To open a medical spa legally, you need a stack of credentials that sits in three layers: a licensed physician (MD or DO) owning or overseeing the medical entity, individual professional licenses for every clinician on staff, and a mix of state business permits plus federal registrations like a CLIA certificate and, where controlled substances are involved, a DEA number. The exact licenses needed to open a medical spa depend on your state, the procedures you plan to offer, and whether a physician or a non-physician is launching the business. Getting any one layer wrong can mean felony charges, six-figure fines, or a forced shutdown before you ever treat a patient.
Physician Ownership Comes First
The biggest licensing hurdle for most medical spa founders isn’t a form. It’s a legal doctrine called the corporate practice of medicine, which prevents non-physicians from owning a medical practice or employing doctors to deliver clinical care. The reasoning is that clinical decisions should be made by someone whose primary obligation is to the patient, not to a corporate bottom line. States including California, Texas, Ohio, Colorado, Iowa, Illinois, New York, and New Jersey enforce the doctrine, and most other states have some version of it on the books.1Internal Revenue Service. Corporate Practice of Medicine
In practice, this means a licensed medical director must hold a controlling ownership interest in the medical entity that delivers patient care. The medical director signs off on treatment protocols, delegates specific procedures to mid-level providers and nurses, and bears ultimate responsibility for clinical outcomes. Some states require the physician to own 100% of the professional corporation’s shares. Others allow a majority stake. Either way, cutting corners here can result in felony charges for practicing medicine without a license.
If You’re Not a Physician: The MSO Structure
Non-physicians who want to run a medical spa typically form a Management Service Organization. The MSO is a separate company that handles the non-clinical side: marketing, billing, lease management, hiring administrative staff, and purchasing non-medical supplies. It signs a management services agreement with the physician-owned professional corporation, creating a legal wall between business operations and clinical decision-making.
The critical constraint is fee-splitting. Fee-splitting happens when a physician shares professional revenue with a non-physician based on a percentage of clinical income. Most states treat this as a serious offense because it creates a financial incentive to push unnecessary procedures. Violations can lead to license revocation for the physician and criminal charges for both parties. The management services agreement needs to use flat-fee compensation or another structure that doesn’t tie the MSO’s income directly to the volume of patient procedures. A health care attorney drafting this agreement is a line item worth paying for.
Professional Licenses for Clinical Staff
Every person performing a medical procedure in your spa needs their own professional license, and the type of license dictates exactly what they can do. State medical boards and nursing boards both regulate these scopes of practice, so you answer to multiple oversight bodies at once.
- Nurse practitioners and physician assistants function as mid-level practitioners. They can perform injectable treatments like neuromodulators and dermal fillers, operate medical-grade lasers, and conduct the pre-treatment assessments that determine whether a patient is a good candidate for a procedure. The required degree of physician supervision ranges from direct oversight (physician physically present) to remote availability by phone, depending on the state.
- Registered nurses can administer many injectable treatments and operate certain lasers under physician delegation. They cannot independently prescribe or diagnose, and they work under protocols set by the medical director.
- Licensed estheticians handle cosmetic procedures that stay at the surface level of the skin: facials, microdermabrasion, basic extractions. They cannot administer injections, and their use of laser devices is restricted to lower-powered machines that don’t penetrate below the outermost skin layers. Higher-powered lasers that reach the dermis require a licensed medical professional.
Supervision is where most compliance failures happen. Some states demand that the medical director be on-site during all clinical hours. Others allow remote availability as long as the physician can respond to emergencies. Iowa, for example, requires the medical director to be physically present for a set number of hours each week and remain within a geographic radius of the facility. Match your staffing model to your state’s supervision rules before you open the doors.
State and Local Business Permits
Beyond medical licensing, you need standard business authorizations from local and state agencies. These are less dramatic than the medical requirements but just as capable of shutting you down if you skip them.
- A general business license from your city or county, allowing commercial operation at your specific address.
- A sales tax permit from your state’s revenue department if you sell skincare products, supplements, or other retail goods.
- A health department permit. Local health departments inspect medical spas for sanitation, sterilization procedures, and safe disposal practices, with an initial inspection before opening and periodic follow-ups.
- Zoning clearance. Not every commercial space is zoned for medical use. Some municipalities group medical spas with salons and barbershops; others require medical office zoning. Verify this before you sign a lease.
- A medical waste permit. Any facility generating sharps or blood-contaminated materials needs authorization for proper disposal, including a contract with a licensed medical waste hauler.
Some states also require a separate registration of the medical spa entity with the state medical board, on top of standard business registration. This step is easy to miss because it doesn’t appear on general small-business checklists.
Federal Registrations
Three federal layers apply to most medical spas, and none of them are optional.
CLIA Certificate
If your spa performs any diagnostic testing, including basic blood draws for treatments like platelet-rich plasma therapy, you need a Clinical Laboratory Improvement Amendments certificate. Most medical spas qualify for a Certificate of Waiver, which covers simple, low-risk tests. The biennial fee is $248.2Centers for Medicare & Medicaid Services. CLIA Certificate Fee Schedule The waiver requires that you follow manufacturers’ instructions for every test you run and limits your facility to specifically approved test categories.3eCFR. 42 CFR Part 493 – Laboratory Requirements
DEA Registration
Any practitioner who prescribes, administers, or dispenses controlled substances must register with the Drug Enforcement Administration before doing so.4eCFR. 21 CFR Part 1301 – Registration Even if you don’t offer pain management, certain sedation protocols or compounded medications may contain scheduled substances. The current practitioner registration fee is $888 for a three-year cycle.5Federal Register. Registration and Reregistration Fees for Controlled Substance and List I Chemical Registrants Each registered location must maintain proper storage, inventory logs, and disposal records.
