What Indiana's SEA 282 Means for Med Spas – August 2026
Indiana's SEA 282 law sets registration and supervision rules for med spas. Review your compliance checklist now. (August 2026)
TL;DR
5 key points- 01Most of SEA 282 took effect July 1, 2026; from January 1, 2027 a med spa must be registered with the Medical Licensing Board to do business in Indiana.
- 02Coverage turns on a three-part definition: medical health care services, prescription drug use, and holding yourself out as focused on cosmetic or lifestyle treatments — with express carve-outs for a physician's office and any facility otherwise licensed by the state.
- 03Serious adverse events must be reported within 15 days, and the statute defines the term narrowly: death, a life threatening occurrence, or inpatient hospitalization.
- 04Compounding rules bite at the bulk drug substance: no research-grade material outside an IRB-approved study, FDA-registered source, certificate of analysis, and two-year record retention.
- 05Decoda Health's AI Scribe, dose-level charting, and role-based permissions build the audit trail SEA 282 requires.
What SEA 282 Is and Why It Was Passed
Governor Mike Braun signed Senate Bill 282 into law on March 5, 2026, creating Indiana's first dedicated regulatory framework for medical spas at Indiana Code 25-22.5-12.5. Most of the act took effect July 1, 2026; the registration requirement itself begins January 1, 2027. The law targets both med spa oversight and drug compounding restrictions.
The patient safety concern driving it was straightforward. As the Indiana Capital Chronicle reported, med spas had been administering prescription drugs, including injectables, GLP-1 compounds, and hormone therapy, in settings that operated largely outside state oversight.
How the Law Defines a Medical Spa
The statutory definition has three prongs, and a facility has to meet all of them. It must offer or provide medical health care services; it must prepare, administer, or dispense prescription drugs, or otherwise use them for intravenous, intramuscular, or subcutaneous delivery; and it must hold itself out as focused on cosmetic or lifestyle treatments. That third prong is where operators misread the law as being about branding alone — the statute then lists weight loss, wellness, longevity, cosmetic and aesthetic services (including botulinum toxin, dermal fillers, hair loss, hormone therapies, and parenteral nutrient therapies), and the nonsurgical cosmetic use of lasers and other energy devices. Rebranding as a wellness or longevity clinic moves you between named categories, not out of the chapter.
Two exclusions sit in the statute itself: a physician's office, and a facility or practice that is otherwise licensed by the state. Neither turns on who signs the LLC documents, so med spa ownership structure and licensing do not settle the registration question on their own. Whether a physician-owned aesthetics practice reads as a physician's office or as a med spa holding itself out to the public is exactly the line worth putting to counsel before the registration window closes.
Mandatory Registration with the Indiana Medical Licensing Board
Two dates matter, and they are not the same date. The Medical Licensing Board must establish the registration procedure by October 1, 2026. From January 1, 2027, a medical spa has to be registered in order to do business in Indiana. Per Indiana medical spa attorney guidance, the application names the business, its address and website, the services it intends to provide, whether it compounds drugs on site, and the responsible practitioner's name and license number along with any collaborating physician or supervising practitioner.
The application is keyed to one spa at one address, so multi-site operators should plan on filing per location and watch for the Board's rules on whether one responsible practitioner may cover more than one site. Operating unregistered after January 1, 2027 lets the Board fine the operator up to $5,000 and order registration as a condition of continuing to do business. Everything filed also lands in a public database the Board is required to maintain, with personally identifying health information redacted.
The Responsible Practitioner Requirement
Every registered med spa must designate a responsible practitioner who has prescriptive authority and training in the services and medications the spa provides, and who is physically present at the location for a sufficient amount of time to ensure the spa complies with the chapter. Because the requirement is physical presence, remote-only supervision does not satisfy it. The Board may also require its approval before one responsible practitioner is designated for more than one location.
The statute defines the eligible pool as a licensed physician, an advanced practice registered nurse meeting IC 25-23-1-19.5, or a physician assistant with delegated prescriptive authority — physician assistants are in, which surprises operators who assumed the role was physician-only. RNs cannot operate independently without appropriate physician oversight. The delegation chain matters: who ordered the treatment, who is supervising the person performing it, and whether that supervision is physically accessible when a patient is in the chair.
Practices where the medical director visits infrequently, or signs off remotely will need a real structural change before January 2027.
