How to Open a Med Spa in 2026: Complete Step-by-Step Guide

There are roughly 10,000 medical spas operating in the United States, and the market has compounded at double-digit rates for most of the past decade. That growth is exactly why the regulatory picture has tightened: state boards that once treated aesthetic clinics as a curiosity now run proactive inspections, and 2026 brought the first wave of statutes written specifically for med spas rather than borrowed from general medical practice law.

That changes what "opening a med spa" means. It is no longer a build-out and a booking system. It is the formation of a medical practice that happens to sell cosmetic outcomes, and almost every hard decision you make in the first ninety days — who owns the entity, who supervises the clinical work, what your staff are allowed to touch — is a legal decision with a compliance consequence attached.

This guide walks the full journey in the order the decisions actually arrive: eligibility, structure, licensing, medical direction, staffing, space, cost, insurance, documentation, privacy, and launch. It ends with a genuine phase-by-phase opening checklist you can work through, and links down to state-specific guides where the rules diverge.

Is a Med Spa Right for You? Ownership Eligibility Comes First

Most people begin with a location or a device. Both are the wrong starting point. The first question is whether you are personally eligible to own the entity that will deliver medical treatment in your state — because the answer determines your entity structure, your tax treatment, your financing options, and whether you will need a physician partner before you can sign a lease.

The Practice-of-Medicine Line

A med spa exists on the far side of a line most consumers never see. Facials, dermaplaning, and superficial exfoliation sit within the cosmetology and esthetics world. Neuromodulators, dermal fillers, prescription-strength peels, GLP-1 weight management, hormone therapy, and most laser and energy-based treatments are the practice of medicine, because they involve prescription drugs, injections beneath the skin, or the deliberate destruction of living tissue.

That single distinction generates almost every requirement in this guide. Once you are practicing medicine, you inherit medical practice law: a physician or authorized provider must evaluate each patient and order treatment, someone with clinical authority must supervise delegated work, written protocols must exist, records fall under HIPAA, and a state medical board — not a cosmetology board — has jurisdiction over what happens in your treatment rooms.

Who May Legally Own the Practice

Three broad categories of owner exist, and your state decides which apply:

• Physician owners (MD or DO). Eligible everywhere. A physician-owned professional corporation is the cleanest structure in every state and the only structure some states will accept for the clinical entity.
• Advanced practice owners (NP or PA). Eligible in many states, with real variation. Roughly 30 states plus the District of Columbia grant nurse practitioners full practice authority, allowing an NP to evaluate, diagnose, and prescribe under the exclusive authority of the state board of nursing. Physician assistant ownership is more constrained and usually depends on a supervising or collaborating physician relationship. Our guide to nurse practitioner med spa ownership covers the state-level detail.
• Lay owners (no clinical license). Eligible in permissive states directly, and in strict states only indirectly, through a management company that contracts with a physician-owned clinical entity.

Three Questions to Answer Before You Spend Anything

Before a lease, a device deposit, or a business name, get written answers to these:

1. Does my state apply the corporate practice of medicine doctrine to aesthetic practices? If yes, a non-physician cannot own the clinical entity, and your structure has to route around that fact rather than ignore it.
2. What may my own license, if I hold one, actually authorize? Full practice authority for prescribing does not automatically confer authority over lasers and energy devices, which many medical boards regulate separately.
3. Who will perform the good faith exam on every patient, and will they be physically present? This determines your staffing model and your cost base more than any other single answer.

A healthcare attorney licensed in your state will answer all three in a $2,000 to $5,000 engagement. That is the highest-return money in the entire opening budget, because every one of these answers is expensive to change after you have signed contracts around the wrong one.

Business Structure: CPOM, PC vs LLC, and the MSO Model

The corporate practice of medicine doctrine holds that a corporation may not practice medicine or employ physicians to do so, because a business owner's profit motive should never sit between a clinician and a clinical judgment. States apply it with wildly different intensity, and the intensity determines your structure.

Strict CPOM States

California, New York, Texas, New Jersey, Illinois, and Colorado are among the states that enforce CPOM meaningfully against aesthetic practices. In these states the entity that bills for and delivers medical treatment must be a professional corporation owned by licensed physicians (or, where permitted, other licensed professionals). A non-physician investor or operator cannot simply hold shares in it.

