North Carolina med spa laws treat almost every injectable, laser, and medium-to-deep skin procedure as the practice of medicine, which means the facility has to be owned by licensed physicians, run under a medical director who is personally competent in every service offered, and staffed by people working strictly inside their license. Federal privacy, advertising, and workplace-safety rules sit on top of the state framework. Getting any of these pieces wrong exposes the business to Medical Board discipline, criminal charges, and civil liability.
Why Most Med Spa Services Count as Practicing Medicine
Chapter 90, Article 1 of the North Carolina General Statutes defines the practice of medicine to include prescribing or administering any drug, diagnosing or treating any disease or abnormal condition by any means or device, and performing any surgical procedure.1North Carolina General Assembly. North Carolina Code Chapter 90 Article 1 – Practice of Medicine That sweeps in Botox, dermal fillers, laser resurfacing, chemical peels that go past the top layer of skin, and prescription-strength topicals.
This threshold question drives everything else. If a service is a medical act, it can only be performed by a North Carolina–licensed practitioner or under that practitioner’s supervision. Misclassifying a procedure as “cosmetic only” is the single most common path to trouble with regulators.
Who Can Own a North Carolina Med Spa
North Carolina follows the corporate practice of medicine doctrine. Under the Professional Corporation Act, all shares of a medical professional corporation must be held by licensees — not a majority, all of them.2North Carolina General Assembly. North Carolina Code 55B-4 An unlicensed entrepreneur cannot hold even a single share in the entity that delivers medical services. Narrow exceptions exist for professions like engineering and real estate appraisal, but none reach medical corporations.3North Carolina General Assembly. North Carolina Code 55B-6
Physicians can also organize as a Professional Limited Liability Company. The North Carolina Medical Board recognizes PLLCs for medical practice, offering LLC-style liability protection while keeping licensed professionals in control.4North Carolina Medical Board. Professional Limited Liability Company in the Practice of Medicine Either way, the entity must register with the Secretary of State and with the Medical Board.
Arrangements where an unlicensed person actually runs the business and pays a doctor to serve as a figurehead owner violate these rules. The physician risks losing their license, and the unlicensed owner faces criminal exposure for aiding the unauthorized practice of medicine.
The Medical Director’s Role
Every med spa needs a medical director who takes legal responsibility for clinical operations. That physician has to be personally competent in each procedure the facility offers. A dermatologist who has never trained on laser devices cannot supervise laser treatments just by signing a contract. The Medical Board expects supervisors to personally assess the skills of everyone they delegate work to and to document those assessments.
For office-based procedures, the Board’s position statement defines “immediately available” as physically within the office.5North Carolina Medical Board. Position Statement 5.1.1 – Office-Based Procedures The supervising physician stays on-site during the procedure period and is ready to step in if something goes wrong. Being available by phone does not meet the standard for procedures that qualify as office-based surgery or special procedures.
When a physician supervises a physician assistant, North Carolina requires monthly face-to-face meetings for the first six months of the relationship, then ongoing meetings at a sufficient frequency. If a nurse injures a patient while following standing orders, the supervising physician can face discipline for negligent oversight.
DEA Registration at the Spa’s Address
Med spas that store or administer controlled substances need the medical director to hold a current DEA registration specific to that practice location. A DEA number from another office does not automatically cover a separate med spa address. New registrations use DEA Form 224, and the physician must have an approved North Carolina license tied to the new address before DEA will process the application.6Drug Enforcement Administration. DEA Forms and Applications Any theft or loss of controlled substances must be reported through the DEA’s online Theft/Loss Reporting system using Form 106.
Patient Evaluation and Informed Consent
Before any medical treatment at a North Carolina med spa, a physician, physician assistant, or nurse practitioner has to evaluate the patient and determine whether the proposed procedure is appropriate. The Board of Nursing’s position statement is explicit: a practitioner with prescriptive authority must complete the evaluation and issue a prescription or order before a licensed nurse can perform the procedure.7North Carolina Board of Nursing. Cosmetic/Aesthetic Dermatological Procedures Position Statement for RN and LPN Practice An RN or esthetician cannot do this step.
The evaluation is also where contraindications get caught. A patient on blood thinners carries higher bleeding risk from injectables. A history of keloid scarring can make certain lasers a poor choice. Skipping the evaluation puts both the patient and the practice in serious jeopardy.
North Carolina’s informed consent statute requires that patients receive enough information to form a general understanding of the procedure, the usual and most frequent risks, and the recognized alternatives.8North Carolina General Assembly. North Carolina Code 90-21.13 – Informed Consent to Health Care Treatment or Procedure The disclosure standard is measured against what other practitioners with similar training in similar communities would tell a patient. Written consent forms belong in every patient’s record, and the alternatives disclosed should include the option of no treatment at all.
Who Can Perform Which Procedures
Scope lines are drawn sharply in North Carolina, and crossing them creates criminal exposure for the individual and regulatory risk for the facility.
