How to Open a Med Spa in New York: Step-by-Step Guide (2026)

New York has one of the most regulated environments in the country for opening a medical practice — and a med spa is, legally, a medical practice. The state's Department of State, the NYSED Office of the Professions, the Department of Health, and the Workers' Compensation Board all touch your file before you ever see a patient.

This guide walks the steps in the order they actually happen. Skip a step and you either can't move to the next one, or you build a structure that has to be dismantled later. Both are expensive.

If you already know the state and just need to confirm the order, the short version is below the Quick Answer. The longer version below it explains why each step exists and where most New York med spas trip themselves up.

Before You File Anything: Decide Who Owns It

This is the single most consequential decision you will make. New York follows the Corporate Practice of Medicine doctrine: only licensed physicians can own a medical entity that delivers medical services. Non-physician investors cannot hold equity in the PC or PLLC.

That means the first question is not "what entity?" — it is "who is the licensed owner of record?" If you are not a New York-licensed MD or DO, you need a physician partner before any of the following steps make sense. See who can own a med spa in New York for the full ownership analysis, including how Management Services Organization structures fit (and where they break).

Once you have your licensed owner, the rest of this guide assumes you are filing as a licensed professional or with one as a co-founder.

Step 1: Choose Your Entity — PC or PLLC

New York gives licensed professionals two real options for their operating entity:

Professional Corporation (PC) — governed by New York's Business Corporation Law Article 15. Older, more established, and what most New York healthcare attorneys default to. Subject to corporate formalities: a board of directors, annual meetings, minutes, and a more rigid governance structure. Default tax treatment is C-corp unless you elect S-corp status.

Professional Limited Liability Company (PLLC) — governed by New York's Limited Liability Company Law Article 12. Newer, fewer formalities, and pass-through taxation by default. Most modern single-physician and small-group med spas choose PLLC for the simpler operating agreement and tax treatment.

Both structures share one rule: every owner must be licensed in the same profession the entity practices. For a med spa, that means every owner must be a licensed New York physician. You cannot have a physician owner and a non-physician spouse co-owner. You cannot have a physician owner and a registered nurse co-owner. The entity's professional license follows its weakest-credentialed owner — and a non-physician owner makes the entity unable to legally provide medical services.

Practical guidance: If you are a single physician opening one location, PLLC is usually cleaner. If you are joining or buying into an existing structure, mirror what already exists. If you anticipate complex governance or institutional investors via an MSO, talk to a healthcare attorney before filing — the entity choice locks in many downstream tax and governance constraints.

Step 2: Reserve Your Name with the NY Department of State

Before you file your Certificate of Incorporation or Articles of Organization, reserve the entity name with the New York Department of State. Names of professional entities have additional rules:

• The name must include "Professional Corporation" or "P.C." (for PC) or "Professional Limited Liability Company" or "PLLC" (for PLLC)
• The name typically must include the surname of one or more owners — though there are exceptions for trade names
• The name cannot mislead the public about the services offered or the credentials of the providers

Most operators use a parent professional entity (e.g., "Smith Medical PLLC") and operate the consumer-facing brand ("Bright Med Spa") through a properly filed assumed name. The branded marketing name is filed as a Certificate of Assumed Name. Your healthcare attorney should confirm both filings are aligned before the doors open.

Step 3: Get the NYSED Certificate of Authority (the New York Step)

This is the step that catches most out-of-state founders by surprise. New York requires a Certificate of Authority — sometimes called Authority to Incorporate — issued by the NYSED Office of the Professions before the Department of State will accept your Certificate of Incorporation (PC) or Articles of Organization (PLLC) for a professional entity.

NYSED reviews:

• The proposed entity name and whether it complies with professional naming rules
• The licenses of every proposed owner and officer
• Whether the structure complies with New York's Education Law and the relevant profession's regulations

Processing time runs 6 to 12 weeks depending on workload — and there is no expedited path. This single step is the most common reason NY launches slip on timeline. If your business plan assumes a 60-day launch, NYSED alone will break it.

Practical advice: File the NYSED application as the first official action after you have your physician owner identified and your entity name selected. Do it before you sign a lease, before you order equipment, and before you build the build-out timeline.

