California Med Spa Regulatory Changes 2026: AB 1415, SB 351 & PSO Requirements

2026 is the most consequential year for California med spa regulation since AB 890 expanded nurse practitioner practice authority in 2023. Three changes — two signed bills and one cumulative enforcement shift — converge on the same business model that most California med spas operate under: the friendly-PC + MSO structure with delegated clinical care to RNs and NPs under standing orders. Each change, individually, would require operational adjustments. Together, they require a structural review of how the practice is owned, how it contracts with administrative services providers, and how every patient encounter is clinically authorized.

This guide covers what each change actually requires, what's still permissible, what enforcement looks like in 2026, and the concrete steps to bring an existing California med spa into compliance before the Medical Board, the Office of Health Care Affordability, or the Attorney General's office gets involved.

The Three 2026 California Changes Every Med Spa Owner Must Understand

The three changes are not technically related — different bills, different agencies, different effective triggers. But they land on the same operational footprint, and most med spas affected by one are affected by all three.

SB 351 — Corporate Practice of Medicine for Private Equity

Signed by Governor Newsom on October 6, 2025; effective January 1, 2026. SB 351 codifies and extends California's existing CPOM doctrine to specifically restrict how private equity firms, hedge funds, and the MSOs they control can interact with physician-owned professional corporations. It also voids most non-compete and non-disparagement clauses in management services agreements between such entities and clinical practices. The California Attorney General is the primary enforcement authority, with power to seek injunctive relief and recover attorneys' fees. Coverage from Epstein Becker Green and the American Med Spa Association both flag this as the year's most consequential change.

AB 1415 — 90-Day OHCA Notice for Med Spa Transactions

Effective January 1, 2026. AB 1415 expands the universe of healthcare transactions that trigger pre-transaction notice to California's Office of Health Care Affordability (OHCA). Health care entities, MSOs, and certain "noticing entities" must now provide written notice at least 90 days before entering into a material transaction — including asset sales, changes of control, governance transfers, and certain new management agreements. The Hooper Lundy & Bookman analysis of AB 1415's notice mechanics walks through the practical filing requirements; Alston & Bird's review of how the new rules affect PE deals covers the broader investor-side implications.

The Patient-Specific Order Shift

Unlike SB 351 and AB 1415, this is not a single bill. It is a cumulative enforcement position taken by the Medical Board of California, the Board of Registered Nursing, and the Physician Assistant Board over 2024–2026, formalized in audit findings and disciplinary actions. The position: generic standing orders covering all patients at a facility are no longer an adequate basis for delegated treatment. Every patient must have a documented Patient-Specific Order (PSO) generated after a Good Faith Exam by a physician, NP, or PA before any RN or other delegated provider treats them. The Medical Board's Medical Spas resource page is the primary touchpoint for the Board's evolving expectations.

SB 351: California's Strengthened Corporate Practice of Medicine Doctrine

California's Corporate Practice of Medicine doctrine has restricted non-physician ownership and control of medical practices for decades. The principle is simple: only licensed physicians can practice medicine, only physician-owned professional corporations can deliver it as a business, and lay (non-physician) entities cannot interfere with clinical decision-making. The friendly-PC + MSO structure has been the standard workaround — the PC is the clinical employer; the MSO is the lay-owned administrative entity that handles everything non-clinical.

SB 351 doesn't eliminate this structure. It tightens the lines. Specifically targeting private equity and hedge fund involvement in healthcare, SB 351 spells out what the MSO can and cannot do — closing gray areas that PE-backed med spa platforms had been operating in for years.

What SB 351 Prohibits MSOs From Doing

Under SB 351, an MSO controlled by a private equity group or hedge fund — and arguably any MSO — may not:

• Make billing or coding decisions tied to clinical judgment. Setting up the billing system is fine; deciding which CPT code a particular patient's treatment should be billed under is a clinical decision reserved for the physician.
• Participate in equipment selection for clinical purposes. The MSO can negotiate vendor contracts; it cannot decide which laser the PC will use for treatment.
• Hire, fire, or supervise clinical personnel — including allied health professionals and medical assistants — when those decisions relate to clinical competency or patient care standards. Lay-side HR decisions are fine; firing an RN for not following a clinical protocol is not.
• Exercise control over patient care decisions. The clinical entity must retain authority over diagnosis, treatment selection, treatment refusal, and care escalation.

