Med Spa Regulations by State: 2026 Compliance Reference

Med spa regulations are primarily governed at the state level, which means a practice that is fully compliant in Florida may have significant gaps if it operates in Texas or California. This reference covers the most critical compliance variables across the eight states where med spa growth has been highest, then dives deep into the six states where we maintain dedicated hubs and in-state regulatory guides.

The framework is consistent: every state has some version of Corporate Practice of Medicine doctrine, every state requires a licensed physician to oversee medical procedures, and every state restricts who can prescribe and administer injectables. What changes is the strictness of each rule and the intensity of enforcement. A physician who cuts corners in Arizona may face a different regulatory reality than the same physician operating in New York.

Important: Regulations change frequently. Verify current requirements with your state's medical board and board of nursing before making compliance decisions. This reference reflects requirements as of May 2026.

Three Regulatory Frameworks Every State Imposes

Before diving into state-by-state specifics, it helps to understand the three frameworks that shape every med spa's compliance posture. Almost every meaningful regulatory difference between states is some combination of where they fall on these three spectrums.

Corporate Practice of Medicine (CPOM) Spectrum

The Corporate Practice of Medicine doctrine governs who can own and control a medical practice. Strict-CPOM states prohibit non-physicians from owning the entity that delivers medical care; minimal-CPOM states allow most ownership structures provided licensed clinicians make the clinical decisions.

• Strict CPOM (NY, CA): Only physicians can own the professional entity. Required structures are Professional Corporations (PCs) or Professional LLCs (PLLCs) with physician owners. Non-physician investors typically use a "friendly PC" / management services organization (MSO) structure to participate economically without owning the medical practice. New York and California enforce CPOM aggressively, and improper ownership invalidates the entire practice.
• Moderate CPOM (TX, GA, FL): Physician control of clinical decisions is required, but ownership flexibility is greater. Texas allows physician-owned PAs (Professional Associations); Georgia and Florida allow various structures provided non-physicians do not direct medical decision-making. Friendly-PC structures are common in all three.
• Minimal CPOM (AZ): Arizona has historically taken the loosest stance — most ownership structures are permitted as long as clinical decisions remain with licensed providers. NPs with full practice authority can own and direct their own practices outright. The state still enforces against unlicensed practice of medicine, but the ownership rules themselves are far less restrictive.

For a deeper dive on ownership specifically, see our state guides on who can own a med spa in California, New York, Georgia, and Arizona.

Nurse Practitioner Scope Spectrum

Whether nurse practitioners can prescribe and direct care without a collaborating physician changes nearly every operational decision: hiring strategy, medical director cost, ownership structure, and which procedures the practice can offer.

• Full practice authority (AZ, CO, and 24+ other states): NPs can evaluate, diagnose, prescribe, and treat independently without a physician collaboration agreement. They can own and direct their own practices. Arizona and Colorado have had full practice authority for years; the list of FPA states grows nearly every legislative session. See our Arizona NP full practice authority guide for the operational implications.
• Conditional practice (NY 3,600-hour rule, CA 104 NP): NPs gain expanded authority after meeting threshold criteria. New York requires 3,600 hours of qualifying practice before an NP can drop the collaborative agreement. California's AB-890 created the "104 NP" pathway — NPs who meet specific credentialing standards can practice independently within designated settings. Both states still draw a hard line at the practice of medicine itself; NPs can practice nursing autonomously, but they cannot serve as a med spa's legal medical director. See our NY 3,600-hour guide and our California AB-890 guide.
• Restrictive collaborative-agreement states (FL, TX, GA): NPs (referred to in Florida as ARNPs and in Texas as APRNs) must work under a written collaborative or protocol agreement with a physician. Florida and Texas require formal collaborative agreements; Georgia requires a protocol agreement that defines prescriptive authority. None of these states permit NP-owned med spas without physician involvement. See our Georgia APRN protocol agreement guide.

State Board Enforcement Intensity

Even when statutes look similar on paper, enforcement intensity varies enormously. The same nominal medical director arrangement that goes unnoticed for years in one state may trigger a board investigation within months in another.

