substances, a medical laser or device permit for energy-based equipment, and a medical waste disposal permit. Some states add pharmacy licensing requirements if your medspa stores or administers prescription drugs on-site. The medical director must also hold an active, unrestricted state license.

Q.2 Can a non-physician own a medical spa?

Yes, in most states — but through a carefully structured arrangement, not through direct ownership of the clinical entity. In states with Corporate Practice of Medicine (CPOM) restrictions, non-physicians must use the PC/MSO model: the physician owns the professional corporation that delivers clinical services, while the non-physician controls an MSO that provides business and administrative services to the PC. In a handful of more permissive states, non-physicians can hold direct ownership provided a qualified medical director oversees all clinical operations.

Q.3 Does every medical spa need a medical director?

Yes, in virtually every U.S. state. Any medspa performing medical procedures — including neurotoxin injections, dermal fillers, laser treatments, chemical peels, IV therapy, or prescription-based services — must operate under the oversight of a licensed physician serving as medical director. The medical director must be actively engaged, not just named in a contract. States including New Jersey, New York, California, and Texas have all intensified enforcement against passive arrangements in 2025 and 2026.

Q.4 What is the PC/MSO structure and do I need it?

The PC/MSO structure separates clinical services (delivered through a physician-owned Professional Corporation) from business operations (managed by a non-clinical Management Services Organization). If your medspa is owned or co-owned by a non-physician in a CPOM-enforcing state, this structure is typically required to maintain legal compliance. The MSO handles marketing, billing, staffing, and administration; the PC handles all medical services and employs the clinical providers.

Q.5 Can a nurse practitioner open their own medspa?

In full practice authority states like Arizona, Colorado, Minnesota, New Mexico, and others — yes, under defined conditions. Even in FPA states, NP ownership of a medspa does not eliminate all physician oversight requirements. Specific procedures such as Botox injections, dermal fillers, and laser treatments may still require physician medical director authorization and standing orders. In restricted and reduced practice states, NPs cannot own a medspa independently and must partner with a physician through a collaboration agreement or PC/MSO structure.

Q.6 How can LocumTele help me open a compliant medical spa?

LocumTele provides the full clinical compliance infrastructure for medspa operators: a qualified, actively engaged medical director with state-specific licensure; written clinical protocols and standing orders for all services; compliant PC infrastructure across all 51 states; and ongoing regulatory compliance support. Whether you are opening your first location or expanding a multi-state brand, we build the physician oversight and corporate structure your medspa requires before you see your first patient.

Read More :- Collaborating Physician vs. Supervising Physician: What’s the Difference?