How to Start a Med Spa: Medical Director Requirement, Corporate Practice of Medicine, MSO Structure, and Startup Costs (2026 Guide)

Yes, in virtually every state. The procedures that define a medical spa — Botox and other botulinum toxin injections, dermal fillers, laser and IPL treatments, IV therapy, chemical peels beyond cosmetic-grade, platelet-rich plasma (PRP) therapy, and body contouring with medical devices — are classified as medical procedures under state medical practice acts. Medical procedures can only be performed or supervised by licensed medical professionals. The medical director role: A medical director is typically a licensed physician (MD or DO) who oversees the medical procedures performed at the spa, establishes protocols, reviews patient records, and is legally responsible for the medical care delivered. In most states, the medical director must hold an active, unrestricted license in the state where the med spa operates. Can a non-physician be medical director? Some states allow nurse practitioners (NPs) or physician assistants (PAs) to serve as medical director under certain conditions — but this typically still requires physician supervision of the NP or PA. States like California, Florida, and Texas are strict about requiring an MD or DO as the supervising physician for med spa procedures. On-site supervision requirements: States vary significantly on how close the physician supervision must be. Some states require the physician to be physically present when procedures are performed; others allow general supervision with defined protocols in place. Texas, for example, requires physicians to directly supervise or perform laser procedures. Medical director compensation: Medical directors who are not the owner of the med spa are typically compensated through a monthly fee (commonly $1,000–$5,000/month) or a percentage of revenue from supervised procedures. Consult a healthcare attorney on the structure — kickback and fee-splitting rules apply.

The corporate practice of medicine (CPOM) doctrine is a legal principle adopted by most US states that prohibits non-physician entities (corporations, LLCs owned by non-physicians) from employing physicians or controlling the delivery of medical services. The rationale is that medical decisions should be controlled by licensed professionals, not corporations motivated purely by profit. How it affects med spa ownership: If you are not a physician and you want to open a med spa that offers medical procedures, you face a fundamental legal problem in most states: you cannot own a corporation or LLC that employs physicians or directs their medical practice. States with strict CPOM enforcement: California, Texas, New York, New Jersey, Ohio, and most other states enforce CPOM doctrine for physician services. Florida has a more permissive structure for some practitioner types but still requires physician oversight. States with more permissive rules: A handful of states (including some that allow mid-level practitioners to practice independently) have less restrictive CPOM rules, but these are a minority. The practical implication: A non-physician who wants to open a med spa must work around CPOM through a carefully structured ownership arrangement — typically involving a Management Services Organization (MSO) and a separate Professional Corporation or PLLC. This structure requires specialized healthcare attorney review before formation. Risks of ignoring CPOM: Operating a med spa with a structure that violates CPOM exposes the owners to: state medical board enforcement action against the supervising physician (which can cost that physician their license), regulatory investigation of the business, civil liability exposure, and in some states criminal charges for practicing medicine without a license through an unlicensed entity.

The Management Services Organization (MSO) structure is the standard legal workaround used by non-physician investors and entrepreneurs to operate med spas in states with corporate practice of medicine restrictions. How the structure works: 1. Professional Corporation (PC) or PLLC: A physician (the medical director or a physician partner) forms a Professional Corporation or Professional Limited Liability Company (PLLC), which is the entity type most states require for entities that practice medicine. The physician owns 100% of this entity (or the required percentage under state law). The PC employs the practitioners and is the entity that holds the medical practice license and supervises all medical procedures. 2. Management Services Organization (MSO): A separate LLC or corporation is formed and owned by the non-physician investor/entrepreneur. The MSO does not provide medical services — it provides management, administrative, and operational services to the PC. Services include: billing and collections, marketing, HR for non-clinical staff, leasing the clinic space and equipment to the PC, purchasing supplies, and handling IT. 3. Management Services Agreement (MSA): A contract between the PC and the MSO specifies what management services the MSO provides and the fee the PC pays the MSO. The MSA fee structure must be structured at fair market value — not a percentage of the PC's medical revenue, which can constitute illegal fee-splitting in many states. What the MSO can and cannot control: The MSO can control business operations, scheduling, marketing, and non-clinical staff. The MSO cannot direct clinical decisions, override the physician's medical judgment, or set standards of care. The physician retains autonomous medical authority. Cost to implement: A properly structured MSO/PC arrangement requires healthcare attorney drafting — typically $5,000–$20,000 in legal fees for the initial structure. Attempting to draft these documents from templates without attorney review is a high-risk approach given the regulatory complexity.