Scope of Practice: Who Can Perform Procedures Under SEA 282
SEA 282 layers on top of Indiana's existing licensure framework without replacing it, which makes compliance planning genuinely difficult.
For injectables and IV therapy, the performing provider must hold a license that independently authorizes the procedure. RNs can administer injectables and IV infusions under physician delegation, but medical assistants cannot perform these services regardless of supervision level. NPs with full practice authority have more flexibility, though the responsible practitioner requirement still applies at the facility level.
Laser treatments sit in a grayer zone, where scope analysis falls back to whether the procedure constitutes the practice of medicine and who is delegating it.
Chiropractors, podiatrists, and dentists operating aesthetics services remain unresolved under the new framework. Performing aesthetic injectables outside their licensed scopes raises liability questions the law does not cleanly answer. If your clinical team includes any of these providers doing aesthetic work, that arrangement needs a legal review before registration opens.
Ownership Structure and the Corporate Practice of Medicine
Indiana's corporate practice of medicine (CPOM) prohibition predates SEA 282 and remains fully in effect. Non-physician entities cannot own a medical practice outright under Indiana law, and SEA 282 does not change or clarify that.
The common structural workaround is the MSO model: a non-physician entity owns the business operations through a management services agreement, while a physician-owned PC holds the clinical practice. As Indiana medical spa attorney guidance notes, this remains a contested legal question in Indiana, and SEA 282 leaves it unresolved.
Registration and ownership structure are separate legal questions that run in parallel. You can be registered with the Medical Licensing Board and still carry liability if your MSO arrangement is later challenged. Get counsel that covers both.
Adverse Event Reporting Obligations
SEA 282 requires med spas to notify the Indiana Medical Licensing Board no later than 15 days after a patient's serious adverse event. Missing that window makes the reporting failure its own compliance violation, separate from the clinical event that triggered it.
The statute does define the trigger, and more narrowly than the phrase suggests: a negative medical occurrence associated with a prescription medication or treatment that, on reasonable medical judgment, jeopardizes the patient's health and results in medical or surgical intervention, or that results in death, a life threatening medical occurrence, or inpatient hospitalization (including prolonging an existing stay). An infection that lands a patient in the hospital is in; a complication managed in-clinic generally is not. The notice itself has to carry the patient's name, the medication or treatment involved, the date, the nature and location of the event, and the patient's medical records for it. Gray-area events still warrant a documentation trail even if you determine reporting is not required.
That is where clinical notes become a compliance tool. If the Board reviews your file, a contemporaneous chart entry carries far more weight than a reconstructed summary written days later.
Location Restrictions and the Fate of Mobile IV Therapy
SEA 282 bars a medical spa from providing health care services and cosmetic or lifestyle treatments anywhere other than the medical spa office, which creates an immediate structural problem for mobile IV therapy businesses, event-based aesthetics operators, and practitioners working out of home offices or pop-up settings.
The statute carries exactly one exception, and it is not a patient-facing one: services may be performed at another location for the education or training of individuals who intend to provide them. Mobile concierge IV drips, on-site injection events, and hotel-room aesthetic treatments do not fit it.
Operators built around mobility face a real decision before January 2027: secure a fixed registered location or stop offering prescription-drug services outside one.
Compounding Drug Restrictions Under SEA 282
SEA 282's compounding provisions are the part of the law most operators underestimated during the legislative process. The law treats the compounding pharmacy and the med spa as a single continuous risk chain, making it one of the first state frameworks to govern the full outpatient ecosystem where compounded drugs are promoted, distributed, and administered.
The restrictions attach to the bulk drug substance rather than the finished dose. A person may not compound unless the substance is neither research grade (outside an IRB-approved study) nor veterinary grade, was manufactured by an establishment registered with the FDA as a human drug establishment, arrives with a certificate of analysis identifying its content and its country of original manufacture, and has undergone quality control testing. The compounding itself has to comply with the federal Food, Drug, and Cosmetic Act and any applicable USP chapter, and anyone selling, transferring, or distributing compounded drugs must keep the acquisition, examination, and testing records for at least two years after the last lot containing that substance expires.
