Open a Med Spa: Ownership, Licenses & Costs August 2026
August 2026 med spa checklist: CPOM laws, state licensing, startup costs, and medical director requirements for new owners.
TL;DR
5 key points- 01Med spas are classified as medical practices, so physician oversight and state licensing apply from day one — whether HIPAA reaches you is a separate question that turns on billing.
- 02Only 37% of med spas have a physician owner; non-physician owners typically need an MSO/PC split to comply with CPOM laws.
- 03Startup costs range from $150,000 for a lean injectable clinic to $1 million-plus for a premium build-out in a major market.
- 04An engaged medical director runs $1,500 to $5,000 per month; nominal arrangements offer little protection during board investigations.
- 05Decoda consolidates scheduling, clinical documentation, billing, and patient communications into one system, with AI Front Desk and AI Scribe built for lean new practices.
What Makes a Med Spa a Medical Practice
A med spa looks like a spa on the outside. Legally, it operates like a clinic.
The moment your service menu includes neurotoxin injections, laser treatments, dermal fillers, chemical peels, or IV therapy, state law stops seeing you as a wellness business and starts seeing you as a healthcare practice. That classification carries real weight: medical licensing requirements apply and a licensed physician must provide oversight. Patient privacy is governed too, though by which rulebook depends on how you bill — covered further down.
This distinction trips up many first-time owners, especially those from esthetics or cosmetology backgrounds. A day spa can be owned by anyone. A med spa, because it performs procedures that carry medical risk, falls under state medical practice acts that restrict who can own, supervise, and administer treatments. Getting this wrong at the start can result in forced closure or personal liability.
Who Can Own a Med Spa
Ownership eligibility depends heavily on your license and your state. AmSpa's 2022 State of the Industry report found that only 37% of single-owner med spas had a physician owner, meaning non-physician ownership structures are now the norm.
- Physicians (MD/DO): Can own outright in all states. No structural workarounds needed.
- Nurse practitioners: Ownership is possible in full-practice-authority states, but restricted or prohibited where physician supervision is required.
- Physician assistants: Eligible in a small number of states. Most require a supervising physician in the ownership chain.
- Registered nurses: Direct ownership of a medical entity is generally not permitted. An RN can hold a business interest, but clinical authority must sit with a physician or advanced practice provider.
- Estheticians and cosmetologists: Cannot own the medical side of a med spa in any state. The business entity may be yours structurally, but the clinical practice must be physician-controlled.
- Non-clinical entrepreneurs: Can own a med spa through specific legal structures, covered in the next section.
Your state's medical practice act governs what's actually permitted where you operate. This is a framework, not legal advice.
The CPOM Doctrine and MSO/PC Structure
Most non-physician owners run their med spa through an MSO/PC split, and the Corporate Practice of Medicine (CPOM) doctrine is why.
CPOM is a legal principle, active in many states, that prohibits corporations or non-physicians from directly hiring physicians or controlling medical decisions. In states that enforce it strictly, you cannot simply own a clinical entity and hire a doctor. The structure has to be split.
The standard workaround: a Management Services Organization (MSO) that you own handles everything non-clinical, including marketing, scheduling, billing, and staffing. A separate physician-owned Professional Corporation (PC) handles all medical services. The two operate under a formal management services agreement. You earn through the MSO; the physician controls the clinical side.
How strictly CPOM is enforced varies widely by state: California, New York, New Jersey, and Texas sit at the strict end, while Florida, Arizona, and Delaware are more permissive. Getting the structure wrong in a strict state can mean fines, forced restructuring, or closure. California's SB 351, one of the more consequential new med spa laws in 2026 (effective January 1, 2026), explicitly prohibited MSOs from interfering with clinical decisions, so even a valid MSO/PC arrangement has guardrails.
An attorney familiar with your state's medical practice act should review any entity structure before you file paperwork.
Medical Director Requirements
Nearly every state requires a medical director before you can open. The question is what that actually means in practice.
