Guide · Running a med spa
Med spa compliance: a checklist for owners
Med spa compliance comes down to a handful of areas: who oversees and owns the medical services, who is allowed to perform each treatment, how clients are evaluated and consented, where drugs and devices come from, how health information is protected, and what your advertising claims. Most of the rules are set by your state, so the answers differ from place to place.
Use this checklist to find the gaps, then confirm the specifics with a healthcare attorney in your state. It is general information, not legal advice.
Updated October 29, 2026. General information, not legal advice; rules differ by state.
Medical oversight and ownership
Most states require a physician or other qualified clinician to be responsible for medical procedures, usually as a medical director with written protocols and a clear delegation and supervision arrangement. Many states also have corporate practice of medicine rules that limit non-physician ownership or control of medical services, which shapes how a med spa owned by a non-physician must be structured.
Check: is your oversight agreement in writing, does it say who supervises whom and how, and does your ownership structure fit your state's rules?
Scope of practice for every treatment
For each service on your menu, confirm which license is allowed to perform it in your state and under what level of supervision. Injectables, lasers, chemical peels and IV therapy are each regulated differently, and aestheticians, nurses, nurse practitioners and physician assistants have different scopes.
Good faith exams and consent
Where your state requires it, a licensed clinician must evaluate each client before medical-aesthetic treatment, and document the decision. Pair that with informed consent for each treatment, covering risks, alternatives and aftercare, and keep both in the client's record.
Drugs, devices and sourcing
Buy neurotoxins, fillers and other drugs only from legitimate, licensed sources, and store and log them as required. Compounded drugs carry their own rules: patient-specific compounding requires a prescription and a documented medical need when a commercial product exists. Lasers and other devices should be cleared for the use you offer and operated by staff your state permits.
Privacy and health information
Whether HIPAA applies to your business depends on how you operate, including whether you conduct certain electronic transactions such as insurance billing, and many states have their own health privacy laws. Either way, treat client health information as protected: limit access, secure your systems, and get business associate agreements from vendors that handle it.
Advertising
Claims must be truthful and substantiated. Avoid guaranteed results, before-and-after images you cannot back up, presenting compounded products as the same as brand-name drugs, or implying that everyone qualifies for a prescription treatment. Use the product names and terms your suppliers and regulators allow.
Workplace safety
If staff can be exposed to blood or needles, OSHA's bloodborne pathogens standard applies: an exposure control plan, training, sharps containers and appropriate vaccination offers. Dispose of sharps and medical waste the way your state requires.
Where a telehealth partner reduces the load
Take-home prescription programs run through a telehealth partner move most of these obligations off your premises. With KiteMD, clinicians licensed in the client's state evaluate and prescribe, a pharmacy ships the medication, and your staff never perform the treatment or see the client's health information. In-office procedures still need everything above.
Common questions
- What licenses does a med spa need?
- It depends on the state and the services. Expect professional licenses for everyone who performs medical treatments, any facility or business registrations your state requires, and, for drugs and devices, compliance with how they are purchased, stored and operated.
- Does HIPAA apply to med spas?
- It applies to businesses that are HIPAA covered entities, which turns on how they operate, such as billing insurance electronically. Many cash-only med spas fall outside that definition but are still covered by state privacy laws, so protect health information either way.
- Who is responsible if something goes wrong in a treatment?
- Responsibility can fall on the person who performed the treatment, the supervising clinician and the business, depending on the facts and the state. Written protocols, proper supervision, documentation and malpractice coverage are the main protections.
Add prescription treatments under your brand
KiteMD runs white-label prescription skincare, hair restoration and weight management for med spas and salons. Licensed clinicians review every intake. $149/mo, and you keep 85% of every membership.