State Med Spa Registration Requirements: August 2026
Learn which states require med spa facility registration in August 2026 and what CPOM, medical director, and scope-of-practice rules apply.
TL;DR
5 key points- 0136 states have no med spa-specific laws, but every state still governs ownership structure, medical director requirements, and clinical staff scope of practice
- 02Rhode Island and Tennessee now require facility-level licensure, and New York runs an active inspection program, each with documentation standards attached
- 03In CPOM states, registering the wrong entity type can invalidate your facility application before it's reviewed
- 04Indiana's SEA 282 is now law, with registration opening January 1, 2027; documentation gaps are far easier to close before a deadline than after
- 05Decoda Health's AI Scribe generates real-time clinical notes and maintains longitudinal patient records to support the documentation auditors request during facility inspections
Why Med Spa Registration Is a State-Level Issue
There is no federal agency that registers med spas. No FDA form, no HHS portal, no national license. Registration requirements, if they exist at all, come entirely from individual states, which means the answer to "what do I need to register my med spa?" depends entirely on where you practice.
That creates a genuine problem. As of April 2026, the AMA reported that 36 states lack med spa-specific laws, citing a 2025 study published in Dermatologic Surgery. The same study found that 44 states lacked any med spa-specific patient-protection requirements, and only 12 states had any med spa-specific provisions at all. When you search "med spa registration requirements," you are searching a patchwork, not a policy.
The Three Regulatory Frameworks Every State Imposes
Even in states with no formal registration requirement, three regulatory levers still govern how a med spa can legally operate.
The first is Corporate Practice of Medicine (CPOM). Most states prohibit lay-owned businesses from hiring physicians or directing medical decisions, which directly affects how you structure ownership. Some states enforce CPOM strictly, requiring physician ownership or a Management Services Organization (MSO) structure. Others have no CPOM restrictions at all.
The second is medical director requirements. Nearly every state with med spa oversight requires a licensed physician to supervise delegated procedures. What varies widely is how active that oversight must be, how it must be documented, and whether the physician can supervise remotely.
The third is scope-of-practice rules for clinical staff. State medical and nursing boards define what procedures a nurse practitioner, RN, or aesthetician can perform, and under what supervision. A treatment legally delegable to an RN in one state may require a physician's physical presence in another.
Registration, where it exists, is the state's mechanism for confirming you have the right answers across all three.
States That Now Require Formal Facility Registration or Licensure
Three states have moved from general medical licensing into dedicated facility-level oversight for med spas.
State | Requirement | Governing Body | Key Details | Effective / Active |
|---|---|---|---|---|
Rhode Island | Facility licensure required | RI Department of Health | Licensed medical director required; strict restrictions on who may perform or delegate cosmetic procedures; documentation standards and training requirements apply | Deadline: July 1, 2026 |
New York | Energy-based device treatments classified as practice of medicine; active inspections | Dept. of State & Dept. of Education (joint) | 223 inspections in 2026 yielded 87 citations; violations include unlicensed medical practices and facility safety issues | Active enforcement as of 2025 and 2026 |
Tennessee | Separate health department registration required | State health department | Registration ties directly to supervision documentation and scope-of-practice compliance; separate from general business filings | Current requirement |
Rhode Island
The Medical Aesthetic Practices Safety Act, signed June 30, 2025, requires all med spas performing cosmetic procedures to obtain licensure from the Rhode Island Department of Health by July 1, 2026. Under the law, med spas licensed as healthcare facilities must maintain licensed medical directors and follow strict restrictions on who may perform or delegate cosmetic procedures. Healthcare facility licensure triggers documentation standards, training requirements, and ongoing Department of Health oversight.
New York
New York's approach is enforcement-led. As of March 2025, treatments using energy-based devices are classified as the practice of medicine. In 2026, 223 inspections yielded 87 citations for violations including unlicensed medical practices and facility safety issues. The Department of State and Department of Education jointly oversee compliance, meaning med spas face multi-agency scrutiny.
Tennessee
Tennessee maintains a dedicated med spa registration program through the state health department, requiring facilities offering medical aesthetic services to register separately from general business filings. That registration ties directly to supervision documentation and scope-of-practice compliance.
The distinction that matters across all three: a business license registers a company. A facility license registers a healthcare operation, with inspections, renewals, and standards attached.