A legitimate medical director does real work: signing standing orders and treatment protocols, overseeing delegated procedures, conducting or supervising Good Faith Exams, reviewing charts, and managing adverse events. What they cannot do, at least not legally, is sign a contract, cash a monthly check, and disappear. States including New York, New Jersey, California, and Texas intensified enforcement against passive arrangements in 2025 and 2026, and regulators have become skilled at identifying nominal directorships during board complaints.
Cost matters here. An actively engaged medical director typically runs $1,500 to $5,000 per month, or $18,000 to $60,000 annually. A nominal arrangement at $500 a month offers almost no protection when a board investigates a patient complaint.
For multi-state expansion, each jurisdiction requires its own physician with an active, unrestricted license in that state.
Licenses and Permits Required to Open
Licensing a med spa involves three distinct layers, and conflating them is one of the most common reasons opening timelines slip.
The first layer is standard business licensing: a state business registration, a local business license, a seller's permit if you're retailing products, and an EIN. These do not authorize a single medical treatment.
The second layer is clinical. You need a qualified physician with an active, unrestricted state license, a signed medical director agreement outlining supervision responsibilities, and documented standing orders for every procedure your staff will perform. Every provider requires their own current, valid license: RN, NP, PA, or MD, depending on treatments and state rules.
The third layer is facility permitting. Depending on your state, you may need to register as a healthcare facility or obtain health department approval before seeing patients. Some states require separate permits for specific equipment like lasers, and these approvals can take weeks to months.
Beyond those three layers, patient-privacy documentation is non-negotiable regardless of which federal rule applies to you: a written privacy policy that matches what your systems actually do, staff training records, and signed agreements with every vendor handling patient data, including your EMR, payment processor, and any marketing tool that touches intake data. Malpractice and general liability insurance round out the pre-opening requirements.
Use the American Med Spa Association legal summaries as a starting point, but your state medical board website is the authoritative source for current facility registration and scope-of-practice rules.
State-Specific Ownership Rules for High-Search States
Ownership rules vary sharply by state, and getting this wrong can mean forced closure. The table below captures the key structures for the most commonly searched states.
State | Who Can Own | CPOM Stance | Key Notes |
|---|---|---|---|
Texas | Physician required | Strict | Texas Medical Board governs; NPs need collaborative agreements |
Florida | Anyone | Permissive | Non-clinical owners cannot influence clinical decisions; medical director required |
New York | Physician-owned PC/PLLC only | Very strict | NYSED Authority to Form required; a 2026 Department of State sweep cited 87 of 223 inspected med spas |
California | Physician-controlled entity | Very strict | SB 351 (Jan 2026) tightened MSO/clinical separation; NPs may hold a minority stake but cannot control the clinical entity; patient-specific orders are displacing standing orders |
Georgia | Physician or supervised NP | Moderate | NPs permitted in some structures with protocol agreements |
New Jersey | Physician oversight required | Strict | Enforcement intensified through 2025 and 2026 |
Rules shift frequently. Verify current requirements with your state medical board and consult a healthcare attorney before filing any entity paperwork.
What It Costs to Open a Med Spa
Startup costs vary widely depending on treatment focus, location, and how many rooms you're building out.
- Lean clinic (1-2 rooms, injectables-only): $150,000 to $250,000
- Mid-range (2-4 rooms, some devices): $300,000 to $500,000
- Premium build-out in a major market: $1 million or more
Equipment typically accounts for 40 to 50 percent of total startup costs, with build-out running $50 to $200 per square foot. Layer in a medical director retainer ($1,500 to $5,000/month), initial product inventory, legal and compliance setup, insurance, and a marketing launch budget.
Monthly operating costs run $20,000 to $70,000 depending on size and staffing. Working capital covering three to six months of operations is the category most first-time owners underfund.
Leasing equipment preserves capital as tech evolves, but purchasing makes more sense for core devices used daily at volume. SBA 7(a) loans, healthcare-specific lenders, and dedicated equipment financing are the most common funding paths.
