Opening a med spa in California is more like opening a medical practice than opening a salon, and the medical spa requirements in California reflect that: the business must be owned by a licensed physician through a professional medical corporation, run under a genuinely supervising Medical Director, staffed within tightly defined delegation rules, and operated in compliance with patient examination, privacy, advertising, and safety laws. Every aesthetic treatment involving needles, lasers, or prescription products is legally the practice of medicine, and the penalties for getting the structure wrong reach criminal prosecution and license revocation.
Who Can Own the Business
California’s Corporate Practice of Medicine doctrine bars anyone who is not a licensed physician from owning or controlling a business that delivers medical services. Business and Professions Code Section 2400 states that “corporations and other artificial legal entities shall have no professional rights, privileges, or powers,” and the Medical Board of California reads this to mean that unlicensed persons cannot interfere with a physician’s clinical judgment.1California Legislative Information. California Business and Professions Code 2400 A med spa therefore cannot be a standard LLC or general corporation. It must operate as a Professional Medical Corporation under the Moscone-Knox Professional Corporation Act.2California Legislative Information. California Corporations Code 13400
Inside that corporation, licensed physicians must hold a controlling share. Corporations Code Section 13401.5 allows certain other licensed healthcare professionals (registered nurses, physician assistants, podiatrists, psychologists, chiropractors, and several others) to hold stock, but their combined ownership cannot exceed 49 percent.3California Legislative Information. California Corporations Code 13401.5 One or more physicians must collectively hold at least 51 percent and retain authority over all clinical decisions. The professional corporation is filed with the California Secretary of State using the designated articles of incorporation form.4California Secretary of State. bizfileOnline Forms
How Non-Physician Investors Participate
Non-physician investors who want a financial stake typically work through a Management Services Organization. The MSO is a separate business entity that handles administrative functions (scheduling, marketing, lease negotiations, billing, staffing of non-clinical roles) under a written Management Services Agreement with the physician-owned professional corporation. The physician keeps full control of everything clinical: treatment protocols, patient selection, hiring and supervision of clinical staff, and purchasing of medical equipment and supplies. That separation is what keeps the arrangement legal under the corporate practice doctrine.
Starting January 1, 2026, the rules around MSOs tighten. Senate Bill 351 prohibits any private equity group, hedge fund, or MSO from interfering with a physician’s professional judgment, including decisions about diagnostic testing, patient referrals, treatment options, patient volume, and working hours. MSAs can no longer include non-compete clauses for the physician, and the physician cannot be restricted from commenting on quality-of-care concerns. Separately, Assembly Bill 1415 requires written notice to the Office of Health Care Affordability at least 90 days before any transaction that transfers control or governance of a healthcare entity, which includes new MSA arrangements that qualify as material change transactions. Anyone structuring a new MSO relationship in 2026 needs to account for both from the start.
The Medical Director Role
Every medical spa must have a licensed MD or DO serving as Medical Director. The role is not a signature on a wall. The Medical Director writes the treatment protocols, decides which procedures the facility offers, determines which staff members are qualified to perform each procedure, and actively supervises the clinical work. A physician who lends their name without genuine involvement in clinical oversight is violating the corporate practice doctrine, and the Medical Board treats it as unprofessional conduct subject to discipline.5California Legislative Information. California Business and Professions Code 2234
Physical presence during every treatment is not required, but the level of supervision depends on the procedure and the credentials of the person performing it. For procedures delegated to registered nurses, the physician must be immediately available for consultation and must actively monitor the nurse’s practice through standardized procedures.
What Each Type of Staff Member Can Do
California physicians can delegate certain medical procedures to qualified staff, but each staff category operates under different rules. Building a service menu starts with knowing what your staff mix can legally deliver.
Registered Nurses
RNs can perform injectables and laser treatments only under written standardized procedures approved by the supervising physician. Those procedures must specify exactly which functions the RN may perform, under what circumstances, and with what level of supervision.6Legal Information Institute. California Code of Regulations Title 16 Section 1474 – Standardized Procedure Guidelines The Board of Registered Nursing calls standardized procedures “the legal mechanism for registered nurses, nurse practitioners to perform functions which would otherwise be considered the practice of medicine.”7Board of Registered Nursing. An Explanation of Standardized Procedure Requirements for Nurse Practitioner Practice Without a written standardized procedure, an RN performing an injectable or laser treatment is practicing medicine without authorization.