States With Pending or Recently Introduced Registration Legislation
Iowa and Indiana both introduced dedicated med spa registration bills in early 2026, part of a broader wave of new med spa laws in 2026. Iowa's House Study Bill 591, the "Medical Spa Oversight Act," and Indiana's Senate Bill 282 would have created mandatory registration frameworks including facility registration, designation of a responsible licensed practitioner, adverse event reporting, and enforcement mechanisms. They ended differently. Indiana's passed: Governor Braun signed SB 282 on March 5, 2026, creating Indiana Code 25-22.5-12.5, and registration with the Medical Licensing Board opens January 1, 2027. Iowa's did not become law.
Even a bill that stalls is a signal. Legislators in both states identified med spa oversight as a priority, and that pressure doesn't disappear when a session ends. If you operate in Indiana, the January 1, 2027 deadline is already fixed. If you operate in Iowa, getting documentation and supervision structures in place before a bill passes is far less disruptive than scrambling after one does.
States With No Formal Registration Requirement (And What That Actually Means)
No formal registration requirement does not mean no paperwork. In the 36 states without med spa-specific laws, you still register a legal business entity, individual providers hold active state licenses, and the state medical board governs every clinical service offered.
The typical compliance stack in these states includes:
- Business entity formation (LLC, PLLC, or professional corporation) with the Secretary of State
- Individual provider licensure through the state medical or nursing board
- DEA registration if controlled substances are prescribed
- Local business licenses and zoning permits
What's absent is a single agency that reviews your med spa as a clinical operation before you open. Oversight happens reactively, through complaints, audits, or medical board investigations, with no pre-registration review. That gap creates real risk: roughly 70% of med spas operate without affiliation to a physician practice, according to the AMA's April 2026 report, and in states without dedicated oversight, that structure often goes unchallenged until something goes wrong.
Who Can Legally Own a Med Spa: The CPOM and MSO Structure Explained
Ownership structure is where registration gets personal. The question of whose name goes on the facility license runs directly through a legal doctrine most non-physician owners have never heard of until it becomes a problem.
Corporate Practice of Medicine (CPOM) prohibits lay-owned businesses from hiring physicians or controlling medical decisions. In states that enforce it strictly, a non-physician cannot open a med spa under their own LLC and hire a doctor. California is the clearest example: the entity providing medical services must be a physician-owned professional corporation.
Texas permits non-physician ownership through an MSO structure, but a supervising Texas-licensed physician must stand behind all medical services.
The PC/MSO structure is the standard workaround in CPOM states. A physician-owned professional corporation (PC) handles all clinical services and holds the medical license. A separate management services organization, owned by the non-physician entrepreneur, handles business operations and is compensated through a management services agreement. Keeping them genuinely separate is what makes the arrangement compliant.
Before filing any med spa registration paperwork, confirm which entity type your state requires to hold the clinical license. In a CPOM state, registering the wrong entity type can invalidate your facility application entirely.
Medical Director Requirements by State
In states with formal facility registration, naming a medical director is part of the application itself. Get this wrong and the license won't issue.
Requirements vary sharply across states. Some demand the physician be physically present for specific procedures. Others allow remote supervision with documented oversight protocols. Almost every state agrees that the relationship must be formalized in writing.
Texas offers the clearest recent example. TMB Rule 169.28, effective January 9, 2025, requires delegation in writing, imposes physician posting requirements visible from the moment anyone enters the facility, and requires prescriptive authority agreements to be executed before any delegated prescribing occurs.
Other requirements that commonly appear in state rules:
- The medical director must hold an active license in that specific state
- Delegation agreements must be renewed on a defined schedule
- The physician's license number must appear on facility registration documents
- Remote supervision requires documented communication protocols
If your state's facility application has a line for "medical director," that line is a compliance checkpoint, and the documentation behind it needs to match what the board would ask to see in an audit.
Licenses and Permits Beyond the State Registration Form
Registration clears the facility. The licenses that follow clear the people and services inside it.
A state facility registration is rarely the last document in the stack. Most med spas need several additional approvals before they can legally see patients:
- General business license from the city or county where you operate
- Secretary of State filing for your business entity (LLC, PLLC, or PC)
- Individual provider licenses: MD, DO, NP, PA, or RN through the state medical or nursing board
- DEA registration if any provider prescribes controlled substances, including certain weight loss or hormone medications
- Cosmetology or esthetics board permits for staff performing non-medical services like facials or waxing
- Local zoning or occupancy permits tied to your physical location
The practical risk is treating facility registration as the last step, not one layer in a longer checklist. A med spa can hold a valid state facility license and still be out of compliance because a provider's RN license lapsed, a DEA registration wasn't updated after a physician change, or a local occupancy permit was never pulled for a renovation. Boards and inspectors check all of it.