• Active inspection states: New York's Office of Professional Medical Conduct (OPMC), the Texas Medical Board (TMB), and the California Medical Board (MBC) all conduct inspections, complaint-driven investigations, and proactive enforcement against med spa medical directors. Disciplinary actions against "ghost" directors and improper compensation arrangements have increased every year since 2022.
• Complaint-driven states: Florida and Georgia rely more heavily on patient complaints to trigger investigations. Enforcement is real but reactive — a clean complaint history allows many borderline practices to operate under the radar for extended periods, until something goes wrong.
• Lighter-touch states: Arizona's regulatory enforcement around aesthetic medicine has historically been less aggressive than the strict states, though full practice authority creates its own accountability — NPs operating independently bear personal responsibility for outcomes. Illinois and Colorado fall in similar territory, with enforcement scaling up around clear violations rather than systemic inspection.

The 5 Compliance Variables That Change by State

Every state-specific decision a med spa operator makes ultimately collapses into five questions. The answer to each one varies meaningfully by jurisdiction, and getting any one wrong can be the difference between a thriving business and a regulatory shutdown.

1. Medical Director Rules

Who must serve as medical director, what licensure they must hold, what supervision activities are required, and how compensation may be structured. Strict states like New York require an in-state MD or DO with documented chart review and on-site visits; minimal states accept lighter supervision. See our national overview on medical director requirements.

2. Who Can Inject Botox and Fillers

Whether RNs can inject under standing orders, whether NPs need a collaborative agreement, whether estheticians may participate at all. The answer varies in every state, and getting it wrong is one of the fastest paths to a board complaint.

3. Who Can Own a Med Spa (CPOM)

The CPOM spectrum described above. Determines whether a non-physician investor can own equity, whether NPs can own outright, and what entity structure (PC, PLLC, PA, LLC) is required.

4. Laser and Energy-Based Device Oversight

Whether RNs and laser technicians can operate Class IV lasers, whether the state requires a Laser Safety Officer, and whether physician supervision must be on-site or available remotely.

5. Advertising and Marketing Rules

Truth-in-advertising standards, before/after photo restrictions, testimonial rules, and influencer disclosure. State boards layer on top of the FTC federal floor; some states (notably New York and California) have aggressive enforcement around claims that imply guaranteed outcomes.

State-by-State Comparison

The table below summarizes the eight states where med spa growth has been highest. The "Deep Dive" column links to our state hub for each of the six markets where we maintain dedicated guides.

Deep Dives — The 6 States We Cover Most Thoroughly

Below are condensed regulatory snapshots for each of the six states where we maintain a dedicated hub. Each section highlights the state-specific differentiators — the things you cannot copy from another state — and links to the hub for the full set of guides on medical director, scope of practice, GLP-1 prescribing, laser safety, advertising, and ownership.

California

California sits at the strict end of every regulatory spectrum. The California Medical Board (MBC) enforces aggressively against improper medical director arrangements, particularly around "ghost" directors and revenue-tied compensation. Corporate Practice of Medicine doctrine in California is strict: only physicians can own the professional medical corporation, and the friendly-PC / MSO structure is universal among investor-backed med spas.

Nurse practitioner scope changed significantly with AB-890. Qualified "104 NPs" can now practice within designated settings without a standing supervising physician relationship — but they still cannot serve as a med spa's medical director, because that role is defined as the practice of medicine. RNs may inject Botox and fillers under written standardized procedures or physician orders; aestheticians cannot. Class IV laser oversight is governed by Cal/OSHA workplace safety standards in addition to medical practice rules. For the full California compliance picture, start at our California state hub.

Florida

Florida has the highest med spa concentration in the country and a complaint-driven enforcement model through the Florida Board of Medicine. Medical director requirements track standard CPOM rules: a Florida-licensed MD or DO must oversee every facility offering medical procedures. ARNPs (Florida's term for nurse practitioners) must work under a written collaborative agreement with a physician and cannot operate independently. Florida does not permit NP-owned med spas without a physician.

Florida is particularly active around office-based surgery rules (Levels I, II, and III) and has tightened oversight of GLP-1 weight loss prescribing and IV therapy in 2024–2026. RN injection authority operates through physician standing orders. The state's complaint-driven enforcement means many borderline practices fly under the radar until a patient complaint surfaces — at which point the Board moves quickly. For the full Florida picture, see our Florida state hub.

Texas

The Texas Medical Board (TMB) is one of the most active med spa enforcement bodies in the country, and Texas has unique facility-level requirements that differ from every other state. Class IV laser facilities must register with the Texas Department of State Health Services (DSHS), a Laser Safety Officer is required, and physician delegation rules govern who at the facility can perform what procedure. Medical director licensure must be in Texas; out-of-state physicians cannot serve.

