National Med Spa Authority

The medical spa industry sits at the intersection of aesthetic medicine and hospitality, generating regulatory complexity that neither traditional spas nor physician offices fully anticipated. This page defines what a med spa is, maps the operational and legal architecture that governs it, and clarifies where public understanding frequently diverges from clinical and regulatory reality. The content here draws on federal agency guidance, state medical board rules, and published professional standards — covering everything from licensing requirements to safety risk categories and the boundaries between qualifying and non-qualifying services.

• Scope and definition

• Why this matters operationally

• What the system includes

• Core moving parts

• Where the public gets confused

• Boundaries and exclusions

• The regulatory footprint

• What qualifies and what does not

Scope and definition

A medical spa — commonly abbreviated as med spa or medi-spa — is a hybrid facility that delivers minimally invasive aesthetic medical procedures under physician oversight, typically in an environment designed to resemble a day spa rather than a clinical office. The American Med Spa Association (AmSpa), which publishes annual state-of-the-industry data and model compliance frameworks, defines the sector as facilities providing medical services including but not limited to laser treatments, injectables, and body contouring, distinguished from day spas by the requirement for medical director supervision.

The definitional boundary matters because it determines which licensing regime governs the facility. A facility offering facials and massage operates under cosmetology or esthetics licensing frameworks administered by state boards. A facility offering botulinum toxin injections, chemical peels at prescription strength, or laser hair removal using Class IV devices operates under medical practice acts — a fundamentally different regulatory tier. The federal Food and Drug Administration (FDA) classifies laser and light-based devices by class (FDA Medical Device Classifications), and that classification determines which professional credentials are required to operate them.

This site covers regulatory context, safety risk boundaries, and the practical questions that arise at every stage of the med spa relationship — from first inquiry through ongoing treatment. The content library spans licensing requirements, informed consent standards, and the operational distinctions that separate compliant from non-compliant facilities.

Why this matters operationally

The Federal Trade Commission (FTC) receives complaints involving misleading aesthetic service claims, and state medical boards across the country have disciplinary dockets that include med spa violations ranging from unlicensed practice to improper delegation of medical procedures (FTC Health Claims Guidance). The stakes are not abstract: the American Society of Plastic Surgeons and the American Academy of Dermatology have both published position statements noting that adverse events — including burns, scarring, and systemic reactions — occur more frequently when procedures are performed outside physician-supervised settings.

The operational importance extends beyond patient safety. Business owners who structure a med spa without a qualifying medical director risk operating what state medical boards classify as the unlicensed practice of medicine, a criminal offense in all 50 states. The structure of ownership, the employment relationship between the business entity and the supervising physician, and the delegation chain for each procedure type are each independently scrutinized during state inspections.

For a detailed breakdown of the federal and state frameworks that govern these requirements, the Regulatory Context for Med Spa page maps the applicable statutes and agency roles in full.

What the system includes

A functional med spa system encompasses five interconnected components:

• Medical directorship — A licensed physician (MD or DO) who holds ultimate clinical responsibility, sets treatment protocols, and whose credentials satisfy the supervising physician requirements of the applicable state medical practice act.

• Clinical staff credentialing — Nurse practitioners, registered nurses, physician assistants, and licensed estheticians each operate within defined scope-of-practice lanes that vary by state.

• Device inventory — FDA-regulated devices including laser platforms, radiofrequency equipment, and ultrasound-based body contouring systems, each requiring operator credentialing aligned to device class.

• Pharmaceutical inventory — Botulinum toxin products (Botox, Dysport, Xeomin, Daxxify), dermal fillers, and topical prescriptions, all of which are prescription-only products under federal law and must be ordered under a physician's DEA and state pharmacy credentials.

• Compliance infrastructure — Written policies, informed consent documentation, adverse event reporting protocols, and HIPAA-compliant patient recordkeeping as required under 45 CFR Parts 160 and 164 (HHS HIPAA Rules).

Core moving parts

The operational mechanics of a med spa turn on four functional relationships that regulators examine when evaluating compliance.

Physician-facility relationship. Most states prohibit corporate ownership of medical practices under the corporate practice of medicine (CPOM) doctrine. This forces med spas to structure ownership through a physician-owned professional corporation (PC) or professional limited liability company (PLLC), with the management services organization (MSO) model separating business operations from clinical control. The structure must be genuine: nominal medical directors who sign paperwork without active clinical involvement have been the subject of enforcement actions by state medical boards.

Delegation chain. A procedure that a physician can legally perform does not automatically become legal when delegated to a non-physician. Each state's nursing practice act and medical practice act specifies which procedures RNs, NPs, and PAs may perform under physician supervision, and the degree of supervision required — direct, general, or collaborative — differs by procedure category and by state.

Informed consent. The Joint Commission and individual state health department regulations specify minimum elements of informed consent for medical procedures. For med spa procedures, this typically includes the risks of the specific device or injectable, alternatives, and post-treatment care requirements. A consent form that omits risk disclosure for a Class IV laser procedure fails this standard regardless of whether the patient signed it.

