How to Open a Med Spa in California: Complete Step-by-Step Guide (2026)

Opening a med spa in California is more regulated than almost anywhere else in the US. The state's Corporate Practice of Medicine doctrine, Medical Board registration requirements, and strict scope of practice rules mean that getting the setup wrong can result in citations before you see your first patient — or even before you open your doors.

This guide walks through every step in the correct order, with the level of detail you'll actually need. Each step includes what it involves, why it matters, common mistakes, and estimated time and cost.

Timeline and Cost Overview

These ranges reflect a single-treatment-room California med spa in a major metro area. Multi-room buildouts, high-cost equipment (e.g., laser platforms), or MSO structures requiring additional legal work push costs higher. Most operators underestimate the timeline by 4–6 weeks — Medical Board processing often runs longer than expected.

Step 1: Determine Your Ownership Structure

Before you file anything, you need a clear answer to: who controls the clinical entity? In California, that must be a licensed physician (MD or DO with an active California license) or — as of January 2026 — a qualifying 104 NP under AB-890. This isn't a detail you can figure out later. Every other step depends on having the right person at the controlling position of your Professional Corporation.

If you are a physician, the path is direct: you form the PC and hold at least 51% controlling interest. If you are a non-physician investor or entrepreneur, you need a physician partner in that role. The physician-owner does not need to perform procedures but must be genuinely involved in medical oversight — not just a name on the documents.

Non-physician investors can participate through a Management Services Organization (MSO) — a separate legal entity that provides non-clinical business services to the PC. The MSO can be owned by anyone, but it cannot control clinical decision-making. This structure requires careful drafting by a California healthcare attorney; a poorly structured MSO is a CPOM violation waiting to happen.

Before moving forward, book a consultation with a California healthcare attorney who specializes in medical practice formation. The cost ($500–$2,000 for an initial consultation and structure review) is one of the best investments you'll make. Getting the structure wrong is far more expensive to fix later than to get right at the start.

For a full breakdown of ownership options, see who can own a California med spa.

Step 2: Form Your Professional Corporation

A California Medical Professional Corporation is formed by filing Articles of Incorporation (Form ARTS-PC) with the California Secretary of State. The $100 filing fee is the easy part — the documents themselves require careful drafting. The entity name must reflect the professional purpose (e.g., "[Physician Name] Medical Corporation" or "[Practice Name] Medical Group, PC"). Generic business names without the medical designation are not acceptable for a medical PC.

Beyond the articles, your formation package should include corporate bylaws (governing how the PC operates, how decisions are made, what happens when a physician-owner loses their license), an initial board resolution (authorizing the bank account, EIN application, and initial officers), and your ownership documentation (stock certificates showing at least 51% physician or qualifying 104 NP control).

Obtain a Federal Employer Identification Number (EIN) from the IRS immediately after formation — you'll need it to open a bank account and begin contracting. Keep the PC's finances completely separate from personal accounts from day one. Commingled funds are a corporate veil problem that can expose the physician-owner to personal liability.

If your structure includes an MSO, the MSO must be formed as a separate entity (usually an LLC) with its own formation documents and bank account. A Management Services Agreement between the MSO and the PC defines what services the MSO provides, at what fee, and with what limitations on clinical authority. This agreement is critical — have a healthcare attorney review it before signing.

Step 3: Recruit and Appoint Your Medical Director

Every California med spa must have a medical director — an MD or DO with an active, unrestricted California license (or a qualifying 104 NP under AB-890). If the physician-owner is also serving as medical director, they still need a written agreement documenting their duties. If a different physician is the medical director, finding and contracting with the right person is typically the most time-consuming part of the entire opening process — start this step earlier than you think you need to.

Where to find a medical director: plastic surgeons and dermatologists (ideal for aesthetic practices but often expensive), primary care or family medicine physicians looking for supplemental income, medical director placement services that specialize in the med spa industry, and professional networks through the American Med Spa Association or similar groups. Expect to interview 5–15 candidates before finding the right fit.

What to look for: a current, unrestricted California license with no Board actions; experience with aesthetic medicine or willingness to learn your specific protocols; genuine availability during your operating hours (not a physician who will be unreachable most of the time); appropriate malpractice coverage that includes med spa work; and a clear understanding that they will be genuinely involved, not just a nominal signatory.

The Medical Director Agreement is the contract that defines this relationship. It must include: the parties and credentials, scope of duties (specific supervision activities, not vague language), supervision structure (how often they'll visit, chart review frequency, availability requirements), compensation (flat monthly retainer or hourly — never a percentage of revenue), malpractice coverage requirements, protocol approval process, and termination provisions. Have a California healthcare attorney draft or review this agreement. For what the agreement must include, see California medical director requirements.