Building a Med Spa Business Plan
A business plan for a med spa serves one concrete function: it forces you to find out whether the math works before you sign anything.
Start with local market research. Mystery-shop competitors, capture their pricing, and look for gaps in the service mix. A saturated market of injection-only clinics might have room for body contouring or hormone therapy.
Build your service menu around margin and repeat rate. Neurotoxins have low per-unit margin but high rebooking frequency. A laser device might carry a $120,000 price tag with an 18-month payback. Know which treatments drive lifetime patient value and which are one-time draws.
Your financial model needs three scenarios: conservative, moderate, and aggressive, each answering how many treatments per week cover fixed costs.
Other components lenders and landlords want to see:
- A 12-month marketing budget with realistic cost-per-consult figures, plan for $100 to $300 per new patient consultation in a competitive market
- A staffing model showing which roles are day-one hires versus month-six additions
- A compliance section reflecting your state's ownership structure, medical director fees, and legal setup costs
Most timelines from decision to opening day run six to twelve months, with legal entity setup, build-out permitting, and state facility licensing as the longest variables.
Choosing a Location and Service Menu
Location shapes patient flow more than most owners expect. A high-visibility space with easy parking near your target demographic outperforms a cheaper lease in an inconvenient strip two miles away. Verify zoning and check whether your county or municipality requires separate health department approval for medical facility use before you sign a lease.
Resist the urge to launch with everything. Starting with one or two focused categories, most commonly injectables plus one device-based treatment, keeps training manageable and lowers capital risk. You can expand once actual patient demand tells you what to add.
The most profitable service mix over time combines recurring revenue from med spa memberships billing and packages with high-ticket procedures that drive per-visit value.
One timing detail many owners miss: set up wholesale accounts with injectable and device suppliers well before your opening date. Credentialing with distributors can take two to six weeks and often requires your medical director's credentials, so starting late pushes your opening day back.
Clinical Compliance: Protocols, Standing Orders, and HIPAA
Every treatment your staff performs needs a paper trail before the first patient walks in.
Written clinical protocols cover what, how, and under whose authority each procedure is delivered. One protocol per service, signed by your medical director. Standing orders then translate those protocols into legal authorization, giving your RNs, NPs, and PAs the written directive they need to perform procedures without the physician present for every encounter. Without valid standing orders, your providers are technically operating outside their delegated scope of practice regardless of their license. One state-level caveat worth checking before you build your protocol binder: California has been moving away from blanket standing orders toward patient-specific orders tied to an individual good faith exam, so a protocol set that satisfies a Florida board may not satisfy a California one.
Settle the HIPAA question before you buy any software, because it decides what the rest of your privacy setup looks like. A provider is a HIPAA covered entity only if it transmits health information electronically in connection with a covered transaction — insurance claims, eligibility checks, and the like. A purely cash-pay med spa that never bills a payer often is not one, which surprises most first-time owners. That does not leave you unregulated: the FTC Act, the FTC's Health Breach Notification Rule, and state privacy statutes reach practices HIPAA misses, and we cover that split in detail in the FTC health data rules for elective care practices.
If you do bill insurance, HIPAA governs, and that means signed Business Associate Agreements with every vendor touching patient data, including your EMR, payment processor, and any intake or marketing tool that handles health information. Either way, choosing HIPAA-compliant medical spa software is the safer default, since the controls it brings — role-restricted record access, audit logging, documented staff training on the minimum necessary standard, and a breach response procedure — are what both regimes expect you to have. OSHA's Bloodborne Pathogens Standard applies any time staff perform injections, requiring exposure control plans, hepatitis B vaccination policies, and proper sharps disposal protocols from day one.
Review your SOPs at least once a year, and any time staff change, you add procedures, bring in new equipment, or your state updates its scope-of-practice rules.