DSCSA Compliance
Medical spas that buy and administer prescription products like neuromodulators, dermal fillers, or GLP-1 medications fall under the Drug Supply Chain Security Act. The DSCSA requires you to verify that every supplier is properly licensed, maintain transaction records including lot numbers and expiration dates, and have a process for quarantining and investigating suspect or illegitimate products before administering them to patients. Records must be retained for six years and produced promptly during an FDA inspection.6ACHC. DSCSA: Safeguarding the Drug Supply Chain Noncompliance can result in civil fines up to $500,000 per violation and criminal charges for intentional violations.
Compliance Programs You Need in Place
Several federal frameworks aren’t licenses in the traditional sense, but inspectors and insurers expect to see documented compliance before you operate.
HIPAA
Medical spas collect patient names, medical histories, treatment photos, payment records, and appointment details. All of that qualifies as protected health information, and the same privacy and security rules apply as to any other medical practice. The Security Rule requires administrative safeguards (written policies, risk assessments, staff training), physical safeguards (securing devices and record storage), and technical safeguards (encryption, strong passwords, data backups).
Any software vendor that handles patient data, including your scheduling platform, EHR system, or payment processor, must sign a Business Associate Agreement before you share protected health information with them. A vendor that refuses to sign one is not HIPAA-compliant and cannot be used. Civil penalties for HIPAA violations start at $145 per violation for unknowing infractions and can reach over $2 million per year for willful neglect that goes uncorrected.7HHS.gov. Breach Notification Rule
OSHA Bloodborne Pathogens
Any spa where staff handle needles, perform injections, or come into contact with blood must comply with OSHA’s Bloodborne Pathogens Standard. You need a written Exposure Control Plan updated at least annually, training for every exposed employee at hire and annually thereafter, and the hepatitis B vaccine offered to all exposed employees within 10 working days of initial assignment. Contaminated sharps go into closable, puncture-resistant, leakproof containers.8OSHA. 1910.1030 – Bloodborne Pathogens Training records must be kept for at least three years.
Laser Safety Officer
Facilities using medical lasers are expected to maintain an ANSI-compliant laser safety program and appoint a Laser Safety Officer. The national standard, ANSI Z136.3, applies to salons and spas as well as clinics. The LSO assesses laser hazards, develops written safety policies, ensures personnel are trained, and audits the program. Most state regulators and insurers treat ANSI compliance as mandatory.
Insurance and Informed Consent
The medical director and all clinical staff need professional liability coverage in place before most licensing applications will be approved. The industry standard for medical spa malpractice policies is $1 million per claim and $3 million in annual aggregate. Some states set minimum coverage requirements by statute; others leave it to the licensing board. General liability insurance covering slip-and-fall injuries and property damage is a separate policy and equally necessary.
Every patient who receives a medical procedure must sign a treatment-specific informed consent form before the procedure begins. The form should describe the procedure, the risks and potential complications, alternative treatments including no treatment, the limitations of expected results, and pre- and post-care instructions. Generic one-size-fits-all consent forms are notoriously weak in court. Each procedure type needs its own form.
A Note on Marketing
Licensing covers your right to operate. It does not cover your right to advertise freely. Social media posts, before-and-after photos, and testimonials fall under Federal Trade Commission oversight, and any claim about a treatment’s effectiveness must be backed by competent and reliable scientific evidence.9Federal Trade Commission. Health Products Compliance Guidance Liability extends to individual owners and corporate officers, not just the business entity, so build this into your marketing policies from the start.
What Goes Into the Application Package
You will be submitting applications to multiple agencies at once. Most state medical boards accept filings through an online portal. The documentation package typically includes:
- The signed medical director agreement between the physician-owned professional corporation and the facility, including delegation of authority protocols specifying which procedures each staff member can perform.
- Current, unrestricted professional licenses for the medical director and all clinical staff, along with each practitioner’s National Provider Identifier.
- Certificates of professional liability coverage for every clinician, meeting your state’s minimum requirements.
- Facility floor plans showing treatment rooms, sterilization areas, private consultation spaces, and storage for controlled substances and medical waste.
- An equipment inventory listing all FDA-cleared medical devices on-site, with model numbers and intended uses.
- Business formation documents, your federal Employer Identification Number, and any MSO agreements.
Application fees commonly run from several hundred to a few thousand dollars per facility, with processing times of 60 to 90 days. Expect a site inspection confirming that your physical space, equipment, and safety protocols match your application. Background checks on the medical director and key personnel are standard. Once everything clears, you receive a physical license that must be displayed in a public area of the spa.
The biggest cause of delay is incomplete paperwork. A single missing document, whether an outdated insurance certificate or an unsigned delegation protocol, can restart the review clock. Assemble the entire package before you file anything.