Med Spa: Frequently Asked Questions

Authority Network America›Life Services Authority›National Health›National Med Spa Authority

Med Spa: Frequently Asked Questions

Medical spas operate at the intersection of aesthetic services and clinical medicine, creating a regulatory environment that is more complex than either a traditional day spa or a licensed medical practice alone. This page addresses the most common questions about how med spas are defined, classified, regulated, and reviewed across the United States. Understanding these distinctions matters because improper classification or unlicensed service delivery can result in state board enforcement actions, civil liability, and facility closure.

What are the most common issues encountered?

The most frequently documented problems in the med spa sector fall into three categories: unlicensed practice, inadequate medical supervision, and scope-of-service violations. State medical boards across the country have issued enforcement actions against facilities where licensed aestheticians performed procedures — such as laser treatments or injectable administration — that fall within the statutory definition of the practice of medicine.

A second persistent issue involves the use of non-physician medical directors who lack the authority under state law to authorize specific procedures. The American Med Spa Association (AmSpa) has published compliance data indicating that a significant share of med spas operating in the United States are not in full legal compliance with their state's ownership and supervision requirements.

Equipment-related adverse events constitute a third category. The U.S. Food and Drug Administration (FDA) classifies laser and intense pulsed light (IPL) devices used for skin treatments as Class II or Class III medical devices, meaning their use is subject to federal performance standards under 21 CFR Part 1040 as well as state-level operator licensing requirements.

How does classification work in practice?

Med spas are not a single, uniformly defined category under U.S. law. Classification depends on the types of services offered and the licensing framework of the state in which the facility operates.

A useful distinction separates two operational models:

• Spa-adjacent facilities — offer services that do not require a physician's order, such as facials, non-device-based skin treatments, and relaxation therapies. These operate under cosmetology or esthetics board jurisdiction.
• Medical-adjacent facilities — offer services that require a physician's order, delegated medical authority, or direct clinical supervision, such as Botox injections, dermal fillers, laser hair removal, and prescription-strength chemical peels.

The second model requires a licensed physician (or, in some states, a nurse practitioner or physician assistant operating under a collaborative agreement) to serve as medical director. Ownership rules add another layer: roughly 35 states have corporate practice of medicine (CPOM) laws that restrict or prohibit non-physician ownership of entities providing medical services (AmSpa State Law Resource).

What is typically involved in the process?

Establishing a compliant med spa involves a sequence of licensing, credentialing, and operational steps:

• Entity formation — structured to comply with CPOM laws in the applicable state.
• Medical director agreement — a written supervisory or collaborative agreement executed between the facility and a licensed physician.
• State facility licensing — varies by state; some require a separate medical clinic or outpatient facility license.
• Staff credentialing — each clinical staff member must hold the license required for the specific procedures they will perform (RN, NP, PA, licensed esthetician, etc.).
• Equipment registration — laser devices may require registration with the state radiation control program; 38 states have formal laser safety programs administered through public health agencies.
• HIPAA compliance infrastructure — med spas that transmit electronic health information are covered entities under the Health Insurance Portability and Accountability Act of 1996 (HHS HIPAA).

What are the most common misconceptions?

One persistent misconception is that any licensed nurse can independently administer injectables in a med spa without physician involvement. In the majority of U.S. states, injectable neurotoxins and dermal fillers are prescription drugs; administration requires either a physician's order or a valid prescriptive authority relationship.

A second misconception is that a physician's name on a website satisfies the medical director requirement. State medical boards, including the Medical Board of California and the Texas Medical Board, have issued guidance clarifying that a medical director must exercise actual supervision — not merely nominal affiliation — over delegated medical acts.

A third error involves assuming that federal FDA clearance of a device automatically permits its use by any operator. FDA clearance addresses device safety and efficacy; it does not preempt state operator licensing requirements.

Where can authoritative references be found?

Primary regulatory authority rests with state medical boards, state boards of nursing, and state cosmetology or esthetics boards. The Federation of State Medical Boards (FSMB) maintains a directory of all U.S. state medical board contacts and publishes model policies on delegation and telemedicine that inform state-level rulemaking.

The FDA's Center for Devices and Radiological Health (CDRH) is the federal reference point for device classification. The American Med Spa Association publishes state-specific legal guides. For an organized overview of the regulatory landscape as it applies to med spa operations, the regulatory context resource on this site consolidates the primary framework.

How do requirements vary by jurisdiction or context?

Variation across U.S. states is substantial. Florida, for example, requires a licensed physician to be physically present when certain laser procedures are performed. California prohibits non-physician ownership of medical practices outright under Business and Professions Code § 2400. Texas requires a written protocol between the med spa and the delegating physician for each category of delegated act.

Contrast this with states such as Arizona, which have broader scope-of-practice authority for nurse practitioners, allowing independent practice without physician collaboration agreements. This means a procedure legally delegated to an NP in Arizona may require physician oversight in an adjacent state.

Facilities operating near state lines or franchises with locations in multiple states must maintain jurisdiction-specific compliance programs rather than a single national policy.

What triggers a formal review or action?

State medical board and licensing agency investigations are typically initiated by one of four triggers:

• Consumer complaint — a patient files a complaint alleging injury, inadequate care, or unlicensed practice.
• Adverse event report — hospitals, insurers, or practitioners are obligated under state law or accreditation standards to report certain adverse outcomes.
• Inspection finding — routine or complaint-driven inspections by state health departments or radiation control programs that identify violations.
• Referral from another agency — a cosmetology board, for example, may refer a matter to the medical board when a licensed esthetician is found performing medical procedures.

The FSMB has documented that the volume of complaints related to aesthetic medical procedures has increased as the med spa sector has grown. Penalties can include license suspension, civil monetary fines, and, in cases involving criminal unlicensed practice statutes, misdemeanor or felony charges depending on the state.

For information on safety classifications and documented risk categories within this sector, the safety context and risk boundaries resource provides a structured breakdown.

How do qualified professionals approach this?

Practitioners and owners operating compliant med spas typically treat regulatory adherence as an operational system rather than a one-time checklist. This involves annual review of state medical board bulletins and statutory updates, because scope-of-practice laws and delegation rules are revised through legislative sessions on a rolling basis.

Medical directors at well-structured facilities maintain documented oversight records — written protocols, staff credentialing files, and delegation logs — that can be produced in the event of a board inquiry. Staff receive procedure-specific training tied to their licensure category, and facilities distinguish between services that require a standing order versus those that require real-time physician involvement.

Risk management frameworks used by hospital systems, such as those outlined in Joint Commission standards, are increasingly being adapted by larger med spa groups even when Joint Commission accreditation is not required. This reflects an industry-wide recognition that the home resource at the national authority level and accreditation-adjacent standards offer a defensible operational baseline.

Qualified professionals also distinguish between marketing-driven service expansion and clinically appropriate scope decisions — a distinction that state medical boards scrutinize when reviewing delegation agreements and supervisory arrangements.

References

• Authority Network America
• Life Services Authority
• National Health
• FDA
• AmSpa State Law Resource
• HHS HIPAA
• Federation of State Medical Boards (FSMB)
• CDRH

The law belongs to the people. Georgia v. Public.Resource.Org, 590 U.S. (2020)