Opening a med spa is not the same as opening a salon. Injectables, laser treatments, microneedling, chemical peels, and body contouring are classified as the practice of medicine in most states. That means ownership rules, supervision requirements, licensing, and liability look nothing like a day spa — and the consequences of getting the structure wrong range from state enforcement actions to criminal charges.
This article walks through the legal, regulatory, and business architecture of opening a med spa in 2026. It is written for physicians entering aesthetics, nurse practitioners exploring practice ownership, and non-clinical entrepreneurs evaluating the space. It is not legal advice. Every state has different rules, and the specifics of entity formation, scope of practice, and supervision should be reviewed with a healthcare attorney licensed in your state.
The core legal question: who can own a med spa
The single most important structural decision is ownership. State law determines who can own, control, and profit from the practice of medicine. This framework is called the Corporate Practice of Medicine (CPOM) doctrine, and it exists in some form in a majority of states.
Strict CPOM states
In states like California, New York, Ohio, Illinois, and New Jersey, only licensed physicians (MDs or DOs) — or physician-owned professional entities — can own a medical practice. A nurse practitioner, physician assistant, or non-clinical entrepreneur cannot hold ownership in the clinical entity, even if they operate the business day-to-day.
In California, for example, the practice must be structured as a Professional Corporation (PC) or Professional Limited Liability Company (PLLC) owned by a physician, registered with the Medical Board of California. The physician owner must hold an active, unrestricted California medical license. Non-physician investors participate through a Management Services Organization (MSO) that provides business services to the physician-owned clinical entity, but the MSO cannot direct clinical decisions.
Moderate CPOM states
Texas, Florida, Georgia, and several other states enforce physician oversight but allow more flexibility in ownership structure. In Texas, the practice of medicine may not be owned by a non-physician under the corporate practice doctrine, and the Texas Medical Board requires that a licensed physician retain authority over all medical decisions, treatment protocols, and clinical staff supervision. Delegation rules under 22 Texas Admin. Code §§169.25–169.27 define what procedures can be delegated and under what level of supervision.
Florida allows some non-physician ownership but still requires a medical director who is a licensed physician with an active Florida medical license. The medical director must supervise all medical procedures and maintain documented treatment protocols.
Minimal CPOM states
Arizona grants full practice authority to nurse practitioners, allowing NPs to own and operate independent medical practices — including aesthetic clinics — without physician oversight. Colorado has moved in a similar direction. Other states with expanded NP practice authority include Oregon, Washington, Montana, and Maine.
Even in states with full NP practice authority, the specific procedures offered may trigger additional requirements. Operating a laser for hair removal, for example, often requires a separate facility registration or operator certification regardless of the practitioner's medical license.
The MSO structure explained
In strict and moderate CPOM states, the most common legal structure for non-physician participation is a two-entity model:
The Professional Corporation (PC). This is the physician-owned entity that holds the medical license, employs clinical staff, maintains patient records, and carries malpractice insurance. The medical director is employed by or contracted with the PC.
The Management Services Organization (MSO). This is the business entity that the non-physician owner controls. The MSO provides administrative services to the PC: marketing, scheduling, billing, real estate, human resources, and vendor management.
The two entities are connected through a Management Services Agreement (MSA), which defines what services the MSO provides, how the MSO is compensated (typically a percentage of gross revenue at fair market value), and — critically — that the MSO has no authority over clinical decisions.
Common MSO mistakes that trigger enforcement
State medical boards and attorneys general look for specific structural problems:
- The MSO controls which treatments are offered, what products are purchased, or how clinical staff are scheduled for medical procedures.
- The physician is paid a flat fee regardless of clinical involvement — a hallmark of a "rented license."
- There is no written medical director agreement, or the agreement gives the MSO authority over patient care decisions.
- The physician has never visited the practice, reviewed charts, or met the clinical staff.
- Fee-sharing between the MSO and PC is structured as a percentage of net revenue rather than gross, or the percentage exceeds fair market value.
In California, under Business and Professions Code §650(b), the MSO fee must be a percentage of gross revenue and must represent fair market value for services actually rendered. In Texas, the absence of a written delegation agreement does not absolve the supervising physician of responsibility — it makes enforcement easier.
Startup costs by practice tier
Startup costs for a med spa range from roughly $75,000 for adding aesthetic services to an existing medical practice to over $1 million for a premium multi-provider flagship. The following breakdown reflects 2026 pricing.