The Federal Floor: Requirements That Apply Regardless of State
Five federal requirements apply to every med spa regardless of state.
- HIPAA: Any practice handling patient health information must comply with privacy and security rules governing how that data is stored, transmitted, and disclosed.
- OSHA: Bloodborne pathogen standards require exposure control plans, sharps disposal protocols, and staff training documentation.
- FDA: Energy-based devices, including lasers and radiofrequency equipment, must carry 510(k) clearance for the specific indications you're using them for. Buying cleared equipment does not automatically mean you're cleared to use it for every treatment.
- DEA: Any provider prescribing controlled substances, including certain hormone therapies or weight loss medications, needs an active DEA registration tied to their physical practice location.
- FTC: Advertising claims, before-and-after photos, and patient testimonials fall under FTC health data rules for med spas. Results must be typical or disclosed as atypical. Incentivized reviews must be disclosed.
None of these require state registration to trigger. They apply from day one, regardless of whether your state has ever heard the phrase "med spa oversight."
2026 Enforcement Trends Driving New Registration Requirements
Three distinct pressures are behind the current registration wave: a documented rise in adverse events, organized medical advocacy, and an industry that grew faster than the rules written to govern it.
The AMA noted that from 2010 to 2023, medical spas grew nearly sixfold, from roughly 1,600 locations to more than 10,000 (the most recent figures available from the AMA's April 2026 report). Regulatory frameworks did not keep pace, leaving most states with no facility-specific oversight while the AMA, American Society for Dermatologic Surgery, and state medical boards all push for change simultaneously.
New York's 2026 inspection results show what happens when a state stops waiting. Inspections of 223 businesses produced 87 citations for violations, including unlicensed medical practices and facility safety issues, generated by a dedicated enforcement task force, not a passive complaint system.
Iowa and Indiana both introduced bills this session; Indiana's was signed into law and Iowa's was not. Arizona's registration bill remains active. Practices without formal registration today are operating in a window that is closing.
What Multi-State Operators Need to Track
Each state you enter is a separate compliance environment, not a variation of the one you already manage.
For multi-location med spa groups, that means separate medical director agreements in each state, individual physician licenses that cannot cross state lines, and entity structures that may need to be reconfigured entirely. A physician licensed in Florida cannot serve as your Texas medical director. A professional corporation structured for California's CPOM rules may not satisfy Arizona's requirements.
Telehealth prescribing adds another layer. If your providers conduct good-faith exams or prescribe remotely across state lines, a multi-location weight loss practice platform can help standardize compliance across jurisdictions. Each state's rules on prescribing authority and supervision apply independently. Some states require the prescribing physician to be licensed where the patient is located, not where the provider sits.
Friendly-PC configurations also differ. The ownership rules, management services agreement terms, and allowable compensation structures between your MSO and each professional corporation can vary by state law. What satisfies a CPOM audit in one jurisdiction may not hold in another.
Sales tax registration is a practical detail that surprises expanding operators: several states tax specific aesthetic products or retail sales differently, requiring separate state tax registration where you operate.
Track these variables by state, not by region.
Maintaining Compliance After Registration: Renewals, Audits, and Documentation
Registration is a starting point, not a finish line. Most state facility licenses require annual or biennial renewal, and the renewal application typically asks you to confirm that your medical director agreement is current, staff credentials are valid, and supervision protocols haven't changed.
States with formal oversight, like Rhode Island, check for documentation that must exist in the facility at the time of audit:
- Current medical director agreement, signed and dated
- Delegation agreements for every procedure performed by non-physician staff
- Individual provider license copies, verified as active
- Standing orders specific to each service offered
- Adverse event logs, including what occurred and how it was handled
- Proof of staff training on infection control and device safety
Rhode Island's Medical Aesthetic Practices Safety Act converted these from best practices into licensure requirements. Deficiencies found during inspection can result in conditional licensure, fines, or suspension.
Even in states without formal registration, a medical board complaint triggers the same documentation review. The board will ask for standing orders, delegation paperwork, and supervision records going back months or years. If those documents don't exist, the absence itself becomes the violation.
Set renewal reminders 90 days out, not 30. State agency processing times vary, and a lapsed facility license can interrupt operations even when the underlying compliance is sound.
How Decoda Health Helps Practices Stay Ahead of Compliance Requirements
Compliance obligations generate documentation, and documentation generates administrative overhead that compounds with every new state requirement.