Hiring and Staffing Your Med Spa
Every clinical hire needs an active, in-good-standing license in the state where you operate. Out-of-state licenses do not transfer automatically, and scope-of-practice rules determine what each role can legally perform, so verify both before extending any offer.
Core roles to plan for:
- Front desk and patient coordination: handles scheduling, intake, and checkout (including your medical spa POS system); no clinical license required; $25,000 to $40,000 per year
- Licensed estheticians: non-medical facials, peels within their scope; $40,000 to $60,000 per year depending on state and experience
- RN, NP, or PA: injectables, IV therapy, device-based treatments per state delegation rules; $60,000 to $80,000 or more depending on scope and market
- Medical director: part-time or full-time physician with active state license; covered under a separate medical director agreement
Commission arrangements tied to clinical services carry legal risk in states with fee-splitting prohibitions. Paying a provider a percentage of revenue from their treatments can constitute unlawful fee-splitting in states like California and New York. Flat salary or hourly plus a non-clinical performance bonus is cleaner from a compliance standpoint. Run any incentive structure past your healthcare attorney before rolling it out.
Start lean. One or two clinical providers cross-trained across front desk intake and retail sales will take you further than a full team hired on projected revenue that hasn't materialized yet.
Patient Acquisition and Marketing Strategy
New practices typically spend up to 20 percent of projected revenue on med spa marketing in their first year. Mature ones maintain growth at 5 to 10 percent. That gap exists for a reason: building a patient base from zero is expensive, and practices that underinvest early often spend years recovering ground.
The core channels worth funding from day one:
- Google Search (SEO and paid): captures people already searching for specific treatments in your area
- Meta ads (Facebook and Instagram): drives awareness through before-and-after content and treatment education before patients know to search
- Review management: a new practice with no reviews loses consultations to a competitor with 200; nearly half of consumers say a provider's social media presence influences their decision to book, per the ASDS 2025 Consumer Survey
- Email and SMS: your cheapest rebooking channel once a patient has visited
- A referral program: word-of-mouth from satisfied patients carries a lower acquisition cost than any paid channel
A new patient acquisition cost of roughly $132, per Curve Compliance med spa benchmarks, is a useful benchmark when assessing whether a paid channel is working or burning budget. Review collection, follow-up automation, and rebooking nudges need to be live before your first patient walks in, because retention is what determines whether your practice hits profitability in 12 months or 36.
How Decoda Supports New Med Spa Operations from Day One
Most new med spas launch on five to seven disconnected tools: one for automated appointment scheduling, another for charting, a separate CRM, a phone system, a payment processor, and something cobbled together for marketing. None of them talk to each other, and that fragmentation is one of the quieter reasons new practices take longer than expected to reach profitability.
Decoda replaces that stack with a single AI-native system built for elective-care clinics. Scheduling, clinical documentation, billing, patient communications, inventory, and memberships all live in one place. For a newly opened practice running lean on staff, the AI Front Desk answers calls and books patients around the clock, because missed calls during your first weeks are missed revenue. The AI Scribe for clinical notes generates documentation in real time, which matters most when providers are learning new workflows and documentation pressure is highest.
Decoda is live in 150-plus clinics processing over $100 million in annual transactions, built for independent practice scale, not retrofitted from hospital software.
Final Thoughts on Med Spa Ownership and Compliance
Owning a med spa means running a business and a clinical practice at the same time, and the owners who do it well treat both sides with equal seriousness. Your ownership structure, your medical director arrangement, and your compliance documentation are not boxes to check once and forget. They need to hold up under scrutiny, and the time to get them right is before your first patient walks in. Book an intro call with Decoda to see how we support new practices getting off the ground.
Frequently Asked Questions
Can a nurse practitioner own a med spa, and does it depend on the state?
Yes, but your ownership rights depend entirely on whether your state grants nurse practitioners full practice authority. In full-practice-authority states, NPs can own and operate the clinical entity without a supervising physician. In states like Texas, California, and New York, NPs face restrictions ranging from required collaborative agreements to outright prohibition from owning the clinical side of the practice — meaning you'd need an MSO/PC structure with a physician-controlled Professional Corporation handling medical services.
