Massachusetts Medical Spa Regulations and Requirements

Massachusetts medical spa regulations come from several agencies at once: the Department of Public Health licenses clinics and registers lasers, the Board of Registration in Medicine holds the supervising physician accountable for clinical care, the Board of Registration in Nursing oversees nurse practitioners, and federal rules under HIPAA, OSHA, and the FTC sit on top of all of it. A spa that gets any one of these layers wrong can lose its license, draw board discipline against the physician, or face consumer lawsuits with tripled damages.

Clinic License or Ownership Exemption

The first question for any operator is whether the facility needs a clinic license from DPH. Under M.G.L. c. 111, § 51 and 105 CMR 140.000, clinics must be licensed.¹ A medical spa that is wholly owned and controlled by one or more of the practitioners who provide its medical services is exempt from clinic licensure.² The exemption removes the clinic license requirement, not the oversight: the practitioners stay accountable to their own licensing boards.

Ownership itself is regulated. Massachusetts follows the corporate practice of medicine doctrine, which bars unlicensed corporations from owning or controlling medical practices. Physicians who want a business entity typically form a professional corporation under M.G.L. c. 156A or an LLC. A non-physician investor cannot hold a controlling stake in a spa that provides medical services. Management services arrangements that leave a physician as nominal owner while a non-physician controls clinical decisions get a skeptical look from regulators.

Beyond state licensure, most spas also need a local business license from the city or town where they operate.

Who Can Perform Procedures

Every medical procedure at a medical spa must be performed by or under the direction of a licensed medical practitioner.¹ In practice, a licensed physician serves as medical director and carries legal responsibility for the clinical care delivered on site. The Board of Registration in Medicine holds that physician accountable for ensuring delegated procedures match the training and competency of the staff performing them.³

Physician Assistants

A PA may perform medical services only under the supervision of a registered physician. Supervision must be continuous, though it does not require the physician to be physically present in the room or even in the building at all times.⁴ If a physician or physician group employs the PA, the employer carries full legal responsibility for the PA’s actions, including treatments the PA provides at a facility under the employer’s direction.

Nurse Practitioners

Nurse practitioners are regulated by the Board of Registration in Nursing, not the Board of Medicine.¹ In 2021 the Board approved amendments to 244 CMR 4.00 that established independent practice authority for advanced practice registered nurses, including NPs with the appropriate authorization.⁵ An NP who holds that authorization can practice in the expanded role the Board defines.

The Good Faith Examination

Before a patient’s first aesthetic treatment, a good faith exam should assess medical history, current condition, and fitness for the proposed procedure. A physician, PA, or NP can perform it. A registered nurse can help gather information but cannot independently generate treatment orders from the findings. The examining practitioner reviews the results and sets the treatment plan. Skipping this step is one of the fastest routes to board discipline, because it strips the clinical justification out of every treatment that follows.

Lasers, Registration, and Safety

Any facility that uses a Class 3B or Class 4 laser must register with the DPH Radiation Control Program before operating the equipment, and the registration application requires the facility to designate a Laser Safety Officer responsible for safe operation and compliance.⁶ Installation, operation, maintenance, and repair must comply with the current version of ANSI Z136.1, the American National Standard for Safe Use of Lasers.

Electrolysis offices that use laser hair removal equipment also need to comply with applicable FDA regulations and the DPH laser control rules.⁷ Safety goggles for staff and patients must be rated for the specific wavelength and optical density of the equipment and must meet ANSI Z87.1.⁸

Consent, Records, and Data Privacy

Informed Consent

Before any procedure, the practitioner should obtain informed consent covering the nature and purpose of the treatment, expected benefits, risks and side effects, and the consequences of declining. The conversation and the patient’s decision belong in the record. A signed consent form, when used, becomes part of the record. Vague or missing consent is a common thread in aesthetics malpractice claims.

