New York Med Spa Compliance Checklist 2026 — Complete Guide

New York runs one of the strictest med spa environments in the country, and it does that without a single dedicated "med spa" statute. Every layer of general practice-of-medicine law applies instead: corporate practice rules enforced by the State Education Department's (NYSED) Office of the Professions under Education Law Title VIII, physician discipline through the Department of Health's Office of Professional Medical Conduct (OPMC), Article 28 facility rules where sedation or surgery is involved, HIPAA paired with NY Public Health Law §18, OSHA layered with NY DEC medical-waste rules, and a Department of State appearance-enhancement license under General Business Law Article 27 that governs estheticians and cosmetologists as a completely separate track from medicine.

This is the working checklist for 2026. If you are opening, buying, or auditing a New York med spa, every item below has to be in place — or in a documented plan to be in place — before you treat your first patient. Where New York hasn't settled a question, or where we could not verify a specific citation from a source we trust, this guide says so rather than inventing one.

What Makes New York Different: Three Agencies, No Med-Spa License

Most states that license "med spas" as such hand an operator a single form. New York gives you three separate regulators, each with a different slice of jurisdiction, and no facility license that covers the whole business. NYSED's Office of the Professions licenses and disciplines physicians, nurse practitioners, physician assistants, and registered nurses, and decides most scope-of-practice questions through its published guidance. The Department of Health's OPMC investigates physician (and PA) misconduct specifically — nurse practitioners, registered nurses, and LPNs answer to the Office of the Professions instead, under 8 NYCRR Part 29. And the Department of State licenses estheticians and cosmetologists under General Business Law Article 27, publishes the Med Spa Procedure Licensure Chart mapping each treatment to the license it requires, and since January 2026 has led a multi-agency inspection task force with DOH, NYSED, OPMC, and New York City's oversight office.

There is no dedicated New York med-spa statute and no facility license category for one. The corporate structure — a physician-owned PC or PLLC — is the real gate, and NYSED screens it before the Department of State will even accept your incorporation filing.

What an Investigation Actually Asks to See

New York doesn't run scheduled med spa facility inspections outside the DOS task force's own sweeps; most OPMC scrutiny starts from a complaint — a patient, a former employee, or a mandatory report from an emergency department. The task force's first published wave, announced January 8, 2026, inspected 223 businesses statewide and cited 87 — for unlawful practice of medicine, unlicensed individuals performing procedures, expired or counterfeit product, and on-site controlled substances. Either route, what gets requested is predictable:

1. Entity paperwork — the NYSED Certificate of Authority and the Department of State filing behind the PC or PLLC, with the current shareholder list
2. Every clinical staff member's license, verified and dated, plus the instrument they work under — an RN's prescriber order, an NP's practice agreement below 3,600 hours, a PA's supervision arrangement
3. Written, physician-signed protocols for the procedure at issue, matched against what the chart shows actually happened
4. The patient's evaluation and order behind the treatment — not a blanket standing order covering "all filler patients"
5. Advertising in force at the time, checked for physician identification and consistency with the entity's actual ownership

Produce clean answers to all five and you are ahead of most New York med spas that draw scrutiny. Everything else in this checklist supports those five.

1. Business Structure: Can a New York Med Spa Be a Plain LLC?

Verdict: no. New York's corporate practice of medicine doctrine prohibits an ordinary LLC or business corporation from delivering medical services. A med spa offering Botox, fillers, dermal-depth laser, IV therapy, or GLP-1 prescribing — anything that meets the Education Law §6521 definition of the practice of medicine — must be organized as a Professional Corporation (PC) under Business Corporation Law Article 15 (§1503) or a Professional Limited Liability Company (PLLC) under LLC Law Article 12. Shareholders or members must be New York-licensed physicians; a registered nurse, esthetician, out-of-state physician, or lay investor cannot hold equity in the entity that delivers the medicine.

