What Indiana's SEA 282 Means for Med Spas – August 2026
Indiana's SEA 282 law sets registration and supervision rules for med spas. Review your compliance checklist now. (August 2026)
TL;DR
5 key points- 01Indiana's SEA 282 requires med spa registration with the Medical Licensing Board by January 1, 2027.
- 02Your practice qualifies if it administers prescription drugs; ownership structure and branding don't exempt you.
- 03Adverse events must be reported within 15 days; missing that window is its own separate violation.
- 04Every compounded GLP-1 dose requires a valid patient-specific 503A prescription; research compounds have no legal path to patients.
- 05Decoda Health's AI Scribe, dose-level charting, and role-based permissions build the audit trail SEA 282 requires.
What SEA 282 Is and Why It Was Passed
Governor Mike Braun signed Senate Bill 282 into law on March 5, 2026, making it Public Law 136 and creating Indiana's first dedicated regulatory framework for medical spas under Indiana Code 25-22.5-12.5. The law targets both med spa oversight and drug compounding restrictions.
The patient safety concern driving it was straightforward. As the Indiana Capital Chronicle reported, med spas had been administering prescription drugs, including injectables, GLP-1 compounds, and hormone therapy, in settings that operated largely outside state oversight.
How the Law Defines a Medical Spa
Under SEA 282, a medical spa is any business that offers aesthetic, wellness, or cosmetic services involving the administration of prescription drugs or prescription devices. The definition is broader than most operators expect. If your practice injects neurotoxins, administers IV infusions, or dispenses compounded medications, the law likely covers you regardless of what you call the business.
Med spa ownership structure and licensing do not determine registration status. A physician-owned practice is not automatically exempt. Registration under the Medical Licensing Board follows the services performed, not who signs the LLC documents. Suite renters inside a host facility face the same analysis. Businesses operating under spa, wellness, or beauty branding are equally in scope if prescription drugs appear on the service menu.
Mandatory Registration with the Indiana Medical Licensing Board
Registration opens January 1, 2027, and that date is the hard deadline. Per Indiana medical spa attorney guidance, covered practices must register with the Indiana Medical Licensing Board, designate a responsible practitioner, and provide location information for each site where services are performed.
Each physical location requires its own registration, even if the business shares a building with other providers. Operating without registration after the deadline exposes the practice to enforcement by the Board, including potential suspension of the ability to operate.
The Responsible Practitioner Requirement
Every registered med spa must designate a responsible practitioner who is physically present on-site a reasonable amount of the time. Telehealth supervision does not satisfy this requirement.
Qualifying provider types include physicians (MD or DO) and certain advanced practice nurses under specific delegation arrangements. RNs cannot operate independently without appropriate physician oversight. The delegation chain matters: who ordered the treatment, who is supervising the person performing it, and whether that supervision is physically accessible when a patient is in the chair.
Practices where the medical director visits infrequently, or signs off remotely will need a real structural change before January 2027.
Scope of Practice: Who Can Perform Procedures Under SEA 282
SEA 282 layers on top of Indiana's existing licensure framework without replacing it, which makes compliance planning genuinely difficult.
For injectables and IV therapy, the performing provider must hold a license that independently authorizes the procedure. RNs can administer injectables and IV infusions under physician delegation, but medical assistants cannot perform these services regardless of supervision level. NPs with full practice authority have more flexibility, though the responsible practitioner requirement still applies at the facility level.
Laser treatments sit in a grayer zone, where scope analysis falls back to whether the procedure constitutes the practice of medicine and who is delegating it.
Chiropractors, podiatrists, and dentists operating aesthetics services remain unresolved under the new framework. Performing aesthetic injectables outside their licensed scopes raises liability questions the law does not cleanly answer. If your clinical team includes any of these providers doing aesthetic work, that arrangement needs a legal review before registration opens.
Ownership Structure and the Corporate Practice of Medicine
Indiana's corporate practice of medicine (CPOM) prohibition predates SEA 282 and remains fully in effect. Non-physician entities cannot own a medical practice outright under Indiana law, and SEA 282 does not change or clarify that.
The common structural workaround is the MSO model: a non-physician entity owns the business operations through a management services agreement, while a physician-owned PC holds the clinical practice. As Indiana medical spa attorney guidance notes, this remains a contested legal question in Indiana, and SEA 282 leaves it unresolved.