Step 4: Register with the Medical Board of California

All medical spas in California must register with the Medical Board of California before operating. This is a hard legal requirement — not a best practice or a recommendation. Operating as a medical spa without Medical Board registration is a violation that can result in immediate closure and disciplinary action against licensed providers.

The registration process requires: your Professional Corporation's formation documents, medical director name and California license number, a list of all procedures you plan to offer, documentation of your ownership structure, and information about your facility. The Medical Board may conduct an inspection of the facility as part of the approval process.

Processing typically takes 4–8 weeks from the time you submit a complete application. Incomplete applications reset the clock — make sure your submission package is complete before submitting. Build this timeline into your opening plan; most operators discover it takes longer than expected and are forced to delay their opening date.

Check current registration instructions and forms at mbc.ca.gov — Medical Spas. If requirements have been updated since this guide was published, the Board's current guidance takes precedence.

Step 5: Obtain Required Licenses and Insurance

Beyond Medical Board registration, a California med spa needs a local business license from the city or county where it operates. Requirements and fees vary significantly — some municipalities have streamlined processes; others require health department inspections, zoning approvals, and multiple separate filings. Contact your city's business licensing office before you sign a lease; some locations are zoned in ways that create problems for medical facilities.

If you're operating under a name other than the PC's legal name (e.g., "Glow Medical Spa" instead of "Jane Smith Medical Corporation"), you need a fictitious business name (DBA) filing through your county clerk and a fictitious name permit from the Medical Board of California. The Medical Board permit is a separate requirement from the county DBA — both are required.

Malpractice insurance is required for every provider performing clinical procedures. Critical detail: most standard malpractice policies written for primary care or hospital-based practice do not automatically cover aesthetic procedures like Botox injections, laser resurfacing, or body contouring. You must confirm with the insurer that your specific procedures are covered, and request a cosmetic/aesthetic endorsement if needed. Typical annual premiums: $5,000–$15,000 per provider depending on procedure types and claims history.

Step 6: Hire and Credential Your Staff

Every clinical staff member must be credentialed before they perform their first procedure. Credentialing means: verifying their California license is active and unrestricted (check directly at the Board of Registered Nursing website for RNs/NPs, and mbc.ca.gov for MDs/DOs), confirming their scope of practice covers the specific procedures they'll be performing, and keeping copies of their license, malpractice certificate, and any relevant certifications on file.

California's scope of practice rules are strict: RNs can perform injectables with physician supervision and a signed delegation order; LVNs and medical assistants cannot perform injectables under any supervision level. This applies to Botox, fillers, PRP, PRF, skinboosters — any injection. Getting this wrong is the most common reason California med spas receive Medical Board citations.

For each RN who will perform injectables, your medical director must sign a written delegation order before that RN performs their first procedure. The delegation order specifies what the RN is authorized to do, under what supervision conditions, and must be kept current. If your medical director changes, new delegation orders must be issued. See California injectable scope of practice for the complete breakdown by credential type.

Step 7: Write Your Treatment Protocols

Every procedure you offer — from Botox to laser hair removal to body contouring — requires a written Standard Operating Procedure (SOP) reviewed and signed by your medical director. "Protocols" means specific documents, not general clinical training or verbal instructions. The Medical Board treats missing or unsigned protocols as a compliance violation even if the procedures are being performed competently.

What each protocol must cover: patient selection criteria (who is a good candidate, who isn't), contraindications (conditions or medications that rule out the treatment), pre-treatment assessment (what the provider checks before proceeding), procedure steps with specific parameters (product, units/volume, injection sites, device settings), adverse event recognition and response, and follow-up requirements. A protocol that says "provider will use clinical judgment" without specifying parameters is not a compliant protocol.

The medical director must sign each protocol — not just review it. Protocols should be reviewed and re-signed at least annually, and whenever a new procedure is added, a new device is purchased, or a clinical change requires updating the procedure steps. Date all protocols clearly; inspectors look at signature dates and will flag protocols that haven't been reviewed in years.

Writing protocols from scratch is one of the most time-consuming parts of opening a California med spa. Budget 2–4 weeks if you're writing them yourself, plus time for your medical director to review and request revisions. Our Complete Suite provides physician-approved protocol templates for all major procedure categories — starting from templates significantly reduces this timeline.

Step 8: Set Up HIPAA Compliance

Med spas are covered entities under HIPAA, which means the full HIPAA compliance framework applies: Notice of Privacy Practices, Business Associate Agreements, staff training documentation, a breach notification policy, and secure patient record storage. These cannot be completed at the last minute — build HIPAA setup into your opening timeline as a structured task.

Notice of Privacy Practices must be posted visibly in your reception area and handed to every new patient at their first visit. Business Associate Agreements must be executed with every vendor that handles patient health information — your EHR system, billing service, laboratory, and any cloud storage service used for patient data. Using personal Gmail or a non-HIPAA-compliant cloud storage service for patient records is a violation.