California sharpened this considerably. Senate Bill 351, effective January 1, 2026, codified CPOM restrictions and expressly barred private equity groups and hedge funds from interfering with professional judgment — including determining the need for referrals, controlling how many patients a clinician sees, or exercising control over clinical staffing and equipment selection. The practical read for a new operator is that management agreements drafted as thin wrappers around clinical control are now enforcement targets, and the state attorney general has explicit authority to pursue them.

Permissive States

Florida, Georgia, Arizona, and a number of others allow a non-physician to own the operating entity outright, provided a qualified medical director supervises clinical care and delegation is properly documented. This does not mean oversight is optional — it means the oversight lives in the medical director agreement and the protocol set rather than in the cap table.

Entity Types and What Each Is For

• Professional Corporation (PC or PA). The clinical entity in CPOM states. Owned by licensed professionals, bills for medical services, employs or contracts the clinical staff, and holds the clinical liability.
• Professional LLC (PLLC). Available in many states as the professional-entity alternative to a PC. Whether a PLLC may hold a medical practice is state-specific — some states permit it, some require a PC.
• Standard LLC. The right vehicle for non-clinical operations: the lease, the equipment, the brand, the marketing, the front desk staff, the software. In a permissive state it may hold the entire business.
• Management Services Organization (MSO). The structure that lets a non-physician participate economically in a strict CPOM state. The MSO owns the assets and provides administrative services to the physician-owned PC under a management services agreement.

Getting the MSO Model Right

The MSO model is legitimate and widely used, and it is also the structure most often built badly. A defensible arrangement keeps clinical and business authority genuinely separate: the PC retains control over clinical protocols, hiring and firing of clinical staff, treatment decisions, and medical records; the MSO handles billing operations, marketing, HR administration, real estate, IT, and procurement. Management fees must be fair market value for services actually rendered rather than a percentage of clinical revenue dressed up as an administrative charge.

Two details cause most of the trouble. First, "friendly PC" arrangements where the physician owner is nominal and the MSO holds a succession agreement giving it effective control are exactly the fact pattern regulators look for. Second, clinical staffing decisions routed through the MSO — who to hire, how many patients to book per hour, which device to buy — are the specific behaviors California's 2026 law names. Have a healthcare attorney draft the management services agreement. Do not adapt a template you found online.

Licensing and Registration: What You File, and in What Order

Licensing is sequential, and filing out of order wastes weeks. You cannot get a local business license without an entity, cannot open a bank account without an EIN, cannot obtain a facility license without a leased address, and cannot obtain a DEA registration without a licensed prescriber and a physical location to register.

Entity and Tax Registrations

• State entity formation — articles of incorporation or organization, filed with the Secretary of State, plus any professional-entity approval required by the medical or nursing board.
• Federal Employer Identification Number from the IRS, issued the same day online.
• State tax registration and, in most states, a seller's permit if you resell skincare or supplements.
• Registered agent designation, and a fictitious business name filing if you trade under a brand different from the entity name.

Local Permits

• City or county business operating license, generally tied to the address and renewed annually.
• Zoning and certificate of occupancy confirmation for medical use — this catches people out in retail centers zoned for personal services but not medical.
• Building and fire permits for build-out, plus final inspection sign-off.
• Biohazard and sharps waste disposal contract, which many jurisdictions verify at inspection.

Facility, Clinic, and Med Spa Registration

Whether the facility itself needs a license depends entirely on the state and on your service menu. Some states require a medical clinic or health care facility license; some regulate only if you provide sedation or office-based surgery; some require nothing beyond the professional licenses of the people working there.

The newer development is med spa specific registration. Indiana became the clearest example when Senate Bill 282 was signed in March 2026, requiring medical spas to register with the state medical licensing board, designate a responsible practitioner, report adverse events within 15 days, and comply with location and advertising restrictions, with registration due by January 1, 2027. Several other states have similar bills in progress. Check your own state board's current guidance rather than assuming the absence of a rule, and re-check annually — this is the fastest-moving area of med spa regulation.