Registration and ownership structure are separate legal questions that run in parallel. You can be registered with the Medical Licensing Board and still carry liability if your MSO arrangement is later challenged. Get counsel that covers both.
Adverse Event Reporting Obligations
SEA 282 requires med spas to report adverse events to the Indiana Medical Licensing Board within 15 days of occurrence. Missing that window makes the reporting failure its own compliance violation, separate from the clinical event that triggered it.
The law does not publish an exhaustive list of qualifying events, but the category covers unexpected patient harm, serious complications, or outcomes that deviate materially from expected procedure results. Infections requiring hospitalization, anaphylactic reactions, and tissue necrosis following injectables are the clearest examples. Gray-area events still warrant a documentation trail even if you determine reporting is not required.
That is where clinical notes become a compliance tool. If the Board reviews your file, a contemporaneous chart entry carries far more weight than a reconstructed summary written days later.
Location Restrictions and the Fate of Mobile IV Therapy
SEA 282 requires that covered services be performed at a registered fixed location, which creates an immediate structural problem for mobile IV therapy businesses, event-based aesthetics operators, and practitioners working out of home offices or pop-up settings.
If a location is not registered with the Indiana Medical Licensing Board, services cannot legally be performed there. Mobile concierge IV drips, on-site injection events, and hotel-room aesthetic treatments all fall outside what the law permits.
Operators built around mobility face a real decision before January 2027: secure a fixed registered location or stop offering prescription-drug services outside one.
Compounding Drug Restrictions Under SEA 282
SEA 282's compounding provisions are the part of the law most operators underestimated during the legislative process. The law treats the compounding pharmacy and the med spa as a single continuous risk chain, making it one of the first state frameworks to govern the full outpatient ecosystem where compounded drugs are promoted, distributed, and administered.
Practices running GLP-1 peptide programs with pharmacy integrations must maintain documentation on every compounded product used, including bulk drug substance source, lot numbers, and prescribing basis. Slow retrieval is not a defensible position if the Board requests records.
Peptides are the sharpest pressure point, and high-risk med spa payment processing adds another layer of complexity. Compounded semaglutide, tirzepatide, and similar GLP-1 products sit at the intersection of FDA GLP-1 compounding enforcement and state compounding law. Every dispensed dose must be backed by a valid patient-specific prescription from a 503A pharmacy. Research-use-only compounds have no legal pathway into a patient treatment room under this framework.
Advertising and Individual License Requirements
SEA 282 adds two compliance layers that catch operators off guard precisely because they feel administrative, not clinical.
On advertising, the law restricts how med spas may describe services and the credentials of the people performing them. Using physician-adjacent titles for non-physician providers in marketing materials, or implying a level of medical oversight that does not exist on-site, creates enforcement exposure, as does failing before-and-after photo compliance standards. If your website says "physician-led" or features a medical director who visits quarterly, that language needs a hard look.
Individual licensure runs parallel to facility registration. Every provider performing a covered service must independently hold a license that authorizes it. Hiring an aesthetician to perform laser treatments, or a laser tech to administer injectables, does not become legal because the practice itself is registered. The Board reviews each provider's scope against each procedure separately. Practices that have historically relied on unlicensed or under-licensed personnel cannot continue that arrangement once registration takes effect on January 1, 2027, regardless of how those roles were structured before.
What Indiana Operators Should Do Before January 1, 2027
Before the January 1, 2027 registration window opens, work through these steps:
Action Item | Category | Key Requirement Under SEA 282 |
|---|---|---|
Confirm whether your services fall under the med spa definition | Scope | Any practice administering prescription drugs or devices is covered, regardless of branding or ownership |
Audit ownership structure for CPOM exposure | Legal | Indiana's corporate practice of medicine prohibition applies; MSO arrangements carry unresolved liability |
Designate a qualified responsible practitioner | Staffing | Must be physically present on-site a reasonable amount of the time; telehealth supervision does not qualify |
Register each fixed location separately | Registration | Every physical site requires its own registration with the Indiana Medical Licensing Board by Jan 1, 2027 |
Review compounding contracts and verify 503A prescription basis | Compounding | A valid patient-specific 503A prescription must back every compounded dose; research compounds are not permitted |
Update adverse event documentation protocols | Reporting | Qualifying events must be reported to the Board within 15 days; missing the window is a separate violation |
Audit provider credentials against each procedure | Licensure | Each provider must independently hold a license authorizing the specific service performed |
Review advertising and website language | Marketing | Physician-adjacent titles for non-physician providers and unsupported oversight claims create enforcement exposure |
Engage healthcare counsel before registration opens.
