California: How to Open a Med Spa — Complete Step-by-Step Guide (2026)

Opening a med spa in California is more regulated than almost anywhere else in the US. The state's Corporate Practice of Medicine doctrine, fictitious name and advertising rules, and strict scope of practice rules mean that getting the setup wrong can result in citations before you see your first patient — or even before you open your doors.

This guide walks through every step in the correct order, with the level of detail you'll actually need. Each step includes what it involves, why it matters, common mistakes, and estimated time and cost.

Timeline and Cost Overview

These ranges reflect a single-treatment-room California med spa in a major metro area. Multi-room buildouts, high-cost equipment (e.g., laser platforms), or MSO structures requiring additional legal work push costs higher. Most operators underestimate the timeline by 4–6 weeks — Medical Board processing often runs longer than expected.

Step 1: Determine Your Ownership Structure

Before you file anything, you need a clear answer to: who controls the clinical entity? In California, that must be a licensed physician (MD or DO with an active California license) or — as of January 2026 — a qualifying 104 NP under AB-890. This isn't a detail you can figure out later. Every other step depends on having the right person at the controlling position of your Professional Corporation.

If you are a physician, the path is direct: you form the PC and hold at least 51% controlling interest. If you are a non-physician investor or entrepreneur, you need a physician partner in that role. The physician-owner does not need to perform procedures but must be genuinely involved in medical oversight — not just a name on the documents.

Non-physician investors can participate through a Management Services Organization (MSO) — a separate legal entity that provides non-clinical business services to the PC. The MSO can be owned by anyone, but it cannot control clinical decision-making. This structure requires careful drafting by a California healthcare attorney; a poorly structured MSO is a CPOM violation waiting to happen.

Before moving forward, book a consultation with a California healthcare attorney who specializes in medical practice formation. The cost ($500–$2,000 for an initial consultation and structure review) is one of the best investments you'll make. Getting the structure wrong is far more expensive to fix later than to get right at the start.

For a full breakdown of ownership options, see who can own a California med spa.

Step 2: Form Your Professional Corporation

A California Medical Professional Corporation is formed by filing Articles of Incorporation (Form ARTS-PC) with the California Secretary of State. The $100 filing fee is the easy part — the documents themselves require careful drafting. The entity name must reflect the professional purpose (e.g., "[Physician Name] Medical Corporation" or "[Practice Name] Medical Group, PC"). Generic business names without the medical designation are not acceptable for a medical PC.

Beyond the articles, your formation package should include corporate bylaws (governing how the PC operates, how decisions are made, what happens when a physician-owner loses their license), an initial board resolution (authorizing the bank account, EIN application, and initial officers), and your ownership documentation (stock certificates showing at least 51% physician or qualifying 104 NP control).

Obtain a Federal Employer Identification Number (EIN) from the IRS immediately after formation — you'll need it to open a bank account and begin contracting. Keep the PC's finances completely separate from personal accounts from day one. Commingled funds are a corporate veil problem that can expose the physician-owner to personal liability.

If your structure includes an MSO, the MSO must be formed as a separate entity (usually an LLC) with its own formation documents and bank account. A Management Services Agreement between the MSO and the PC defines what services the MSO provides, at what fee, and with what limitations on clinical authority. This agreement is critical — have a healthcare attorney review it before signing.

Step 3: Recruit and Appoint Your Medical Director

Every California med spa must have a medical director — an MD or DO with an active, unrestricted California license (or a qualifying 104 NP under AB-890). If the physician-owner is also serving as medical director, they still need a written agreement documenting their duties. If a different physician is the medical director, finding and contracting with the right person is typically the most time-consuming part of the entire opening process — start this step earlier than you think you need to.

Where to find a medical director: plastic surgeons and dermatologists (ideal for aesthetic practices but often expensive), primary care or family medicine physicians looking for supplemental income, medical director placement services that specialize in the med spa industry, and professional networks through the American Med Spa Association or similar groups. Expect to interview 5–15 candidates before finding the right fit.

What to look for: a current, unrestricted California license with no Board actions; experience with aesthetic medicine or willingness to learn your specific protocols; genuine availability during your operating hours (not a physician who will be unreachable most of the time); appropriate malpractice coverage that includes med spa work; and a clear understanding that they will be genuinely involved, not just a nominal signatory.

The Medical Director Agreement is the contract that defines this relationship. It must include: the parties and credentials, scope of duties (specific supervision activities, not vague language), supervision structure (how often they'll visit, chart review frequency, availability requirements), compensation (flat monthly retainer or hourly — never a percentage of revenue), malpractice coverage requirements, protocol approval process, and termination provisions. Have a California healthcare attorney draft or review this agreement. For what the agreement must include, see California medical director requirements.

Step 4: Know Which State Approvals Actually Apply

There is no med spa license in California, and no med spa registry or facility registration held by the Medical Board of California. A medical spa is not a separately licensed facility type in this state. Guidance claiming you must file a med spa registration and wait weeks for Board approval before opening — a claim this guide previously repeated — does not reflect California law, and acting on it can delay an opening for no reason.