Before the Department of State will accept the incorporation filing, the proposed PC or PLLC needs a Certificate of Authority (also called an Authority to Incorporate) from NYSED's Office of the Professions, confirming every owner holds an active New York license in the profession and that the entity's stated purpose stays inside that license. Skipping straight to the Department of State is one of the most common New York formation mistakes — the filing gets accepted, but the entity isn't authorized to practice medicine until NYSED's consent issues.

2. Ownership, Fee-Splitting and MSO Structures

New York's corporate practice bar isn't only about entity type — it extends to who benefits from clinical revenue. Non-physician capital can participate through a separate management services organization (MSO) supplying real administrative services — branding, leasing, scheduling, marketing — under a written management services agreement. The arrangement holds up only if the fee reflects fair value for those services and isn't structured as a share of professional revenue. New York's fee-splitting prohibition — Education Law §6530(19) and §6509-a, alongside Public Health Law §238-a — is written broadly enough to catch a management fee that functions as a disguised percentage of collections.

A nurse practitioner is a partial exception in one narrow sense: an NP can own an NP professional entity, but its scope is limited to nursing practice, not the full range of services a typical med spa sells. An NP cannot own the medical PC or PLLC that delivers Botox, fillers, laser, or GLP-1 prescribing, and installing a physician as a nominal "medical director" over an NP-owned entity does not cure that — it inverts the rule the corporate practice doctrine exists to enforce. Registered nurses and estheticians cannot own the clinical entity at all; each can own a business within their own license's scope, plus a stake in an MSO.

3. Does New York Require a Medical Director?

Verdict: yes in substance, no in vocabulary. No New York statute creates a "medical director" title for a med spa, no agency registers one, and there's no across-the-board rule requiring on-site presence or a set chart-review percentage. What's mandatory is what the title stands in for: because medical services must run through a physician-owned PC or PLLC, the owning or supervising physician already carries legal responsibility for the clinical work. That accountability is enforced after the fact, under Education Law §6530(11) — failing to supervise appropriately, or permitting an unlicensed person to perform licensed activities — and §6530(25), delegating to someone unqualified by training or licensure, through OPMC rather than a registry.

Because the role isn't defined by statute, what OPMC actually evaluates is whether oversight was real. A signed medical director agreement, documented chart reviews, and a dated visit log are the practical evidence a physician was engaged — not because a statute demands that specific paperwork, but because it's what "appropriate supervision" looks like when someone has to prove it after an adverse event. A physician who signs an agreement and is never reachable, never reviews a chart, and never visits is the "paper director" pattern OPMC investigations keep returning to.

4. Physician Assistants: Continuous Supervision and the Six-PA Limit

A physician assistant may perform only medical services delegated by, and under the continuous supervision of, a supervising physician. Under Education Law Article 131-B and §6542(3), that supervision doesn't require the physician's physical presence, but it does require the physician to be reasonably available and the delegation to fit what the PA is actually trained to do. In private practice, one physician may supervise no more than six PAs at a time.

"Continuous" is not a formality. A PA performing dermal-depth laser or injectables needs delegation specific to that procedure, not a general employment agreement, and the supervising physician's exposure under §6530(11) tracks exactly how well that delegation was actually documented and followed.

5. Nurse Practitioners: The 3,600-Hour Threshold

Below 3,600 hours of qualifying practice, a New York NP works under a written practice agreement and protocols with a collaborating physician qualified in the NP's specialty, under Education Law §6902(3) — including periodic peer review of the NP's patient records. Above 3,600 hours, §6902(3)(b) removes the written-agreement requirement, and the NP may prescribe, evaluate, and inject within their certification without it. That threshold was extended by legislation the Governor approved in May 2026 and now runs through July 1, 2030.

None of that changes ownership. An NP above 3,600 hours can practice without a written agreement, but the corporate practice doctrine still bars an NP from owning the medical PC or PLLC that delivers Botox, fillers, or laser treatment — and an NP cannot serve as a med spa's medical director, because that role requires a New York-licensed physician. NPs are the backbone of New York's injectables workforce for a different reason: once the hours threshold clears, they hold independent prescribing and evaluation authority within their own certification.