Step 4: File Your Certificate of Incorporation with NY DOS

Once NYSED issues the Certificate of Authority, you can file with the New York Department of State:

• PC: Certificate of Incorporation, attaching the NYSED Certificate of Authority
• PLLC: Articles of Organization, attaching the NYSED Certificate of Authority, plus the publication requirement (PLLC formation requires publication in two newspapers in your county for six consecutive weeks, with a Certificate of Publication filed afterward)

Budget for the publication cost in your PLLC. In New York County (Manhattan), publication is famously expensive — often $1,500 to $2,000 — because of the designated newspapers. In most upstate counties, publication runs $200 to $500. This is a real, non-optional cost; missing the publication requirement suspends the PLLC's ability to bring lawsuits in NY courts.

Step 5: Get a Federal EIN

Apply directly with the IRS at irs.gov. The EIN is free, issued immediately online, and required for nearly every step that follows: opening a bank account, registering as an employer, applying for DEA, signing payor contracts, and filing taxes. Use the EIN that matches the entity name on your DOS filing exactly — mismatches between IRS and NY filings cause headaches at tax time.

Step 6: Register as a New York State Employer

Even if you are the only worker on day one, you typically need to register as an employer in New York to comply with:

• Workers' compensation coverage through the New York Workers' Compensation Board — required even for one-person practices in most cases
• Disability Benefits Law (DBL) coverage — New York-specific short-term disability insurance for employees
• Paid Family Leave (PFL) — funded through employee payroll deductions, but the policy must be in place
• Unemployment insurance registration with the New York Department of Labor
• State withholding registration with the New York Department of Taxation and Finance

Many New York med spa owners underestimate this. Workers' comp and DBL are typically packaged together by the same broker — but the policy must be active before a single W-2 employee starts. 1099 contractor structures do not exempt you from these obligations for true employees; misclassification penalties in New York are substantial.

Step 7: Contract Your Medical Director

If you are not the owner-physician practicing on-site, you need a contracted medical director. Even if you are an owner-physician, a written supervision and protocol structure is required. New York's medical director requirements are stricter than many states — including specific expectations around chart review, protocol approval, and supervision of nurse practitioners and physician assistants.

The full breakdown of who can serve, what the contract must include, and how compensation must be structured to avoid kickback issues is in our New York medical director requirements guide. Read that before you sign anyone — a sham medical director arrangement is one of the most common enforcement triggers in New York.

Step 8: Build Out the Facility

Lease, design, permit, build. The order of operations:

1. Confirm zoning — Medical use is not permitted in every commercial zone. Confirm with the local building department before signing a lease. In NYC, the certificate of occupancy must allow medical or professional use; many "office" or "retail" spaces require a CO change.
2. Negotiate the lease — Build in a contingency for permitting delays. New York permitting (especially in NYC) is unpredictable. A "permits or terminate" clause protects you if the city denies your build-out.
3. Architectural plans — Required for any tenant improvements affecting plumbing, electrical, or partition walls. Treatment rooms typically need dedicated sinks, GFCI outlets, and appropriate lighting.
4. Pull permits — Building permit, plumbing permit, electrical permit. NYC adds its own DOB process.
5. Build, inspect, sign-off — Final inspection and sign-off must precede patient operations.

Realistic build-out timeline outside NYC is 6 to 10 weeks for a light-touch fit-out. Inside NYC: 10 to 16 weeks if everything goes smoothly. Plan accordingly.

Step 9: DEA Registration (If Applicable)

You need a DEA registration if your practice will store, prescribe, or administer controlled substances. For a typical aesthetic-only med spa (Botox, fillers, laser, microneedling), you usually do not need DEA. For practices offering:

• Compounded peptides where the underlying substance is scheduled
• Certain weight-loss medications (some GLP-1 adjuncts and stimulants are scheduled)
• Sedation or pain management procedures using scheduled drugs
• Hormone therapy involving scheduled testosterone preparations

...DEA registration is required, and it is tied to the specific practice address. Application is through DEA Form 224. Processing typically takes 4 to 6 weeks. Note: the registered owner must be an authorized prescriber under New York law, and the New York State Bureau of Narcotic Enforcement also requires a separate state-level controlled substance registration.

Step 10: Malpractice Insurance

Two layers of coverage:

• Entity coverage — Covers the PC or PLLC for vicarious liability and corporate exposure. Typical minimum limits are $1M per occurrence / $3M aggregate, though many New York med spas carry $2M / $4M.
• Per-provider coverage — Each licensed clinician (physician, NP, PA, RN performing injections) needs their own coverage. Some entity policies cover employed providers; others require individual policies.