This is one of the most critical questions for med spa operations, and the answer varies by state — but the general framework is consistent. Esthetician scope of practice (no physician supervision required in most states): - Superficial facial treatments: European facials, hydrafacials, basic extractions - Cosmetic-grade chemical peels: Low-concentration AHA/BHA peels (typically glycolic acid under 30%, lactic acid, salicylic acid under 2%) that do not penetrate below the epidermis - Waxing and threading - Non-invasive LED light therapy - Basic microdermabrasion - Eyebrow and eyelash services Medical procedures (require physician supervision or prescription in most states): - Botox and all botulinum toxin injections: Require physician prescription and supervision in all states. Who can administer under supervision varies — some states allow RNs; others require physician administration. - Dermal fillers (Juvederm, Restylane, Sculptra): Medical procedures requiring physician oversight in all states. - Medium and deep chemical peels (TCA 20%+, phenol peels): Classified as medical procedures in most states. - Laser and IPL treatments: Generally medical procedures — specific rules vary widely by state. - Microneedling: Classified as a medical procedure in most states; some states allow licensed estheticians with specific training to perform it with physician supervision. - PRP (platelet-rich plasma) therapy: Blood draw and injection — medical procedure in all states. - IV therapy: Medical procedure in all states; requires physician oversight. Practical implication: Your med spa needs to categorize every service on its menu as either esthetic (esthetician scope) or medical (physician supervision required), and staff accordingly. A licensed esthetician performing Botox injections without physician supervision is practicing medicine without a license — regardless of their training.

Laser and intense pulsed light (IPL) device regulations for med spas are highly variable by state — some states require specific licensure to operate these devices, others require physician oversight but no separate device license, and a few have minimal requirements. Federal FDA regulation: All laser devices used in medical procedures are classified as medical devices and are subject to FDA regulation under the Federal Food, Drug, and Cosmetic Act. Manufacturers must obtain FDA clearance or approval for specific uses. As a med spa operator, you must use devices for only their FDA-cleared indications — using a laser for non-cleared procedures is an off-label use that carries legal risk. State-by-state laser regulation — key examples: - Texas: Lasers used for medical purposes (hair removal, tattoo removal, skin resurfacing) must be performed or directly supervised by a physician. The Texas Medical Board has been aggressive in enforcement. - California: No specific laser operator license required, but procedures must be performed by a licensed practitioner (physician, NP, PA, or in some cases an RN) within their scope of practice. Estheticians cannot use medical-grade lasers. - Florida: The Board of Medicine has issued guidance that laser procedures constitute the practice of medicine; physician supervision required. - Arizona: Has relatively permissive rules — licensed nurses can perform many laser procedures under indirect physician supervision. - New York: Laser procedures are medical procedures; physician or licensed practitioner supervision required. Who can operate laser devices: Depending on state, laser procedures may be performed by: physicians, NPs, PAs (under physician supervision), RNs (under physician supervision), or in some states medical assistants under specific supervision protocols. Estheticians typically cannot operate medical-grade lasers for medical procedures in most states. Device safety training: Regardless of state licensing requirements, operators should complete manufacturer training and ideally certification through an accredited laser safety course. OSHA also has laser safety guidelines for employee protection.