Professional and Prescribing Credentials

• Primary-source verification of every clinical hire's license through the state board database, documented in the personnel file before the first shift.
• Medical director agreement or collaborative practice agreement, signed and on file, with any board filing your state requires.
• DEA registration for the prescriber if you store, dispense, or administer controlled substances — testosterone and certain anesthetics are the common triggers — plus any state controlled substance registration.
• Laser or energy-device operator certification where the state requires it; several states impose training and registration requirements distinct from the underlying professional license.
• CPR and BLS certification for all clinical staff, with ACLS often expected where sedation or higher-risk procedures are performed.

Build a renewal calendar on the day each credential is issued rather than the day it is due. Entity registrations, local business licenses, facility registrations, DEA registration, individual professional licenses, insurance policies, and device service contracts all renew on independent cycles, and a lapsed credential discovered during an inspection is treated exactly like a credential you never held. Owners who run this as a shared calendar with 60-day reminders almost never have a lapse; owners who rely on renewal notices arriving by post eventually do.

Finding and Contracting a Medical Director

The medical director relationship is the single most consequential compliance decision after entity structure, and the one most commonly treated as a formality. A director who signs protocols they never read and visits twice a year is a "paper director" — an arrangement that provides no clinical protection and is treated by boards as an aggravating factor rather than a defense.

What the Role Actually Requires

• Reviewing, customizing, and signing every clinical protocol on the service menu, with a documented review cadence.
• Issuing standing orders and delegation authority defining exactly what each staff member may perform, on which patients, and under what conditions.
• Performing or supervising good faith exams, depending on state rules and the model you have built.
• Conducting periodic chart reviews at whatever frequency your state or your protocols specify, with the review itself documented.
• Being reachable during operating hours — some states require physical presence for specific procedures, most require reliable availability.
• Owning the clinical response to adverse events, and signing off on corrective action afterwards.

What to Look For

An active, unrestricted license in your state is the baseline. Beyond it: a clean disciplinary and malpractice history, malpractice coverage that explicitly extends to the supervision and medical direction role, genuine familiarity with aesthetic medicine or a credible willingness to build it, realistic availability given their other commitments, and — this matters more than it sounds — a temperament that will say no to a treatment plan when saying no is unpopular.

Ask directly how many other med spas they direct. A physician nominally directing a dozen clinics across three states is not providing oversight, and both of you will be judged on that fact if something goes wrong.

Structuring the Agreement

A written medical director agreement should define the scope of duties, compensation and its basis, supervision and availability requirements, protocol review schedule, chart review obligations, adverse event responsibilities, insurance requirements on both sides, term, termination, and what happens to protocols and records at termination. Compensation should be fair market value for the time and responsibility involved, and should not be structured as a share of treatment revenue in states where fee-splitting rules bite.

Retainers vary widely by market and involvement, from a few thousand dollars a month for a genuinely engaged director in a moderate-cost state to substantially more in strict states with high supervision requirements. Our complete medical director guide covers agreement terms, compensation benchmarks, and supervision models in depth, and medical director requirements by state covers the jurisdictional rules.

Staffing: Who You Can Hire and What Each License May Legally Do

Scope of practice is where good intentions most often become violations. The rules are set state by state, they differ between the medical board and the nursing board, and they change. Two clinics an hour apart across a state line can run legally identical service menus with completely different staffing.

Roles and Their Typical Boundaries

• Physician (MD/DO). Full scope. May perform and delegate everything within their competence, and is the delegating authority in most supervision models.
• Nurse Practitioner (NP). Evaluates, diagnoses, prescribes, injects, and in full practice authority states may do so independently. In reduced or restricted states, requires a collaborative or supervisory agreement.
• Physician Assistant (PA). Broad clinical scope under a supervising physician relationship, with the specific delegation set out in a written agreement. Increasingly granted collaborative rather than supervisory frameworks, but rarely full independence.
• Registered Nurse (RN). May administer injections and operate many devices under a valid order from an authorized prescriber, following an established protocol. An RN may not diagnose, prescribe, or perform the good faith exam.
• Licensed Practical or Vocational Nurse (LPN/LVN). Narrower than an RN and highly state-dependent. Many states do not permit LPNs to administer neuromodulators or fillers at all.
• Licensed Esthetician. Non-invasive treatment only: facials, superficial peels within cosmetology limits, dermaplaning, and in some states specific device work under supervision. Estheticians may not inject, and may not perform treatments that ablate or wound living tissue.
• Laser technician. A category that exists in some states and not others. Where it exists, it typically requires certification plus supervision; where it does not, laser work falls to licensed clinical staff.