Carriers will ask about specific procedures, training documentation, and supervision protocols before issuing a quote. The medical director arrangement and written SOPs influence pricing — practices with formal protocols and documented training records pay less.

Tail coverage matters when providers leave: claims-made policies require a tail to cover incidents after the policy ends. Make sure your contracts specify who pays for tail coverage when a provider departs.

Step 11: HIPAA Program and NY PHL §18 Patient Records

Federal HIPAA applies to every med spa as a "covered entity." New York adds Public Health Law §18, which governs patient access to medical records and imposes specific timelines and requirements that are sometimes stricter than HIPAA defaults.

Your minimum HIPAA program before opening:

• Designated Privacy Officer and Security Officer (often the same person in a small practice)
• Written Notice of Privacy Practices given to every patient at first visit
• Business Associate Agreements with every vendor that touches PHI (EHR, billing, lab, analytics, even some marketing tools)
• Security Risk Assessment documented in writing
• Workforce HIPAA training, documented with sign-off
• Breach response plan
• Patient access procedures aligned with PHL §18 timelines

This is not optional and not paperwork-only. The HHS Office for Civil Rights audits small practices, and the NY Attorney General has its own enforcement authority. A compliant program is a Day 1 requirement.

Step 12: Build Written SOPs and Protocols for Every Procedure

Every clinical service offered must have a written, medical-director-approved standard operating procedure. At a minimum, each protocol should specify:

• Indications and contraindications
• Patient screening and informed consent requirements
• Pre-procedure assessment and required labs (where applicable)
• Step-by-step procedure technique
• Dosing ranges and product specifications
• Adverse event recognition and response
• Post-procedure care and follow-up
• Documentation requirements

A written protocol is what distinguishes "supervised practice" from "unsupervised practice." Without protocols, every procedure is performed at the individual judgment of the staff member — which is not defensible to the New York State Department of Health or to a malpractice carrier when something goes wrong.

Step 13: Hire Staff and Verify Every License

Every clinical staff member's license must be verified through NYSED before they touch a patient. Verify:

• Active New York license in the relevant profession (MD, DO, NP, PA, RN, LPN)
• No active disciplinary actions, surrenders, or restrictions
• NP collaborative practice agreements where applicable, or 3,600-hour status (see our NY NP 3,600-hours guide)
• National certification (FNP, AGNP, etc.) for NPs
• Specialty board certification for physicians (where relevant)

Document the verification with the date and the source. Check licenses again at renewal — a lapsed license that you didn't catch creates exposure for the practice and the medical director.

Equally important: who is allowed to perform what. Scope of practice for cosmetic injectors in New York is more restrictive than many states. See our who can inject Botox in New York guide for the provider-by-provider breakdown before you build job descriptions.

Step 14: Marketing and Advertising Setup

Set up your website, Instagram, Google Business Profile, and any local advertising — but build them to comply with New York's medical advertising rules from the start. New York requires clear identification of the supervising physician, prohibits misleading claims about provider credentials, and restricts certain promotional language (e.g., "guaranteed results," undocumented before/after claims).

The full set of New York-specific advertising rules — including required disclosures and the language Google and Meta will reject — is in our New York med spa advertising rules post. Get your marketing collateral reviewed against that list before you spend money on paid ads.

Step 15: NYC-Specific Add-Ons

Operating in any of the five boroughs adds requirements on top of the state-level checklist:

• NYC Department of Consumer and Worker Protection — Certain service categories require local registration; confirm whether your specific offerings trigger it.
• NYC Health Code — Article 5 and related sections impose additional sanitation, infection control, and reporting requirements on facilities providing medical services. Inspections occur and citations are real.
• Regulated medical waste disposal — You must contract with a licensed medical waste / sharps disposal vendor. Document the manifest for every pickup. NYC tracks this.
• NYC Department of Buildings permits — Any tenant build-out requires DOB approval. The CO must reflect medical or professional use; if it doesn't, you need a CO amendment, which can take months.
• Signage rules — NYC limits the size, illumination, and content of business signs. Permits are typically required for any exterior signage.
• Fire Department inspections — FDNY inspects for occupancy, exit signage, fire extinguisher placement, and emergency lighting before you operate.

Budget an extra 4 to 8 weeks and an extra $10,000 to $25,000 for the NYC layer on top of the state-level launch.

