How to Open a Med Spa in Georgia: Step-by-Step Guide (2026)

Georgia is one of the friendlier states in the country for opening a med spa — the entity filings are fast, the Secretary of State portal is modern, and the state does not impose a separate "Authority to Incorporate" review the way New York does. But "friendlier" is not "frictionless." The Georgia Composite Medical Board (GCMB), the Georgia Drugs and Narcotics Agency, the Georgia Secretary of State Corporations Division, and the Georgia Department of Revenue all have to see your file before patients walk through the door.

This guide walks the steps in the order they actually happen. Skip a step, file out of order, or treat the medical director as a paper signature, and you create exposure that takes months and significant legal fees to clean up.

If you already know the order you want to follow, the Quick Answer above summarizes it. Below is the longer version — what each step is, why it exists, and where most Georgia operators trip themselves up.

Before You File Anything: Confirm Who Holds the Clinical Authority

Georgia is more flexible than New York or California on med spa ownership, but the practice of medicine itself is still reserved for licensed physicians. The business entity can be owned by non-physicians in many structures, but every medical decision — protocol approval, drug ordering, delegation to APRNs and PAs, supervision, chart review — has to flow from a Georgia-licensed MD or DO.

That means before any filing, you need clarity on two questions: who is the legal owner of the business, and who is the licensed medical director responsible to the GCMB. The full ownership analysis — including how Management Services Organization structures fit and where Georgia draws the line — is in our who can own a med spa in Georgia guide. Read that before you file Articles, because the entity structure and the ownership split should reflect the answer.

Phase 1 — Entity Formation & Setup

Step 1: Decide Entity Type — PC or PLLC

Georgia gives professionals two real options for the operating entity:

Professional Corporation (PC) — governed by the Georgia Professional Corporation Act, codified at Title 14, Chapter 7 of the Official Code of Georgia Annotated. PCs require corporate formalities — board, annual meetings, minutes, bylaws — and default to C-corp tax treatment unless an S-election is filed. PCs are familiar to long-tenured Georgia healthcare counsel, and many established practices remain in this structure.

Professional Limited Liability Company (PLLC) — formed under the Georgia LLC Act, Title 14, Chapter 11. Pass-through taxation by default, fewer formalities, and an operating agreement that is far simpler than corporate bylaws. Most modern single-physician and small-group Georgia med spas choose PLLC for the cleaner tax and governance posture.

Practical guidance: A single physician opening one location is usually best served by a PLLC. A multi-physician practice or one bringing in non-physician investors through an MSO should engage a Georgia healthcare attorney before filing — the entity choice locks in tax and governance constraints that are expensive to reverse. Whichever you choose, the entity name must clearly indicate the structure (e.g., "P.C." or "PLLC") on the formation document.

Step 2: Reserve Your Name with the Georgia Secretary of State

Search the entity name on the Georgia Secretary of State Corporations Division portal to confirm availability. Names of professional entities have a few rules:

• The name must include the proper designator — "Professional Corporation," "P.C.," "Professional Limited Liability Company," or "PLLC" — depending on the structure
• The name cannot be misleading about the services offered or the credentials of the providers
• The name must be distinguishable from any other entity already registered with the Georgia Secretary of State

Most operators run a parent professional entity (e.g., "Smith Aesthetics PLLC") and operate the consumer brand ("Peach State Med Spa") through a properly filed trade name. The trade name registration in Georgia happens at the county level — typically the Superior Court of the county where the business operates. Both the entity name and the trade name should be consistent across the lease, the website, the bank account, and the malpractice policy.

Step 3: File Articles of Incorporation with the GA Secretary of State

Once the name is cleared, file your formation document directly through the Secretary of State eCorp portal:

• PC: Articles of Incorporation under O.C.G.A. §14-7
• PLLC: Articles of Organization under O.C.G.A. §14-11

Online filings typically issue within 5 to 7 business days; expedited options can shorten that to 24 hours for an additional fee. Georgia does not require a separate "Authority to Incorporate" review (unlike New York), which is one reason Georgia launches move faster than NY launches by default.

After the formation document is approved, file the Initial Annual Registration within 90 days of formation and every year thereafter by April 1. Missing the annual registration administratively dissolves the entity — and an administratively dissolved entity that has been seeing patients creates a real liability gap.

Step 4: Federal EIN

Apply directly with the IRS at irs.gov. The EIN is free, issued immediately online, and required for the bank account, employer registrations, DEA application, payor contracts, and tax filings. Use the EIN that exactly matches the entity name on your Georgia Articles — IRS/SOS mismatches cause real headaches at tax time.