Delegation, Supervision, and Standing Orders

Delegation is not a conversation, it is a document. A defensible delegation framework names the delegating provider, names the delegated task, names who may perform it, states the training and competency required, states the supervision level (personal, direct, or general), and defines when the delegate must stop and escalate. Standing orders operationalize that by pre-authorizing a specific treatment for patients who meet defined criteria — which only works if a qualified provider has evaluated the patient first and confirmed they meet those criteria.

The good faith exam is the hinge. It is the initial evaluation by a physician, NP, or PA that establishes the patient relationship and generates the treatment order. Without it, an injection by an RN is unordered treatment no matter how good the protocol is. States differ on whether it can be performed by telehealth and how often it must be repeated, and boards have grown notably skeptical of outsourced platforms that produce exam documentation without meaningful evaluation. Whatever model you use, the responsibility stays with your practice.

What a Realistic Opening Team Looks Like

Most single-location med spas open with three to five people: one advanced practice injector who carries the clinical load, one aesthetician or laser provider if the menu includes device work, one front-desk coordinator, and a medical director engaged on a retainer rather than as an employee. Owners who also treat should still hire a coordinator, because the most common early failure is a clinical owner absorbed in treatment rooms while consultations go unanswered.

Recruiting the first injector is usually the hardest hire, and it is worth treating as a founding decision rather than a staffing one. Experienced aesthetic injectors are in short supply in most markets, they are frequently bound by non-competes from a previous employer, and they arrive with a patient following that may or may not be transferable. Verify the non-compete before you make an offer, and be explicit in writing about who owns the patient relationship, because that conversation is far more painful to have after a resignation.

Hiring, Credentialing, and Training Records

Build the personnel file before the first shift, not during an investigation. Each clinical hire should have primary-source license verification, malpractice coverage confirmation, device and injectable training certificates from the manufacturer or a recognized program, a signed scope-of-practice acknowledgment, documented competency sign-off by the medical director, current CPR or BLS certification, and dated HIPAA and OSHA bloodborne pathogen training records. See med spa staff training requirements for the full documentation set, and who can inject Botox by state for injector scope specifics.

Space, Build-Out, and Equipment

Choosing and Qualifying a Location

Med spas do well in high-visibility retail adjacencies — affluent suburban centers, mixed-use developments, and medical office buildings with street presence. Before signing anything, confirm three things with the landlord and the municipality in writing: that medical use is permitted under the zoning and the lease, that the premises can accommodate the plumbing and electrical loads your devices require, and who pays for what in the build-out. A tenant improvement allowance negotiated up front is worth more than a few months of free rent.

Most single-location med spas run 1,200 to 2,500 square feet: two to four treatment rooms, a consultation room, reception, a clean supply and medication area, staff space, and restrooms. Resist the urge to open with more rooms than you can staff — empty rooms carry rent and produce nothing.

Build-Out Requirements That Are Not Optional

• Hand-washing sinks in or immediately adjacent to every treatment room.
• Non-porous, cleanable surfaces in clinical areas — no carpet in treatment rooms.
• Lockable medication storage, with a dedicated refrigerator with temperature logging for toxins and biologics.
• Sharps containers at point of use, and a compliant biohazard waste stream.
• Laser-safe treatment rooms where applicable: controlled access, appropriate signage, window coverings, and eyewear for every wavelength in use.
• Physical and administrative safeguards for records and PHI, including the front desk sight lines and screen positioning.
• ADA-accessible entry, restroom, and treatment access.