Why This Law Is a Signal for the Entire Industry
Indiana is not an outlier. Iowa introduced similar med spa registration legislation in the same 2026 session, and New York, Rhode Island, and Texas each moved on new med spa oversight laws, covering physician supervision requirements and injectable scope restrictions.
The pattern is consistent: states that once treated med spas as a gray-area business are building formal licensure and enforcement regimes around them. Indiana moved faster and more explicitly than most.
If you operate outside Indiana, watch what Indiana's Medical Licensing Board does with its new enforcement authority. Other state boards are watching too. Mandatory registration, responsible practitioner designation, adverse event reporting, and location restrictions will be familiar language when your own state legislature acts.
How Decoda Health Helps Indiana Practices Prepare for SEA 282
SEA 282's compliance requirements are documentation requirements at their core. The 15-day adverse event window, responsible practitioner oversight, consent tracking, and scope-of-practice verification all depend on clinical records that exist, are accurate, and can be retrieved on demand.
Decoda Health's ambient AI scribe generates contemporaneous clinical notes in real time, before the patient leaves the room. Digital HIPAA-compliant consent forms are dispatched before appointments. GFE compliance runs in parallel, while role-based permissions let practice owners restrict chart access by provider type, which matters directly when the Board reviews your supervision chain. Granular dose-level charting ties each injectable unit to a specific patient encounter, creating the audit trail SEA 282 implicitly requires.
A practice that documents well, controls provider access, and captures every consent is already doing most of what SEA 282 demands. The question is whether your current system makes that easy or forces your team to work around it.
Final Thoughts on Preparing Your Med Spa for Indiana's New Rules
SEA 282 does not leave much room for ambiguity. Fixed locations, physical supervision, 503A-only compounding, and 15-day adverse event reporting are concrete requirements with real enforcement behind them. The practices that treat this as a documentation project now will be in a much stronger position when registration opens. Connect with the Decoda Health team to see how real-time charting and consent tracking fit into your compliance workflow.
Frequently Asked Questions
Does SEA 282 apply to my Indiana med spa if I use an MSO ownership structure?
Yes — registration with the Indiana Medical Licensing Board follows the services performed, not the ownership structure. An MSO arrangement separates business operations from clinical oversight, but it does not exempt your practice from SEA 282's facility registration, responsible practitioner, or adverse event reporting requirements. The MSO model also carries separate corporate practice of medicine exposure that SEA 282 leaves unresolved, so both questions need legal review before the January 1, 2027 deadline.
What does Indiana's new med spa law require for adverse event reporting?
SEA 282 requires practices to report qualifying adverse events to the Indiana Medical Licensing Board within 15 days of occurrence. Missing that window creates a separate compliance violation, independent of the clinical event itself. Contemporaneous clinical notes — created at the time of the encounter, not reconstructed days later — carry the most weight if the Board reviews your records.
Can my Indiana med spa legally continue offering mobile IV therapy or pop-up injection events under SEA 282?
No. SEA 282 requires that covered services be performed at a registered fixed location. Services delivered at a patient's home, a hotel, or an event venue do not qualify. Operators built around mobility need to either secure a fixed registered location or stop offering prescription-drug services outside one before January 1, 2027.
What software should Indiana med spas use to meet SEA 282's documentation requirements?
SEA 282's compliance obligations — the 15-day adverse event window, responsible practitioner oversight documentation, consent tracking, and provider scope verification — all depend on clinical records that are accurate, complete, and retrievable on demand. Decoda Health's ambient AI Scribe captures notes in real time before the patient leaves the room. Role-based permissions let owners restrict chart access by provider type, which maps directly to the supervision chain the Board will evaluate. Granular dose-level charting ties each injectable unit to a specific patient encounter, and HIPAA-compliant digital consent forms are dispatched before appointments — creating the audit trail the law implicitly requires.
