For years, medical spas in most states operated under general medical practice rules — the same regulations that govern a dermatology clinic or a primary care office, without any framework specifically designed for the med spa business model. That is changing. In 2026, multiple states have introduced or enacted legislation that creates dedicated regulatory structures for medical spas, including mandatory facility registration, responsible practitioner designation, adverse event reporting requirements, and public databases of licensed med spas.
Indiana became the first state to sign dedicated med spa legislation into law in 2026. Iowa, Arizona, and Florida have introduced similar bills. The American Med Spa Association (AmSpa) has described this as part of a "growing national trend to regulate and license medical spas and aesthetic practices."
This article covers what is in the new laws, what they require, when they take effect, and what med spa operators should be doing now — regardless of which state they operate in.
Why states are acting now
Several factors are driving the regulatory push:
Rapid industry growth without corresponding oversight. The global medical spa market was valued at approximately $21.3 billion in 2025 and is projected to reach $41–49 billion by 2030, depending on the research firm, growing at a compound annual growth rate of 14–15% (Grand View Research; Research and Markets, 2026). This growth has outpaced regulatory frameworks in most states.
High-profile enforcement actions. New York formed a dedicated med spa enforcement task force in 2025–2026 to address unsafe and unlawful practices, including unlicensed procedures, improper supervision, and deceptive advertising. Regulators in California, Texas, and Florida have also increased inspections and enforcement actions.
Patient safety incidents. Adverse events at med spas — including vascular occlusions from filler injections, burns from improperly operated lasers, complications from compounded GLP-1 medications, and infections from unsanitary practices — have attracted media attention and legislative scrutiny.
Scope-of-practice ambiguity. The question of who can perform what procedure, under what level of supervision, has been inconsistently regulated across states. Med spas often operate in a gray area between medical practice and cosmetic services.
Indiana SB 282 — signed into law March 5, 2026
Indiana Senate Bill 282, signed by Governor Mike Braun on March 5, 2026, and codified at Indiana Code 25-22.5-12.5, creates Indiana's first comprehensive regulatory framework for medical spas. The law was analyzed in detail by Keffer Hirschauer LLP, Quarles & Brady LLP, and Krieg DeVault.
What the law defines as a medical spa
The law applies to any facility that provides medical treatments, uses prescription drugs or injectables, and markets aesthetic, wellness, or longevity services. This includes:
- Traditional medical spas
- IV hydration clinics
- Weight loss practices offering GLP-1 medications
- Any facility offering Botox injections, laser treatments, microneedling, or other medical aesthetic services
Key requirements
Mandatory registration. Beginning January 1, 2027, every medical spa operating in Indiana must be registered with the Indiana Medical Licensing Board (MLB). The Board has until October 1, 2026, to develop the registration framework.
Responsible practitioner. Each registered med spa must designate a responsible practitioner — a licensed physician, or in some cases a nurse practitioner or physician assistant operating within their scope — who oversees clinical operations.
Adverse event reporting. Medical spas must report serious adverse events to the Medical Licensing Board within 15 days of occurrence.
Public database. The Board will establish and maintain a public database of registered medical spas. Patients will be able to verify that a facility is registered.
Location restrictions. The law includes provisions about where medical services may be performed, addressing the growth of mobile med spas and pop-up injection events.
Advertising compliance. Advertising obligations are specified, building on existing medical board advertising rules.
Compounding pharmacy oversight. The law includes provisions related to pharmacy compliance with the federal Food, Drug, and Cosmetic Act, particularly for drug compounding — a direct response to concerns about compounded semaglutide and tirzepatide sold through med spas.
Enforcement and penalties
Medical spas that operate without registration risk a fine of up to $5,000. The Medical Licensing Board has investigation authority and the ability to take disciplinary action against registered facilities.
Indiana's existing prohibition on the corporate practice of medicine continues to govern ownership structure. The MSO (Management Services Organization) / MSA (Management Services Agreement) model remains the standard structure for non-physician ownership, though it continues to be a contested legal question.
Timeline
| Date | Milestone |
|---|---|
| March 5, 2026 | SB 282 signed into law |
| July 1, 2026 | Most provisions take effect |
| October 1, 2026 | MLB must develop registration framework |
| January 1, 2027 | Mandatory registration takes effect |
Iowa HSB 591 — the Medical Spa Oversight Act
Iowa House Study Bill 591, introduced on January 20, 2026, is titled the "Medical Spa Oversight Act." As of early 2026, it had been recommended for amendment and passage by a subcommittee.