Nor does your Professional Corporation register with the Medical Board. Corporations Code section 13401(b) expressly provides that a professional corporation rendering services through persons licensed by the Medical Board is not required to obtain a certificate of registration, unlike professional corporations in some other fields. Your entity filing is with the Secretary of State, as covered in Step 2.

What the Medical Board does regulate is the people and the practice: the licenses of everyone delivering care, supervision and delegation, advertising, and the use of a business name. The one Board filing most med spas genuinely need is a fictitious name permit under Business and Professions Code section 2415, required whenever a physician or medical corporation practices under a name other than the physician's own. Section 2285 makes using a fictitious name without that permit unprofessional conduct, and processing runs roughly 4–6 weeks — so it belongs in your timeline even though "med spa registration" does not. Step 9 covers it alongside the advertising rules it interacts with.

One real facility-level obligation can attach depending on your menu: outpatient settings that use anesthesia beyond local anesthesia or minimal sedation fall under California's outpatient setting accreditation requirements. A med spa working with topical or local anesthetic only is generally outside that regime, but if you plan deeper sedation, confirm the accreditation position with counsel before you build. Local business licensing and zoning are separate again and are covered in Step 5. For current Board guidance on med spa arrangements, see mbc.ca.gov — Medical Spas.

Step 5: Obtain Required Licenses and Insurance

Beyond the fictitious name permit, a California med spa needs a local business license from the city or county where it operates. Requirements and fees vary significantly — some municipalities have streamlined processes; others require health department inspections, zoning approvals, and multiple separate filings. Contact your city's business licensing office before you sign a lease; some locations are zoned in ways that create problems for medical facilities.

If you're operating under a name other than the PC's legal name (e.g., "Glow Medical Spa" instead of "Jane Smith Medical Corporation"), you need a fictitious business name (DBA) filing through your county clerk and a fictitious name permit from the Medical Board of California. The Medical Board permit is a separate requirement from the county DBA — both are required.

Malpractice insurance is required for every provider performing clinical procedures. Critical detail: most standard malpractice policies written for primary care or hospital-based practice do not automatically cover aesthetic procedures like Botox injections, laser resurfacing, or body contouring. You must confirm with the insurer that your specific procedures are covered, and request a cosmetic/aesthetic endorsement if needed. Typical annual premiums: $5,000–$15,000 per provider depending on procedure types and claims history.

Step 6: Hire and Credential Your Staff

Every clinical staff member must be credentialed before they perform their first procedure. Credentialing means: verifying their California license is active and unrestricted (check directly at the Board of Registered Nursing website for RNs/NPs, and mbc.ca.gov for MDs/DOs), confirming their scope of practice covers the specific procedures they'll be performing, and keeping copies of their license, malpractice certificate, and any relevant certifications on file.

California's scope of practice rules are strict: RNs can perform injectables with physician supervision and a signed delegation order; LVNs and medical assistants cannot perform injectables under any supervision level. This applies to Botox, fillers, PRP, PRF, skinboosters — any injection. Getting this wrong is the most common reason California med spas receive Medical Board citations.

For each RN who will perform injectables, your medical director must sign a written delegation order before that RN performs their first procedure. The delegation order specifies what the RN is authorized to do, under what supervision conditions, and must be kept current. If your medical director changes, new delegation orders must be issued. See California injectable scope of practice for the complete breakdown by credential type.

Step 7: Write Your Treatment Protocols

Every procedure you offer — from Botox to laser hair removal to body contouring — requires a written Standard Operating Procedure (SOP) reviewed and signed by your medical director. "Protocols" means specific documents, not general clinical training or verbal instructions. The Medical Board treats missing or unsigned protocols as a compliance violation even if the procedures are being performed competently.

What each protocol must cover: patient selection criteria (who is a good candidate, who isn't), contraindications (conditions or medications that rule out the treatment), pre-treatment assessment (what the provider checks before proceeding), procedure steps with specific parameters (product, units/volume, injection sites, device settings), adverse event recognition and response, and follow-up requirements. A protocol that says "provider will use clinical judgment" without specifying parameters is not a compliant protocol.

The medical director must sign each protocol — not just review it. Protocols should be reviewed and re-signed at least annually, and whenever a new procedure is added, a new device is purchased, or a clinical change requires updating the procedure steps. Date all protocols clearly; inspectors look at signature dates and will flag protocols that haven't been reviewed in years.

Writing protocols from scratch is one of the most time-consuming parts of opening a California med spa. Budget 2–4 weeks if you're writing them yourself, plus time for your medical director to review and request revisions. Our Complete Suite provides physician-approved protocol templates for all major procedure categories — starting from templates significantly reduces this timeline.

Step 8: Set Up HIPAA Compliance

Med spas are covered entities under HIPAA, which means the full HIPAA compliance framework applies: Notice of Privacy Practices, Business Associate Agreements, staff training documentation, a breach notification policy, and secure patient record storage. These cannot be completed at the last minute — build HIPAA setup into your opening timeline as a structured task. HIPAA is federal, so this step looks the same wherever you open — it is covered in the same form in our national walkthrough for opening a med spa.