What license do you need to open a medical spa in Florida, California, Texas, or New York?
Every state requires a standard business license and EIN, but the clinical licensing layer is where the rules diverge sharply. Florida is relatively permissive — non-clinical owners can hold the business, but a licensed medical director must oversee all treatments. California and New York are strict CPOM states: the clinical entity must be physician-controlled, and California's SB 351 (effective January 2026) added explicit guardrails preventing MSOs from influencing clinical decisions. Texas requires physician involvement in the ownership chain, with NPs needing collaborative agreements to perform many procedures. In every state, you also need individual provider licenses current and in good standing, standing orders for each treatment your staff performs, and facility registration before seeing patients.
Can an esthetician open a medical spa in Georgia, Florida, California, or Ohio?
An esthetician can own the business entity in most states, but cannot own or control the medical side of a med spa anywhere in the United States. States like Florida allow flexible ownership structures, so an esthetician can hold the MSO that handles scheduling, retail, and marketing — but a physician must own or control the Professional Corporation through which all clinical procedures are delivered. In strict CPOM states like California and New York, even that business-side ownership comes with tight limits on how much the MSO can direct clinical operations. Georgia sits in the middle, allowing some NP-supervised structures, but esthetician-controlled clinical entities are not permitted there either.
How much does it cost to open a med spa, and what do most first-time owners underfund?
A lean injectable-focused clinic runs $150,000 to $250,000 to open; a mid-range build with device treatments typically falls between $300,000 and $500,000; premium build-outs in major markets can exceed $1 million. Equipment alone accounts for 40 to 50 percent of startup costs. The category most first-time owners underfund is working capital — you need three to six months of operating expenses ($20,000 to $70,000 per month depending on size) in reserve, because patient volume rarely covers fixed costs in the first 90 days. Medical director fees ($1,500 to $5,000 per month), legal entity setup, and a launch marketing budget are frequently underestimated line items as well.
What's the best practice management software for a medical spa in 2026, and what should I look for when switching?
The right software depends on whether it was built for elective care from the ground up or adapted from general-purpose healthcare tools. For an independent med spa, the features that matter most are: clinical documentation built for aesthetic workflows (not hospital charting), membership and package configuration that handles rollovers and tiered discounts natively, scheduling that manages rooms and equipment alongside providers, and communications tools that work without a separate CRM. Decoda is an AI-native system built specifically for elective-care clinics — its AI Front Desk, AI Scribe, and membership engine are built into a single system rather than assembled from separate tools — and it is live in 150-plus clinics processing over $100 million in annual transactions.
What is the MSO/PC split structure, and do I actually need one to open a med spa?
You need an MSO/PC split if you want to own a med spa without being a physician in a state that enforces the Corporate Practice of Medicine doctrine. The structure separates your business entity (the Management Services Organization, which you own) from the physician-controlled Professional Corporation that employs providers and delivers clinical care. States like California, New York, and New Jersey require this arrangement for non-physician owners; permissive states like Florida do not, though a medical director is still required everywhere.
Can a PA own a med spa, and which states allow it?
Physician assistants can hold a business ownership interest in a med spa in some states, but direct ownership of the clinical entity is permitted only in a small number of jurisdictions. In most states, a supervising physician must remain in the ownership or oversight chain, meaning a PA-led practice typically still needs an MSO/PC structure. Check your state's PA licensing board and medical practice act before filing any entity paperwork, because scope-of-practice rules for PAs vary more than almost any other provider category.
Can an RN own a med spa in New York, Texas, or Florida?
Registered nurses cannot own the clinical side of a med spa in New York, Texas, or Florida. In New York, the clinical entity must be a physician-owned PC or PLLC. In Texas, a physician must be in the ownership or oversight chain, and RNs cannot perform many injectable procedures without standing orders from a physician. Florida's permissive structure lets RNs hold a business interest in the MSO, but clinical authority must sit with a physician or appropriately supervised advanced practice provider.
