A registered nurse can open a med spa in most states, but ownership splits in two: an RN can own the business operation, while the clinical practice generally has to be owned by a physician or a physician-owned professional entity. Around 33 states enforce some form of the Corporate Practice of Medicine doctrine, which reserves clinical ownership for doctors. In those states, nurses typically form a management company that handles operations, paired with a physician-owned entity that handles the medicine. Even in the roughly 17 states without those restrictions, every med spa still needs a physician medical director overseeing clinical care.
So the real question is not whether you can open one. It’s how the structure has to be built in your state, and what you can personally do inside it.
Why the Clinical Side Is Restricted
The Corporate Practice of Medicine doctrine exists to keep clinical decisions in the hands of licensed physicians rather than business investors. Under this principle, a general business corporation or LLC cannot practice medicine, employ physicians to treat the public, or control how medical services are delivered. The reasoning: when non-physicians own the clinical side, financial pressure can override patient safety.
Roughly two-thirds of states enforce some version of this doctrine, and strictness varies. Some apply it broadly to any entity offering medical procedures; others focus narrowly on physician employment. In an enforcing state, an RN who forms a standard LLC and offers neurotoxin or dermal filler injections under that entity is operating illegally, because those procedures qualify as the practice of medicine.
Penalties differ by state but can be severe. Many states treat unlicensed practice of medicine as a felony, with prison exposure and significant fines. Even where criminal prosecution is unlikely, state medical and nursing boards can discipline every clinician involved in a non-compliant arrangement, up to license revocation.
The MSO Structure RN Owners Use
The standard workaround in states with corporate practice restrictions is the Management Services Organization, or MSO. The RN forms a management company (usually an LLC) that handles everything non-clinical: marketing, scheduling, lease payments, administrative payroll, equipment purchasing, and vendor relationships. A separate physician-owned professional entity, often called a “friendly PC,” employs or contracts with the clinicians and holds the medical licenses.
The two entities sign a Management Services Agreement that spells out which services the management company provides and how much it is paid. The fee is where this gets delicate. If it is too high relative to what the management company actually does, regulators may view the arrangement as a sham in which the physician is a figurehead. Courts have treated management fees that exceed fair market value as evidence of a prohibited employer-employee relationship between the non-physician owner and the physician.
Red flags that attract enforcement attention include non-physicians pressuring the physician to increase procedure volume, management company policies that dictate clinical decisions, and organizational charts that place non-physicians above clinical staff. The management company can run business strategy and operations, but the physician-owned entity must retain complete authority over what treatments are offered, how they are performed, and which patients are appropriate candidates.
Fees are typically structured as a flat monthly payment or a percentage of gross revenue. Percentage-based fees face extra scrutiny because federal regulators have warned that compensation fluctuating with revenue may not qualify for safe harbor protections under anti-kickback laws. A flat fee supported by a documented fair market value analysis is the safer approach.
States Where Direct Ownership Is Possible
Approximately 17 states do not enforce the Corporate Practice of Medicine doctrine, including Alabama, Florida, Ohio, Utah, and Virginia. In these states, an RN can potentially hold direct ownership of the entire med spa entity without the split MSO structure. Some still require additional licensing, such as a health clinic license when non-physicians own a facility providing medical services.
Direct ownership simplifies the corporate structure and eliminates the cost of maintaining two entities, but it does not eliminate the need for physician oversight. Every state requires a medical director for facilities offering injectable treatments, laser procedures, and other services classified as the practice of medicine. The RN still cannot independently diagnose patients, create treatment plans, or perform procedures outside the nursing scope of practice.
The Medical Director Every Med Spa Needs
Every med spa needs a medical director who holds an active MD or DO license. This physician establishes the clinical protocols governing every procedure the facility offers, decides which treatments are appropriate for each patient, and takes ultimate responsibility for the quality of care delivered.
A central requirement is the good faith examination. Before any medical treatment begins, a physician (or in some states an APRN or PA operating under a collaborative agreement) must evaluate the patient. This evaluation establishes the provider-patient relationship and confirms the proposed treatment is medically appropriate given the patient’s health history. Skipping or rubber-stamping this exam is one of the most common compliance failures in the industry, and one of the easiest for regulators to detect.