What it would require
Mandatory licensure. A business would be prohibited from operating as a medical spa, providing wellness services, or handling, storing, administering, dispensing, or distributing prescription drugs unless licensed by the Iowa Board of Medicine.
Broad definition of "wellness services." The bill defines wellness services to include Botox injections, laser hair removal, skin pigmentation treatment, microneedling, IV nutrient therapy, and intramuscular injections of vitamins, minerals, or other nutrients.
Registration details. Medical spas would need to submit their name, business address, license number, and any address where they intend to provide wellness services or prescription medication. The information would be included in a public database.
Inspections and adverse events. The bill includes provisions for inspections and serious adverse event reporting.
Current status
HSB 591 does not specify a proposed effective date. The Iowa Board of Medicine would be required to adopt rules to implement and administer the chapter if the bill passes.
Arizona HB 4047
Arizona introduced HB 4047 on February 10, 2026, regarding the licensure of medical spas. The bill contains elements common to legislation in other states, including licensing requirements and operational standards.
As of mid-2026, the bill was under legislative review.
Florida proposed legislation
Florida introduced SB 1728 and HB 1429, titled the "Medical Spa Prescription Drug Oversight Act," in January 2026. The bills would have required medical spas handling prescription medications to obtain a license from the Florida Board of Pharmacy, designate a responsible supervising healthcare provider, and comply with standards for storage, security, and adverse event reporting. However, both bills died in committee on March 13, 2026 — SB 1728 in the Senate Health Policy Committee and HB 1429 in the House Health Professions & Programs Subcommittee.
Florida already has a well-developed office-based surgery framework (Levels I–III) that has served as a model for other states. Despite the bills failing in 2026, the legislative activity signals that Florida is likely to revisit med spa regulation in future sessions.
Massachusetts H 5087
Massachusetts introduced House Bill 5087 in January 2026, sponsored by Representative Alice Peisch. As of May 2026, the bill had been accompanied by a new draft (H 5455) and was under review by the Joint Committee on Public Health.
The bill would require medical spas to register with the Department of Public Health and obtain a facility license. Key provisions include:
- Mandatory registration within 120 days of the act's effective date for existing med spas
- Licensure application within one year of regulations being promulgated
- Minimum seven-year patient record retention
- Requirements for practitioner training, continuing education, and supervision
- Provisions restricting who may perform medical aesthetic procedures based on licensure
Massachusetts already requires a clinic license from the Department of Public Health for facilities offering cosmetic medical procedures, so the new bill would add med spa-specific requirements on top of the existing clinic licensure framework. AmSpa noted that the bill is "somewhat unusual in that it requires many things that are already required in Massachusetts while adding much greater complexity and difficulty in compliance."
Rhode Island: proposed CPOM ban
Rhode Island has proposed legislation that would ban the corporate practice of medicine for med spas — a more aggressive approach than registration. As reported by Lengea Law in April 2026, the proposal would affect MSOs, investors, and non-physician owners, potentially requiring structural changes to how med spas are owned and operated in the state.
This approach is distinct from the registration frameworks in Indiana, Iowa, Arizona, and Florida. Rather than creating a new licensing pathway, Rhode Island's proposal focuses on ownership restrictions — potentially prohibiting the MSO model entirely.
What the national trend means for operators
Even if your state has not yet introduced med spa-specific legislation, the trajectory is clear. Several steps are worth taking now:
1. Audit your current compliance posture
Review your current operations against the requirements that are becoming standard:
- Are you operating under a valid medical license or MSO structure?
- Is your medical director actively involved in clinical oversight (not just a name on a form)?
- Do you have written protocols for every procedure you offer?
- Are your delegation and supervision arrangements documented?
- Do you have an adverse event reporting process?
2. Document your adverse event process
Both Indiana SB 282 and Iowa HSB 591 include adverse event reporting requirements. This is likely to become a standard feature of future med spa legislation. If you do not already have a formal adverse event reporting process — including documentation, internal review, and state reporting when required — now is the time to build one.
3. Verify your compounding sources
The Indiana law includes specific provisions related to compounding pharmacy compliance. The FDA's 2025 delisting of compounded semaglutide and tirzepatide has already changed how med spas source GLP-1 medications. Verify that any compounded products you use come from licensed 503A or 503B compounding facilities, and that your prescribing and dispensing practices comply with state pharmacy law.