Equipment: Buy the Demand, Not the Brochure

Devices are the largest discretionary line in the budget and the easiest to get wrong. The disciplined approach is to open with injectables and one or two proven device categories, prove utilization, and add capital equipment only when a waitlist justifies it. Leasing preserves cash and allows technology refresh; buying wins on high-utilization workhorse devices over a multi-year horizon.

Three non-negotiables regardless of route: use only FDA-cleared devices for the indications you actually treat and keep the clearance documentation; budget for annual service contracts on every laser and energy device, because unserviced devices are both a clinical and a liability problem; and make sure your written protocol records the specific parameters and settings your team has been trained on, not the manufacturer's full range.

What It Costs to Open a Med Spa

Most new med spas open for roughly $250,000 to $750,000 all in, with lean single-room or suite models starting nearer $100,000 to $200,000. Build-out, devices, and your operating reserve drive nearly all of the variance — licensing and legal fees, which people worry about most, are among the smallest line items. Recurring costs then land in a fairly predictable band: rent, payroll, medical director retainer, insurance, software, and consumables, with payroll the largest by a wide margin. For a market-level breakdown of these numbers, see how much it costs to open a med spa in Texas.

One planning note that matters more than the headline range: capitalize a runway, not just a build. Most med spas take six to twelve months to reach breakeven, and undercapitalized openings fail during the ramp rather than at launch.

We keep the full financial model in a separate guide rather than duplicating it here. How much does it cost to open a med spa? has the complete line-item breakdown — one-time startup categories, recurring monthly costs, state-by-state comparison, hidden costs, funding options including SBA 7(a) loans, and break-even math. Build your budget there, then come back to this checklist.

Insurance and Malpractice Coverage

Insurance is a gate, not a formality: most landlords require proof of general liability before handing over keys, most device manufacturers require coverage before installation, and no defensible practice treats its first patient uninsured. Underwriting also takes longer than new owners expect, and carriers increasingly ask to see written protocols as part of the application — which is one more reason the protocol set has to exist early.

The Policies a Med Spa Actually Needs

• Professional liability (malpractice) for the entity, typically at $1M per claim and $3M aggregate, which is the most commonly purchased med spa limit.
• Individual provider coverage for each clinician, including the medical director, whose policy must explicitly cover the supervision role.
• General liability for slips, falls, and premises claims, usually bundled into a business owner's policy.
• Property and equipment coverage for build-out, devices, and inventory, including refrigerated product loss.
• Cyber liability, which is not optional for a practice holding electronic PHI.
• Workers' compensation, required in nearly every state once you have employees.
• Business interruption coverage, frequently overlooked and genuinely useful during a device failure or forced closure.

What Underwriters Ask For

Expect the application to ask for your full service menu procedure by procedure, the license type and credentials of every provider, your device list with FDA clearances, your medical director agreement, your written protocols for higher-risk treatments, your consent forms, and your training and competency records. Carriers have grown noticeably more specific about filler and thread procedures, and several now ask directly whether a vascular occlusion protocol exists and whether hyaluronidase is stocked on site. Answer accurately — a policy issued on an inaccurate application is a policy your carrier can contest at exactly the moment you need it.

What It Costs and What Changes the Price

A realistic full insurance program for a new single-location med spa runs roughly $6,000 to $25,000 a year. Entity professional liability commonly falls between $3,500 and $10,000 annually, individual provider policies add roughly $2,000 to $5,000 each, and general liability often runs a few hundred to $1,500 within a business owner's policy. Price moves on the procedure mix more than anything else — threads, deep fillers, ablative lasers, and weight-management prescribing all raise premiums — followed by claims history, provider count, and state.

Claims-Made vs Occurrence, and Why It Matters at Exit

An occurrence policy covers incidents that happen during the policy period whenever the claim is filed. A claims-made policy covers only claims filed while the policy is active, which means that if you switch carriers or close the practice you need tail coverage to stay protected for incidents already in the past. Tail can cost one to two times the annual premium and is a genuine surprise for owners who did not plan for it. Read med spa insurance and malpractice coverage for the full comparison and application checklist.

SOPs, Protocols, and the Compliance Document Set You Need on Day One

Standard operating procedures are the written clinical and operational instructions that define how your practice does what it does. They are the documents your medical director signs, your carrier underwrites against, your staff train on, and a state board asks for first. A practice without them is not merely disorganized — in an investigation it is undocumented, which is functionally the same as non-compliant.