What does Indiana's med spa registration law mean for practices in other states?
Indiana's SEA 282 is part of a broader state-level trend. Iowa introduced parallel legislation in the same 2026 session, and New York, Rhode Island, and Texas each acted on med spa oversight between 2025 and 2026. The specific requirements — mandatory facility registration, responsible practitioner designation, adverse event reporting, and fixed-location restrictions — are appearing across multiple states in similar form. If your state has not yet acted, the practical preparation is the same: document supervision chains, verify provider credentials against each procedure performed, and confirm your compounding products carry valid 503A prescription backing.
What is the January 1, 2027 registration deadline under Indiana's SEA 282 and what happens if my practice misses it?
Registration with the Indiana Medical Licensing Board opens January 1, 2027, and that same date is the hard deadline for covered practices. Operating without registration after that date exposes your practice to Board enforcement, including potential suspension of the ability to perform services — each unregistered location carries its own exposure.
Which provider types satisfy Indiana SEA 282's responsible practitioner physical presence requirement?
Qualifying providers include physicians (MD or DO) and certain advanced practice nurses under specific delegation arrangements. Telehealth supervision does not satisfy the requirement — the responsible practitioner must be physically on-site a reasonable amount of the time, which means practices where a medical director signs off remotely need a structural change before January 2027.
Does Indiana's SEA 282 cover my practice if I brand it as a wellness center or beauty studio rather than a med spa?
Branding does not determine coverage — services do. If your practice administers prescription drugs or prescription devices, including injectables, IV infusions, or compounded medications, SEA 282 applies regardless of what you call the business.
What are the compounded GLP-1 documentation requirements Indiana med spas must meet under SEA 282?
Every compounded GLP-1 dose must be backed by a valid patient-specific prescription from a 503A pharmacy, and practices must maintain records of bulk drug substance source and lot numbers for each product used. Research-use-only compounds have no legal pathway into a patient treatment room under this framework, and slow record retrieval is not a defensible position if the Board requests documentation.
How granular do role-based permissions need to be in a med spa EMR to satisfy SEA 282's supervision chain requirements?
The Board evaluates each provider's scope against each procedure separately, so your software needs to restrict chart access and clinical actions by provider type — not just by login. Decoda Health's role-based permissions let practice owners control which staff roles can view, create, or edit clinical dose records, which maps directly to the supervision chain auditors will examine.
Should I use a separate consent management tool or does my EMR handle HIPAA-compliant consents for Indiana med spa compliance?
A dedicated consent tool is unnecessary if your EMR dispatches and stores HIPAA-compliant digital consents natively. Decoda Health sends procedure-specific consent forms to patients before their appointment, timestamps the signature, and attaches the document to the patient record — creating the retrievable consent trail SEA 282's audit exposure demands.
What advertising language do Indiana med spas need to review before the SEA 282 compliance deadline?
SEA 282 restricts how practices may describe services and provider credentials in marketing materials. Language like 'physician-led' or any implication of on-site medical oversight that does not actually exist creates enforcement exposure — particularly if the medical director visits infrequently. Website copy, social media bios, and service descriptions all warrant a review before January 2027.
How does Indiana's SEA 282 interact with the state's existing corporate practice of medicine prohibition for med spa owners using an MSO model?
They run in parallel as separate legal questions. SEA 282 governs facility registration, responsible practitioner designation, and adverse event reporting — none of which an MSO arrangement exempts you from. Indiana's CPOM prohibition remains fully in effect and SEA 282 does not resolve whether a specific MSO structure is permissible, so both issues require counsel before the registration window opens.
What is the best way to document injectable dose usage at the patient level to prepare for Indiana med spa Board audits under SEA 282?
Granular dose-level charting that ties each injectable unit to a specific patient encounter is the most defensible audit trail. Decoda Health's checkout workflow supports medications billed by dose — Botox, Dysport, fillers — so every unit dispensed is connected to the clinical note and patient record created at the time of treatment, not reconstructed after the fact.
Can a med spa in Indiana with multiple locations register as a single entity under SEA 282, or does each site need its own registration?
Each physical location requires its own separate registration with the Indiana Medical Licensing Board, even when multiple sites operate under the same business entity or share a building with other providers. Multi-location practice owners need to account for each site individually when preparing for the January 2027 deadline.