4. Review your advertising
Med spa advertising is under increasing scrutiny from both state medical boards and the FTC. The Federal Trade Commission's Endorsement Guides require clear disclosure of paid relationships in influencer marketing, and every clinical claim must be substantiated. Several states have specific advertising rules for medical practices that go beyond the FTC floor.
5. Prepare for registration
If your state has introduced or enacted legislation, understand the timeline and begin preparing registration materials. In Indiana, operators should be ready to register by October 2026, when the Medical Licensing Board's framework is expected to be in place.
6. Monitor legislation
The American Med Spa Association maintains a legal updates page that tracks state-specific legislation. Law firms including Lengea Law, Quarles & Brady, Krieg DeVault, and Keffer Hirschauer publish state-specific med spa compliance updates. Review these resources at least quarterly.
The existing compliance landscape
These new laws do not operate in a vacuum. Med spas are already subject to:
- Corporate practice of medicine (CPOM) doctrine — varies by state, governs who can own and control a medical practice
- Scope of practice laws — define what procedures each licensure type (MD, DO, NP, PA, RN, esthetician) can perform and under what level of supervision
- HIPAA — governs patient data privacy and security
- OSHA — workplace safety standards including sharps disposal, chemical handling, and bloodborne pathogen protocols
- FDA regulations — device clearances, drug approval, off-label use, and compounding oversight
- State medical board rules — licensing, advertising, telemedicine, and practice standards
- FTC advertising rules — truth-in-advertising, substantiation requirements, and endorsement disclosure
The new facility registration laws add a layer on top of these existing obligations. They do not replace them.
What this means for patients
For patients, the trend toward med spa registration is positive. Public databases will allow patients to verify that a facility is registered with the state. Adverse event reporting requirements create accountability. Responsible practitioner designation means someone is named and accountable for clinical oversight.
Patients in states with new registration laws should:
- Ask whether the facility is registered or plans to register with the state medical board
- Verify the credentials of the practitioner performing their procedure
- Confirm that a licensed physician is involved in clinical oversight, not just business management
- Ask about the facility's adverse event reporting process
Sources
- Keffer Hirschauer LLP. "Indiana Medical Spa Regulations." https://www.indyjustice.com/blog/indiana-medical-spa-regulations
- Quarles & Brady LLP. "Med Spa Compliance Series: Area of Focus — Proposed Med Spa Facility Licensure Requirements in Iowa and Indiana." JD Supra, 2026. https://www.jdsupra.com/legalnews/med-spa-compliance-series-area-of-focus-8464988
- Krieg DeVault. "Compounding Oversight — New Regulations for Medical Spas and Compounding Pharmacies." https://www.kriegdevault.com/insights/compounding-oversightnew-regulations-for-medical-spas-and-compounding-pharmacies
- American Med Spa Association. "Iowa Bill Would Regulate Medical Spas." January 26, 2026. https://www.americanmedspa.org/news/legal-updates/iowa-bill-would-regulate-medical-spas
- American Med Spa Association. "The Future of the Aesthetics Industry: Key Conversations and Takeaways from Medical Spa Show 2026." https://www.americanmedspa.org/news/the-future-of-the-aesthetics-industry-key-conversations-and-takeaways-from-medical-spa-show-2026
- Lengea Law. "New York Med Spa Compliance in 2026: Investigations Are Up." January 12, 2026. https://lengealaw.com/new-york-med-spa-compliance-in-2026-investigations-are-up
- MedSpire Health. "New Jersey Med Spa Laws: Key Regulations to Know in 2026." https://medspire-health.com/blog/new-jersey-med-spa-laws-key-regulations-to-know-in-2026
- Health Law Advisor. "Interested in Opening a Medical Spa? (Part III)." https://www.healthlawadvisor.com/interested-in-opening-a-medical-spa-part-iii-heres-more-that-you-need-to-know
- MedSpa Standards. "Med Spa Regulations by State: 2026 Compliance Reference." https://medspastandards.com/blog/med-spa-regulations-by-state
- American Med Spa Association. "Massachusetts Bill Regulates Med Spas." February 17, 2026. https://www.americanmedspa.org/legal-updates/massachusetts-bill-regulates-med-spas
- Massachusetts General Court. House Bill 5087: "An Act Regulating the Operation of Medical Spas." https://malegislature.gov/Bills/194/H5087
- Lengea Law. "Rhode Island's Proposed CPOM Ban: What Med Spas, MSOs, and Investors Need to Know." April 30, 2026. https://lengealaw.com