6. Registered Nurses: The Order Is Everything

Yes, but only on an order. Education Law §6902(1) allows a registered nurse to execute a medical regimen prescribed by a physician, NP, or PA — and adds the line that decides most New York cases: a nursing regimen "shall not vary any existing medical regimen." The prescriber has to evaluate the patient and write a patient-specific order before the RN administers anything. An RN who selects the product, sets the dose, adds a treatment area, or proceeds without a prescriber's order hasn't executed a regimen — they've written one, and that's outside RN scope entirely.

This is the single most misunderstood role in a New York med spa. The limit isn't on the injection itself — it's on assessment and authorization. A standing instruction covering "all filler patients" is not a patient-specific order.

7. Does New York Require a "Good-Faith Exam" Before Botox or Filler?

Not by that name. Unlike some states, New York has no statute or regulation using the term "good-faith examination" for cosmetic injectables — the phrase is borrowed from California, and no New York board has published its elements. That doesn't make the underlying obligation optional. The State Board for Medicine's guidance on energy devices requires "an assessment of the patient's condition before, during, and after" any aesthetic treatment, and treating or prescribing without an appropriate evaluation is misconduct under Education Law §6530. For injectables specifically, the requirement flows from §6902(1): an RN can only execute a regimen a prescriber actually wrote after evaluating that patient, so the evaluation has to happen — it's just not a named, separately codified "exam."

Telehealth evaluations are permitted under Public Health Law Article 29-G (§2999-cc recognizes physicians, NPs, PAs, and RNs as telehealth providers), but the same scope and standard of care apply remotely as in person.

8. Laser and Energy-Device Oversight

The State Board for Medicine determined in 2025 that using any energy device or laser affecting the basement membrane or deeper tissue — the dermis, fat — to treat a physical condition is the practice of medicine under Education Law §6521. That treatment must be performed by, or under the order of, a physician, PA, or NP, and among non-physician staff, only a registered nurse may execute those orders. Laser and IPL hair removal is specifically carved out of that determination, along with other surface-level (Class I–IIIa) devices, which trained non-licensed personnel — including estheticians — may perform.

The practical line: if the device reaches past the basement membrane to treat a medical condition, it's medicine, ordered and supervised the same way an injectable is. If it's surface-level hair removal or a Class I–IIIa device, an esthetician can run it, and the licensure question shifts to their device-specific training rather than a physician order.

9. Esthetician Scope: Where the Appearance Enhancement License Stops

A New York esthetician holds an Appearance Enhancement license issued by the Department of State — not a health board — under General Business Law Article 27. That license covers surface work: facials, superficial chemical exfoliation, microdermabrasion, dermaplaning, comedone extraction, high-frequency and LED treatments, enzyme masks, waxing, and laser hair removal. It does not cover anything that breaks living skin or reaches past the epidermis.

Injections, medium and deep chemical peels, dermal-depth laser and energy devices, and microneedling all fall outside appearance-enhancement scope and into Education Law §6521 as the practice of medicine — regardless of how the treatment is marketed or priced. An esthetician working inside a physician's practice may in some cases perform a delegated task under written protocols, real supervision, and a documented prior evaluation, but that authority comes from the delegating physician, not from the esthetics license itself, and it doesn't travel anywhere else.

10. Office-Based Surgery and Article 28 — When It Applies

Most injectable-and-laser New York med spas fall outside Article 28 facility licensing and outside Public Health Law §230-d's office-based surgery regime entirely, because neither triggers until a practice uses more than minimal sedation or anesthesia. Standard injectables, laser, microneedling, and IV vitamin therapy sit below that line. Bring in a CRNA for sedation cases, run a tumescent liposuction line, or add moderate, deep, or general anesthesia, and the analysis changes: §230-d requires full accreditation and reporting of defined adverse events — an unplanned hospital transfer within 72 hours, an unscheduled admission over 24 hours, a death within 30 days — to the Department of Health's patient safety center within three business days.