Nurse Practitioners
Assembly Bill 890 created two new NP categories. A “103 NP” can practice without standardized procedures but must work in a group setting with at least one physician. A “104 NP” can practice independently, but only after working as a 103 NP in good standing for at least three years. Both require national board certification and completion of a transition-to-practice period of 4,600 hours of direct patient care in California.8Board of Registered Nursing. Assembly Bill 890 A standard NP who has not met these requirements practices under standardized procedures like any RN. AB 890 expanded clinical authority; it did not touch the ownership rules, so the med spa still has to be a physician-owned professional corporation.
Physician Assistants
PAs may perform delegated medical procedures under the supervising physician’s oversight, and the delegation does not relieve the physician of primary responsibility for the patient’s welfare.9Legal Information Institute. California Code of Regulations Title 16 Section 1399.542 – Delegated Procedures A PA’s scope is governed by the written delegation agreement with the Medical Director, which should list every procedure the PA is authorized to perform.
Estheticians
Estheticians hold a cosmetology-category license and are limited to non-medical skin care. The Barbering and Cosmetology Act states that the cosmetology chapter “confers no authority to practice medicine or surgery” and that medical practice “shall not be performed by, or offered by” anyone licensed under that chapter without separate medical authorization.10California Legislative Information. California Business and Professions Code 7320 Any esthetician who uses a laser on a patient commits a misdemeanor.11California Legislative Information. California Business and Professions Code 7320.5 Estheticians cannot inject, operate medical-grade lasers, or administer chemical peels that penetrate beyond the outermost skin layer. A physician cannot delegate medical procedures to an esthetician no matter the training.
Good Faith Exam and Informed Consent
Before any medical aesthetic procedure, a patient must receive a good faith examination. A qualified provider evaluates the patient, confirms the treatment is medically appropriate, and rules out contraindications. Only a licensed physician, nurse practitioner, or physician assistant may perform this evaluation. An RN cannot conduct the GFE because it involves diagnosing a condition and developing a treatment plan, which sits outside the RN scope.
The examination should include a review of the patient’s medical history, a physical or visual assessment of the treatment area, and a documented treatment plan, all charted before the procedure begins. Skipping the GFE or having unqualified staff conduct it is one of the most common compliance failures the Medical Board investigates in med spa settings.
California also requires informed consent before any medical procedure. The provider must explain the nature of the proposed treatment, its risks and potential complications, reasonable alternatives, and what could happen without treatment. Under California law, a physician has a duty to disclose material risks a reasonable patient would want to know, and that duty is not waived by boilerplate consent forms. Consent goes in the patient’s record in writing.
Telehealth Consultations
California permits the GFE by telehealth under Business and Professions Code Section 2290.5, which authorizes health care providers to deliver services through real-time video or store-and-forward technology. Before using telehealth, the provider must inform the patient about the format and obtain documented consent, verbal or written.12California Legislative Information. California Business and Professions Code 2290.5 Telehealth does not expand any provider’s scope, so the GFE must still be performed by a physician, NP, or PA, and it must be documented the same way as an in-person evaluation.
Telehealth is not always adequate. If the provider needs to assess skin texture, elasticity, or a specific treatment area in detail, a video consultation may not carry enough clinical information to meet the good-faith standard. The provider performing the GFE decides whether the format is sufficient for that patient and procedure.
Advertising and Marketing
Business and Professions Code Section 651 makes it unlawful for any licensed healing arts practitioner to disseminate a public communication (social media posts, websites, printed materials) that contains any false, misleading, or deceptive statement or image intended to induce the rendering of professional services.13California Legislative Information. California Business and Professions Code 651 Any photo of a model (someone who did not actually receive the advertised procedure from the advertising provider) must be clearly labeled as such. Before-and-after images of actual patients must identify which procedures were performed, use comparable lighting and poses so results are not visually exaggerated, and include a statement that results may vary. Altered images violate the statute.