Estheticians and Cosmetologists
North Carolina defines esthetics as giving facials, applying makeup, performing surface-level skin care, removing hair with creams or wax, and cleaning or stimulating the skin with cosmetic preparations and hands or devices.9North Carolina General Assembly. North Carolina Code Chapter 88B – Cosmetic Art The Board of Cosmetic Art Examiners has ruled that estheticians cannot use any product, device, or technique that penetrates the skin past the epidermis.10North Carolina Board of Cosmetic Art Examiners. Esthetic Scope Intent of the Service Declaratory Ruling That rules out injectables, medium and deep chemical peels, and Class III or IV lasers. Superficial exfoliation with lower-concentration alpha or beta hydroxy acids stays in bounds.
Registered Nurses and Licensed Practical Nurses
Licensed nurses can perform neuromodulator and dermal filler injections, but only after a physician, PA, or NP has evaluated the patient and issued a prescription or order for the specific procedure.7North Carolina Board of Nursing. Cosmetic/Aesthetic Dermatological Procedures Position Statement for RN and LPN Practice Nurses also need documented training and competency in each procedure, and they always work under the medical director’s standing orders. A nurse injecting Botox without a prior patient evaluation and prescription is practicing outside their legal scope.
Physician Assistants and Nurse Practitioners
PAs and NPs can conduct initial evaluations, prescribe, and perform procedures within their scope, operating under a supervisory arrangement with a physician. A PA’s supervisory agreement has to list the procedures they are authorized to perform, and the supervising physician must be competent in those same procedures.
Advertising and Marketing
Advertising faces two layers of regulation. The Medical Board’s position statement treats deceptive, false, or misleading advertising as unprofessional conduct under the Medical Practice Act.11North Carolina Medical Board. Position Statement 8.3.1 – Advertising and Publicity Ads cannot carry false claims or misrepresentations, cannot omit material facts, and must be substantiated. Before-and-after photos must show the licensee’s own patients and realistic outcomes. Testimonials cannot be fabricated. Claims about successfully treating large numbers of patients are considered deceptive if they imply guaranteed results.
Federal law adds Section 5 of the FTC Act, which bars unfair or deceptive health-services advertising, and Section 12, which targets false advertisements for drugs, devices, services, and cosmetics.12Federal Trade Commission. Health Products Compliance Guidance Health-related claims need competent and reliable scientific evidence to back them up. Spas working with social media influencers must make sure those influencers disclose any paid or in-kind relationship with the practice. Disclosures have to be hard to miss and placed inside the endorsement itself, not tucked onto a profile page or hidden behind a “more” link.13Federal Trade Commission. Disclosures 101 for Social Media Influencers
Patient Privacy, Workplace Safety, and Records
A med spa that collects health information to deliver clinical treatments is a HIPAA covered entity, regardless of size and regardless of whether it bills insurance. Intake forms, clinical notes, identifiable before-and-after photos, prescription records, and treatment-linked payment data all count as protected health information. The Security Rule requires technical safeguards for electronic records, including unique user IDs, audit controls that log access, and transmission security like encryption. A breach of unsecured patient information triggers notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery.14eCFR. 45 CFR 164.404 – Notification to Individuals Breaches hitting 500 or more people also require notice to HHS and prominent local media.
OSHA’s Bloodborne Pathogens Standard applies to any facility where employees handle needles or come into contact with blood or other potentially infectious material. The standard requires a written Exposure Control Plan reviewed and updated at least annually, covering exposure determination by job classification, engineering controls, PPE at no cost to the employee, hepatitis B vaccination, and post-exposure follow-up.15Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens Employers also have to solicit input from frontline staff when picking safer devices and document that process.
For Class 3B or Class 4 lasers, the ANSI Z136.3 standard calls for a designated Laser Safety Officer who conducts hazard analyses, sets safety policies, and makes sure protective eyewear and barriers match the wavelengths in use. ANSI standards are not directly enforceable, but OSHA can cite employers under its General Duty Clause for unaddressed laser hazards, and following ANSI is the most reliable way to show compliance.
On records, North Carolina’s administrative code requires licensed healthcare facilities to keep adult patient medical records for 11 years after discharge.16Legal Information Institute. 10A North Carolina Administrative Code 13B .3903 – Preservation of Medical Records Records for patients who were minors must be kept until the patient’s 30th birthday. The retention rules apply equally to paper originals, computer media, and digitally archived files. Treat this as a floor, not a ceiling: malpractice claims can surface years later, and complete documentation of the evaluation, consent, and treatment is often the facility’s best defense.
Penalties for Operating Outside the Rules
Practicing medicine without a valid North Carolina license is a Class 1 misdemeanor. The charge escalates to a Class I felony if the unlicensed person falsely represents themselves as licensed, and the same felony applies to out-of-state practitioners who practice in North Carolina without proper licensure.17North Carolina General Assembly. Session Law 2011-194 – Senate Bill 31 A person convicted of practicing without a license also forfeits the right to collect any fees for the services provided.
Administratively, the Medical Board can impose fines, public reprimands, suspensions, or permanent revocation. Investigations usually start with a patient complaint, and the Board looks at whether supervision protocols were in place and whether delegated staff were qualified for what they did. A single patient injury tied to inadequate oversight can trigger a Board investigation and a civil malpractice lawsuit at the same time. Any staff member who exceeds their scope also risks discipline from their own licensing board, whether that is the Board of Nursing, the Board of Cosmetic Art Examiners, or both.