Step 5: Georgia Tax Registration

Register with the Georgia Department of Revenue through the Georgia Tax Center for:

• Sales and use tax — applies to retail product sales (skincare, supplements, cosmetics) sold at the practice
• Withholding tax — required before any W-2 employee starts
• Local option taxes — Atlanta, Fulton, and DeKalb add city/county-level layers in some cases

Most clinical services performed by a licensed provider are not subject to Georgia sales tax, but retail product sales typically are. Get clarity from your CPA on the right way to ring up bundled services where products are included — the tax treatment differs from a pure service.

Phase 2 — Licensure, Medical Director & Compliance Foundation

Step 6: Find and Contract Your Medical Director

Every Georgia med spa must have a Georgia-licensed MD or DO acting as medical director. The director is responsible to the GCMB for the practice's clinical activity, and the contract has to reflect real responsibilities — not just a name on a wall.

The medical director's contract should at minimum cover:

• Protocol approval and signature for every clinical service offered
• Chart review on a documented cadence
• On-site or telemedicine availability standards consistent with the services offered
• Supervision of APRNs (under a written protocol agreement) and PAs (under a job description) per Georgia Board of Nursing and Composite Medical Board rules
• Compensation structured to avoid Stark and federal anti-kickback issues — typically a flat or hourly retainer, never a per-procedure or revenue-share fee

The full breakdown of who can serve, what the contract must include, and how compensation must be structured is in our Georgia medical director requirements guide. Read that before you sign anyone — a paper director is one of the most common GCMB enforcement triggers in Georgia. If you also plan to operate under nurse practitioner protocols, see our Georgia NP protocol agreement guide for the additional document set.

Step 7: Build Out the Facility — Atlanta Zoning and Permits

Lease, design, permit, build. The order of operations:

1. Confirm zoning — Medical use is not permitted in every commercial zone. Confirm with the local building department before signing a lease. In the City of Atlanta, the certificate of occupancy must reflect medical or professional office use; a CO change can take months.
2. Negotiate the lease — Build in a permits contingency. A "permits or terminate" clause protects you if the city denies your build-out application.
3. Architectural plans — Required for any tenant improvements affecting plumbing, electrical, or partition walls. Treatment rooms typically need dedicated sinks, GFCI outlets, and appropriate lighting.
4. Pull permits — Building, plumbing, electrical, and where applicable, signage permits. Atlanta and Fulton County add their own review layers.
5. Final inspection and CO sign-off — must precede operations.

Realistic build-out timeline outside metro Atlanta is 4 to 8 weeks for a light-touch fit-out. Inside the City of Atlanta or in Fulton/DeKalb permitting tracks, plan 8 to 14 weeks. If your space requires a CO change (because it was previously retail or office without medical use), add another 4 to 8 weeks on top of that.

Step 8: DEA Registration + GDNA Registration (If Applicable)

You need controlled substance registration if your scope includes any scheduled drugs. For a typical aesthetic-only med spa (Botox, fillers, laser, microneedling), neither DEA nor GDNA is needed. For practices offering:

• Compounded peptides where the underlying substance is scheduled
• Certain weight-loss medications (some adjuncts and stimulants are scheduled)
• Hormone therapy involving scheduled testosterone preparations
• Sedation or pain management procedures using scheduled drugs

...you need both registrations. Federal DEA registration is filed via DEA Form 224 and tied to the practice address. Georgia layers on a state-level controlled substance registration through the Georgia Drugs and Narcotics Agency. Both are required if you store, prescribe, or administer controlled substances at the facility.

Processing typically takes 4 to 6 weeks for the DEA and 2 to 4 weeks for the GDNA. The registered owner must be an authorized prescriber under Georgia law. GDNA inspectors do show up, and they expect a logged, locked, and inventoried controlled substance area with surrender records and disposal documentation.

Step 9: Workers' Compensation

Georgia law generally requires workers' compensation coverage once you have three or more employees (regularly working). For most med spas, that threshold is hit quickly — front desk, RN injector, esthetician, and a part-time provider can all count. Bind workers' comp before that third employee starts.

Even below the three-employee threshold, many practices carry workers' comp voluntarily because the premium is modest and the personal exposure of an injury claim against the entity is significant. Confirm with your insurance broker.

Step 10: Malpractice Insurance — Entity and Per-Provider

Two layers of coverage:

• Entity coverage — Covers the PC or PLLC for vicarious liability and corporate exposure. Typical minimum limits are $1M per occurrence / $3M aggregate, though many Georgia med spas carry $2M / $4M.
• Per-provider coverage — Each licensed clinician (physician, NP, PA, RN performing injections) needs their own coverage. Some entity policies cover employed providers; others require individual policies. Confirm the structure with the carrier in writing.