Practices running GLP-1 peptide programs with pharmacy integrations should be able to produce that paper on request; slow retrieval is not a defensible position if the Board asks. Peptides are the sharpest pressure point, and high-risk med spa payment processing adds another layer of complexity. Compounded semaglutide, tirzepatide, and similar GLP-1 products sit at the intersection of FDA GLP-1 compounding enforcement and state compounding law. SEA 282 holds 503A pharmacies to Section 503A and 503B outsourcing facilities to Section 503B rather than picking a winner between them, so the sourcing question is whether your supplier is actually operating inside its own federal section — the "research use only" vial is the one with no pathway at all.
Advertising and Individual License Requirements
SEA 282 adds two compliance layers that catch operators off guard precisely because they feel administrative, not clinical.
On advertising, SEA 282 does not write new rules so much as attach existing ones: a medical spa must comply with IC 25-1-10.3, Indiana's prohibition on deceptive advertising by health care practitioners, and the Board may suspend a registration for violating it. Using physician-adjacent titles for non-physician providers in marketing materials, or implying a level of medical oversight that does not exist on-site, creates enforcement exposure, as does failing before-and-after photo compliance standards. If your website says "physician-led" or features a medical director who visits quarterly, that language needs a hard look.
Individual licensure runs parallel to facility registration. Every provider performing a covered service must independently hold a license that authorizes it. Hiring an aesthetician to perform laser treatments, or a laser tech to administer injectables, does not become legal because the practice itself is registered. The Board reviews each provider's scope against each procedure separately. Practices that have historically relied on unlicensed or under-licensed personnel cannot continue that arrangement once registration takes effect on January 1, 2027, regardless of how those roles were structured before.
What Indiana Operators Should Do Before January 1, 2027
Before the January 1, 2027 registration window opens, work through these steps:
Action Item | Category | Key Requirement Under SEA 282 |
|---|---|---|
Confirm whether your services fall under the med spa definition | Scope | Covered if you provide medical health care services, use prescription drugs, and hold yourself out as focused on cosmetic or lifestyle treatments; a physician's office and any state-licensed facility are excluded |
Audit ownership structure for CPOM exposure | Legal | Indiana's corporate practice of medicine prohibition applies; MSO arrangements carry unresolved liability |
Designate a qualified responsible practitioner | Staffing | Physician, qualifying APRN, or PA with delegated prescriptive authority; must be physically present a sufficient amount of time, so remote-only supervision does not qualify |
Register each fixed location separately | Registration | Registration procedure due from the Board by Oct 1, 2026; a med spa must be registered to do business from Jan 1, 2027, with fines up to $5,000 for operating unregistered |
Review compounding contracts and verify bulk drug substance sourcing | Compounding | No research-grade substance outside an IRB-approved study; FDA-registered source, certificate of analysis, QC testing, and two-year record retention |
Update adverse event documentation protocols | Reporting | Qualifying events must be reported to the Board within 15 days; missing the window is a separate violation |
Audit provider credentials against each procedure | Licensure | Each provider must independently hold a license authorizing the specific service performed |
Review advertising and website language | Marketing | IC 25-1-10.3 applies; physician-adjacent titles for non-physician providers and unsupported oversight claims can cost you the registration |
Engage healthcare counsel before registration opens.
Why This Law Is a Signal for the Entire Industry
Indiana is not an outlier. Iowa introduced similar med spa registration legislation in the same 2026 session — House Study Bill 591, the Medical Spa Oversight Act, which cleared subcommittee in February and then died with the session — and New York, Rhode Island, and Texas each moved on new med spa oversight laws, covering physician supervision requirements and injectable scope restrictions.
The pattern is consistent: states that once treated med spas as a gray-area business are building formal licensure and enforcement regimes around them. Indiana moved faster and more explicitly than most.
If you operate outside Indiana, watch what Indiana's Medical Licensing Board does with its new enforcement authority. Other state boards are watching too. Mandatory registration, responsible practitioner designation, adverse event reporting, and location restrictions will be familiar language when your own state legislature acts.
How Decoda Health Helps Indiana Practices Prepare for SEA 282
SEA 282's compliance requirements are documentation requirements at their core. The 15-day adverse event window, responsible practitioner oversight, consent tracking, and scope-of-practice verification all depend on clinical records that exist, are accurate, and can be retrieved on demand.
Decoda Health's ambient AI scribe generates contemporaneous clinical notes in real time, before the patient leaves the room. Digital HIPAA-compliant consent forms are dispatched before appointments. GFE compliance runs in parallel, while role-based permissions let practice owners restrict chart access by provider type, which matters directly when the Board reviews your supervision chain. Granular dose-level charting ties each injectable unit to a specific patient encounter, creating the audit trail SEA 282 implicitly requires.