Medical Records

Clinics licensed by DPH must keep records of the treatment of cases under their care, including medical histories and nursing notes.⁹ Under M.G.L. c. 111, § 70E, patients have the right to inspect their records and receive copies on request.¹⁰ Copying fees are capped at the cost of reproduction, and no fee may be charged when the records support a claim under the Social Security Act or a needs-based benefit program.

HIPAA and State Data Rules

A medical spa that collects and stores patient health information electronically generally qualifies as a HIPAA covered entity. The federal Privacy Rule protects individually identifiable health information in any form, whether electronic, paper, or oral.¹¹ For a spa, protected information includes patient histories, treatment notes, and before-and-after photos. Using any of that content for marketing requires separate written patient consent. The Privacy Rule’s minimum necessary standard limits use and disclosure to what is reasonably needed for the purpose at hand.

Massachusetts layers its own rules on top. Under 201 CMR 17.00, every business that owns or licenses personal information about a Massachusetts resident must develop, implement, and maintain a comprehensive written information security program covering paper and electronic records, with minimum standards for encryption and access controls.¹²¹³¹⁴ A spa that cannot produce a written security program after a breach fares considerably worse in any enforcement action that follows.

Advertising, Testimonials, and Endorsements

M.G.L. c. 93A declares unfair or deceptive acts in trade or commerce unlawful.¹⁵ A spa’s promotional materials must accurately represent the services and cannot make unsupported claims about results or safety. The Board of Registration in Medicine also holds physicians to honesty and transparency standards in advertising, and violations can bring fines, consumer suits, and discipline against the physician’s license.

Spas that use patient testimonials, influencer partnerships, or before-and-after photos must follow the Federal Trade Commission’s Endorsement Guides. Any material connection between the spa and the endorser must be disclosed clearly and conspicuously, including payment, free treatments, discounts, or any other perk given with the expectation of promotion.¹⁶ When an ad features a patient with dramatic results, it must make clear what results are generally expected unless the spa has evidence those results are typical. The “#ad” tag works for paid posts, but it cannot be buried below a “more” truncation, and hyperlinked disclosures that require a click to another page are generally not sufficient. If the spa tells testimonial participants in advance that they might appear in advertising, that fact belongs in the disclosure as well.

OSHA, Sharps, Chemicals, and Medical Waste

Federal OSHA standards apply to medical spas the same way they apply to any healthcare setting where employees face exposure to bloodborne pathogens, hazardous chemicals, or laser radiation. OSHA can inspect and fine employers that fail to comply.

Bloodborne Pathogens

A spa where employees have occupational exposure to blood or other potentially infectious materials must maintain a written Exposure Control Plan identifying at-risk employees, the methods used to minimize exposure, and procedures for evaluating exposure incidents. Employers must review and update the plan at least annually and must solicit input from staff who handle sharps or provide direct patient care when selecting safer devices.¹⁷ Contaminated sharps go immediately into puncture-resistant, leakproof, closable, clearly labeled containers kept upright, close to the point of use, and replaced before they overfill.

Chemical Safety and PPE

Under OSHA’s Hazard Communication Standard, the employer must keep a safety data sheet on site for every hazardous chemical in the workplace and keep those sheets readily accessible during shifts.¹⁸ A written hazard communication program must list all hazardous chemicals present and describe how labeling and SDS requirements will be met. Container labels must be legible, in English, and prominently displayed.

Employers must run a hazard assessment covering biological, chemical, and radiant energy risks and provide appropriate PPE at no cost to employees. For injectors, that typically means gloves selected for puncture resistance and chemical compatibility. For laser operators, it means wavelength-specific goggles. Staff handling hazardous chemicals may also need lab coats or surgical gowns.⁸

Medical Waste

Massachusetts regulates medical and biological waste under 105 CMR 480.000. Categories relevant to spas include blood and blood products in free-draining liquid state, materials saturated or dripping with blood, and pathological waste such as tissue specimens removed during procedures.¹⁹ Waste shipped off site must be packaged to federal Department of Transportation standards, including rigid, puncture-resistant, securely closed containers for sharps.²⁰

Insurance a Spa Actually Needs

A medical spa needs at least two kinds of coverage. Professional liability insurance, sometimes called malpractice, covers claims that a treatment caused harm, whether from injectable complications, laser burns, or adverse reactions. Industry policies commonly carry limits around $1,000,000 per claim and $3,000,000 in annual aggregate. General liability covers everything unrelated to treatment: a client tripping in the lobby, property damage, advertising injury. Landlords and lenders typically require proof of general liability before signing a lease or financing a buildout.