Carriers ask about specific procedures, training documentation, supervision protocols, and the medical director arrangement before issuing a quote. Practices with formal protocols and documented training records pay less. Tail coverage matters when providers leave — claims-made policies require a tail to cover incidents after the policy ends. Specify in every provider contract who pays for tail coverage on departure.

Phase 3 — Operations, Staffing & Launch

Step 11: HIPAA Program and Georgia Code §31-33 Patient Records

Federal HIPAA applies to every med spa as a "covered entity." Georgia adds O.C.G.A. §31-33, which governs patient access to medical records and imposes specific timelines for record requests, retention, and copy fees.

Your minimum HIPAA program before opening:

• Designated Privacy Officer and Security Officer (often the same person in a small practice)
• Written Notice of Privacy Practices given to every patient at first visit
• Business Associate Agreements with every vendor that touches PHI (EHR, billing, lab, analytics, even some marketing tools)
• Security Risk Assessment documented in writing
• Workforce HIPAA training, documented with sign-off
• Breach response plan
• Patient access procedures aligned with §31-33 timelines (10 business days for routine requests in most cases)

This is not paperwork-only. The HHS Office for Civil Rights audits small practices, and the Georgia Attorney General has its own enforcement authority. A compliant program is a Day 1 requirement, not a Year 2 task.

Step 12: Build Written SOPs and Protocols for Every Procedure

Every clinical service offered must have a written, medical-director-approved standard operating procedure. At a minimum, each protocol should specify:

• Indications and contraindications
• Patient screening and informed consent requirements
• Pre-procedure assessment and required labs (where applicable)
• Step-by-step procedure technique
• Dosing ranges and product specifications
• Adverse event recognition and response
• Post-procedure care and follow-up
• Documentation requirements

A signed protocol is what distinguishes "supervised practice" from "unsupervised practice" in front of the GCMB or the Georgia Board of Nursing. Without protocols, every procedure is performed at the individual judgment of the staff member — which is not defensible to a regulator or to a malpractice carrier when something goes wrong.

Step 13: Hire Staff and Verify Every License

Every clinical staff member's license must be verified before they touch a patient. Verify through:

• The Georgia Composite Medical Board for MD/DO/PA licensure and any disciplinary history
• The Georgia Board of Nursing for RN, LPN, and APRN licensure and prescribing authority
• National certification (FNP, AGNP, CRNA) for APRNs where applicable

Document every verification with the date and source. Re-check at renewal. A lapsed license you didn't catch creates exposure for the practice and the medical director.

Equally important: who is allowed to perform what. Scope of practice for cosmetic injectors in Georgia is narrower than many operators assume. See our who can inject Botox in Georgia guide for the provider-by-provider breakdown before you build job descriptions.

Step 14: Marketing Setup — GCMB Rule 360-3 Advertising

Set up your website, Instagram, Google Business Profile, and any local advertising — but build them to comply with GCMB Rule 360-3 from the start. Georgia requires:

• Accurate identification of provider credentials (MD, DO, NP, PA, RN — never "doctor" for a non-physician)
• Clear identification of the supervising physician where required
• No misleading claims about results, expertise, or board certifications
• Documented patient consent for any before/after photos used in marketing
• No "guaranteed results" language or undocumented superlative claims

The full set of Georgia-specific advertising rules — including what Google and Meta will reject and the disclosure language the GCMB expects to see — is in our Georgia med spa advertising rules post. Get your marketing collateral reviewed against that list before you spend money on paid ads — Rule 360-3 violations are one of the easier ways to land in front of the GCMB.

Step 15: Atlanta and Fulton County-Specific Add-Ons

Operating inside the City of Atlanta or in Fulton/DeKalb County layers on requirements on top of the state-level checklist:

• City of Atlanta business license — required for any business operating within city limits, renewed annually
• Certificate of Occupancy verification — must reflect medical or professional office use; a CO change is a multi-month process
• Atlanta Department of City Planning permits — any tenant improvement requires permits, plan review, and final inspection
• Regulated medical waste contract — you must contract with a licensed medical waste / sharps disposal vendor and document each pickup manifest
• Signage permits — Atlanta limits the size, illumination, and placement of business signs; permits are typically required for any exterior signage
• Fire Marshal inspection — for occupancy, exit signage, fire extinguisher placement, and emergency lighting before patient operations
• Fulton County Health Department coordination — for certain regulated services, particularly anything involving sterile injectables, IV therapy, or sharps disposal

Budget an extra 4 to 8 weeks and an extra $5,000 to $20,000 for the Atlanta layer on top of the state-level launch. The exact additional cost depends heavily on the condition of the space and whether the CO already supports medical use.

