Med spa compliance spans state medical and nursing board rules on supervision and delegation, business and professional licensing, ownership rules for medical practices, controlled substance or prescription handling where applicable, device rules for lasers and IPL, HIPAA privacy and security, OSHA workplace safety including bloodborne pathogens, and advertising rules. Because these vary by state, use this list to prepare questions for your attorney and the boards.
Who to ask and what to ask
| Office | Question |
|---|---|
| State medical board | What are the supervision and delegation rules for each treatment? |
| State nursing board | What may RNs and NPs perform, and under what supervision? |
| Healthcare attorney | Which ownership structure is allowed in this state? |
| State radiation or health agency | Are there registration or operator rules for lasers and IPL? |
| City and county | Business license and certificate of occupancy? |
| HHS resources | What do HIPAA privacy and security rules require of us? |
Sample consent and photo checklist
Each treatment should have a written consent form approved by the medical director, listing the procedure, expected results, risks, alternatives and aftercare. Photo consent should be separate and say clearly whether photos may be used only in the chart or also in marketing, including the website and social media. Store signed forms in the patient record and honor any later request to stop using a photo.
Mistakes that cause problems
- Advertising a treatment by a provider who cannot legally perform it unsupervised
- Using marketing photos without separate written consent
- Storing patient photos on personal phones
- Letting laser operators work without the training your state requires
Rules owners often miss
Because supervision rules differ for injectables, lasers and facial treatments, many med spas keep a written chart showing who may perform each service, under whose supervision and with what training. Review it whenever staff or services change.
What to research
| Requirement | Usually handled by |
|---|---|
| Medical oversight and licensing rules | State medical board and related boards |
| Facility and business licenses | State and local |
| Device and product rules | FDA for devices and products |
| Privacy obligations | HIPAA may apply; ask a qualified advisor |
| Advertising claims | FTC truth-in-advertising rules |
Free tools
Common questions
Are lasers regulated?
Yes. Laser products are regulated as radiation-emitting products federally, and many states add registration or operator rules.
Do I need bloodborne pathogen training?
Employers whose staff may be exposed to blood follow OSHA's bloodborne pathogens standard, which includes training and an exposure control plan.
Can estheticians use lasers?
It depends on the state; some allow it with training and supervision, others do not.
Do I need a separate license for the business?
Requirements vary; many states license the providers rather than the spa, but local business licenses still apply.
Sources
- SBA: Apply for licenses and permits
- American Med Spa Association
- FDA: Radiation-emitting products
- HHS: HIPAA for professionals
Sources checked October 6, 2026. Rules, fees and forms change; confirm details with the agency or provider before you act. This guide is general information, not legal, tax or insurance advice.
Check your domain and prepare your business information
Once your name is settled, check that the domain is free and keep your legal name, phone and address consistent. Your domain is included when we build your website. Start with the free checklist.
Check domain and website options