What SB 351 Permits

SB 351 does not invalidate the friendly-PC + MSO structure. It does not prohibit private equity from investing in med spa platforms. It does not eliminate MSAs. It permits MSOs to:

• Provide administrative services (HR for non-clinical staff, marketing, IT, real estate, accounting, payroll, billing operations after clinical coding decisions are made)
• Receive a fair-market-value management fee for those services
• Own facility assets, lease space, hold vendor contracts
• Make business and operational decisions that don't bear on clinical judgment

The bright line is clinical control. As long as the physician-owned PC retains genuine authority over how medicine is practiced, the structure remains compliant. When the MSO crosses into clinical territory — even informally — SB 351 exposure attaches.

The Attorney General as Primary Enforcer

SB 351 gives the California Attorney General specific enforcement authority: injunctive relief to stop prohibited conduct, and recovery of attorneys' fees from violators. There is no fixed dollar penalty in the bill itself, but the AG's office has signaled active interest in private equity rollups in healthcare, and SB 351 hands it the statutory hook to pursue arrangements that previously operated in CPOM gray areas. Collateral consequences — Medical Board action against the physician owner for ceding clinical control, licensing exposure for the facility — multiply the effective penalty.

What SB 351 Means for the Friendly-PC / MSO Med Spa Structure

The friendly-PC + MSO model is how most non-physician-led California med spas legally operate. A licensed physician owns 51% or more of a California professional medical corporation (per Cal. Corp. Code §13401.5(a)); the PC employs the providers and delivers clinical services; a separately-owned MSO — often owned by the operator who actually runs the business — provides administrative services under a Management Services Agreement.

SB 351 doesn't kill this structure. It does require a careful audit of how the MSA is written and how decisions are actually made in practice. Three areas need attention before any 2026 audit.

The Management Services Agreement Itself

Most pre-2026 MSAs were drafted broadly, giving the MSO sweeping authority over operations, equipment, vendor selection, billing, and personnel. Post-SB 351, that breadth is a liability. The MSA needs to be reviewed and rewritten to:

• Carve out clinical decisions, equipment selection for clinical use, billing/coding decisions tied to clinical judgment, and clinical personnel decisions — reserve all of these to the PC
• Replace blanket "operational control" language with specific enumerated administrative services
• Remove non-compete and non-disparagement clauses that don't fit the narrow sale-of-business exception
• Document a fair-market-value management fee with reference to comparable arrangements

How the Practice Actually Operates

Paper compliance is not enough. SB 351 enforcement will look at how decisions are actually made — not just what the MSA says. Common pre-2026 patterns that create post-2026 exposure:

• MSO leadership directing the physician owner on which providers to hire
• MSO selecting the laser, injectable, or IV product the PC uses clinically
• MSO setting clinical protocols or treatment menus without physician input
• MSO firing an RN or NP for clinical performance issues
• MSO-led decisions on patient acceptance or refusal

Each of these patterns is a potential SB 351 violation regardless of what the written MSA says. Operationally separating clinical from administrative — and documenting that separation in board minutes, decision logs, and standing protocols — is the work to do in 2026.

The Physician Owner's Role

The physician who serves as the PC's owner-of-record must actually function as a clinical decision-maker. A 51% owner who never reviews anything, never makes a clinical decision, and never overrides MSO recommendations is exactly the arrangement SB 351 was designed to flag. Real clinical involvement — documented chart review, protocol approval, hiring authority for clinical staff, treatment menu approval — is the protection. For more on what real medical director involvement looks like, see our California medical director requirements guide and our broader medical director liability analysis.

AB 1415: 90-Day OHCA Pre-Transaction Notice for Med Spa Deals

The Office of Health Care Affordability (OHCA), created in 2022 to monitor healthcare spending and consolidation, has had pre-transaction notice authority for large hospital and health-system deals for several years. AB 1415 expands that authority dramatically — pulling MSOs, "noticing entities," and many smaller transactions into the notice net for the first time.

What Triggers the 90-Day Notice

Under AB 1415, a noticing entity, MSO, or health care entity must give OHCA at least 90 days written notice before entering into an agreement or transaction that either:

• Disposes of a material amount of assets or operations — sells, transfers, leases, exchanges, options, encumbers, conveys, or otherwise disposes of a material amount of the health care entity's or MSO's assets to one or more entities
• Transfers control, responsibility, or governance of a material amount of assets or operations to one or more entities

"Material" is the key term, and the Health Care Affordability Board has authority to set thresholds, exemptions, and definitions. As of mid-2026 the regulatory specifics are still being refined, but the practical guidance is straightforward: any med spa transaction that involves a sale, an acquisition, a change of ownership, a new MSO relationship, or a material amendment to an existing MSO relationship should be treated as a potential triggering event until counsel confirms otherwise.