Med spas that prescribe or administer controlled substances — including some weight loss medications, testosterone for hormone replacement therapy (HRT), and ketamine for certain treatments — must comply with DEA registration requirements. DEA registration: A Drug Enforcement Administration (DEA) registration is required for any physician or mid-level practitioner who prescribes, administers, or dispenses Schedule II–V controlled substances. The DEA number is individual — it is tied to the practitioner, not the facility. Common controlled substances in med spas: - GLP-1 agonists (semaglutide, tirzepatide for weight loss): Note that semaglutide (Ozempic/Wegovy) and tirzepatide (Mounjaro/Zepbound) are NOT DEA-controlled substances — they are non-scheduled prescription drugs. A prescribing physician's DEA number is not required solely for semaglutide, but a valid prescribing license is. Med spas prescribing semaglutide must comply with compounding pharmacy regulations if sourcing from compounders. - Phentermine: Schedule IV controlled substance — DEA registration required. - Testosterone: Schedule III controlled substance — DEA registration required for any practice that prescribes, administers, or dispenses testosterone. - Ketamine: Schedule III controlled substance — DEA registration required. State pharmacy board rules: Even for non-scheduled prescription drugs, med spas that maintain on-site drug inventory may be subject to state pharmacy board rules, which can require a pharmacy license or specific storage and recordkeeping requirements for prescription drug samples or stock. DEA registration fees: DEA registration costs $888 for a 3-year registration for practitioners (as of 2024; fees may be updated). Registration is per practitioner per practice location in some cases. Practical note: Before advertising any weight loss injection programs, consult a healthcare regulatory attorney to confirm your state's specific rules on prescribing, dispensing, and compounding at med spa facilities.

Med spas are healthcare providers under HIPAA if they conduct electronic transactions (billing, payment processing, appointment scheduling systems that transmit health information) or if they treat patients and maintain medical records. Most med spas qualify as "covered entities" under HIPAA. What HIPAA requires for med spas: 1. Privacy Rule compliance: Patients must be given a Notice of Privacy Practices (NPP) describing how their health information will be used and shared. The NPP must be provided at the first service encounter and posted in the facility and on your website. Patients must acknowledge receipt. 2. Security Rule compliance: All electronic protected health information (ePHI) — electronic medical records, before/after photos stored digitally, email communications about patient health — must be protected by administrative, physical, and technical safeguards. This includes: password policies, encrypted storage, access controls, audit logs, and a written security risk assessment. 3. Breach notification: If a data breach exposes unsecured ePHI, the med spa must notify affected patients within 60 days of discovery, and notify HHS. Breaches affecting 500+ individuals in a state also require notification to prominent media outlets in that state. 4. Business Associate Agreements (BAAs): Any vendor who handles ePHI on your behalf — EMR/EHR software vendors, billing services, cloud storage providers, IT support firms — must sign a BAA. Using a vendor that processes patient data without a signed BAA is a HIPAA violation. 5. Before/after photos: Patient photos used for marketing require both HIPAA-compliant handling and a specific signed photo release consent — separate from the general treatment consent. Do not post patient photos on social media without a signed, HIPAA-compliant photo release. Penalties: HIPAA violations range from $100 to $50,000 per violation (per incident), up to $1.9 million annually for violations of the same type. HHS Office for Civil Rights (OCR) enforces HIPAA and conducts audits.

Med spas generate regulated medical waste — specifically sharps (needles, syringes used for Botox, fillers, PRP, IV therapy) and potentially other biohazardous materials. Federal and state regulations govern disposal. Federal baseline: The EPA and DOT regulate medical waste disposal and transport at the federal level. The Medical Waste Tracking Act provides a framework, but specific requirements are primarily state law. What med spas typically generate: - Sharps waste: Needles, syringes, lancets, and broken ampules from injections. This is the primary regulated waste category for most med spas. - Contaminated materials: Gauze, gloves, and materials contaminated with blood or other potentially infectious materials. - Pharmaceutical waste: Unused or expired medications — particularly relevant if your med spa carries prescription medications or controlled substances on-site. Disposal requirements: 1. Sharps containers: FDA-cleared sharps containers must be used for all needles and sharps. Containers must be puncture-resistant, leak-proof, and properly labeled. Never overfill — fill to the indicated fill line only. 2. Licensed medical waste hauler: Most states require sharps and biohazardous waste to be picked up by a licensed medical waste disposal company. The hauler provides a manifest documenting chain of custody from your facility to the treatment facility. 3. Mail-back programs: Some states permit sharps disposal through FDA-cleared mail-back programs as an alternative to on-site pickup. These are available from vendors like Stericycle and Sharps Compliance. Pharmaceutical waste: Unused prescription medications cannot be disposed of in regular trash or flushed down drains in most cases. EPA rules under RCRA may classify certain unused pharmaceuticals as hazardous waste. Consult your state environmental agency for specific disposal requirements. State medical waste permit: Some states require a permit from the state environmental or health agency to generate and store regulated medical waste. Check with your state health department before opening.

