Pennsylvania Med Spa Laws 2026: The Complete Regulatory Guide

Most guides to Pennsylvania med spa regulation start by looking for the rule that governs medical spas, fail to find it, and then either invent one or go quiet. This page starts from the opposite end. The absence is the answer, and once you accept it the rest of the picture snaps into focus: the Commonwealth regulates practitioners and acts, and leaves the category of business you happen to be running entirely unaddressed.

What follows is the map — not a scope guide. We have deep Pennsylvania guides for who may inject, what an esthetician may do, and who may own the entity, linked at the relevant points rather than repeated. This page answers the prior question those guides assume you have settled: who is actually in charge of me, what do I have to file, and what will be asked for if a complaint lands?

Does Pennsylvania License Med Spas?

No. There is no Pennsylvania medical spa licence, registration or permit, and no Pennsylvania statute uses the term. If you have been hunting for the application form, you can stop: it does not exist, and its absence is structural rather than an oversight.

The direct answer, and why it surprises people

Operators expect a licence because almost every other regulated business they have run required one. But in Pennsylvania "med spa" is a marketing description for a business whose legal character is something else — a physician medical practice that sells cosmetic services. The Commonwealth licenses the physician, the nurse, the physician assistant and the esthetician individually. It does not license the room they stand in. So there is no moment at which the state blesses your operation, no pre-opening inspection, and no certificate to point to. You assemble your authority from individual licences, an entity form and a defensible delegation chain — and you are the only party who ever checks the assembly is complete.

What Pennsylvania regulates instead: the people and the acts

The governing instrument for nearly everything a med spa sells is the Medical Practice Act of 1985 (act of 20 December 1985, P.L. 457, No. 112; 63 P.S. §§ 422.1–422.53), with the parallel Osteopathic Medical Practice Act (act of 5 October 1978, P.L. 1109, No. 261; 63 P.S. §§ 271.1–271.18) doing the same work where the responsible physician is a DO. Injecting a neuromodulator, firing an aesthetic laser, running an IV, prescribing a weight-loss agent — each is the practice of medicine, and therefore something a physician performs or lawfully delegates under written conditions.

Why "unlicensed" does not mean "unregulated"

The most expensive misreading is treating the missing licence as a missing rule. A state that licenses facilities tells you what it expects and inspects against that list. Pennsylvania gives you no such list and holds you to the underlying standards anyway: unauthorised practice remains actionable under 63 P.S. § 422.10, the Commonwealth can seek an injunction against unlawful practice under § 422.38, and the licensed people around a bad outcome face discipline under § 422.41. Because nothing is checked in advance, everything shifts to the back end — proved after the fact, from your own records, at the worst possible moment.

Which Pennsylvania Boards Regulate a Med Spa?

Four professional boards and two Commonwealth departments, and which of them reaches you depends on your menu and staffing. No single body owns a Pennsylvania med spa, which is exactly why operators struggle to work out who to call.

The State Board of Medicine

This is the board that matters most for the majority of Pennsylvania med spas. It licenses medical doctors and physician assistants, administers the Medical Practice Act of 1985, and wrote the delegation rule most med spa treatments run through: 49 Pa. Code § 18.402, in Subchapter G, "Medical Doctor Delegation of Medical Services". If your responsible physician is an MD, its rules define what your non-physician staff may be handed.

The State Board of Osteopathic Medicine — the parallel board people forget

Pennsylvania runs two medical boards, and a DO-supervised practice answers to the second. It administers the Osteopathic Medical Practice Act and maintains its own delegation provision at 49 Pa. Code § 25.217, issued under sections 3 and 16 of that act (63 P.S. §§ 271.3 and 271.16). The substance runs closely parallel; the citations and the disciplinary forum differ. Practices that hire a DO director after operating under an MD sometimes carry forward policies citing only the Board of Medicine — a small error that reads badly in an investigation.

The State Board of Nursing

Any med spa staffed by nurses has a second board in the picture. It administers the Professional Nursing Law (63 P.S. §§ 211–225.5) and 49 Pa. Code Chapter 21, governing registered nurses, licensed practical nurses and certified registered nurse practitioners. Two provisions recur: § 21.14, under which a licensed registered nurse may administer a drug ordered for a patient in the dosage and manner prescribed, and the CRNP prescriptive-authority provisions at §§ 21.283 and 21.285. Its jurisdiction is independent of the medical board's, which is why one incident can generate two disciplinary files.

The State Board of Cosmetology

If you employ an esthetician or run a salon alongside the clinical side, the fourth board applies. It administers the Cosmetology Law (act of 3 May 1933, P.L. 242, No. 86; 63 P.S. §§ 507–527) and 49 Pa. Code Chapter 7, where § 7.1 defines the services and § 7.14a states flatly that an esthetician licence qualifies the holder "to perform esthetician services only". It is the only one of the four that licenses premises at all — salons, not med spas. We work the boundary in our Pennsylvania esthetician scope of practice guide.