Some carriers offer add-ons for license defense if a board complaint is filed, HIPAA violation defense, and medical director liability. Given how broad spa menus have become, confirming that the policy covers every service offered, including newer treatments, is worth a careful read of the coverage schedule.

Inspections, Penalties, and a Bill to Watch

DPH inspects every facility before issuing a clinic license and may conduct additional inspections whenever the Commissioner deems necessary.²¹ Current regulations do not set a fixed annual inspection schedule for existing clinics, and advance notice is not required. Inspectors generally review sanitation, record-keeping, collaborative agreements, laser registration, and waste disposal. The Board of Registration in Medicine separately reviews physicians to confirm they are meeting supervisory responsibilities and that delegated procedures match the training of the staff performing them.³ Patient, staff, or practitioner complaints can trigger an investigation at any time.

DPH can revoke or refuse to renew a clinic license. The Board can impose discipline on individual practitioners, from mandatory retraining to license suspension or revocation. A practitioner who allows unlicensed staff to perform procedures outside their scope faces personal exposure to allegations of aiding the unlicensed practice of medicine. Violations of Chapter 93A can bring treble damages in private consumer lawsuits.

As of early 2026, Senate Bill 1065 would create a dedicated medical spa licensing framework within DPH, including mandatory annual inspections and authority to assess fines between $1,000 and $10,000 per deficiency for each day a violation continues past the correction deadline.²² The bill has been reported favorably by committee and referred to Senate Ways and Means but has not been enacted. Existing clinic licensure rules and practitioner discipline already give regulators substantial leverage without it.

1
Mass.gov. Medical Spa Services Advisory
2
Mass.gov. 105 CMR 140.000 Licensure of Clinics
3
Board of Registration in Medicine. Board of Registration in Medicine
4
General Court of Massachusetts. Massachusetts Code Chapter 112 Section 9E
5
Mass.gov. Learn About Advanced Practice Registered Nurses APRN
6
Mass.gov. 105 CMR 121.000 Control of Radiation Hazards of Lasers
7
Commonwealth of Massachusetts Division of Professional Licensure. Policy Bulletin 2015-1 Licensure Requirements for Laser Hair Removal
8
Occupational Safety and Health Administration (OSHA). Personal Protective Equipment
9
General Court of Massachusetts. Massachusetts General Laws Part I Title XVI Chapter 111 Section 70 – Records of Hospitals or Clinics
10
General Court of Massachusetts. Massachusetts General Laws Part I Title XVI Chapter 111 Section 70E
11
Centers for Disease Control and Prevention (CDC). FAQs About HIPAA Privacy Rule
12
Mass.gov. 201 CMR 17.00 Standards for the Protection of Personal Information of Residents of the Commonwealth
13
Mass.gov. Requirements for Data Breach Notifications
14
General Court of Massachusetts. Massachusetts General Laws Chapter 93H Security Breaches
15
General Court of Massachusetts. Massachusetts General Laws Chapter 93A Section 2 – Unfair Practices
16
Consumer Advice (FTC). FTCs Endorsement Guides What People Are Asking
17
Occupational Safety and Health Administration (OSHA). Bloodborne Pathogens Standard 1910.1030
18
Occupational Safety and Health Administration. Hazard Communication Standard 1910.1200
19
Mass.gov. 105 CMR 480.000 Minimum Requirements for the Management of Medical or Biological Waste
20
eCFR. 49 CFR 173.197 Regulated Medical Waste
21
Cornell Law Institute. 105 CMR 140.111 – Frequency of Inspection
22
General Court of Massachusetts. Bill S.1065 – Medical Spa Licensing