Med spa insurance requirements are more complex than a typical small business because medical procedures create professional liability exposure that standard general liability policies exclude. Medical malpractice / professional liability insurance: Covers claims arising from injuries caused by medical procedures performed at the spa — adverse reactions to Botox or fillers, laser burns, infections from injections, adverse outcomes from chemical peels. This is a separate policy from general liability. Who needs it: Every physician, NP, PA, and RN who performs medical procedures should have individual malpractice coverage. The med spa entity should also carry an entity-level malpractice policy. Coverage structure: Med spa malpractice policies are typically claims-made policies (covering claims reported during the policy period, not when the incident occurred). When a claims-made policy is cancelled, a "tail" policy is needed to cover incidents that occurred during the policy period but are reported after cancellation. Tail coverage can cost 1–2x the annual premium. Coverage amounts: Minimum recommended coverage is $1,000,000 per occurrence / $3,000,000 aggregate for the entity. Physicians typically carry $1,000,000/$3,000,000 individually. General liability insurance: Covers third-party bodily injury and property damage at the facility — a client slipping and falling, for example. This does not cover professional liability from medical procedures. Both GL and malpractice are required. Specialty med spa policies: Several insurers offer combined med spa policies that bundle professional liability, general liability, and property coverage. American Med Spa Association (AmSpa) maintains a list of insurers that specialize in med spa coverage. Cost: Med spa malpractice insurance typically runs $3,000–$10,000/year for the entity, depending on procedures offered, location, revenue, and claims history. Adding IV therapy, laser, or PRP increases premiums.

Med spas are among the most capital-intensive service businesses to start, with typical startup costs ranging from $150,000 to $500,000. Here is a detailed breakdown: Legal structure (MSO/PC setup): $5,000–$20,000. A properly structured MSO/Professional Corporation arrangement requires healthcare attorney drafting. This is not optional in most states — getting it wrong exposes both the physician medical director and the business owners to serious regulatory risk. Lease and buildout: $50,000–$200,000. Med spas typically occupy 1,500–3,500 sq ft in medical or high-end retail centers. Buildout requires medical-grade construction: proper electrical for laser equipment, plumbing, treatment rooms with appropriate privacy and lighting, reception and waiting area. Class IV laser rooms may require specific structural modifications (laser safety interlocks, light barriers). Medical equipment: $50,000–$150,000. Laser/IPL device: $20,000–$80,000 (used to new, depending on technology). Microneedling device: $2,000–$10,000. Body contouring equipment: $10,000–$80,000. Injectables refrigerator, mixing station, procedure table. Initial product and supply inventory: $5,000–$15,000. Injectables (Botox, fillers — note these are prescriptions and must be ordered by the supervising physician through licensed distributors). Skincare product lines. Disposable supplies. Medical director compensation (first year): $12,000–$60,000. Monthly medical director fees vary by market and scope of supervision. Licenses and permits: $2,000–$8,000 total for business license, entity formation, DEA registration (if applicable), medical waste permit, state medical board facility notification (required in some states). Insurance (malpractice + GL + property): $8,000–$20,000/year. HIPAA compliance setup (EMR, BAAs, policies): $2,000–$10,000. Marketing and website: $5,000–$20,000. Working capital (6 months): $30,000–$75,000.