Transactions That Likely Trigger Notice

• Sale of a med spa's assets to a strategic or financial buyer
• Acquisition of a med spa by an existing platform or rollup
• Change of ownership in the professional corporation
• New management services agreement between a med spa and an MSO
• Material amendment to an existing MSA (including those required by SB 351)
• Conversion from a sole-physician practice to a friendly-PC + MSO structure
• Joint ventures or platform combinations

Transactions Generally Outside the Trigger

• Internal reorganization within a single ownership group
• Adding a new physician shareholder to an existing PC
• Routine real estate leases or vendor contracts unrelated to clinical control transfer
• Hiring a new medical director (where the MD role is employee/contractor, not ownership transfer)

What the Notice Requires

The 90-day notice gives OHCA the opportunity to review the transaction for impact on cost, access, quality, and equity. The agency does not approve or deny transactions in the way an antitrust regulator might — it reviews and may publish findings or refer matters to other regulators. The practical effect: a 90-day window before a deal can close, and a public-facing process that surfaces transaction details that previously stayed confidential.

Practical Planning Implications

Any med spa contemplating a sale, acquisition, or material MSO restructuring in 2026 needs to build the 90-day notice into the deal timeline. A signed LOI that contemplates closing in 60 days will not work if the transaction triggers notice. Get the notice analysis done early; build the timeline around it; do not let a buyer's closing demand force a non-compliant timeline.

Patient-Specific Orders (PSOs): The End of Generic Standing Orders

For years, the standard California med spa model worked like this: the medical director signed a standing order authorizing the facility's RNs to perform Botox, fillers, IV therapy, and laser treatments on any patient who met defined criteria. The patient came in, an esthetician or RN intake'd them, and the RN delivered treatment under the standing order — with the physician available by phone if needed. That model is dead.

What the Medical Board Now Expects

The Medical Board of California, the BRN, and the PA Board have collectively shifted their enforcement position over 2024–2026. The current standard:

• Every patient must have a documented Good Faith Exam performed by an MD, DO, NP, or PA before any treatment. The GFE includes review of medical history, contraindication screening, examination of treatment areas, and clinical decision that the treatment is appropriate for this specific patient.
• The GFE must result in a Patient-Specific Order (PSO) — an individualized written authorization, signed by the prescribing provider, naming the patient and specifying the treatment(s) authorized.
• The PSO must reflect the patient's history, presentation, and clinical needs — not be a copy-paste of generic terms applied to all patients.
• Only after a valid PSO is in the chart can the RN or other delegated provider treat the patient.

Standing orders may still exist in the practice's protocol library as general clinical guidelines, but they no longer authorize treatment on their own. The PSO is the legal authority for any individual patient encounter.

What Treatments the PSO Standard Applies To

• Injectables — Botox, Dysport, Xeomin, Daxxify, dermal fillers, Sculptra, Radiesse
• Laser and energy-based treatments — laser hair removal, IPL, RF microneedling, skin resurfacing
• IV therapy — vitamin infusions, hydration, NAD+, customized formulations
• Wellness injections — B12, glutathione, lipotropic injections
• Weight loss medications — GLP-1s, compounded semaglutide, tirzepatide. For California-specific GLP-1 nuances, the same PSO requirement layers on top of standard controlled medication compliance covered in our national GLP-1 compliance guide.
• Any other treatment requiring a prescription, prescription device, or invasive technique

The Telehealth GFE Question

Telehealth Good Faith Exams remain permissible in California, provided the examining provider has California licensure and the exam meets the same clinical standard as an in-person evaluation. The PSO requirement does not change based on whether the GFE was conducted in-person or by telehealth. What matters is that a qualifying provider conducted an actual clinical evaluation and generated a patient-specific order before treatment.

How to Convert Your Standing-Order Protocols to PSOs

For an existing California med spa operating under standing orders, the transition to a PSO-based model is procedural. The clinical content does not need to change; the documentation flow does. Five steps cover the conversion.

1. Document the GFE Workflow

Write a clear SOP defining who conducts the Good Faith Exam, what the exam covers, where it is documented, and how it links to the PSO. For most California med spas, the GFE is conducted by the medical director, an NP, or a PA — either in person or via telehealth. The SOP should specify GFE content (history, medications, allergies, prior treatments, examination findings) and require that every patient's chart contain a documented GFE before treatment.

2. Create PSO Templates by Treatment Category

Build PSO templates for each major treatment category — neuromodulators, fillers, laser hair removal, IV therapy, GLP-1, etc. Each template should require the prescribing provider to fill in patient identifier, specific treatment authorized, dose or parameters, frequency or duration, and any patient-specific notes. Generic copy-paste templates that don't vary by patient defeat the purpose; the PSO must reflect actual clinical decision-making for that patient.