At the federal level, the FTC requires health-related advertising to be truthful and backed by competent scientific evidence.14Federal Trade Commission. Health Products Compliance Guidance Med spas that use influencer partnerships or patient testimonials must disclose material connections between the endorser and the business.15Federal Trade Commission. Endorsements, Influencers, and Reviews Paying for or soliciting fake reviews violates the FTC’s Rule on the Use of Consumer Reviews and Testimonials. The practice owner, the Medical Director, social media managers, and outside marketing agencies all share potential liability for deceptive claims.
Patient Privacy and Records
Med spas collect medical histories, document clinical treatments, and manage prescription information, which makes them covered entities under HIPAA. That is true whether or not the practice bills insurance. The HIPAA Privacy Rule requires every covered entity to designate a privacy official, train workforce members on privacy policies, implement administrative, technical, and physical safeguards for patient health information, and maintain a complaint process for patients.16eCFR. 45 CFR 164.530 – Administrative Requirements
Protected health information in a med spa includes intake forms, treatment notes, prescription records, payment data tied to treatments, and before-and-after photos linked to a patient’s identity. Photos are where many practices slip up. Storing clinical images on personal phones, sharing them in staff group chats, or posting them on social media without proper authorization all risk a violation. HIPAA compliance documentation must be kept for at least six years.
California requires patient medical records to be maintained for at least seven years after discharge, and records for minors must be kept until at least one year after the patient turns 18, but never less than seven years.17Legal Information Institute. California Code of Regulations Title 22 Section 72543 – Patients Health Records Records must be permanent, legible, and reproducible.
Facility Licensing and Safety
You need a local business license from the city or county where the spa operates, and the professional corporation must be registered with the California Secretary of State. Beyond those baseline steps, the facility has medical safety obligations.
Bloodborne Pathogens
Any med spa where staff could be exposed to blood or other infectious materials (which covers virtually every practice performing injections or laser treatments) must comply with the federal bloodborne pathogens standard under 29 CFR 1910.1030. The core requirement is a written Exposure Control Plan identifying at-risk employees and documenting the engineering controls, work practices, and personal protective equipment used to minimize exposure. The plan must be updated annually to reflect new safety technology, and employers must solicit input from patient-care staff when selecting safer devices.18Occupational Safety and Health Administration. Bloodborne Pathogens – Standards A sharps injury log tracks any needle-stick or other percutaneous injuries from contaminated sharps.
Medical Waste
Under California’s Medical Waste Management Act, a med spa producing less than 200 pounds of medical waste per month is a small quantity generator. Small quantity generators that treat waste onsite using methods like steam sterilization must register with the local enforcement agency and file a medical waste management plan detailing the types and quantities of waste generated, the treatment methods used, and the name of any registered hazardous waste hauler used for offsite disposal.19California Department of Public Health. Medical Waste Management Act Even small quantity generators that contract with a hauler for all removal should keep clear records of what they generate and how it leaves the facility. Sharps, blood-soaked materials, and expired medications each require separate handling and cannot go into regular trash.
Penalties for Getting It Wrong
Practicing medicine without proper authorization under BPC 2052 is a wobbler in California, meaning prosecutors can charge it as either a misdemeanor or a felony. As a felony, the fine can reach $10,000, with potential imprisonment.20California Legislative Information. California Business and Professions Code 2052 Aiding or conspiring with someone who practices medicine illegally carries the same penalties.
The Medical Board can also pursue administrative discipline against the licensed physician involved. Unprofessional conduct under BPC 2234 covers gross negligence, repeated negligent acts, incompetence, and any violation of the medical practice act, and can result in license suspension or revocation.5California Legislative Information. California Business and Professions Code 2234 A Medical Director who signs off without genuine supervision, or who allows unlicensed staff to perform medical procedures, is squarely in that territory.
HIPAA violations add another layer. Civil penalties range from $145 to over $2 million per violation depending on culpability, and intentional violations can bring criminal prosecution with fines and imprisonment. On the esthetician side, any cosmetology licensee who uses a laser on a patient faces misdemeanor charges under BPC 7320.5.11California Legislative Information. California Business and Professions Code 7320.5 With the Medical Board, the Board of Barbering and Cosmetology, OSHA, and federal agencies all in play, a single compliance failure can trigger investigations from several directions at once.