What are the requirements to work at a med spa as an injector or clinical provider?
You need an active, unrestricted state license in the state where you'll practice, typically as an RN, NP, PA, or MD depending on the treatments you'll perform. Beyond your individual license, you must operate under current, signed standing orders from the medical director authorizing the specific procedures you'll deliver. Some states restrict which license types can administer neurotoxins or dermal fillers independently, so confirm scope-of-practice rules with your state nursing or medical board before accepting a role.
How long does it typically take to open a med spa from decision to first patient?
Most first-time owners should plan for six to twelve months from decision to opening day. Legal entity setup and state facility registration are usually the longest variables, often taking two to four months depending on your state. Build-out permitting, equipment procurement, medical director credentialing with suppliers, and provider licensing verification all run in parallel, but delays in any one of them push the whole timeline back. Practices in strict CPOM states like California and New York tend to run toward the longer end of that range.
What should a med spa business plan include that most templates leave out?
Most templates cover revenue projections and service menus but leave out the compliance cost structure. Your business plan needs a line item for medical director fees ($1,500 to $5,000 per month), legal entity setup including attorney review of your ownership structure, and state facility registration fees. It should also include a realistic working capital reserve covering three to six months of operating expenses, because patient volume rarely covers fixed costs in the first 90 days. Lenders and landlords will also want to see a staffing model showing day-one hires versus later additions and a per-channel marketing budget with an estimated cost per new patient consultation.
Can a dentist own a medical spa in California?
A dentist can own a business entity in California, but a dental license does not authorize ownership or control of a medical spa's clinical operations. California's strict CPOM rules require the clinical entity to be physician-controlled, meaning an MD or DO must own or govern the Professional Corporation through which all medical treatments are delivered. A dentist-owned MSO could potentially hold the non-clinical business side, but the clinical entity structure would still need a physician at the helm, and California's SB 351 added explicit guardrails against the MSO influencing clinical decisions.
What standing orders does a med spa need, and who has to sign them?
You need a separate written standing order for every procedure your non-physician staff will perform, covering what the treatment is, who is authorized to deliver it, under what conditions, and what to do if there is an adverse event. Your medical director, who must hold an active, unrestricted license in your state, signs all standing orders. Without valid standing orders, your RNs, NPs, and PAs are technically practicing outside their delegated scope regardless of their individual license level. Review and re-sign standing orders any time you add a new treatment, bring in new equipment, change staff, or your state updates its scope-of-practice rules. California is the notable exception to the blanket-standing-order model, having shifted toward patient-specific orders tied to an individual good faith exam.
What's the difference between a nominal medical director arrangement and an engaged one, and why does it matter?
A nominal medical director signs a contract and collects a monthly retainer but has no meaningful involvement in clinical oversight. An engaged medical director signs standing orders, reviews protocols, supervises Good Faith Exams, and responds to adverse events. The difference matters because state medical boards have become skilled at identifying passive arrangements during investigations, and a nominal setup at a low monthly fee offers almost no legal protection when a patient complaint triggers a board inquiry. An actively engaged director typically costs $1,500 to $5,000 per month; paying significantly less than that usually signals a nominal arrangement that won't hold up under scrutiny.
How does switching from five disconnected tools to a single system actually affect a new med spa's day-to-day operations?
Running separate tools for scheduling, charting, billing, communications, and inventory means staff spend time re-entering the same data across systems and manually reconciling records that should update automatically. For a newly opened practice operating lean on headcount, that friction compounds quickly. A single system where scheduling, clinical documentation, billing, and patient communications share one patient record removes that reconciliation work. Decoda's AI Front Desk and AI Scribe are built into the same system as scheduling and payments, so a provider generating a note in real time and a front desk booking the next appointment are working inside one record, not two separate tools that may or may not sync.