Decoda Health's ambient AI Scribe generates clinical notes in real time and maintains longitudinal patient records, directly supporting the documentation standards that facility-licensed practices must uphold during audits. Role-based permissions extend to clinical records, revenue dashboards, and sensitive analytics, supporting the multi-staff data governance that states like Rhode Island and New York increasingly require. Good faith exam records are part of the same audit trail inspectors review, so digital intake forms, GFE compliance workflows, and consent workflows handle procedure-specific clinical and HIPAA requirements without manual data entry.
Clinic partners using Decoda Health see an average 80% reduction in check-in time and 20% fewer claim denials, supported in part by accurate med spa EMR superbill workflows, both reflecting the documentation accuracy that compliance-focused practices need to survive an inspection. For multi-location and MSO-structured groups, Decoda Health's unified reporting, standardized inventory tracking, and granular role-level permissions make it easier to apply consistent compliance standards across every location instead of managing each one separately.
Final Thoughts on Med Spa Registration and Compliance by State
Most med spa owners find out their documentation gaps exist at exactly the wrong moment. Staying ahead of registration requirements means understanding which rules apply to your state now, and keeping an eye on what is moving through state legislatures for next year. The states that already have formal oversight are a preview of where the rest are headed. Reach out to Decoda Health if you want to see how our tools support the clinical recordkeeping and audit trails that compliance-focused practices depend on.
Frequently Asked Questions
Which states currently require a med spa to obtain a facility license before opening?
Rhode Island, New York, and Tennessee have the most active facility-level requirements as of 2026. Rhode Island's Medical Aesthetic Practices Safety Act requires licensure from the Department of Health by July 1, 2026. New York classifies energy-based device treatments as the practice of medicine and runs active inspection programs. Tennessee requires separate health department registration for facilities offering medical aesthetic services. Every other state still governs med spas through individual provider licensure, business entity filings, and medical board oversight, with no dedicated facility registration process.
Can a non-physician legally own a med spa in every state?
No. States with strict Corporate Practice of Medicine enforcement, including California, require that the entity holding the clinical license be physician-owned, most commonly as a professional corporation. Non-physician owners in those states operate through a PC/MSO structure: a physician-owned professional corporation handles all clinical services, while a separate management services organization handles business operations. Texas and several other states allow non-physician ownership with appropriate physician supervision in place. Confirm which entity type your state requires to hold the clinical license before filing any registration paperwork, because registering the wrong entity type can invalidate a facility application entirely.
I'm opening a med spa in a state with no med spa-specific laws. What registration and licensing do I actually need?
A state without med spa-specific rules still requires several approvals before you see patients. You need a business entity filing with the Secretary of State (LLC, PLLC, or professional corporation depending on your state's CPOM rules), individual provider licenses through your state medical or nursing board, a DEA registration if any provider prescribes controlled substances, local business licenses and zoning permits, and cosmetology or esthetics board permits for any non-medical services. Federal requirements (HIPAA, OSHA bloodborne pathogen standards, FDA device clearance, and FTC advertising rules) apply regardless of state. Oversight in these states is reactive, not pre-registration, which means a complaint or audit triggers the same documentation review a formal facility inspection would.
Should I wait for my state to pass a med spa registration law before building out my compliance documentation?
No. Indiana's Senate Bill 282 passed and registration opens January 1, 2027, so Indiana operators are working to a fixed deadline rather than waiting on one. Iowa's Medical Spa Oversight Act did not become law, but the same documentation a registration framework would require (medical director agreements, delegation paperwork, standing orders, adverse event logs) is already what your state medical board would ask for in an audit or complaint investigation. Building that infrastructure before a bill passes is far less disruptive than building it under a compliance deadline. The documentation requirements don't change; only the enforcement trigger does.
What documentation does Decoda Health's AI Scribe generate that supports a facility audit or Department of Health inspection?
Decoda Health's ambient AI Scribe captures clinical encounters in real time and maintains longitudinal patient records that directly satisfy the documentation standards states like Rhode Island require to hold a facility license. Role-based permissions control which staff roles can view or edit clinical records, revenue data, and sensitive analytics, a requirement that multi-provider and multi-location practices face under state oversight frameworks. Procedure-specific consent forms and digital intake workflows are generated without manual data entry, so delegation agreements and standing orders are tied directly to individual patient records instead of stored in a separate filing system. For practices entering a renewal cycle or preparing for inspection, that means audit-ready documentation is a byproduct of daily clinical operations, not a separate preparation task.