Adding aesthetics to an existing practice: $75,000–$200,000
This is the lowest-cost entry point. A physician or NP who already operates a dermatology, family medicine, or OB-GYN practice adds aesthetic services to the existing space:
| Category | Cost Range |
|---|---|
| Basic equipment (one laser or IPL device, used or leased) | $30,000–$80,000 |
| Injectables inventory (neuromodulators, fillers) | $5,000–$15,000 |
| Treatment bed, cart, supplies | $3,000–$8,000 |
| Legal and licensing (if MSO not already in place) | $2,000–$10,000 |
| Marketing launch | $5,000–$15,000 |
| Insurance (malpractice rider, general liability) | $3,000–$10,000 |
| Working capital (3 months) | $25,000–$60,000 |
Small standalone med spa: $200,000–$350,000
A single-location practice with 1–2 treatment rooms, one to two providers, and a focused service menu (injectables plus one energy-based device):
| Category | Cost Range |
|---|---|
| Entity formation and legal (healthcare attorney, MSO setup) | $5,000–$15,000 |
| Lease deposit and build-out (medical-grade HVAC, ADA compliance) | $30,000–$100,000 |
| Equipment (laser or IPL device, RF microneedling) | $80,000–$150,000 |
| Initial injectables and skincare inventory | $10,000–$25,000 |
| Software (EHR, scheduling, photo management, billing) | $5,000–$15,000 |
| Insurance (malpractice, general liability, property, cyber) | $5,000–$15,000 |
| Marketing and branding | $10,000–$25,000 |
| Working capital (3–6 months) | $50,000–$100,000 |
Mid-range standalone: $350,000–$500,000
A multi-provider practice with 3–4 treatment rooms, two or more energy-based devices, and a broader service menu:
| Category | Cost Range |
|---|---|
| Legal and entity formation | $10,000–$25,000 |
| Lease and build-out | $80,000–$200,000 |
| Equipment (multiple devices) | $150,000–$300,000 |
| Inventory and supplies | $20,000–$40,000 |
| Software and IT | $10,000–$25,000 |
| Insurance | $8,000–$20,000 |
| Marketing | $20,000–$40,000 |
| Working capital | $60,000–$120,000 |
Premium / flagship: $500,000–$1,000,000+
A large, multi-provider practice in a top-tier market with premium devices, extended service offerings, and a full clinical and administrative staff. Equipment alone can exceed $300,000 when including a CO2 fractional laser ($80,000–$200,000), a body contouring platform like CoolSculpting ($100,000–$250,000), and an RF microneedling device ($40,000–$80,000).
Equipment: buy, lease, or finance
Equipment is the single largest capital expense. For a practice that plans to offer laser treatments, the decision between buying, leasing, and financing has significant cash-flow implications.
Purchasing gives full ownership and eliminates per-treatment fees, but ties up capital. A new Alexandrite or Nd:YAG laser costs $50,000–$200,000. Used devices are available at 40–60% discounts but require due diligence on shot count, service history, and transferability of the manufacturer's service agreement.
Leasing reduces upfront cost by 50–70% and bundles maintenance in many contracts, but increases the total cost of ownership over the lease term. Fair market value (FMV) leases offer a purchase option at the end; dollar-buyout leases transfer ownership for a nominal fee.
Financing through a medical equipment loan spreads the cost over 3–7 years while retaining ownership. Interest rates for healthcare practices in 2026 range from 7–14% depending on loan size, term, and credit profile.
The American Med Spa Association (AmSpa) recommends that new practices start with one core device and add equipment as revenue stabilizes, rather than over-leveraging on day one.
Licensing, permits, and registrations
Beyond entity formation, med spas must obtain multiple licenses and registrations before opening:
- State medical license. Every physician, NP, and PA who provides clinical services must hold an active, unrestricted license in the state where the practice operates.
- Business license. A general business license from the city or county where the med spa is located.
- Medical facility registration. Some states require med spas to register as healthcare facilities with the state health department.
- DEA registration. Required if the practice will prescribe or dispense controlled substances (including certain weight-loss medications like phentermine).
- CLIA waiver. A Clinical Laboratory Improvement Amendments certificate of waiver is required if the practice performs any in-office lab testing (blood glucose, pregnancy tests, etc.).
- Sales tax permit. If the practice sells retail skincare products, a state sales tax permit is required.