Where the Department of State fits

All four boards live inside the Bureau of Professional and Occupational Affairs (BPOA), within the Department of State. That is where licence verification happens, where board filings are lodged — a CRNP's prescriptive authority collaborative agreement is filed with the Bureau — and where the investigators who handle professional complaints sit.

Where the Department of Health fits — and where it does not

The Department of Health is separate, and it does not license or inspect medical spas. Two of its programmes can touch you. The Drug, Device and Cosmetic Program requires registration by businesses that manufacture, compound, distribute or sell drugs, medical devices or cosmetics, with requirements at 28 Pa. Code § 25.113. Facility licensure under the Health Care Facilities Act (35 P.S. §§ 448.101–448.904b) reaches ambulatory surgical facilities — a category almost no med spa falls into.

The regulator map, on one screen

Read the "reaches you when" column first: it tells you which rows you can ignore.

For the condensed reference version with primary-source links alongside each dimension, see our Pennsylvania med spa regulations summary.

What Business Licences and Registrations Does a Pennsylvania Med Spa Actually Need?

Ordinary business ones, plus a health-specific registration that depends on what you stock. There is no clinical licence to obtain, so the list is shorter than most people brace for — and the items on it are ones a general business lawyer would recognise.

The entity filing comes first

Because a Pennsylvania med spa delivers medical services, it cannot be an ordinary LLC owned by whoever put up the money. It must be a professional entity whose ownership satisfies Pennsylvania's rules on who may hold equity in a medical practice — the professional corporation route under 15 Pa.C.S. Chapter 29, with the board's constraint at 49 Pa. Code § 16.21, which permits a medical doctor to form a professional corporation with other medical doctors or with health care practitioners licensed to provide services without referral or supervision from another practitioner. This is the most consequential filing you will make and the hardest to unwind. Read who can own a med spa in Pennsylvania before forming anything.

Fictitious name registration

If the business trades under a name that is not the registered entity name — and med spas almost always do — Pennsylvania requires registration of the assumed name under the Fictitious Names Act of 1982 (54 Pa.C.S. §§ 301 et seq.), on Form DSCB:54-311 with the Department of State. It is a modest filing, most commonly skipped by practices that grew out of an existing physician office and simply started using a new brand on the signage.

Tax registration

Register with the Department of Revenue through the PA-100 enterprise registration, now handled in the myPATH portal, for the accounts your operation triggers — employer withholding if you have staff, and a sales tax licence if you sell tangible goods. That last one catches med spas routinely, because retail skincare is a taxable product line even where treatments are not. There is no fee for a Pennsylvania sales tax licence.

Drug, Device and Cosmetic registration

This is the registration most likely to be missed, because it does not sound as though it applies. Any business in Pennsylvania that manufactures, compounds, distributes or sells drugs, medical devices or cosmetics must register with the Department of Health's programme unless exempt, and separate registration is required for each place where drugs or devices are sold. Whether it reaches you depends on what you do with product: administering a drug ordered for a specific patient is a different activity from stocking and retailing it. If you sell physician-dispensed skincare, resell devices or hold inventory for distribution, raise it with counsel before assuming you are exempt.

A cosmetology salon licence — only if you run a salon

If part of your footprint operates as a cosmetology or esthetician salon, that part needs a salon licence under 49 Pa. Code § 7.51, and the board will not issue it until it has verified the owner-applicant's sworn statements and a Bureau inspector has inspected the premises for compliance with the facility requirements. This is the only pre-opening inspection anywhere in the Pennsylvania med spa picture — and it applies to the salon, not the medical side.

Does a Pennsylvania Med Spa Need a Medical Director?

Not by that title — and the honest answer is more demanding, not less. Pennsylvania imposes no medical director requirement on medical spas, because it does not recognise medical spas. It imposes personal, non-delegable duties on whichever physician is delegating the services your staff perform.

The word Pennsylvania does not use

Search the Medical Practice Act and the Board of Medicine's regulations for a med spa medical director requirement and you will not find one: no registration naming that person, no attestation they file, no rule specifying their duties by that title. Practices arriving from states that run a named-director regime often assume Pennsylvania must have an equivalent buried somewhere. Time spent looking for it is time not spent on the requirement that does exist.