There is no general New York med-spa adverse-event reporting duty below that threshold. That's not permission to treat an adverse event casually — it will still be examined through the misconduct and recordkeeping provisions if a complaint follows — it just means the mandatory three-day filing duty is specific to office-based surgery, not to every med spa incident.

11. Records, HIPAA, NY Public Health Law §18 and OSHA/RMW

HIPAA is the federal floor; New York layers Public Health Law §18 on top, governing a patient's own access to their records. Compliant practices need a written Notice of Privacy Practices signed at intake, a designated Privacy Officer, a records-access workflow that responds within §18's statutory window, a reasonable per-page copying fee, Business Associate Agreements with every vendor touching PHI, and documented annual HIPAA training. Records must accurately reflect each patient's evaluation and treatment under Education Law §6530(32), retained at least 6 years from the last entry — for a minor, at least 6 years and until 1 year after they turn 18, so until they turn 19.

Sharps and biohazard handling add a second, state-specific layer. The OSHA bloodborne pathogens standard (29 CFR 1910.1030) applies to any practice using needles; New York's DEC Regulated Medical Waste rules sit on top of it — a written Exposure Control Plan reviewed annually, point-of-use sharps containers, a contract with a DEC-permitted RMW transporter, manifest tracking retained at least 3 years, Hepatitis B vaccination offers with declination forms on file, and a post-exposure protocol with a named occupational health provider.

12. Advertising Compliance

New York med spa advertising sits under three layers of oversight: NYSED (unprofessional conduct rules, including Education Law §6530(27) on false or misleading advertising), OPMC (for physician-specific claims), and the Attorney General (consumer protection). Advertising rarely triggers an investigation on its own, but it's frequently the first thing an investigator reviews once a complaint about something else is already open — and a mismatch between what the ad claims and who's actually licensed to deliver it turns a narrow complaint into a broader one.

13. Emergency Preparedness, Workforce Coverage and the Inspection Binder

Every procedure carrying anaphylaxis or vascular-occlusion risk needs a written response protocol — not a plan to "call 911." Staff need training in early-symptom recognition, not just severe reactions, and epinephrine (plus hyaluronidase where fillers are used) needs to be on hand and in date. Separately, and easy for out-of-state operators to miss: New York requires workers' compensation for virtually every employee, Disability Benefits Law (DBL) coverage for off-the-job illness or injury, and Paid Family Leave, typically bundled with the DBL policy. Certificates of coverage (Forms C-105.2 and DB-120.1) should be at the facility — inspectors can ask for them on the spot.

Build the inspection-ready binder once and keep it current monthly: the NYSED Certificate of Authority, Department of State filing receipt and current biennial statement, PLLC Certificate of Publication (if applicable), medical director agreement and license verification, written protocols for every procedure, staff license verifications, chart-review and site-visit logs, the adverse-event and complaint log, HIPAA/§18 policies, OSHA Exposure Control Plan and RMW manifests, workers' comp/DBL/PFL certificates, and malpractice certificates for the practice and every provider.

The Complete New York Med Spa Compliance Checklist

Run this summary table before opening, before adding a procedure, and before any OPMC or DOS inquiry. Each row maps to a section above — and if you'd rather not build the underlying documentation from scratch, our ready-to-use med spa compliance SOPs cover the protocol side of every row here.

Run through this checklist before your first patient, before adding any new procedure, and before any OPMC or Department of State inquiry. If you find gaps, close them before operating — not after a citation.

Disclaimer: This article is for educational purposes only and does not constitute legal advice. New York med spa compliance involves overlapping statutes, regulations, and agency interpretations specific to your facility, and several questions discussed here are genuinely unsettled. Consult a qualified New York healthcare attorney before forming an entity, signing a medical director or supervision agreement, or opening for patients.