NP and PA scope in Texas requires a written delegation order from the supervising physician. RNs and LVNs can administer injectables only under specific delegation. Texas also tightened GLP-1 prescribing rules following the FDA shortage delisting, with the TMB issuing guidance against compounded semaglutide outside specific patient-specific clinical justifications. For the full Texas picture, see our Texas state hub.

New York

New York's regulatory regime is among the strictest and most aggressively enforced in the country. The Office of Professional Medical Conduct (OPMC) treats nominal medical director arrangements as professional misconduct, and the state has sustained an enforcement wave against "ghost" directors and over-extended physicians. CPOM doctrine is strict — Education Law §6521 and Public Health Law §238-a together prohibit non-physician ownership and revenue-percentage compensation.

The 3,600-hour rule defines NP scope: NPs in New York must accumulate 3,600 hours of qualifying practice before they can drop the collaborative agreement, but even then they cannot serve as the legal medical director of a med spa. Out-of-state physicians cannot serve as medical director under any circumstances. Compensation must be flat retainer or documented hourly — not percentage of revenue. For the full New York picture, see our New York state hub.

Georgia

Georgia's regulatory environment is moderate-CPOM with a complaint-driven enforcement style under the Georgia Composite Medical Board. The state's distinguishing feature is the APRN protocol agreement: rather than a generic collaborative practice agreement, Georgia requires a specific written protocol that defines prescriptive authority, scope of delegated services, and the supervising physician relationship. NPs cannot prescribe Schedule II controlled substances under most protocol agreements.

Medical director licensure must be in Georgia, and the medical board has been active in 2024–2026 around GLP-1 telehealth prescribing and improper delegation of laser procedures. RNs may administer injectables under a physician's written delegation. For the full Georgia picture and the protocol agreement details, see our Georgia state hub.

Arizona

Arizona is the friendliest of the six deep-dive states for non-traditional ownership structures. Full nurse practitioner practice authority, in place for years, allows NPs to evaluate, diagnose, prescribe, and own their own practices without a physician collaborative agreement. CPOM enforcement is among the lightest in the country, and Arizona's regulatory burden has historically been lower than New York, California, or Texas.

That said, every Arizona med spa offering medical procedures still needs a licensed physician medical director (MDs and DOs only — NPs can own the practice but cannot be the legal medical director where one is required for non-NP services). Laser oversight is governed by OSHA workplace standards and physician supervision rules; there is no separate Arizona laser operator license. The state has tightened GLP-1 prescribing oversight through the AZ Medical Board in 2025–2026. For the full Arizona picture, see our Arizona state hub.

Cross-State Compliance Themes

Some compliance topics matter in every state but play out differently across jurisdictions. The sections below organize the most important ones with links to the in-state guides.

Medical Director Requirements

Every state with active med spa regulation requires a licensed physician (MD or DO) with an active in-state license to serve as medical director. What changes is the supervision intensity, the documentation burden, and the compensation rules. New York and California are the strictest; Florida and Texas are moderate but enforce real consequences when complaints arise; Arizona is comparatively light.

Read the in-state details for California, New York, Georgia, and Arizona. Texas and Florida medical director versions are part of those state hubs.

Who Can Inject Botox and Fillers

Injection authority is the most common scope-of-practice question med spa operators ask, and the answer varies sharply across states. NPs and PAs can prescribe and inject in every covered state; RNs can administer under standing orders or written physician orders almost everywhere; aestheticians and unlicensed staff cannot inject anywhere. The detail that matters: the documentation that must exist in advance.

State-by-state breakdowns: California, New York, Georgia, and Arizona.

Who Can Own a Med Spa (CPOM Spectrum)

Ownership rules are where Corporate Practice of Medicine doctrine bites the hardest. Non-physician investors typically participate through MSO / friendly-PC structures in strict-CPOM states; in minimal-CPOM states like Arizona, NPs and even non-clinicians can own outright provided clinical decisions stay with licensed providers.

State-specific guides: California, New York, Georgia, and Arizona.

GLP-1 Prescribing Post-FDA-Shortage

The FDA delisted compounded semaglutide from the official shortage list in February 2025 and tirzepatide in October 2024 — meaning compounding pharmacies can no longer rely on the FDA Section 503A/503B shortage exception to produce these medications at scale. State medical boards in 2025–2026 have ramped up enforcement against med spas continuing to dispense compounded GLP-1s without strict patient-specific clinical justification. For most operators, the right post-delisting path is FDA-approved branded medication only.

