California Med Spa Compliance Checklist 2026 — Complete Guide

California runs the most complex med spa regulatory environment in the country — but not because it has a med-spa statute. It doesn't. Unlike states that maintain a dedicated medical spa registry, California regulates a med spa the same way it regulates any other medical practice: through the Medical Practice Act, the Nurse Practice Act, and a corporate practice of medicine doctrine enforced more aggressively than almost anywhere else. This checklist works through every compliance category that actually gets checked, organized so you can move through it area by area — before you open, before an inspection, and whenever you add a new procedure or provider.

Each section explains why the requirement exists and what an investigator actually asks for, so you understand the reasoning behind the rule and not just the checkbox. Where California hasn't settled a question, or where we couldn't verify a specific citation, this guide says so rather than inventing one.

What Makes California Different: No Med-Spa Statute, Just the Practice of Medicine

Most state med spa checklists open with a licensing step: register the facility, pay a fee, list a medical director on file. California has none of that. There is no med spa license, no facility registration, and no medical-director registry maintained by the Medical Board of California. Search the Business and Professions Code for the phrase "medical director" as applied to a medical spa and you will find no definition and no minimum-hours rule.

What California has instead is broader, and in practice stricter: the treatments a med spa sells — botulinum toxin and filler injections, medical-grade laser and IPL, prescription-strength peels, GLP-1 prescribing — are simply the practice of medicine (BPC 2052), and practicing medicine without a license, or aiding someone else in doing so, is a public offense. That classification pulls in the full weight of the Medical Practice Act, the Nurse Practice Act, and the corporate practice of medicine doctrine at BPC 2400, which holds that corporations and other artificial entities have no professional rights, privileges, or powers. An LLC cannot own a California med spa, no matter how experienced its operators are or how qualified the physician they hire.

That difference reshapes this whole checklist. Instead of "did you register," the questions become "is the entity structured correctly," "is a real physician in control," "was every patient actually examined before treatment," and "is every provider performing only procedures they are actually licensed to perform." Those four questions, more than any filing, are where a California med spa's compliance risk concentrates — and where inspectors and complaint-driven investigations start.

What a Complaint-Driven Investigation Actually Asks For

California doesn't run scheduled med spa inspections the way some states run facility checks; most Medical Board and Board of Registered Nursing scrutiny of med spas starts from a complaint — a patient, a competitor, or a former employee. That changes what "being ready" means: there's no facility binder to have on a shelf, but there is a specific set of records an investigator will ask a practice to produce.

1. Entity documents — Is the business a professional corporation? Secretary of State filings and the shareholder register showing physician control at 51% or more.
2. Provider licenses and the delegation chain — Are the people performing injectables and laser procedures actually licensed to do so, and can the practice produce the standardized procedure or practice agreement authorizing each one?
3. Good-faith exam documentation — For the patient at issue, is there a dated, individualized exam by a physician, PA, or NP, not a template clearance or a blanket standing order?
4. Treatment protocols — Is there a written, signed protocol for the procedure in question, and does it match what the record shows actually happened?
5. Advertising materials — Does the practice's website and marketing name the supervising physician?

If you can produce clean answers to all five without scrambling, you are ahead of most California med spas that get investigated. Everything else on this checklist supports those five — but this is where a complaint turns into discipline or doesn't.

1. Business Structure: Can a California Med Spa Be an LLC?

Verdict: no. California's corporate practice of medicine doctrine is not a technicality — it's the foundational legal requirement that dictates everything else about how a med spa is organized. Business and Professions Code section 2400 provides that corporations and other artificial entities have no professional rights, privileges, or powers, and California's LLC statute does not permit an LLC to render services that require a professional license. That holds even if every member of the LLC is a physician, because the defect is the entity type itself, not the identity of the owners. If your structure is wrong, every other compliance effort in this checklist is built on an illegal foundation.

The entity that works is a professional medical corporation formed under the Moscone-Knox Professional Corporation Act (Corporations Code section 13400 and following). Physicians must hold at least 51% of its issued and outstanding shares. Corporations Code section 13401.5 lets certain other licensees — registered nurses, physician assistants, psychologists, acupuncturists, and several others — hold up to 49% together, subject to a rule that their number can't exceed the number of physician shareholders. Estheticians, practice managers, and lay investors appear nowhere on that list and can't hold a single share of the clinical entity; their only equity route is a separate management services organization (MSO) that supplies non-clinical services — billing, marketing, premises, equipment — under a written agreement priced at fair market value.

A qualifying 104 nurse practitioner under AB 890 is a partial exception: from January 1, 2026, a 104 NP can own a nursing corporation outright and practice independently, within the population focus of their national certification — but that's a nursing corporation, not a medical corporation, and it can only render services nursing scope actually covers.