Staff training must be completed and documented before any staff member begins working with patient information. This includes front desk staff who handle intake forms, billing staff who see patient financial records, and clinical staff who create and review patient charts. Keep training records (names, dates, what was covered) permanently — they are audit evidence.

One specific HIPAA issue common in med spas: patient photos. Before/after photos are a standard marketing tool in this industry, but using any patient's photo without a specific, separate written authorization for marketing use is a HIPAA violation. A general consent for treatment does not cover marketing use. Create a standalone photo authorization form and get it signed before taking any photos you intend to use in marketing.

Step 9: Ensure Advertising Compliance Before Launch

California requires that all advertising for a medical practice include the supervising physician's name or, if operating under a business name, a fictitious name permit number issued by the Medical Board. "All advertising" means your website, Instagram profile, Facebook page, Google Business Profile, email newsletters, business cards, exterior signage, and any other promotional material. This is not optional and it applies from the first post you make before you even open.

If you're operating under a business name like "Pacific Glow Med Spa," you need two things: a county fictitious business name (DBA) registration, and a fictitious name permit from the Medical Board of California. The Medical Board permit specifically authorizes you to advertise under the business name and must be in place before you advertise. Without it, your advertising — even a placeholder website — is technically non-compliant.

Before your website or social media goes live, review all content for California advertising rules: no unsubstantiated claims ("guaranteed results," "pain-free," "risk-free"), before/after photos must include "results may vary" disclaimers, testimonials cannot include medical claims the practice cannot substantiate, and pricing promotions must comply with California's prohibition on certain types of fee-splitting arrangements. See California advertising rules for the complete breakdown.

Step 10: Pre-Opening Compliance Check

Before your first patient walks in — before your soft opening, before any public announcement of your opening date — do a full compliance review against the California med spa compliance checklist. Not a mental walkthrough: a documented check where each item is verified and evidence is collected.

The items that most commonly fail a pre-opening review: the Medical Board registration isn't finalized yet (the most common delay), the medical director agreement is signed but unsigned delegation orders mean RNs can't legally inject, one or more protocols haven't received the medical director's signature, or advertising materials are live before the fictitious name permit was issued.

If you discover a gap, fix it before opening — not after. A citation received before you've treated a single patient is still a citation. More importantly, the risks that compliance requirements are designed to prevent — patient harm, liability, Board enforcement — don't disappear because you're new. Your compliance obligation starts when you start seeing patients, not when you feel ready.

See the California Med Spa Compliance Checklist for the complete pre-opening verification list.

Common Opening Mistakes That Lead to Citations

Forming an LLC Instead of a Professional Corporation

The single most common structural error — and the most serious. Operators choose an LLC because it's faster to form, cheaper to set up, and more familiar. But California's CPOM doctrine is explicit: an LLC cannot deliver medical services. Even if you correct this before opening, you've wasted the formation cost and need to start over with a PC.

Starting Without a Signed Medical Director Agreement

The physician is "on board" and has agreed to serve as medical director — but the contract hasn't been signed yet. Starting operations without a signed agreement means every procedure performed is without the required physician oversight documentation. If a complaint is filed during this window, there's no agreement to show that oversight existed.

Opening Before Medical Board Registration Is Confirmed

The registration was submitted and the operator assumes it's approved because no one said otherwise. Medical Board registration is not deemed approved by silence — you must receive written confirmation. Operating before registration is confirmed is a violation.

Relying on Verbal Protocol Approval

The medical director reviewed the protocols verbally and "approved" them in conversation. Verbal approval doesn't satisfy the California requirement. Protocols need the medical director's written signature and date on each document before the first patient is treated.

Allowing LVNs or MAs to Inject Because "The Doctor Is Here"

A physician is on-site, so operators assume that means all staff can perform injections under supervision. California law is explicit: LVNs and medical assistants cannot perform injectables under any supervision level. Physical presence does not change this. This is the most commonly cited scope of practice violation in California med spa inspections.

Summary: Opening a California Med Spa in Plain Terms

• You need a Professional Corporation — not an LLC — controlled by an MD, DO, or qualifying 104 NP
• Medical Board of California registration is required before you see patients — plan 4–8 weeks for processing
• Your medical director must be real: licensed in California, under a written agreement, genuinely available
• Staff must be credentialed for the specific procedures they perform — LVNs and MAs cannot inject under any supervision
• Written physician-approved protocols are required for every procedure before the first patient is treated
• HIPAA compliance and California advertising rules apply from day one of any public presence
• Plan 3–6 months from decision to first patient, and $150,000–$400,000+ for a single-room med spa

This guide is for informational purposes only and does not constitute legal or medical advice. California med spa regulations are complex and change over time. Consult a California healthcare attorney before proceeding with formation and registration.

Frequently Asked Questions