Clinical Protocols

You need one for every service on the menu. Each should cover indications and contraindications, patient screening and assessment, informed consent requirements, pre-treatment preparation, the treatment procedure and parameters, post-treatment care, expected outcomes and complications, complication management, escalation and referral criteria, and documentation requirements. A neuromodulator protocol, a filler protocol with a vascular occlusion pathway, and a GLP-1 protocol with dosing and monitoring are the three most scrutinized in current enforcement.

Operational and Compliance SOPs

• Patient intake, medical history, and screening.
• Good faith exam procedure and documentation standard.
• Informed consent process, with a signed consent for every distinct treatment.
• Standing orders and the delegation matrix.
• Medical director supervision and chart review cadence.
• Staff training, competency verification, and annual re-verification.
• Infection control, sterilization, and single-use device policy.
• Medication storage, cold chain, inventory, and disposal — including controlled substance logs where applicable.
• Adverse event identification, management, documentation, and reporting.
• Emergency response for anaphylaxis, vascular occlusion, syncope, burns, and cardiac events.
• HIPAA privacy and security policies, including breach notification.
• Advertising and social media compliance, including before-and-after photo consent.

Writing Them vs Buying Them

Drafting a complete protocol library in-house is a real project — typically 40 to 80 hours of clinical writing plus legal review, and commonly $5,000 to $15,000 if you commission it from a healthcare attorney. The alternative most operators use is a professionally written template library that the medical director and attorney then customize to the actual menu, devices, and state rules. That path gets a signed protocol set in place in days instead of months and keeps legal hours focused on the parts that are genuinely practice-specific.

Whichever route you take, the documents must be customized, signed, dated, version-controlled, and accessible to staff. An unsigned template in a shared drive is not a protocol. For depth, see the complete med spa SOP guide and what protocols a med spa needs; for the surrounding program, what med spa compliance requires in 2026. You can also browse the full MedSpa Standards library to see what a complete protocol set covers.

HIPAA, Medical Records, and Consent

The moment you take a medical history, you are a HIPAA covered entity. Aesthetic practices sometimes assume that cash-pay, non-insurance operations fall outside the rules; they do not. Photographs, treatment records, and appointment data are all protected health information, and before-and-after images are the category most frequently mishandled in this industry.

The HIPAA Program

• A documented security risk analysis, updated at least annually — the single most commonly cited omission in enforcement actions.
• Written privacy and security policies, with a Notice of Privacy Practices posted and provided to patients.
• Business associate agreements with every vendor that touches PHI: EHR, booking software, billing, marketing platforms, cloud storage, IT support.
• Role-based access controls, unique user accounts, and audit logging in the EHR.
• Encryption of PHI at rest and in transit, including on any device that leaves the building.
• Annual documented workforce training, and a written breach notification procedure.

Note that the proposed HIPAA Security Rule overhaul published in January 2025 — mandatory multi-factor authentication, asset inventories, network mapping, and the removal of the "addressable" category — remains a proposed rule. HHS has moved the final action target to 2027. Build to the current Security Rule, but assume the direction of travel is toward more prescriptive technical controls, and choose an EHR that already supports MFA and audit logging. Our HIPAA compliance guide covers the operational detail.

Records and Retention

Every treatment needs a chart entry that records who evaluated the patient, what was ordered, who performed the treatment, what was used including lot numbers and expiration dates for injectables, the settings or dose administered, and the post-treatment instructions given. Retention periods are set by state and typically run five to ten years for adults and longer for minors, measured from the last date of service or the age of majority. See med spa medical records retention for state-by-state periods and destruction requirements.

Informed Consent

Consent is a process, not a signature. Each treatment needs its own consent form describing the specific procedure, realistic expected outcomes, known risks and complications, alternatives including no treatment, and off-label status where relevant — most aesthetic filler and neuromodulator uses have off-label components, and patients should be told. Photography and marketing consent must be separate and separately revocable. Never bundle treatment consent and social-media release into one signature.