2. Does a California Med Spa Need to Register with the Medical Board?

Verdict: no. There is no med spa license, no facility registration, and no separate "med spa registry" maintained by the Medical Board of California. Under Moscone-Knox, professional corporations generally need a certificate of registration from the board regulating the profession — but Corporations Code section 13401(b) expressly exempts a professional corporation rendering services through persons licensed by the Medical Board from that certificate-of-registration requirement. If a consultant or a template tells you to wait weeks for Medical Board approval before opening, that instruction doesn't reflect California law.

What a California med spa does need is unglamorous: Articles of Incorporation filed with the Secretary of State, a city or county business license in each operating municipality, a fictitious business name filing if the practice trades under anything other than its legal name, a seller's permit if it retails taxable products, and an EIN and payroll registrations. Keep the corporation's banking genuinely separate from any MSO — commingled accounts undermine the argument that the professional corporation is a real, independently capitalized business if that's ever tested.

Eligibility here is also a continuing condition, not a one-time filing. A departing shareholder, a new investor, or a physician moving out of state can quietly break the 51% floor or the section 13401.5 shareholder cap. Re-check the cap table whenever ownership changes, not only at formation.

3. Does California Require a Medical Director for a Med Spa?

Verdict: yes in substance, no in vocabulary. "Medical director" is not a licensed role or a defined term anywhere in the Business and Professions Code as applied to a med spa, and there's no medical-director registry, no minimum-visit rule, and no cap on how many locations one physician may oversee. What the law actually requires is assembled from several other provisions: the corporate practice bar at BPC 2400 (a physician must own and control the practice), BPC 2264 (aiding or abetting unlicensed practice is unprofessional conduct for the physician who enables it), and BPC 2242 (an appropriate prior exam before any dangerous drug is prescribed). Together they require a licensed physician who owns or controls the medical entity, authorizes what each provider may do, and remains answerable for it.

Because the role isn't defined by statute, the standard applied afterward is simply whether real oversight was occurring — a question of evidence, not paperwork. A written agreement documenting supervision duties, visit frequency, and chart-review responsibilities is still the practical way California med spas prove that oversight is real rather than nominal, even though no statute requires that specific document. A physician who signed something once and never visits, reviews a chart, or answers a call is the "paper director" pattern that shows up in nearly every California med spa enforcement action.

4. Who Can Perform Which Procedure: Scope of Practice by Role

California has some of the strictest scope-of-practice rules for aesthetic procedures in the country, and it enforces them through a chain of authority rather than a list of approved job titles. A prescriber examines the patient, orders the treatment, and — where the law allows it — delegates the act itself through a specific written instrument: a practice agreement for a PA, standardized procedures for an RN or an uncertified NP, or nothing at all once an NP holds AB 890 103 or 104 certification. Break any link in that chain and the procedure is unlicensed practice, regardless of how well trained the person holding the device is.

Physicians inject or operate lasers on their own license. Physician assistants work under a practice agreement meeting BPC 3502.3. Nurse practitioners work under standardized procedures until the Board of Registered Nursing certifies them under section 2837.103 or 2837.104, after which the standardized-procedure requirement falls away within the limits of that certification. Registered nurses act on a physician's order under BPC 2725, or under a written standardized procedure meeting the eleven elements required by Title 16 CCR section 1474 — and even then, only after a physician, PA, or NP has examined that specific patient and ordered the treatment. An RN never decides candidacy or selects the product and dose independently.

Licensed Vocational Nurses cannot perform injectables or operate medical lasers as the treating provider — their license is a directed scope under the Vocational Nursing Practice Act that doesn't reach either. Medical assistants are unlicensed personnel limited to basic technical supportive services under BPC 2069–2071; Title 16 CCR section 1366 lets an MA give certain drug-specific injections under direct physician presence, but that authority does not extend to cosmetic injectables. Estheticians and cosmetologists are limited to the epidermis under Title 16 CCR section 991, and BPC 7320 states plainly that a cosmetology license confers no authority to practice medicine — no amount of physician supervision moves an esthetician's license into injectables, medical lasers, or peels that go beyond the epidermis.

5. Laser and Energy-Based Device Oversight

Operating a laser or IPL device on living tissue is the practice of medicine in California, the same way injecting is — the device delivers a form of energy capable of altering or damaging tissue, and BPC 2052 reaches it exactly as it reaches injectables. The Medical Board's own guidance permits laser and light-based treatment only for a physician, or for a registered nurse or physician assistant working under a physician's supervision; nurse practitioners qualify through the same furnishing and standardized-procedure authority that governs their injectable practice. As with injectables, a qualifying provider examines the patient and sets the treatment before anyone fires the device.

Estheticians and cosmetologists may not operate medical lasers under any circumstances. Title 16 CCR section 991 limits their license to the epidermis, and a device capable of penetrating or damaging tissue below it is outside that boundary regardless of how the manufacturer markets the device's needle depth or energy setting. Medical assistants and LVNs cannot be delegated laser procedures either — the same scope limits that keep them out of injectables keep them off energy-based devices. A supervising physician who lets an esthetician run an ablative or fractional laser is not stretching a gray area; the Medical Board treats it as aiding the unlicensed practice of medicine, the same exposure as an unlicensed injection.

