California Med Spa Compliance Checklist 2026 — Complete Guide

California has the most complex med spa regulatory environment in the US. This checklist covers every compliance category the Medical Board of California checks — organized so you can work through it area by area. Use it before you open, before any inspection, and whenever you add a new procedure or provider.

Each section includes a brief explanation of why the requirement exists and what inspectors look for, so you understand the intent — not just the rule.

What Inspectors Check First

When the Medical Board of California conducts a med spa inspection, they don't work through a random checklist. There is a consistent pattern to what gets examined first:

1. The Medical Director Agreement — Does it exist? Is it signed? Does it specify actual supervision duties, visit frequency, and chart review requirements? A generic template that doesn't reflect what the director actually does is as problematic as no agreement at all.
2. Business entity documents — Is the med spa a Professional Corporation? Who holds the controlling interest? Inspectors will check Secretary of State filings and ask to see the PC's operating documents.
3. Provider licenses and scope — Are the staff performing procedures actually licensed to do so under California law? LVNs and medical assistants doing injectables is the single most commonly cited violation in California med spa inspections.
4. Treatment protocols — Is there a written, signed protocol for every procedure on the service menu? Are they current, or do they have a physician's signature from three years ago?
5. Advertising materials — Does the med spa's website and marketing include the supervising physician's name or fictitious name permit number?

If you can walk into an inspection with confident answers to all five of these, you're ahead of most California med spas. Everything else on this checklist is important — but these are where enforcement actions begin.

1. Business Structure

California's Corporate Practice of Medicine (CPOM) doctrine is not a technicality — it is the foundational legal requirement that dictates everything else about how a med spa is organized. An LLC cannot own a California med spa regardless of who operates it. If your structure is wrong, every other compliance effort is built on an illegal foundation.

2. Medical Board of California Registration

California is one of a small number of states that requires med spas to register directly with the state medical board. This isn't a one-time filing — registration must reflect the current medical director and current procedures. An unregistered med spa is operating illegally regardless of how well-structured everything else is.

3. Medical Director Requirements

The medical director is the cornerstone of California med spa compliance. Every procedure you offer must be covered by a physician-approved protocol. Every clinical decision your staff makes happens under the medical director's supervision authority. A "paper" medical director — someone who signed some documents but never actually visits or reviews charts — is a violation waiting to be discovered.

The Medical Director Agreement is the document that defines this relationship. When inspectors arrive, it's the first thing they ask to see. It must exist, be signed, and specifically describe supervision duties — not just say the director will "oversee medical operations."

4. Staff Credentials & Scope of Practice

California has some of the strictest scope-of-practice rules for aesthetic procedures in the US. LVNs and medical assistants cannot perform injectables — period. This is the violation inspectors find most often. It's not a gray area, not a matter of supervision level, and not something that can be remedied with extra training. The credential either qualifies or it doesn't.

Every provider performing procedures must be credentialed at the correct level for that specific procedure. Laser treatments have different requirements from injectables. Verify each provider's license before they perform their first procedure, and verify again at each license renewal cycle.

5. Treatment Protocols (SOPs)

California requires a written, physician-approved clinical protocol for every procedure a med spa offers. "Protocol" means a specific document — not general training, not verbal instructions, not a note in a staff meeting. The Medical Board considers operating a procedure without an approved SOP to be practicing medicine without appropriate physician oversight.

Protocols must be thorough enough that any qualified provider could follow them consistently. They need to specify patient selection criteria, contraindications, preparation steps, treatment parameters, adverse event response, and follow-up requirements. A one-paragraph "injection guidance" document is not a protocol.

6. Advertising Compliance

California's advertising rules for medical practices are enforced through the Business and Professions Code, and the Medical Board treats advertising violations seriously. The most common advertising violation: the med spa's website or marketing materials do not display the supervising physician's name. This isn't optional — it's a specific requirement under California law for any facility advertising medical services.

A fictitious name permit can be used instead of the physician's personal name, but the permit itself must be obtained from the Medical Board and used consistently. Non-compliant advertising can trigger an investigation even if clinical operations are perfectly structured.

7. HIPAA Compliance

Med spas are covered entities under HIPAA. This means the full range of HIPAA obligations apply — Notice of Privacy Practices, Business Associate Agreements with all vendors who handle patient data, documented staff training, and a written breach notification policy. California also adds the California Consumer Privacy Act (CCPA) for certain data practices, which overlaps with but is separate from HIPAA.

One HIPAA issue specific to med spas: patient photos. Using a patient's before/after photo in any marketing without a specific, separate written authorization (not buried in a general intake form) is a HIPAA violation. A general consent for treatment does not cover marketing use of patient images.

8. Informed Consent

California informed consent requirements for medical procedures are among the most detailed in the country. The consent must be specific to the procedure, given in advance (not immediately before the procedure while the patient is already on the table), and documented in the patient's permanent record. Verbal consent is not sufficient for any procedure.

For procedures with significant risk profiles — laser resurfacing, deep chemical peels, certain body contouring treatments — a more detailed consent process may be required, with a waiting period between consent and treatment. When in doubt, consult with a California healthcare attorney about your specific service menu.

9. Emergency Protocols

The Medical Board requires med spas to have a written emergency response protocol for each procedure that carries anaphylaxis or serious adverse event risk. "We'd call 911" is not a protocol. The protocol must specify: what symptoms trigger the response, who on staff is responsible for each action, what medications are on-site and where they are stored, and how the incident is documented.

Anaphylaxis is the most common emergency scenario in med spa settings, occurring with injectables, chemical peels, and certain topical treatments. Staff training must include recognition of early anaphylaxis symptoms — not just severe reactions. A patient who leaves the facility and goes into anaphylaxis in the parking lot is still a liability event for the med spa.

10. Malpractice Insurance

Every provider performing procedures at the med spa must carry malpractice insurance that covers those specific procedures. Coverage gaps are common when a provider's policy was written for a different practice context — for example, an NP whose policy was written for primary care may not cover cosmetic injectables without an endorsement.

The med spa itself should also carry a general liability policy. Malpractice insurance covers professional negligence; general liability covers premises incidents, equipment failures, and slip-and-fall claims. Both are needed.

Run through this checklist before your first patient, before adding any new procedure, and before any inspection. If you discover gaps, address them before operating — not after a citation.

This checklist is for informational purposes only and does not constitute legal or medical advice. California compliance requirements are complex and change frequently. Consult a California healthcare attorney to review your specific situation.

Frequently Asked Questions