Notice of Privacy Practices must be posted visibly in your reception area and handed to every new patient at their first visit. Business Associate Agreements must be executed with every vendor that handles patient health information — your EHR system, billing service, laboratory, and any cloud storage service used for patient data. Using personal Gmail or a non-HIPAA-compliant cloud storage service for patient records is a violation.

Staff training must be completed and documented before any staff member begins working with patient information. This includes front desk staff who handle intake forms, billing staff who see patient financial records, and clinical staff who create and review patient charts. Keep training records (names, dates, what was covered) permanently — they are audit evidence.

One specific HIPAA issue common in med spas: patient photos. Before/after photos are a standard marketing tool in this industry, but using any patient's photo without a specific, separate written authorization for marketing use is a HIPAA violation. A general consent for treatment does not cover marketing use. Create a standalone photo authorization form and get it signed before taking any photos you intend to use in marketing.

Step 9: Ensure Advertising Compliance Before Launch

California requires that all advertising for a medical practice include the supervising physician's name or, if operating under a business name, a fictitious name permit number issued by the Medical Board. "All advertising" means your website, Instagram profile, Facebook page, Google Business Profile, email newsletters, business cards, exterior signage, and any other promotional material. This is not optional and it applies from the first post you make before you even open.

If you're operating under a business name like "Pacific Glow Med Spa," you need two things: a county fictitious business name (DBA) registration, and a fictitious name permit from the Medical Board of California. The Medical Board permit specifically authorizes you to advertise under the business name and must be in place before you advertise. Without it, your advertising — even a placeholder website — is technically non-compliant.

Before your website or social media goes live, review all content for California advertising rules: no unsubstantiated claims ("guaranteed results," "pain-free," "risk-free"), before/after photos must include "results may vary" disclaimers, testimonials cannot include medical claims the practice cannot substantiate, and pricing promotions must comply with California's prohibition on certain types of fee-splitting arrangements. See California advertising rules for the complete breakdown.

Step 10: Pre-Opening Compliance Check

Before your first patient walks in — before your soft opening, before any public announcement of your opening date — do a full compliance review against the California med spa compliance checklist. Not a mental walkthrough: a documented check where each item is verified and evidence is collected.

The items that most commonly fail a pre-opening review: advertising materials are live before the fictitious name permit was issued (the most common one), the medical director agreement is signed but unsigned delegation orders mean RNs can't legally inject, or one or more protocols haven't received the medical director's signature.

If you discover a gap, fix it before opening — not after. A citation received before you've treated a single patient is still a citation. More importantly, the risks that compliance requirements are designed to prevent — patient harm, liability, Board enforcement — don't disappear because you're new. Your compliance obligation starts when you start seeing patients, not when you feel ready.

See the California Med Spa Compliance Checklist for the complete pre-opening verification list.

Common Opening Mistakes That Lead to Citations

Forming an LLC Instead of a Professional Corporation

The single most common structural error — and the most serious. Operators choose an LLC because it's faster to form, cheaper to set up, and more familiar. But California's CPOM doctrine is explicit: an LLC cannot deliver medical services. Even if you correct this before opening, you've wasted the formation cost and need to start over with a PC.

Starting Without a Signed Medical Director Agreement

The physician is "on board" and has agreed to serve as medical director — but the contract hasn't been signed yet. Starting operations without a signed agreement means every procedure performed is without the required physician oversight documentation. If a complaint is filed during this window, there's no agreement to show that oversight existed.

Advertising Before the Fictitious Name Permit Is Issued

The permit application went in and the operator assumes silence means approval, so the website and Instagram profile go live under the business name. A fictitious name permit is not deemed issued by silence, and advertising under a business name without one is unprofessional conduct under Business and Professions Code section 2285 — even for a placeholder page before opening.

Relying on Verbal Protocol Approval

The medical director reviewed the protocols verbally and "approved" them in conversation. Verbal approval doesn't satisfy the California requirement. Protocols need the medical director's written signature and date on each document before the first patient is treated.

Allowing LVNs or MAs to Inject Because "The Doctor Is Here"

A physician is on-site, so operators assume that means all staff can perform injections under supervision. California law is explicit: LVNs and medical assistants cannot perform injectables under any supervision level. Physical presence does not change this. This is the most commonly cited scope of practice violation in California med spa inspections.

Summary: Opening a California Med Spa in Plain Terms

• You need a Professional Corporation — not an LLC — controlled by an MD, DO, or qualifying 104 NP
• There is no med spa license or Medical Board med spa registration in California; the Board filing most operators need is a fictitious name permit, roughly 4–6 weeks
• Your medical director must be real: licensed in California, under a written agreement, genuinely available
• Staff must be credentialed for the specific procedures they perform — LVNs and MAs cannot inject under any supervision
• Written physician-approved protocols are required for every procedure before the first patient is treated
• HIPAA compliance and California advertising rules apply from day one of any public presence
• Plan 3–6 months from decision to first patient, and $150,000–$400,000+ for a single-room med spa

This guide is for informational purposes only and does not constitute legal or medical advice. California med spa regulations are complex and change over time. Consult a California healthcare attorney before proceeding with formation and registration.

Frequently Asked Questions