What is the PC/MSO structure and when does a med spa actually need one?
A Professional Corporation/Management Services Organization structure is required in states that enforce Corporate Practice of Medicine doctrine, where a lay-owned LLC cannot legally hire physicians or direct medical decisions. The physician-owned PC holds the clinical license and employs or contracts clinical staff, while a separate MSO (owned by the non-physician entrepreneur) handles business operations under a management services agreement. If your state enforces CPOM strictly, like California, you need this structure before filing any facility registration paperwork.
How do med spa registration requirements differ between a state with CPOM enforcement and one without?
In a CPOM state, the entity seeking facility registration must be physician-owned, which means your registration application must name a professional corporation, not a standard LLC, as the applicant. In states without CPOM restrictions, a non-physician owner can hold the facility license directly, so the registration process is simpler and focuses on business filings, provider credentials, and local permits rather than ownership structure validation.
What specific documents should be in a med spa's compliance file before a state facility inspection?
A facility inspection typically calls for a current signed medical director agreement, delegation agreements for every procedure performed by non-physician staff, copies of all active individual provider licenses, standing orders tied to each service offered, adverse event logs, and staff training records covering infection control and device safety. Rhode Island's Medical Aesthetic Practices Safety Act converted this list from best practice into a licensure requirement, and states with active enforcement programs like New York check for the same documentation.
What is the difference between a business license and a facility license for a med spa?
A business license registers a company as a legal commercial entity with city or county government. A facility license registers a healthcare operation with a state health agency and carries ongoing obligations including inspections, renewals, supervision documentation standards, and scope-of-practice compliance checks. A med spa can hold a valid business license and still be out of compliance because it lacks the facility-level registration that states like Rhode Island, New York, and Tennessee now require.
If my med spa's medical director changes, what registration steps do I need to take?
Most state facility licenses require the medical director's name and license number to appear on the registration itself, so a physician change typically triggers an amendment filing with the governing agency. Delegation agreements and standing orders tied to the departing physician must be reissued under the new director's credentials before any delegated procedures continue. DEA registration at the practice location may also need to be updated if the new medical director is the prescribing provider.
How do role-based permissions in a med spa EMR support compliance with state oversight requirements?
States with formal facility oversight, including Rhode Island and New York, require controls that limit who can view or modify clinical records, supervision logs, and sensitive performance data. Decoda Health's role-based permissions extend to clinical records, revenue dashboards, reviews, and scheduling controls, so practice administrators can restrict access by staff role without removing anyone from core workflows. During an audit, that access structure documents itself: the system shows which staff role created, edited, or approved each clinical entry.
What federal requirements apply to a med spa that is adding energy-based devices like lasers or radiofrequency equipment?
The FDA requires that any energy-based device carry 510(k) clearance for the specific indications it is being used for, and purchasing a cleared device does not automatically authorize every treatment application. OSHA bloodborne pathogen standards apply to any procedure with exposure risk, requiring exposure control plans, sharps disposal protocols, and documented staff training. HIPAA governs every patient record generated during those treatments regardless of whether the state has a formal facility registration program.
Should a multi-location med spa group use one medical director across all locations or a separate one per state?
A physician licensed in one state cannot serve as medical director in another, so each state where you operate requires a separately licensed physician in that supervising role. Multi-state groups need independent medical director agreements, delegation paperwork, and standing orders for each state's legal requirements, which can differ substantially. A management services organization structure that works in one CPOM state may need to be reconfigured entirely before it satisfies the rules in a second state.
What happens if a med spa in a state without formal registration requirements receives a medical board complaint?
A medical board complaint triggers the same documentation review that a formal facility inspection would conduct in a licensed state. The board will request standing orders, delegation paperwork, supervision records, and adverse event logs going back months or years. The absence of those documents, rather than any specific clinical finding, frequently becomes the primary violation cited, because it signals the practice was operating without the oversight structure the board's rules require.
How can a med spa practice send patient communications like appointment reminders and promotional messages without relying on separate third-party tools?
Decoda Health's communications module handles appointment reminders and promotional blasts from distinct phone numbers, so patients can opt out of marketing messages without losing appointment confirmations. Blast analytics within the same module surface open rates, click rates, and bookings generated directly from each campaign, removing the need to export data to a separate marketing tool. Scheduled messaging lets staff compose and queue outbound texts from any patient's profile to send at a future date and time.