Whether that initial evaluation can happen via telehealth depends entirely on state law. There is no single federal standard. Some states permit synchronous video exams to establish the provider-patient relationship; others require an in-person encounter for the first visit. The rules can also differ depending on which licensing board governs the practitioner conducting the exam. Before building a business model around remote physician evaluations, check your state’s telehealth statutes for the specific practitioner type involved.
The medical director relationship is documented through a formal collaborative or supervisory agreement. The contract specifies which procedures the physician authorizes, how available the physician must be during treatment hours, and how clinical emergencies are handled. If the medical director’s involvement is purely on paper, both the physician and the facility face disciplinary action, including license suspension for the physician and closure for the facility.
What You Can Actually Do as an RN Owner
An RN working in a med spa operates under delegated authority from the medical director. The physician issues standing orders that detail which procedures the RN may perform, the protocols for each treatment, and the circumstances that require contacting the physician before proceeding. These standing orders provide the legal basis for the RN to perform clinical tasks that would otherwise fall outside the nursing scope of practice.
Procedures commonly delegated to RNs include neurotoxin injections such as Botox, dermal filler injections, chemical peels, microneedling, and certain laser treatments. Two limitations apply. First, the RN cannot independently diagnose a patient or create a treatment plan. The physician makes those decisions, and the RN executes the prescribed treatment. Second, certain advanced procedures may be restricted to physicians, APRNs, or physician assistants depending on state law.
Laser treatments deserve particular attention. The FDA classifies medical lasers used for skin treatments as Class IV devices, meaning they pose immediate skin and eye hazards from both direct and reflected beams.1Food and Drug Administration. Laser Products and Instruments State regulations on who may operate these devices vary widely. Some states allow RNs to operate Class IV lasers under physician standing orders with documented training; others require a separate laser technician certification or restrict operation to physicians and APRNs. Facilities using Class IV lasers should also designate a Laser Safety Officer in accordance with ANSI Z136 standards.
Crossing into independent clinical judgment is the fastest way for a nurse to lose their license. Each state’s Board of Nursing defines the boundaries, and “I didn’t know” is not a defense. If you are an RN-owner operating under the MSO model, the temptation to make clinical calls yourself when the medical director isn’t available is real, and it is exactly what regulators look for.
The APRN or NP Path Changes the Picture
Advancing to an Advanced Practice Registered Nurse credential shifts the analysis significantly. APRNs and Nurse Practitioners hold graduate-level training and, in states that grant full practice authority, can diagnose, prescribe, and treat patients independently. Some state nursing boards explicitly allow APRNs to own a med spa and serve as its medical director, collapsing two roles into one.
Full practice authority for NPs now covers roughly half the country. In those states, an NP-owned med spa may not need a physician medical director at all, depending on the services offered and how the state’s nursing board interprets its scope of practice rules. Even so, certain procedures (deep chemical peels, surgical fat reduction, invasive laser resurfacing) may still require physician involvement regardless of the NP’s authority level.
For an RN seriously considering med spa ownership, pursuing an NP or APRN credential is worth evaluating. It expands both the clinical services you can personally perform and the ownership structures available to you.
Federal Fraud Laws That Shape the Structure
Owners focused on state licensing sometimes overlook federal healthcare fraud laws, which apply whenever Medicare, Medicaid, or other federal health programs are involved. Even if your med spa is primarily cash-pay, some patients may use federal program benefits for medically necessary treatments like Botox for chronic migraines or hyperhidrosis. A single touchpoint can trigger federal jurisdiction.
The Stark Law
The Stark Law prohibits physicians from referring patients covered by Medicare or Medicaid to entities in which the physician (or an immediate family member) has a financial interest. The entity receiving the referral is also prohibited from billing for services furnished under a prohibited referral.2Office of the Law Revision Counsel. 42 US Code 1395nn – Limitation on Certain Physician Referrals For med spas, this means the financial arrangement between the medical director and the management entity has to be structured carefully. If the medical director has a financial stake in both the clinical entity and the management company, referral patterns could trigger a Stark violation.
The Anti-Kickback Statute
The federal Anti-Kickback Statute makes it a felony to knowingly offer or receive anything of value in exchange for referrals of patients covered by federal healthcare programs. Violations carry fines up to $100,000 and imprisonment up to 10 years per offense.3Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs In the MSO context, management fees that fluctuate with referral volume or that exceed fair market value can be characterized as disguised kickbacks.