Adverse event management. FDA MedWatch reporting obligations apply when device malfunction contributes to patient injury (FDA MedWatch). Facilities that do not have documented adverse event protocols in place are exposed both to regulatory sanction and to enhanced liability in civil proceedings.

Where the public gets confused

Three misconceptions account for the majority of consumer confusion in this sector.

"Medical spa" implies physician presence during each visit. It does not. The physician medical director may be physically present, available by phone, or review treatment plans remotely, depending on state law. The word "medical" in the name signals regulatory classification, not continuous on-site physician staffing.

Laser treatments are cosmetic, not medical. Class IV laser devices are FDA-regulated medical devices. Their operation constitutes the practice of medicine in a majority of states, meaning unlicensed operation — including operation by a cosmetologist with no medical credentials — is a violation of the medical practice act regardless of the aesthetic intent.

All injectables are the same risk tier. They are not. Botulinum toxin injections carry systemic risk including the potential for toxin spread to areas beyond the injection site, documented in FDA black-box labeling (FDA Botox Prescribing Information). Dermal fillers carry separate risk profiles including vascular occlusion. The risk category of the injectable determines the credential level required to administer it under most state delegation frameworks.

The Med Spa: Frequently Asked Questions page addresses these and related questions in structured Q&A format.

Boundaries and exclusions

A med spa is not:

• A day spa. Day spas operate under cosmetology and esthetics licensing boards and are categorically prohibited from offering prescription-only procedures or operating prescription devices.

• A plastic surgery center. Plastic surgery facilities performing general anesthesia and invasive procedures are governed by ambulatory surgical center (ASC) regulations under CMS Conditions for Coverage (CMS ASC Rules), a substantially more intensive regulatory framework than the med spa tier.

• A dermatology office. Dermatology practices are physician-owned medical offices billing under CMS and state payer rules. While procedural overlap exists, the ownership model, billing structure, and inspection regime are distinct.

• A wellness center. Facilities offering IV vitamin therapy, hormone optimization, or weight management without physician oversight of prescription drug administration are operating outside their licensed scope — a common enforcement target.

The regulatory footprint

The regulatory architecture governing med spas is layered across federal and state jurisdictions with no single unified framework.

Regulatory Layer Governing Authority Scope

Device regulation FDA (21 CFR Part 880) Laser, RF, ultrasound devices

Drug regulation FDA / DEA Injectables, topicals, controlled substances

Medical practice State medical boards Physician licensing, supervision requirements

Nursing practice State nursing boards RN/NP/PA scope and delegation

Privacy HHS / OCR (HIPAA) Patient recordkeeping, data security

Facility licensure State health departments Physical plant, inspection

Advertising FTC, state AGs Claims substantiation

The absence of a federal med spa statute means compliance obligations are assembled from at least 7 distinct regulatory sources for any given facility. States including California, Florida, and Texas have issued specific medical board guidance documents on med spa supervision requirements that supplement their general medical practice acts.

This regulatory complexity is why the broader Authority Network America network — which publishes reference-grade content across health and professional licensing verticals — treats the med spa sector as a specialized compliance domain requiring dedicated treatment rather than general wellness coverage.

What qualifies and what does not

The qualifying distinction for a procedure to be classified as a med spa service rather than a cosmetology service is whether the procedure:

Qualifies as a med spa procedure if:

• Requires a prescription drug or prescription device as defined under the Federal Food, Drug, and Cosmetic Act

• Penetrates below the dermal layer (e.g., filler injection, microneedling with PRP)

• Uses an FDA-classified medical device (Class II or Class IV) to produce a biological effect

• Requires a physician order, standing order, or treatment protocol signed by a licensed physician

• Carries adverse event reporting obligations under FDA MedWatch

Does not qualify as a med spa procedure if:

• Limited to topical application of over-the-counter products

• Uses Class I devices or non-regulated equipment (e.g., basic facial steamers, manual extraction)

• Performed entirely within cosmetology scope of practice as defined by the state esthetics board

• Requires no physician order and no prescription-only products

The dividing line is not the aesthetic intent of the procedure but its regulatory classification under FDA device rules and the state medical and nursing practice acts. A glycolic acid peel at 30% concentration crosses into prescription territory in most states; a 10% retail formulation does not. That 20-percentage-point difference determines whether the procedure requires physician oversight or can be performed in a licensed esthetics setting.

References

• American Med Spa Association (AmSpa) — Industry Standards and State Law Guides

• FDA — Medical Device Classifications (21 CFR)

• FDA — MedWatch Safety Reporting Program

• HHS — HIPAA for Professionals (45 CFR Parts 160 and 164)

• CMS — Ambulatory Surgical Center Certification and Compliance

• FTC — Health Claims in Advertising

• FDA — Drug Approvals and Databases (CDER)

The law belongs to the people. Georgia v. Public.Resource.Org, 590 U.S. (2020)