Med Spa License Requirements: Ownership and Supervision

The layers, and who issues each

Nothing about this list is uniform. Two neighboring states can differ on whether laser hair removal requires a facility permit, whether a nurse may perform it, and who has to be on site while it happens. Several states have also changed device and facility rules in recent years. Treat any published list, including this one, as a starting point for calls to the issuing agencies rather than an answer.

Ownership: who the state lets hold the medical entity

The threshold question is your state's position on the corporate practice of medicine. The doctrine bars unlicensed persons and ordinary corporations from practicing medicine, employing physicians to practice medicine, or controlling clinical judgment.

States commonly described as strict — California, New York, New Jersey, Texas, Illinois and Colorado among them — expect the professional entity to be physician-owned, and they examine actual control rather than the paperwork. California requires a medical corporation to be majority-owned by licensed physicians, with certain other licensed professionals permitted to hold minority interests. New York requires the professional corporation's shareholders to be licensed in the profession the entity practices. Texas enforces its version through the medical board with a limited set of statutory exceptions. Recent legislation in California and Oregon has gone further, restricting how much control a management company and its owners may exercise over a professional medical entity.

At the other end, a substantial group of states impose no meaningful prohibition; Florida, Ohio, Missouri, Nebraska, Virginia, Utah and Oklahoma are frequently named. There a general business corporation can own the practice outright, though every clinical service still has to be performed and supervised by properly licensed people.

The standard workaround in restrictive states is the professional corporation plus management services organization. The physician owns the PC, which employs the clinical staff, holds the patient records, and makes every clinical decision. The non-physician founder owns the MSO, which provides premises, equipment, brand, software and administrative staff under a written management services agreement at a fair market fee. It works when the physician has genuine clinical authority and the fee is not a disguised share of clinical revenue. It fails when the physician is a nominee.

Provider licenses and scope of practice

Scope is where most enforcement actually starts, because it surfaces the moment something goes wrong. A few rules hold almost everywhere:

• Estheticians and cosmetologists are licensed for non-medical services. They cannot inject, and in most states cannot perform medical-depth peels or operate medical lasers. Whether they may perform microneedling, and at what depth, differs sharply by state.
• Registered nurses may generally administer injectables and operate certain devices under delegation from a prescriber, after a patient-specific order and within a signed protocol. RNs do not prescribe and, in most states, cannot perform the good faith exam.
• Nurse practitioners and physician assistants may prescribe and perform the good faith exam within their state scope. In full practice authority states an NP may practice independently; elsewhere a collaborative or supervisory agreement with a physician is required.
• Physicians may perform and delegate, subject to state delegation rules that specify supervision level and, sometimes, ratios of supervised personnel.

Two practical additions. Training certificates are not licenses: a weekend injector course does not expand what a license permits. And a provider's license status has to be verified at the primary source and re-verified on renewal, with the printout kept in the file.

Supervision is a separate variable from scope, and it is where states diverge most. Some require the supervising physician or mid-level to be physically on site while a delegated procedure is performed; others accept immediate availability by phone; a few set numeric limits on how many delegates one prescriber may supervise or how many locations they may cover. The same state can apply different standards to neurotoxin injection, laser resurfacing and IV therapy. Write your delegation matrix against the actual statute and board rules rather than against what a competitor down the road appears to be doing, and re-check it every time you add a service or a device, because the menu is what changes and the license file rarely gets revisited alongside it.

Devices, drugs and the permits people forget

Energy-based devices trip up more practices than injectables. Some states register lasers and require a designated laser safety officer; others restrict who may operate a Class IV device, or require physician presence for certain wavelengths. These programs have been amended repeatedly in recent years, so verify with the current state agency rather than a secondary source.

Prescription products are the other gap. Neurotoxins, dermal fillers, prescription-strength peels and IV solutions are prescription items. They are purchased on an account tied to a licensed prescriber and, in most states, must be ordered for the practice by that prescriber. Buying from a source that will sell without verifying a prescriber account is a serious warning sign and a documented route to counterfeit product. Keep purchase records, lot numbers and storage temperature logs; they are also what lets you trace patients if a product is recalled.

HIPAA deserves a note because it is widely misunderstood. HIPAA applies to covered entities, which are providers who transmit health information electronically in connection with covered transactions such as insurance billing. A strictly cash-pay med spa may fall outside that definition. It rarely helps to rely on that: state medical privacy and data breach laws still apply, patients and referring physicians expect HIPAA-grade handling, and most practices touch a covered transaction sooner or later. Building to the HIPAA standard is the practical default.

What you must be able to produce

Inspections and complaint investigations are documentation exercises. The file that answers them contains the entity and ownership documents, the medical director agreement, current primary source license verifications for every provider, the signed clinical protocols and standing orders with version dates, the delegation matrix, training and competency records per employee and per device, the good faith exam and treatment-specific consent in every chart, chart notes with product, lot and settings, the chart review log, the adverse event log, drug purchase and storage records, the OSHA exposure control plan with training records, and proof of insurance.

That list is not a compliance formality. It is the same list an insurer requests at underwriting and, in a narrower form, the first thing a carrier asks for after a claim. A practice that keeps it current answers a board inquiry in an afternoon. A practice that does not spends weeks reconstructing records, which is the point at which small problems become large ones.

The bottom line

Med spa licensing is a stack of separate authorizations from separate agencies, and the ownership layer is the one that cannot be fixed retroactively. Settle your state's corporate practice position first, then structure the entity, then license the people, then the devices and drugs. Scope of practice is enforced independently of ownership, so verify what each license may actually do in your state and keep the training records that show competency was checked. Then keep the file current, because in every enforcement scenario the question is not what you did but what you can show.

Frequently asked questions

Is there a state license specifically for a med spa?

In most states there is no single permit called a med spa license. What exists is a stack: a business entity that satisfies your state's ownership rules, individual professional licenses for every provider, sometimes a facility or device permit, and a supervision structure with a physician medical director. A handful of states do register or inspect facilities that perform certain procedures, so confirm with your medical board and health department.

Can an esthetician own a med spa?

An esthetician can often own the business in permissive states, but not the medical entity in states that enforce the corporate practice of medicine, and never the clinical scope. Esthetician licenses cover non-medical services such as facials, waxing and superficial exfoliation; injectables, medical-depth peels and most laser treatments fall outside that scope in nearly every state. Ownership and scope of practice are two separate questions and both have to be satisfied.

What happens if a med spa operates without the right licenses?

The common outcomes are cease-and-desist orders, fines, board discipline against the supervising physician and the individual providers, and in serious cases charges for the unlicensed practice of medicine. Malpractice carriers can also deny or contest coverage where treatment was outside a provider's licensed scope. The exposure usually surfaces through a patient complaint or an adverse event rather than a routine inspection.

Related templates