For the national overview, see our national GLP-1 compliance guide. For state-specific details: New York, Georgia, and Arizona.

Laser Safety and Operator Delegation

Class IV laser oversight follows three different patterns: states with explicit Laser Safety Officer and facility registration requirements (Texas), states with general physician supervision rules layered onto OSHA workplace safety (most others), and states with specific delegation rules around who may operate the device (New York, California). Aestheticians can typically operate Class I and Class II devices for cosmetic purposes; Class IV laser operation almost always requires nursing-level licensure plus device-specific training.

State-specific guides: New York, Georgia, and Arizona.

Advertising Rules

The FTC sets the federal floor on advertising substantiation, endorsement disclosures, and deceptive claims. State medical boards layer additional rules on top — particularly around before-and-after photos, testimonial framing, "guaranteed results" language, and influencer disclosure. New York and California enforce especially aggressively against claims that imply medical outcomes without substantiation.

State guides: California, New York, Georgia, and Arizona.

Multi-State Operators — What Changes When You Expand

When a single brand operates locations in multiple states, the regulatory complexity multiplies in ways that catch most operators off-guard. The mistake to avoid is assuming that a compliance posture that works in your home state can be exported wholesale to a new state. It cannot.

Separate Physician Licensing in Each State

The medical director must be licensed in the state where the facility operates. A California-licensed MD cannot serve as medical director for a Texas location, and vice versa. Multi-state operators either retain one physician who holds licenses in multiple states (often facilitated by the Interstate Medical Licensure Compact, which currently includes 40+ states), or hire separate medical directors per state. Either approach involves separate written agreements per facility per state.

Friendly-PC Structures Vary by State

The MSO / friendly-PC arrangement that works in California may not translate directly to New York, Texas, or Florida. Each state's CPOM doctrine has its own quirks around fee-splitting, anti-kickback overlap, and what management services may legally include. A multi-state expansion typically requires a state-specific structuring review by a healthcare attorney before opening the new location.

Telehealth Prescribing Across State Lines

Telehealth is regulated at the patient's state of residence, not the prescriber's. A New York-licensed physician cannot legally prescribe to a patient sitting in Florida unless they also hold a Florida license or qualify under a specific telehealth exception. The Interstate Medical Licensure Compact accelerates getting additional state licenses but does not eliminate the requirement. Multi-state telehealth expansion almost always requires multi-state physician licensing.

Sales Tax and Per-State Registration

Many states (including Texas, with its Transaction Privilege Tax counterparts; Arizona's actual TPT; and most others) require sales tax or service tax registration in each state of operation, even for service-based businesses. The taxability of cosmetic procedures, retail product sales, and bundled service packages varies state to state. Multi-state expansion adds bookkeeping and compliance overhead beyond the medical regulatory footprint.

The Federal Floor — What Every State Shares

Underneath every state's specific rules sits a federal regulatory floor that applies regardless of where the med spa operates. These rules are non-negotiable nationally and are often the source of the most expensive compliance failures.

HIPAA and State PHI Laws

The Health Insurance Portability and Accountability Act governs protected health information at every med spa, in every state. Patient charts, photos, intake forms, payment information tied to clinical care — all of it falls under HIPAA's privacy and security rules. Some states (notably California with the CMIA, and New York with state-level PHI protections) layer additional requirements on top. HIPAA violations carry per-record penalties that scale into the millions for systemic breaches.

OSHA Bloodborne Pathogens and Sharps Disposal

Every facility that handles blood, sharps, or body fluids — which means every injection-providing med spa — must comply with OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030). Required elements include a written exposure control plan, annual training, hepatitis B vaccination availability, sharps disposal protocols, and post-exposure follow-up procedures. State OSHA programs (Cal/OSHA, AZ State Plan, others) sometimes impose stricter standards than federal OSHA.

FDA Device 510(k) Clearance

Every laser, IPL, RF microneedling, ultrasound, and other energy-based device used at a med spa must be FDA-cleared (typically through the 510(k) pathway) for the specific clinical indication being treated. Off-label use is permitted under the practice of medicine, but the device itself must be cleared. Importing non-FDA-cleared devices for treatment use is a federal violation; many state board enforcement actions begin with an FDA tip.