3. Update the Chart Workflow

The patient encounter flow needs to enforce the GFE → PSO → Treatment sequence. New patient intake should not allow an RN to schedule treatment without a documented GFE and signed PSO in the chart. EHR systems should be configured with hard stops; paper charts should use printed checklists that the RN must complete before proceeding.

4. Retrain Clinical Staff

Every RN, NP, PA, and esthetician at the facility needs to understand the new workflow. The key shift: the standing order no longer authorizes treatment on its own. Treatment authority now comes from the patient's individual PSO. Training should be documented, signed by each staff member, and retained in the personnel file.

5. Audit the Conversion

Have the medical director audit a sample of recent patient charts at least monthly for the first six months to verify that every treatment is preceded by a valid GFE and PSO. Document the audits. When an audit identifies missing documentation, correct the workflow before the next Medical Board inspection identifies the same gap. For broader SOP infrastructure that supports the GFE/PSO workflow, see our complete guide to med spa policy and procedure manuals.

Non-Compete Clauses in California Med Spa MSAs After SB 351

Non-compete clauses in California have long been the exception rather than the rule — Business and Professions Code §16600 has voided most employee non-competes for decades. SB 351 closes one of the last remaining workarounds: non-compete provisions embedded in management services agreements between PE/hedge-fund-backed MSOs and the professional corporations they manage.

What's Now Void

• Provider non-competes embedded in MSAs that restrict where a physician, NP, PA, or RN can practice after leaving the PC
• Geographic restrictions imposed by the MSO on PC providers
• Non-solicitation clauses as applied to other providers leaving the practice (patient non-solicitation remains a closer call and depends on factual specifics)
• Non-disparagement clauses in many MSA contexts — narrowly limited under SB 351

What's Still Enforceable

• Sale-of-business non-competes under §16601 — where a person sells their ownership interest in a business, a non-compete tied to the sale remains enforceable in California for a reasonable scope and duration
• Confidentiality and trade secret protections — these are not non-competes and are not affected by SB 351
• Non-competes during the term of employment — restrictions on simultaneously working for a competitor while still employed remain enforceable

What This Means for Existing Agreements

An MSA signed before January 1, 2026 that contains a provider non-compete is not retroactively voided — but enforcement of that non-compete after January 1, 2026 runs straight into SB 351. Practically, courts post-SB 351 will not enforce these clauses going forward. Any med spa relying on a non-compete to retain key clinical talent should treat that protection as gone and rebuild the retention strategy around compensation, equity, and culture rather than legal restriction.

Enforcement Landscape: Who's Actually Pursuing Violations in 2026

California's 2026 enforcement environment for med spas is the most active in the country. Four agencies are involved, each with overlapping but distinct authority.

The Medical Board of California (MBC)

The Medical Board enforces against physicians for inadequate supervision, sham medical director arrangements, ceding clinical control to non-physicians, and inadequate Good Faith Exams. In 2024–2026 the MBC has been particularly active against PSO violations — where treatment was administered to patients without a documented Good Faith Exam — and against medical directors who function nominally rather than substantively. Disciplinary outcomes range from reprimands to license suspension or revocation.

The Board of Registered Nursing (BRN)

The BRN enforces against RNs who treat patients without proper delegated authority — which now means without a valid PSO. An RN who performs Botox under an old standing order without a documented GFE and PSO for that patient is exposed to BRN discipline regardless of what the medical director's protocols say. The standard cited in BRN audits: every treatment requires individualized authorization.

The Physician Assistant Board

The PA Board enforces against PAs operating outside their delegated scope or under arrangements that don't conform to current supervision standards. PA-led GFEs are permitted but must meet the same clinical standard required of physician-led exams.

The California Attorney General

The AG is the primary enforcement authority for SB 351 violations and a frequent participant in AB 1415 reviews when transactions raise consolidation or PE-control concerns. The AG also enforces broader CPOM, fee-splitting, and unauthorized-practice rules — particularly against rollup platforms and out-of-state operators establishing California footprints.

The Office of Health Care Affordability (OHCA)

OHCA is the agency that receives AB 1415 transaction notices and reviews them for cost, access, quality, and equity impact. OHCA does not directly fine or discipline, but its reviews can refer matters to other regulators or generate public findings that affect a transaction's viability.

The Realistic Threat Model in 2026

A California med spa that has not reviewed its MSO arrangement, its non-compete clauses, or its standing-order-to-PSO conversion by mid-2026 should expect to be exposed in any inspection or complaint-driven audit. The agencies talk to each other; a complaint to one often results in document requests from another. The cost of proactive cleanup is much lower than the cost of being on the receiving end of an inspection finding.