- Laser registration. Several states require laser devices to be registered with a state agency. Texas requires laser hair removal facilities to register with the Texas Department of Licensing and Regulation (TDLR), and individual laser operators must hold a TDLR laser hair removal license.
- Fictitious name permit. In states like California, if you operate under a business name rather than the physician's legal name, you need a fictitious name permit from the Medical Board of California in addition to a county DBA registration.
- HIPAA compliance documentation. Every practice that handles protected health information (PHI) must have documented HIPAA policies, a security risk assessment, Business Associate Agreements with every vendor that touches patient data, and staff training records.
The 2026 HIPAA Security Rule update, expected to finalize in mid-2026, eliminates the "addressable" category for safeguards and makes multi-factor authentication, encryption, and 24-hour breach notification mandatory for all practices regardless of size.
Insurance requirements
Most med spas need at least four types of insurance:
- Professional liability (malpractice). Covers claims arising from medical procedures. Policies for aesthetic practices typically cost $3,000–$10,000 per provider per year, depending on specialty, procedure volume, and state.
- General liability. Covers non-medical claims (slip-and-fall, property damage). Typically $500–$2,000 per year.
- Property insurance. Covers the physical space and equipment. Costs depend on lease terms and whether the landlord requires the tenant to carry property coverage.
- Cyber liability. Covers data breaches and HIPAA violations. Increasingly important as the 2026 HIPAA Security Rule raises the bar for digital safeguards. Fines for HIPAA violations can reach $1.8 million per violation category per year.
If the practice has employees, workers' compensation insurance is required in every state. The medical director should carry separate malpractice coverage that specifically includes med spa supervision — a standard physician policy may not cover off-site supervisory roles.
Staffing: who can do what
Scope of practice determines which professionals can perform which procedures, and under what level of supervision. This varies dramatically by state.
Physicians (MDs and DOs)
Physicians can perform all aesthetic procedures within their training and scope. They serve as medical directors and are the only license type that can independently supervise all other clinical staff in strict CPOM states.
Nurse practitioners (NPs)
In full-practice-authority states (Arizona, Colorado, Oregon, Washington, Montana, and others), NPs can independently own, operate, and practice in aesthetic clinics without physician oversight. In restricted-practice states, NPs require a collaborative practice agreement or physician supervision. Even where independent practice is allowed, some procedures — such as operating certain laser devices — may require additional certification.
Physician assistants (PAs)
PAs practice under physician supervision in all states. The supervising physician does not need to be on-site in most states but must be available for consultation and must review a defined percentage of charts. The specific delegation rules vary by state.
Registered nurses (RNs)
RNs can administer injectables in most states, but only under physician delegation and supervision. The physician must establish standing orders or treatment protocols, and the level of supervision (on-site, direct, or indirect) depends on state law. RNs cannot independently diagnose, prescribe, or determine treatment plans.
Estheticians and medical assistants
Estheticians can perform facials, chemical peels (within scope), and superficial treatments, but they cannot perform medical procedures such as injectable administration, microneedling beyond the epidermis (in most states), or laser treatments classified as medical procedures. Medical assistants may assist clinical staff but cannot independently perform medical procedures.
Key hiring mistakes
- Allowing unlicensed staff to perform laser treatments classified as medical procedures.
- Delegating injectable administration to staff whose state license does not permit it.
- Failing to verify that NP or PA collaborative agreements are current and cover aesthetic procedures.
- Not documenting training and competency sign-offs for each procedure each staff member performs.
The pre-opening compliance checklist
Before accepting the first patient, every med spa should have the following documented and in place:
- Entity formed in compliance with state CPOM rules (PC, PLLC, or MSO/PC structure)
- Healthcare attorney has reviewed ownership and operating agreements
- Medical director agreement signed, with scope, compensation, supervision standards, and termination provisions
- Written treatment protocols for every medical procedure offered, approved by the medical director
- All staff licenses verified and current (physician, NP, PA, RN, laser operator)
- State medical facility registration filed (if required)
- DEA registration obtained (if dispensing controlled substances)
- CLIA waiver filed (if performing in-office lab tests)
- Business license, sales tax permit, and fictitious name permit obtained
- Laser device registrations filed with state agency (if required)
- Malpractice, general liability, property, and cyber liability insurance active
- HIPAA policies documented, security risk assessment completed, Business Associate Agreements signed with all vendors
- Emergency protocols written, posted, and rehearsed with staff
- Informed consent forms drafted for every procedure, reviewed by healthcare attorney
- Before-and-after photo consent forms compliant with HIPAA and state privacy law
- EHR and practice management software configured with role-based access controls
- Chart audit schedule established with the medical director
- Marketing materials reviewed for advertising compliance (no guaranteed results, no misleading before/after photos, proper credential representation)
Financing the med spa
Most practices do not pay for everything from savings. The most common financing approaches in 2026:
- SBA 7(a) loans. The U.S. Small Business Administration's flagship loan program offers up to $5 million with repayment terms of 10–25 years. In 2026, with the prime rate at 6.75%, SBA 7(a) variable rates range from roughly 9–11.5% APR depending on loan size and term. These loans require a detailed business plan, personal guarantee, and collateral, and they take 30–90 days to close.