DEA Registration for Controlled Substances

Any med spa storing or prescribing controlled substances (including Schedule III–V testosterone, Schedule IV ketamine for IV mood therapy, and others) needs DEA registration tied to the practitioner and the location. The DEA registration is location-specific, which becomes another multi-state complication for expansion. Improper handling, theft, or diversion triggers DEA enforcement that often extends beyond the initial finding.

FTC Endorsement Guides and Advertising Substantiation

The Federal Trade Commission enforces truth-in-advertising standards at the federal level. Its Endorsement Guides require clear disclosure of paid relationships in influencer marketing — a frequent enforcement target since 2022. Substantiation requirements mean every clinical claim ("dramatic results," "lose 20 pounds," "permanent hair removal") must be backed by reliable scientific evidence. State medical board advertising rules add layers on top, but the FTC floor applies regardless of state.

2026 Enforcement Trends to Watch

Regulatory enforcement is not static. The trends below are the ones most likely to affect operators across multiple states in the next 12–18 months.

GLP-1 Overprescribing Crackdowns

Following the FDA shortage delisting (semaglutide February 2025, tirzepatide October 2024), compounded GLP-1 prescribing without patient-specific clinical justification has become a primary enforcement target for state medical boards. Telehealth-only weight loss shops have been hit hardest — multiple states have issued cease-and-desist orders, and the trend will continue through 2026. Operators still dispensing compounded GLP-1s should expect board scrutiny.

Nurse Practitioner Scope Expansion Legislation

The list of full-practice-authority states grows nearly every legislative session. Several states are actively debating bills in 2026 that would either expand NP scope or, in some cases, tighten restrictions following adverse-event publicity. Operators should track legislation in their states quarterly — major changes typically take effect within 12 months of passage.

State Board Enforcement Wave

OPMC (NY), TMB (TX), and MBC (CA) have all measurably increased disciplinary actions against med spa medical directors and owners in 2024–2026. The pattern is consistent: complaint volume rises, the board responds with proactive inspections and audit-style document requests, and a disciplinary wave follows. Florida and Georgia complaint-driven enforcement is also up, though through a different pattern. Practices operating with marginal medical director arrangements should expect that the regulatory environment is tightening, not loosening.

Office-Based Surgery and Anesthesia Tightening

Several states have tightened office-based surgery rules following sentinel events involving anesthesia complications at med spas and aesthetic clinics. Florida's Levels I–III office-based surgery framework has been a model that other states are adopting in modified form. Operators offering procedures involving sedation, anesthesia, or surgical-grade interventions should expect new facility registration, anesthesia provider, and emergency response requirements through 2026.

How to Use This Reference

Each cell in the comparison table represents the general rule in that state. Exceptions apply based on how your practice is structured, the specific procedure being performed, whether a provider holds additional certifications, and recent regulatory updates. Always verify directly with your state's medical board and board of nursing before making compliance decisions.

The practical next step for most operators is the state hub for your market: California, Florida, Texas, New York, Georgia, or Arizona. Each hub consolidates the medical director, scope of practice, GLP-1, laser, advertising, and ownership guides for that state into a single navigable page.

For broader compliance topics that are not state-specific, see our reference guides on the most common med spa compliance violations and why med spas get shut down.

Summary — 7 Actionable Takeaways

1. Every state requires a medical director. Confirm the director's in-state license, supervision activities, and written agreement before opening or expanding.
2. The CPOM spectrum determines your ownership structure. Strict states (NY, CA) require physician-owned PCs/PLLCs; minimal states (AZ) allow more flexibility. Get an attorney involved before structuring equity.
3. Nurse practitioner scope is the single biggest variable across states. Full-practice states (AZ, CO) allow NP-owned practices; restrictive states (FL, TX, GA) require collaborative or protocol agreements.
4. The federal floor is non-negotiable. HIPAA, OSHA, FDA, DEA, and FTC apply in every state and are the source of the most expensive compliance failures.
5. GLP-1 prescribing has fundamentally changed post-delisting. Stop dispensing compounded semaglutide and tirzepatide without strict patient-specific clinical justification; expect state board enforcement to continue through 2026.
6. Multi-state expansion multiplies compliance complexity. Separate medical director, separate license, separate CPOM analysis, separate sales tax registration per state.
7. Verify with state boards before making decisions. Regulations change frequently. The state hubs we maintain give a starting point, but your healthcare attorney and the state board are the final authorities.

Frequently Asked Questions