6. Does California Require a Good-Faith Exam Before Botox or Filler?

Verdict: yes, and it's the requirement California enforcement leans on hardest. Business and Professions Code section 2242 makes it unprofessional conduct to prescribe, dispense, or furnish a dangerous drug — which includes botulinum toxin and dermal filler — without an appropriate prior examination and a medical indication. Because every injectable treatment plan in a med spa is downstream of a prescribing decision, every one of them needs a documented, individualized examination behind it: relevant history, contraindications, current medications, and the specific treatment plan, recorded in the chart before treatment. An intake form the patient fills out at the front desk is intake, not an examination.

Only a prescriber may perform it: a physician, a PA under a practice agreement, or an NP under standardized procedures or AB 890 certification. A registered nurse may gather history, take photographs, and record vitals — but the exam and the resulting order belong to the prescriber, and an RN who documents one has stepped outside their scope. Telehealth is allowed under BPC 2290.5 with documented patient consent, but the clinical threshold doesn't drop for a remote visit. What California will not accept, and has made an enforcement priority, is a blanket standing order or a template clearance covering every patient in place of an individualized, patient-specific exam.

7. Treatment Protocols (SOPs)

Every procedure a California med spa offers needs a written, physician-approved clinical protocol — a specific document, not general training or verbal instruction. Because the physician who approves it is the same person whose license is on the line under BPC 2264 for aiding unlicensed practice, a protocol that doesn't reflect what actually happens in the treatment room is a liability rather than a defense. Protocols need to be thorough enough that any qualified provider could follow them consistently: patient selection criteria, contraindications, preparation steps, treatment parameters, adverse event response, and follow-up requirements. A one-paragraph "injection guidance" memo is not a protocol.

8. Advertising Compliance

A California medical practice's advertising is governed by the Business and Professions Code, and advertising that omits the supervising physician's name is one of the more common findings that turns a routine complaint into a broader look at the whole practice. A fictitious business name can be used instead of the physician's personal name, but it has to be on file and used consistently. Advertising problems rarely trigger an investigation on their own — but they are frequently what an investigator reviews once a complaint about something else is already open, and inconsistent or missing physician identification invites exactly that kind of broader look.

9. HIPAA and CCPA Compliance

Med spas are covered entities under HIPAA, so the full range of HIPAA obligations apply: a Notice of Privacy Practices, Business Associate Agreements with every vendor that touches patient data, documented staff training, and a written breach notification policy. California layers on the California Consumer Privacy Act (CCPA) for certain data practices, which overlaps with but is legally separate from HIPAA — a practice that is HIPAA-compliant is not automatically CCPA-compliant, particularly around what the practice discloses about data it collects for marketing.

One issue specific to med spas: patient photos. Using a patient's before/after photo in marketing without a specific, separate written authorization — not buried in a general intake form — is a HIPAA violation on its own, independent of any advertising rule it might also trip.

10. Informed Consent

California's informed consent expectations for medical procedures follow directly from the good-faith exam requirement: consent has to be specific to the procedure, given in advance rather than immediately before treatment while the patient is already on the table, and documented in the permanent record. Verbal consent alone is not sufficient for any procedure. For higher-risk services — laser resurfacing, deep chemical peels, certain body-contouring treatments — practices often build in a longer consent-to-treatment window and more detailed disclosure, though the specific timing isn't fixed by a single statewide rule; when in doubt, that's a question for California healthcare counsel rather than a template answer.

11. Emergency Protocols

A California med spa needs a written emergency response protocol for every procedure that carries anaphylaxis or serious adverse-event risk. "We'd call 911" is not a protocol — it has to specify what symptoms trigger the response, who on staff is responsible for each action, what medications are on-site and where they're stored, and how the incident gets documented. Anaphylaxis is the most common emergency scenario in med spa settings, arising from injectables, chemical peels, and certain topical treatments, so staff training needs to cover recognition of early symptoms, not just severe reactions.

12. Malpractice Insurance

Every provider performing procedures at the med spa needs malpractice insurance that actually covers those specific procedures. Coverage gaps are common when a provider's policy was written for a different practice context — an NP whose policy was written for primary care, for example, may not cover cosmetic injectables without a specific endorsement. The practice should also carry general liability coverage separately: malpractice covers professional negligence, general liability covers premises incidents and equipment failures, and a med spa needs both.

The Complete California Med Spa Compliance Checklist

Run this summary table before opening, before adding a procedure, and before any complaint-driven inquiry. Each row maps to a section above — and if you'd rather not build the underlying documentation from scratch, our ready-to-use med spa compliance SOPs cover the protocol side of every row here.

Run through this checklist before your first patient, before adding any new procedure, and before any complaint-driven inquiry. If you discover gaps, address them before operating — not after a citation.

This checklist is for informational purposes only and does not constitute legal or medical advice. California compliance requirements are complex, enforced across several boards, and change frequently. Consult a California healthcare attorney to review your specific situation.

Frequently Asked Questions