Safe Harbor for Management Agreements
Federal regulations provide a safe harbor for personal services and management contracts that shields compliant arrangements from Anti-Kickback prosecution. To qualify, the agreement must be in writing and signed by both parties, specify the services to be performed, run for at least one year, and set compensation using a methodology determined in advance that reflects fair market value and does not account for the volume or value of referrals.4eCFR. 42 CFR 1001.952 – Exceptions Percentage-of-revenue arrangements face heightened scrutiny because compensation inherently fluctuates with business volume rather than being fixed in advance.
HIPAA and OSHA Obligations
Whether HIPAA applies depends on how you handle transactions. Under federal rules, a health care provider becomes a HIPAA-covered entity when it transmits any health information electronically in connection with a covered transaction, such as insurance claims or benefit eligibility inquiries.5U.S. Department of Health and Human Services. Covered Entities and Business Associates A purely cash-pay med spa that never bills insurance might technically fall outside coverage, but most industry advisors recommend full compliance regardless. One patient who submits a superbill to their insurer, or a single HSA transaction processed electronically, can change your status.
Practical compliance means encrypted systems for patient health information, restricted access, trained staff, and a documented breach response plan. Before-and-after photos, which are central to med spa marketing, are protected health information. Posting them without proper written authorization is a HIPAA violation, not just a marketing misstep.
Any med spa performing injections, microneedling, or laser procedures that could break the skin must also comply with OSHA’s Bloodborne Pathogens Standard. The core requirement is a written Exposure Control Plan identifying every task that involves potential contact with blood or infectious material, reviewed and updated annually. Facilities must provide puncture-resistant sharps containers, prohibit needle recapping, supply personal protective equipment at no cost to employees, and offer immediate medical evaluation after any exposure incident. Serious OSHA violations can bring fines up to $16,550 per violation, with willful or repeated violations reaching $165,514.6Occupational Safety and Health Administration. OSHA Penalties
Startup Costs, Insurance, and Entity Formation
Opening a med spa requires significantly more capital than a standard day spa. A small facility with one or two treatment rooms typically runs $200,000 to $350,000 in total startup costs. A mid-range spa with three to four rooms generally falls in the $350,000 to $500,000 range. The biggest cost drivers are medical-grade equipment (lasers alone can run $100,000 to $300,000), build-out of clinical treatment rooms, initial product inventory, and the marketing needed to establish a patient base before revenue stabilizes.
Professional liability insurance is non-negotiable. Typical policies carry limits of $1,000,000 per claim and $3,000,000 in annual aggregate coverage, with premiums ranging from roughly $3,500 to $12,000 per year depending on procedures offered and clinician headcount. Beyond malpractice coverage, med spas should carry general liability insurance, workers’ compensation, and cyber liability insurance for patient records and payment data. Budget for biomedical waste disposal as well, typically $900 to $2,400 annually for a small clinical facility.
Equipment purchases may qualify for the Section 179 tax deduction, which allows businesses to deduct the full purchase price of qualifying equipment in the year it is placed in service. For 2025, the maximum deduction is $2,500,000.7Internal Revenue Service. Instructions for Form 4562 (2025) For a med spa buying one or two lasers, the deduction will almost certainly cover the full cost in year one.
On entity structure: in states with corporate practice restrictions, plan on at least two entities, an LLC or similar for the management company and a physician-owned professional corporation (or PLLC where allowed) for the clinical side. In non-CPOM states a single entity may suffice, though many owners still use a separate management LLC for liability protection. Formation documents are filed with the Secretary of State, typically through an online portal, with filing fees generally running from around $100 to $500. If you are forming the MSO structure, the Management Services Agreement between the two entities should be drafted by a healthcare attorney before you start operating.
Once the entity is legally formed, apply for an Employer Identification Number through the IRS. The online application is free and produces the EIN immediately upon approval.8Internal Revenue Service. Get an Employer Identification Number Form your state entity first, because the IRS requires a legally existing entity before issuing an EIN.9Internal Revenue Service. Employer Identification Number
If your med spa will bill any insurance or federal health programs, or if you simply want clean operations and future billing flexibility, apply for a Type 2 National Provider Identifier through the National Plan and Provider Enumeration System. The application is online, free, and typically processes within a few business days.10Centers for Medicare and Medicaid Services. How to Apply Individual clinicians at the facility each need their own Type 1 NPI. You will also need local business permits and, in many jurisdictions, a health department inspection or certificate before opening the doors.