Realistic Timeline

Below is a defensible 5-month sequence, assuming nothing major goes wrong:

• Month 1: Decide entity, identify physician owner, file NYSED Certificate of Authority application, sign engagement with healthcare attorney and CPA, start scouting real estate
• Month 2: NYSED still processing — sign lease (with permits contingency), start architectural plans, begin medical director conversations, draft SOPs and consent forms
• Month 3: NYSED Certificate received, file PC/PLLC with DOS, EIN issued, employer registrations filed, malpractice quotes in hand, build-out begins
• Month 4: Build-out continues, medical director contracted and protocols finalized, equipment ordered and delivered, HIPAA program documented, hire and credential staff
• Month 5: Final inspections, soft-open, marketing live, first patients

Inside NYC, add at least one month for permitting and CO issues. If your physician owner is also working full-time elsewhere during the launch, add another month for execution bandwidth.

Realistic Cost Ranges (2026)

Outside Manhattan (most of NY State):

• Legal (entity formation, NYSED, contracts, lease review): $7,000–$15,000
• Build-out (light fit-out): $25,000–$60,000
• Equipment (treatment chairs, basic devices, supplies): $15,000–$50,000
• Initial inventory (toxin, fillers, peptides, skincare): $10,000–$25,000
• Medical director retainer (3 months prepaid): $9,000–$18,000
• Malpractice (entity + provider): $4,000–$8,000 first year
• Software (EHR, scheduling, payments, marketing): $3,000–$8,000 setup
• Marketing launch budget: $5,000–$15,000
• Working capital (3 months operating): $30,000–$60,000

Realistic all-in: $25,000 to $75,000 to launch, plus working capital.

Manhattan / NYC:

• PLLC publication alone: $1,500–$2,000
• Build-out costs run 50%–100% higher
• Rent and key money on lease signing
• NYC permitting fees and architect costs
• Higher medical director rates ($4,000–$8,000/month)

Realistic NYC all-in: $100,000 and up to launch. Manhattan-specific launches often cross $200K when the build-out is full custom.

Common Mistakes That Delay or Sink New York Launches

• Filing entity formation before NYSED — DOS will reject the filing and you waste filing fees plus weeks
• Adding a non-physician spouse or investor as a co-owner — invalidates the entity's professional license
• Treating a paper medical director as sufficient — if the director never visits, never reviews charts, and is unreachable, you are unsupervised in practice
• Signing a lease before confirming zoning and CO — discovering you cannot legally provide medical services in the space after the lease is signed is catastrophic
• Skipping PLLC publication — suspends your ability to enforce contracts and bring claims in NY courts
• Ignoring NYC layer until late — discovering NYC-specific requirements after build-out delays opening by months
• Operating before workers' comp / DBL is in place — fines escalate quickly and stop-work orders are real
• Marketing before legal opening — running ads before the PC/PLLC is registered, the medical director is contracted, and the protocols are signed creates exposure on every booked appointment

Summary

1. Confirm physician ownership before anything else — only NY-licensed physicians can own a NY med spa
2. Choose PC or PLLC; both work, PLLC is cleaner for most modern launches
3. File NYSED Certificate of Authority FIRST — this is the New York-unique step that breaks most timelines
4. File with NY DOS only after NYSED issues authority; PLLC requires publication
5. EIN, employer registration, workers' comp, DBL, and PFL before any employee starts
6. Contract a real medical director with a written agreement, on-site visit schedule, and chart review
7. DEA registration if controlled substances are part of your scope
8. Malpractice — entity policy plus per-provider coverage with tail provisions
9. HIPAA program and NY PHL §18 records procedures from Day 1
10. Written, signed SOPs for every procedure offered
11. NYC adds significant time and cost — budget for it from the start
12. Plan 3–6 months and $25K–$75K (or $100K+ in Manhattan) to open

If you are building toward launch and want the SOP and consent form library already mapped to New York standards, the Complete SOP Suite covers all 62 procedure protocols. Combined with our New York med spa compliance checklist, it covers the documentation an inspector would ask for on Day 1.

Disclaimer: This article is for educational purposes only and does not constitute legal advice. Opening a medical practice in New York involves complex legal, tax, and regulatory considerations specific to your situation. Consult with a New York healthcare attorney and a CPA before forming an entity, signing a lease, or hiring staff.