The Complete Med Spa Opening Checklist

This is the working version of everything above, sequenced. Timings assume a first-time owner and a modest build-out; adjust the calendar, not the order. Items in earlier phases unblock items in later ones, which is why the sequence matters more than the dates.

Phase 1 — Foundation (Months 9 to 6 Before Opening)

1. Confirm whether your state applies corporate practice of medicine restrictions to aesthetic practices.
2. Determine your personal ownership eligibility based on the license you hold, or do not hold.
3. Engage a healthcare attorney licensed in your state and get the structure decision in writing.
4. Write a service menu you can legally staff on day one, and price it against local competitors.
5. Build the financial model and confirm you have six to twelve months of operating reserve, not just build-out capital.
6. Secure financing — SBA loan, equipment financing, or personal capital — with the entity structure already decided.
7. Form the entity or entities, including any professional-entity board approval your state requires.
8. Obtain the federal EIN and register for state tax accounts.
9. Open business banking and set up accounting, keeping clinical and management entities strictly separate if you are using an MSO.
10. Begin recruiting a medical director — start now, because this reliably takes six to twelve weeks.

Phase 2 — Licensing, Location, and Contracts (Months 6 to 3)

1. Confirm zoning permits medical use at your target address, in writing, before signing.
2. Negotiate the lease, including tenant improvement allowance, medical-use permission, and signage rights.
3. Apply for the local business operating license.
4. Determine whether a state facility, clinic, or med spa registration applies, and file it.
5. Execute the medical director agreement, drafted by counsel and signed by both parties.
6. File any collaborative practice agreement your state board requires, and confirm acceptance.
7. Submit DEA registration for the prescriber if you will handle controlled substances, plus state controlled substance registration.
8. Commission build-out drawings and submit for building and fire permits.
9. Order devices, accounting for eight to sixteen week lead times, and schedule installation and training.
10. Apply for insurance: professional liability, general liability, property, cyber, and workers' compensation.
11. Select and contract an EHR with MFA, audit logging, and a signed business associate agreement.
12. Open accounts with pharmaceutical and device suppliers, which require a physician or prescriber of record.

Phase 3 — Clinical Readiness (Months 3 to 1)

1. Assemble the full clinical protocol set covering every service on the menu.
2. Have the medical director review, customize, sign, and date every protocol.
3. Issue written standing orders and a delegation matrix naming who may perform what.
4. Finalize the good faith exam workflow, including who performs it and how it is documented.
5. Build treatment-specific informed consent forms, plus separate photography and marketing consents.
6. Complete the HIPAA security risk analysis and adopt written privacy and security policies.
7. Execute business associate agreements with every vendor that touches patient data.
8. Hire clinical staff and complete primary-source license verification for each.
9. Document device and injectable training, and have the medical director sign competency verification for each provider.
10. Complete HIPAA, OSHA bloodborne pathogen, and emergency response training, with dated records.
11. Stock the emergency kit — epinephrine, hyaluronidase, an AED, and oxygen where indicated — and log expiration dates.
12. Run an emergency drill for anaphylaxis and vascular occlusion, and document it.
13. Set up medication storage with a temperature-logged refrigerator and lockable controlled storage.
14. Contract biohazard and sharps waste disposal.
15. Pass final building inspection and obtain the certificate of occupancy.

Phase 4 — Launch Week and the First 30 Days

1. Confirm all insurance policies are bound and certificates are on file — not quoted, bound.
2. Verify every license, registration, and agreement is current and physically or digitally on file.
3. Run a full soft-launch day on friends and family, charting every encounter exactly as you would for a paying patient.
4. Audit those charts against your own documentation standard and fix what the audit exposes.
5. Confirm the good faith exam actually happens in the booking flow, rather than being assumed.
6. Publish the Google Business Profile with accurate services, hours, and photos.
7. Launch the website with treatment pages, provider credentials, and compliant claims — no guarantees of outcome.
8. Review all advertising against your state's rules on before-and-after imagery, testimonials, and provider titles.
9. Set the medical director's first chart review date and put the recurring cadence in the calendar.
10. Schedule the annual review dates for protocols, HIPAA risk analysis, training, and license renewals.
11. Track first-month metrics that actually predict survival: consultation-to-treatment conversion, rebooking rate, and revenue per treatment hour.