A practice that documents well, controls provider access, and captures every consent is already doing most of what SEA 282 demands. The question is whether your current system makes that easy or forces your team to work around it.
Final Thoughts on Preparing Your Med Spa for Indiana's New Rules
SEA 282 does not leave much room for ambiguity. Fixed locations, physical supervision, documented bulk drug substance sourcing, and 15-day serious adverse event reporting are concrete requirements with real enforcement behind them. The practices that treat this as a documentation project now will be in a much stronger position when registration opens. Connect with the Decoda Health team to see how real-time charting and consent tracking fit into your compliance workflow.
Frequently Asked Questions
Does SEA 282 apply to my Indiana med spa if I use an MSO ownership structure?
Ownership structure is not part of the statutory definition, so an MSO arrangement does not by itself exempt you from SEA 282's registration, responsible practitioner, or adverse event reporting requirements. What does matter is the definition in IC 25-22.5-12.5-1, which covers a facility that provides medical health care services, uses prescription drugs, and holds itself out as focused on cosmetic or lifestyle treatments — and which expressly excludes a physician's office and any facility otherwise licensed by the state. The MSO model also carries separate corporate practice of medicine exposure that SEA 282 leaves unresolved, so both questions need legal review before January 1, 2027.
What does Indiana's new med spa law require for adverse event reporting?
A medical spa must notify the Medical Licensing Board no later than 15 days after a patient's serious adverse event. The statute defines that term: a negative medical occurrence tied to a prescription medication or treatment that, on reasonable medical judgment, jeopardizes the patient's health and requires medical or surgical intervention, or that results in death, a life threatening medical occurrence, or inpatient hospitalization (including prolonging an existing stay). The notice must include the patient's name, the medication or treatment involved, the date, the nature and location of the event, and the patient's medical records for it — which is why contemporaneous clinical notes matter more than a summary reconstructed days later.
Can my Indiana med spa legally continue offering mobile IV therapy or pop-up injection events under SEA 282?
Not as a patient-facing service. IC 25-22.5-12.5-9 bars a medical spa from providing health care services and cosmetic or lifestyle treatments at any location other than the medical spa office, with one exception: services performed elsewhere for the education or training of people who intend to provide them. A patient's home, a hotel room, or an event venue does not fit that exception. Operators built around mobility need to either secure a registered fixed location or stop offering prescription-drug services outside one before January 1, 2027.
What software should Indiana med spas use to meet SEA 282's documentation requirements?
SEA 282's compliance obligations — the 15-day adverse event window, responsible practitioner oversight documentation, consent tracking, and provider scope verification — all depend on clinical records that are accurate, complete, and retrievable on demand. Decoda Health's ambient AI Scribe captures notes in real time before the patient leaves the room. Role-based permissions let owners restrict chart access by provider type, which maps directly to the supervision chain the Board will evaluate. Granular dose-level charting ties each injectable unit to a specific patient encounter, and HIPAA-compliant digital consent forms are dispatched before appointments — creating the audit trail the law implicitly requires.
What does Indiana's med spa registration law mean for practices in other states?
Indiana's SEA 282 is part of a broader state-level trend. Iowa introduced parallel legislation in the same 2026 session (House Study Bill 591, which died without passing), and New York, Rhode Island, and Texas each acted on med spa oversight between 2025 and 2026. The specific requirements — mandatory facility registration, responsible practitioner designation, adverse event reporting, and fixed-location restrictions — are appearing across multiple states in similar form. If your state has not yet acted, the practical preparation is the same: document supervision chains, verify provider credentials against each procedure performed, and confirm your compounded products came from a pharmacy or outsourcing facility operating within Section 503A or 503B.
What is the January 1, 2027 registration deadline under Indiana's SEA 282 and what happens if my practice misses it?
The Medical Licensing Board has to establish the registration procedure by October 1, 2026, and beginning January 1, 2027 a medical spa must be registered in order to do business in Indiana. Operating unregistered after that date lets the Board impose a fine of up to $5,000 and order the operator to register before continuing to do business.
Which provider types satisfy Indiana SEA 282's responsible practitioner physical presence requirement?