The Compliance Checklist for California Med Spas Before Any Inspection

Concrete items to verify, in priority order, before the next Medical Board audit or transaction review.

MSO Structure and Documentation

1. Review the existing MSA against SB 351's prohibitions; rewrite clinical-control language and remove voided non-competes
2. Confirm the PC is at least 51% owned by a California-licensed physician (Cal. Corp. Code §13401.5(a))
3. Document a fair-market-value management fee with reference to comparable arrangements
4. Confirm the PC retains authority over clinical decisions, equipment selection for clinical use, and clinical personnel decisions
5. Maintain board minutes or decision logs showing the PC making clinical decisions, not the MSO

Patient-Specific Order Workflow

1. Confirm every active patient chart contains a documented Good Faith Exam by an MD, DO, NP, or PA
2. Confirm every patient encounter is preceded by an individualized Patient-Specific Order in the chart
3. Audit a sample of recent charts monthly; document audit findings; correct workflow gaps
4. Update standing-order documents to indicate they are general protocols, not patient-specific authorizations

Transaction Readiness

1. Identify any contemplated 2026 transaction (sale, acquisition, MSO restructure) and assess AB 1415 notice triggers
2. Build the 90-day OHCA notice into any transaction timeline
3. Document materiality analysis for any transaction below presumed threshold

Provider Credentials and Scope

1. Verify current California licensure for every clinical staff member; document verification
2. Confirm AB 890 NPs operating as medical directors meet the 104 NP requirements; see our AB 890 NP guide for the details
3. Confirm each provider's scope matches the procedures they are performing; see our California injectable scope of practice guide for the breakdown

Adjacent Compliance Items

1. Review the full California compliance checklist for any items not addressed above
2. Confirm ownership structure compliance per California med spa ownership rules
3. If launching, review our California med spa launch guide

What Multi-State Operators Need to Know About the California Model

For operators running med spas in multiple states, California's 2026 changes don't directly affect operations elsewhere — but the trend they represent does. Three observations:

CPOM Tightening Is a National Trend

California is the most aggressive state on CPOM enforcement, but other states (Texas, New York, Massachusetts, Illinois) have been incrementally tightening their own doctrines and are watching California's SB 351 closely. Operators with PE-backed structures in multiple states should not assume California is an outlier — the model that complies with SB 351 is the model most likely to remain compliant nationally over a 3–5 year horizon. For a state-by-state regulatory overview, see our med spa regulations by state pillar.

The PSO Model Is the Future of Delegated Care

California's shift from generic standing orders to Patient-Specific Orders is the strictest version of an enforcement trend appearing in multiple states. The clinical and documentation infrastructure that supports a PSO model — a real GFE for every patient, individualized written authorization, RN treatment only after PSO is in the chart — is closer to the standard of care most states will gravitate toward. Building it now means less rebuilding later.

Transaction Notice Regimes Are Spreading

California's OHCA notice regime under AB 1415 is the most expansive in the country, but Oregon, Washington, Massachusetts, and several other states have similar healthcare transaction review frameworks at various stages of development. Multi-state platforms should expect that what triggers notice in California today may trigger similar notice in other states within the next 24–36 months.

Summary

1. Three California laws hit the med spa industry in 2026: SB 351 (CPOM/PE), AB 1415 (OHCA notice), and the PSO enforcement shift
2. SB 351 codifies CPOM specifically against PE/hedge-fund involvement, bars MSO clinical control, and voids most provider non-compete clauses in MSAs — effective January 1, 2026
3. AB 1415 requires 90-day OHCA pre-transaction notice for material med spa transactions including sales, acquisitions, and material MSO restructurings — effective January 1, 2026
4. Patient-Specific Orders have replaced generic standing orders as the Medical Board's enforcement standard; every patient needs a documented Good Faith Exam and individualized PSO before treatment
5. The friendly-PC + MSO structure remains legal but requires MSA rewrites and operational separation between clinical and administrative decision-making
6. Non-compete clauses in MSAs are largely void going forward; sale-of-business non-competes remain enforceable
7. The California Attorney General is the primary SB 351 enforcer; the Medical Board, BRN, PA Board, and OHCA all have overlapping authority
8. Existing MSAs and standing-order protocols need targeted rewrites; existing PCs need to demonstrate genuine clinical decision-making by the physician owner

Disclaimer: This article is for educational purposes only and does not constitute legal advice. SB 351, AB 1415, and Medical Board enforcement positions involve complex regulatory considerations specific to your practice structure, ownership, and procedure mix. Consult California healthcare counsel before restructuring an MSO arrangement, contemplating a material transaction, or modifying clinical-order workflows.