Medical Spa Compliance: Ownership, Supervision, and Scope of Practice
Medical spas operate at the intersection of cosmetic services and medical practice, and state medical boards have stepped up enforcement against facilities that blur the line. Most violations cluster in three areas: ownership structure, physician supervision of mid-level injectors, and scope-of-practice creep. This article covers the rules and the documentation patterns that survive a board investigation.
Corporate Practice of Medicine and Ownership
Most states bar non-physicians from owning a practice that delivers medical services. Botulinum toxin and dermal filler injections are considered medical services in nearly every state, which means a non-physician owner generally cannot directly own the entity that bills for those services.
Many states accept a Management Services Organization (MSO) structure where a physician-owned professional entity delivers the medical services and a separately owned management company handles non-clinical operations. The contracts between the two entities have to be carefully drafted to avoid fee-splitting prohibitions.
States with active enforcement against improper med spa ownership include California, New York, Texas, New Jersey, and Florida. Each has issued public actions against med spa operators in the past several years.
An ownership review by counsel familiar with your state's medical board guidance is the cleanest way to confirm compliance. Operating without that review is a recurring source of board investigations.
Physician Supervision of Injectors
Most states require a licensed physician or, where allowed, an advanced practice nurse or physician assistant with appropriate prescriptive authority to evaluate the patient before any prescription cosmetic agent is administered.
States vary on whether the supervising physician must be physically on-site, immediately available, or available by telecommunication. The rules are stricter for first-treatment evaluations than for follow-up visits.
A standing order or protocol that allows a registered nurse to inject without an individualized patient evaluation is generally not acceptable. Each patient encounter requires a clinician with prescriptive authority to make the prescribing decision.
Documentation should show the prescriber's evaluation note, the prescription order specifying the agent and dose, and the injector's note confirming administration. Three separate entries, three signatures.
Scope of Practice for Aestheticians and RNs
Aestheticians (cosmetology license) generally cannot perform any procedure that penetrates the skin or alters living tissue. Microneedling, chemical peels above superficial depth, laser hair removal, and any injectable are typically out of scope.
Registered nurses can administer prescribed injectables under physician oversight in most states, but cannot independently prescribe or evaluate the medical appropriateness of the treatment.
Laser device operation is restricted by state, with some jurisdictions requiring physician operation or direct supervision of every treatment. Confirm against your state laser rules before purchasing devices.
PDO threads, plasma fibroblast devices, and PRP injections are increasingly being classified as medical procedures, with several state boards issuing cease and desist orders to non-physician operators.
Documentation and Adverse Event Reporting
Each patient should have a medical record including informed consent, photographs (where applicable), drug lots and expiration dates, batch numbers, injection map, and post-procedure instructions.
Adverse events including vascular occlusion, infection, and unexpected drug reactions are reportable to the manufacturer through the FDA MedWatch program (Form 3500) and may also require state board notification depending on severity.
Hyaluronidase or other reversal agents must be on site whenever hyaluronic acid filler is administered. The protocol for vascular occlusion management should be written and signed by the supervising physician.
Records must be retained per state medical board requirements (typically 7 to 10 years) and stored in a HIPAA-compliant manner regardless of whether the spa is technically a covered entity.
In most states, no, not directly for the medical services portion. A non-physician can own a management services organization that handles non-clinical operations while a physician-owned professional entity owns the medical services side. The structure must comply with corporate-practice-of-medicine and fee-splitting rules in the relevant state.
What is the most common medical spa compliance violation?
Performing prescription injectable treatments without an individualized evaluation by a clinician with prescriptive authority. Standing orders or protocol-based prescribing for cosmetic agents have been rejected by multiple state boards. Each patient needs a documented evaluation by a physician, NP, or PA before the first treatment, and many states require updated evaluations on a defined cadence.
Are cosmetic injectables considered the practice of medicine?
Yes in essentially every state. Botulinum toxin and dermal fillers are prescription medications, and their administration constitutes the practice of medicine. This applies regardless of whether the setting is a medical spa, salon, or freestanding clinic.
For practices
Bring this to your own practice.
QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.
This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.