IC 25-22.5-12.5-2 defines the eligible pool as a licensed physician, an advanced practice registered nurse who meets IC 25-23-1-19.5, or a physician assistant with delegated prescriptive authority. Whoever is designated must have prescriptive authority and training in the services and medications the spa provides, and must be physically present at the location for a sufficient amount of time to ensure the spa complies with the chapter. Because the statute requires physical presence, remote-only supervision does not satisfy it, so practices where a medical director signs off from a distance need a structural change before January 2027.
Does Indiana's SEA 282 cover my practice if I brand it as a wellness center or beauty studio rather than a med spa?
Renaming the business does not get you out, because the statute's third prong asks whether you hold yourself out as focused on cosmetic or lifestyle treatments and then lists weight loss, wellness, and longevity by name alongside cosmetic and aesthetic services. A wellness center that also provides medical health care services and uses prescription drugs meets all three prongs. What does sit outside the definition is narrower than most operators assume: IC 25-22.5-12.5-1(b) excludes a physician's office and any facility or practice otherwise licensed by the state.
What are the compounded GLP-1 documentation requirements Indiana med spas must meet under SEA 282?
SEA 282's compounding chapter (IC 16-42-22.5) works on the bulk drug substance rather than the finished dose. Research-grade substance cannot be used at all unless it is part of an IRB-approved study, veterinary grade is out, and the substance must come from an FDA-registered human drug establishment, arrive with a certificate of analysis identifying its content and country of manufacture, and have undergone quality control testing. Anyone selling, transferring, or distributing compounded drugs has to keep the acquisition, examination, and testing records for at least two years after the last lot expires. 503A pharmacies and 503B outsourcing facilities are each held to their own federal section, so both remain viable sources — slow record retrieval, not the sourcing tier, is what leaves you undefended if the Board asks.
How granular do role-based permissions need to be in a med spa EMR to satisfy SEA 282's supervision chain requirements?
The Board evaluates each provider's scope against each procedure separately, so your software needs to restrict chart access and clinical actions by provider type — not just by login. Decoda Health's role-based permissions let practice owners control which staff roles can view, create, or edit clinical dose records, which maps directly to the supervision chain auditors will examine.
Should I use a separate consent management tool or does my EMR handle HIPAA-compliant consents for Indiana med spa compliance?
A dedicated consent tool is unnecessary if your EMR dispatches and stores HIPAA-compliant digital consents natively. Decoda Health sends procedure-specific consent forms to patients before their appointment, timestamps the signature, and attaches the document to the patient record — creating the retrievable consent trail SEA 282's audit exposure demands.
What advertising language do Indiana med spas need to review before the SEA 282 compliance deadline?
SEA 282 does not write its own advertising code. IC 25-22.5-12.5-10 requires a medical spa to comply with IC 25-1-10.3, Indiana's existing rules against deceptive advertising by health care practitioners, and lets the Board suspend a registration for violating it. In practice that means language like 'physician-led,' or any implication of on-site medical oversight that does not actually exist, is the exposure — particularly if the responsible practitioner is rarely there. Website copy, social media bios, and service descriptions all warrant a review before January 2027.
How does Indiana's SEA 282 interact with the state's existing corporate practice of medicine prohibition for med spa owners using an MSO model?
They run in parallel as separate legal questions. SEA 282 governs facility registration, responsible practitioner designation, and adverse event reporting — none of which an MSO arrangement exempts you from. Indiana's CPOM prohibition remains fully in effect and SEA 282 does not resolve whether a specific MSO structure is permissible, so both issues require counsel before the registration window opens.
What is the best way to document injectable dose usage at the patient level to prepare for Indiana med spa Board audits under SEA 282?
Granular dose-level charting that ties each injectable unit to a specific patient encounter is the most defensible audit trail. Decoda Health's checkout workflow supports medications billed by dose — Botox, Dysport, fillers — so every unit dispensed is connected to the clinical note and patient record created at the time of treatment, not reconstructed after the fact.
Can a med spa in Indiana with multiple locations register as a single entity under SEA 282, or does each site need its own registration?
The registration application is keyed to a single medical spa and a single address, so multi-site operators should plan on a filing per location. The statute also lets the Board require its approval before one responsible practitioner covers more than one location, which is the constraint most multi-site owners will feel first. The Board's registration procedure, due by October 1, 2026, is where the mechanics get settled — build the per-site record now and confirm the filing detail when the rules publish.