Print it, assign an owner to every line, and treat the phase boundaries as gates. The single most common opening failure is running Phase 4 activities on a Phase 3 foundation — marketing hard into a practice whose protocols are unsigned and whose staff competency is undocumented.

How Long It Takes to Open a Med Spa

Six to nine months from decision to first patient is realistic for a first-time owner; twelve is common when build-out requires permits and inspections. The timeline is rarely set by the things people plan around.

The reliable long poles are municipal build-out permitting, which is the least predictable item in the whole project and can add two months without warning; device lead times of eight to sixteen weeks; medical director recruitment at six to twelve weeks; insurance underwriting at two to six weeks, longer if the carrier asks for protocols you have not written yet; and state facility or registration approvals where they apply. Entity formation is fast — days to a few weeks — but the CPOM structuring conversation that precedes it is not.

Protocol development is the one long pole you can genuinely compress. Drafting from scratch takes two to three months of clinical writing and legal review; starting from a reviewed library and customizing it turns that into days of medical director time. That is often the difference between opening in month eight and opening in month eleven, and every month of delay is rent and payroll against zero revenue.

State-by-State Differences: Where the Rules Diverge

Everything above is the national frame. Four things vary enough by state to change your plan outright: whether CPOM restricts who may own the clinical entity, who may perform the good faith exam and whether telehealth is permitted for it, what an RN or esthetician may do with lasers and energy devices, and whether the facility itself needs a license or registration. We maintain a state regulation reference for all 51 jurisdictions with primary sources, plus detailed opening guides for the states where most new operators launch:

Read the national frame here, then read your state's guide before you form anything. Where the two conflict, your state wins.

Common Mistakes That Shut New Med Spas Down

Closures rarely follow a single catastrophic event. They follow a complaint — from a patient, a competitor, or a former employee — that triggers a document request the practice cannot answer. Five patterns account for most of them.

Building the Wrong Ownership Structure

A lay owner holding the clinical entity directly in a strict CPOM state, or an MSO agreement that gives the management company control over clinical staffing and treatment decisions. This is the most expensive mistake because unwinding it means restructuring contracts, bank accounts, payer relationships, and sometimes ownership itself — while operating.

The Paper Medical Director

A physician who signs protocols they have not read, never reviews a chart, and directs a dozen clinics across several states. Boards recognize this pattern immediately, and it exposes the director and the owner simultaneously. Pay for real oversight and use it.

Skipping or Faking the Good Faith Exam

Treating patients on a protocol without an authorized provider evaluating them first is unordered treatment. Outsourced exam platforms that generate documentation without genuine evaluation carry the same exposure, and the responsibility does not transfer to the vendor. This is currently among the most actively enforced issues in aesthetic medicine.

Staffing Beyond Scope

An esthetician injecting, an LPN administering neuromodulators where the state does not permit it, or an unlicensed assistant operating a laser. Often it happens through drift rather than intent — a busy day, a trained staffer, a shortcut that becomes routine. It ends careers, not just businesses.

Operating Without Documentation

Unsigned protocols, missing consents, no delegation matrix, no HIPAA risk analysis, no training records. In an investigation, the absence of documentation is treated as the absence of the practice it was meant to describe. Our analysis of why med spas get shut down walks through real enforcement patterns and what the boards actually asked for.

A final note on the regulatory weather. Two federal items are worth watching as you plan a 2026 opening: the DEA and HHS extended COVID-era telemedicine flexibilities for prescribing controlled substances through December 31, 2026, with a permanent rule expected before that date; and the FDA has moved decisively against mass compounding of GLP-1 medications, having clarified compounder policies as supply stabilized and proposed excluding semaglutide, tirzepatide, and liraglutide from the 503B bulks list in April 2026. If your business plan depends on compounded weight-management drugs, model a version of it that does not.

None of this makes opening a med spa hard in a way that should deter you. It makes it a project with a correct order of operations. Work the phases, document as you go, and you will open a practice that can survive its first inspection as comfortably as its first Saturday.