- Medical equipment financing. Equipment loans and leases specifically for healthcare practices offer 3–7 year terms with the equipment as collateral. Approval is faster than SBA loans (typically 1–2 weeks), and rates range from 5–12%.
- Business line of credit. A revolving credit line ($25,000–$250,000) for working capital, inventory purchases, and unexpected expenses. Interest accrues only on drawn amounts. Rates vary from 7–18%.
- Personal investment and partners. Many med spa founders use personal savings, home equity lines, or bring on partners. If taking on investors, ensure the ownership structure does not violate CPOM rules — a non-physician equity investor in a strict CPOM state must participate through the MSO, not the PC.
The typical break-even timeline for a well-run med spa with consistent marketing is 12–18 months. Most practices do not reach profitability until month 8–14, making the working capital reserve one of the most critical line items in the startup budget.
What most first-time owners underestimate
Legal costs. Forming the right entity structure with a healthcare attorney costs $5,000–$15,000 in CPOM-strict states. Skipping this step and fixing it after an enforcement action costs 10–50 times more.
Time to open. Plan 3–6 months from entity formation to first patient in a moderate-complexity state. California and New York can take longer due to Medical Board registration requirements.
Working capital needs. Most practices do not break even for 6–12 months. Undercapitalization — running out of cash before revenue stabilizes — is the leading cause of med spa closures in the first two years.
HIPAA compliance is not optional. The 2026 HIPAA Security Rule eliminates exemptions for small practices. Before-and-after photos stored on personal phones, patient names in consumer iCloud accounts, and unencrypted messaging apps for clinical communication are all violations. Fines start at $100 per violation and can reach $1.8 million per category per year.
The medical director must be real. A physician who signs a contract but never visits the practice, reviews charts, or sets protocols is not a medical director — they are renting their license. State boards are actively investigating and penalizing this arrangement.
Sources
- American Med Spa Association (AmSpa), "How to Open a Med Spa," updated April 2026. https://www.americanmedspa.org/how-to-open-a-med-spa
- MedSpa Standards, "How to Open a Med Spa in California: Complete Step-by-Step Guide (2026)," April 28, 2026. https://medspastandards.com/blog/california/how-to-open-a-med-spa-california
- AestheticsPro, "Licenses Required to Open a Med Spa in 2026." https://www.aestheticspro.com/Blog/Licenses-Required
- Vagaro, "How Much Does It Cost to Open a Med Spa? 2025–2026 Startup Guide." https://www.vagaro.com/learn/med-spa-start-up-costs
- MedSpa Standards, "How Much Does It Cost to Open a Med Spa in 2026? Complete Cost Breakdown." https://medspastandards.com/blog/cost-to-open-a-med-spa
- Texas Medical Board, delegation rules, 22 Texas Admin. Code §§169.25–169.27. https://www.tmb.state.tx.us
- California Business and Professions Code §650(b). https://leginfo.legislature.ca.gov
- NetcoSA, "Does HIPAA Apply to Your Med Spa? The IT Checklist for Aesthetics Practices," 2026. https://netcosa.com/blog/med-spa-hipaa-compliance-checklist
- Phorest, "Compliance Checklist for California Med Spas: 2026 Edition." https://www.phorest.com/us/blog/compliance-checklist-for-california-med-spas-2026-edition
- Cohen Healthcare Law Group, "Optimize Your Medical Spa with MSO Structure Guide." https://cohenhealthcarelaw.com/how-to-use-the-mso-structure-to-build-your-medical-spa
- Florida Healthcare Law Firm, "HIPAA Compliance for Aesthetic Clinics: Privacy Guide 2026." https://floridahealthcarelawfirm.com/hipaa-compliance-for-aesthetic-clinics