Realistic Timeline (Georgia)

Below is a defensible 3 to 5 month sequence, assuming nothing major goes wrong:

• Month 1: Decide entity, identify physician owner / medical director, file Articles of Incorporation or Articles of Organization with GA SOS, EIN issued, GA DOR registration filed, scout real estate
• Month 2: Sign lease (with permits contingency), start architectural plans, pull permits, draft SOPs, sign medical director agreement, begin staff recruiting
• Month 3: Build-out underway, equipment ordered, malpractice quotes in hand, workers' comp bound, DEA/GDNA filed if needed, HIPAA program documented, hire and credential staff
• Month 4: Build-out complete, final inspections, CO sign-off, marketing collateral built and reviewed against GCMB Rule 360-3, soft-open
• Month 5: Fully open, marketing live, first patients

Inside the City of Atlanta, add at least one month for permitting and CO issues. If your physician owner or medical director is also working full-time elsewhere during the launch, add another month for execution bandwidth.

Realistic Cost Ranges (2026)

Outside the Atlanta metro (most of Georgia):

• Legal (entity formation, contracts, lease review): $4,000–$10,000
• Build-out (light fit-out): $20,000–$50,000
• Equipment (treatment chairs, basic devices, supplies): $15,000–$40,000
• Initial inventory (toxin, fillers, peptides, skincare): $8,000–$20,000
• Medical director retainer (3 months prepaid): $6,000–$15,000
• Malpractice (entity + provider): $3,500–$7,000 first year
• Software (EHR, scheduling, payments, marketing): $2,500–$7,000 setup
• Marketing launch budget: $4,000–$12,000
• Working capital (3 months operating): $25,000–$50,000

Realistic all-in: $20,000 to $60,000 to launch outside metro Atlanta, plus working capital.

City of Atlanta / Fulton or DeKalb County:

• Build-out costs run 30%–60% higher
• Higher rent and key money on lease signing
• Atlanta permitting fees and architect costs
• Higher medical director rates ($3,500–$7,000/month)
• Atlanta business license and signage permits

Realistic Atlanta metro all-in: $50,000 to $120,000+ to launch, depending on the condition of the space and how custom the build-out is.

Common Mistakes That Delay or Sink Georgia Launches

• Treating a paper medical director as sufficient — if the director never visits, never reviews charts, and is unreachable, you are unsupervised in practice and exposed to GCMB enforcement
• Signing a lease before confirming zoning and CO — discovering you cannot legally provide medical services in the space after the lease is signed is catastrophic
• Skipping GDNA registration — assuming federal DEA is enough is a common error; Georgia requires its own state registration
• Missing the GA SOS Initial Annual Registration — administratively dissolves the entity and creates real liability gaps
• Operating before workers' comp is bound — a workplace injury without coverage is a personal-asset event for the owner
• Marketing language that violates GCMB Rule 360-3 — "best in Atlanta," "guaranteed results," undocumented before/afters — easy regulator triggers
• APRN protocols that don't exist on paper — a Georgia NP injecting without a current written protocol agreement is unsupervised practice in the eyes of the Board of Nursing
• Hiring before credentialing — verifying licenses on Day 1 not Week 4

For a complete pre-open audit, work through our Georgia med spa compliance checklist before you book your first patient.

Summary

1. Confirm clinical authority before anything else — a Georgia-licensed physician must hold the medical decision-making
2. Choose PC (Title 14, Ch. 7) or PLLC (Title 14, Ch. 11); PLLC is cleaner for most modern launches
3. Reserve the name and file Articles with the Georgia Secretary of State — online, 5 to 7 business days
4. EIN and Georgia Department of Revenue registration before payroll or banking
5. Contract a real medical director with a written agreement, on-site visit cadence, chart review, and protocol approval
6. Build out the facility with permits, CO, and Atlanta-specific add-ons if applicable
7. DEA + GDNA registration if controlled substances are part of your scope
8. Workers' comp once you cross the three-employee threshold; malpractice (entity + provider) before any provider sees a patient
9. HIPAA program and O.C.G.A. §31-33 records procedures from Day 1
10. Written, signed SOPs for every procedure offered
11. Verify every license with the GCMB and Board of Nursing before staff start
12. Marketing built to comply with GCMB Rule 360-3 from launch
13. Plan 3–5 months and $20K–$60K to open outside metro Atlanta, $50K–$120K+ inside

If you are building toward launch and want the SOP and consent form library already mapped to Georgia standards, the Complete SOP Suite covers all 62 procedure protocols. Combined with our Georgia med spa compliance checklist, it covers the documentation a GCMB or GDNA inspector would ask for on Day 1.

Disclaimer: This article is for educational purposes only and does not constitute legal advice. Opening a medical practice in Georgia involves complex legal, tax, and regulatory considerations specific to your situation. Consult with a Georgia healthcare attorney and a CPA before forming an entity, signing a lease, or hiring staff.