What the delegating physician is actually on the hook for

Delegation authority comes from section 17 of the Medical Practice Act (63 P.S. § 422.17), which permits a medical doctor to delegate performance of a medical service where the delegation is consistent with the standards of acceptable medical practice in the Commonwealth, is not prohibited by the Board's regulations, and is not prohibited by the statutes or regulations governing other licensed practitioners. The implementing rule, 49 Pa. Code § 18.402, adds the conditions that decide real cases:

• The physician must know the delegatee has the education, training, experience and continued competency to safely perform the delegated service.
• The physician must have determined the delegation creates no undue risk to the particular patient being treated.
• The nature of the service and the fact of the delegation must be explained to the patient, who must not object; the explanation may be oral and may be given by the physician or the physician's designee.
• The physician assumes responsibility for the delegated service, including its performance.
• The physician must be available to the delegatee as appropriate to the difficulty of the procedure, the skill of the delegatee, and the risk level to that patient.
• A service may not be delegated where performing it, or recognising its complications and risks, requires knowledge and skill not ordinarily possessed by non-physicians.

Pennsylvania does not want a title on an org chart; it wants a physician who can demonstrate, patient by patient and delegatee by delegatee, that they knew who was competent to do what and stayed reachable while it happened. The osteopathic provision at § 25.217 runs in parallel. "Available" does quiet, heavy work here: it is a proportionate standard, not a fixed distance, and one of the genuinely unsettled corners of Pennsylvania practice.

The CRNP-led variation

Where a nurse practitioner leads the clinical side, the physician relationship takes a different legal shape — collaboration under a written agreement rather than delegation, with prescriptive authority resting on the requirements at 49 Pa. Code §§ 21.283 and 21.285. That agreement must be in writing, identify the collaborating physician and at least one substitute, specify how often the collaborating physician will personally see patients, be reviewed at least every two years, and be kept at the CRNP's primary practice location with a copy filed with the Bureau. Practices frequently paper this as a "medical director agreement" and then find it does not contain what a prescriptive authority collaborative agreement must contain.

Do Med Spas Have to Be HIPAA Compliant?

Only if a specific federal test is met — and it is a real legal test, not a general expectation of discretion. Pennsylvania operators get this wrong in both directions: some assume HIPAA reaches every practice that touches health information, others assume cash-pay means it never applies. Both are wrong, and the difference is a single defined term.

The covered-entity test, stated precisely

Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter. A med spa is plainly a health care provider. Whether it is a covered one turns entirely on the second half of that clause. Note what it does not say: not a provider who holds records electronically, or emails patients, or uses cloud software, or takes card payments. The trigger is transmitting health information electronically in connection with a covered transaction.

What counts as a covered transaction

The covered transactions are the standard administrative and financial messages for which HHS has adopted standards under 45 CFR Part 162: health care claims or equivalent encounter information, eligibility for a health plan, claim status, referral certification and authorisation, enrolment and disenrolment, payment and remittance advice, premium payments, and coordination of benefits. Every one is a message between a provider and a health plan — billing-and-benefits messages, not clinical ones. A practice that exchanges none of them does not meet the trigger, however sophisticated its electronic record system.

Why cash-pay med spas assume wrongly — in both directions

The first error is assuming coverage. A purely cash-pay aesthetic practice that has never submitted a claim, run an eligibility check or touched a payer is very likely not a covered entity, and the federal Privacy, Security and Breach Notification Rules do not attach to it by default.

The second error is assuming exemption, and it is more dangerous because the trigger is easy to pull without noticing: a single electronic eligibility check; a superbill workflow that becomes actual electronic claim submission; adding a service line such as hormone therapy or weight management that bills insurance while the aesthetic side stays cash; a practice management platform running benefit verification because the setting was on by default. Status attaches to the practice, not the service line — you cannot be covered for the medical side and uncovered for the cosmetic side.

The two other routes in

Covered-entity status is not the only way HIPAA reaches a med spa. The first alternative is business associate status: if you perform a function involving protected health information on behalf of a covered entity — the arrangement some med spas have with an affiliated dermatology or plastic surgery practice — you are directly regulated in that capacity whatever your own status. The second is contractual: a laboratory, pharmacy, hospital partner or software vendor may simply require a business associate agreement, and once signed its terms bind you regardless of what the regulation would have required.

What applies even when HIPAA does not

Concluding that HIPAA does not apply is not a conclusion that patient information is unprotected. Pennsylvania's own confidentiality obligation sits in professional conduct: 49 Pa. Code § 16.61 makes it unprofessional conduct for a Board-regulated practitioner to reveal personally identifiable facts obtained as the result of a practitioner-patient relationship without the patient's prior consent, except as authorised or required by statute. That duty follows the practitioner's licence, not the practice's HIPAA status.

Pennsylvania's breach notification law, and what changed in 2024

Separately from HIPAA, Pennsylvania's Breach of Personal Information Notification Act (73 P.S. §§ 2301 et seq.) requires notification when personal information is breached. Act 151 of 2022, effective 2 May 2023, broadened the definition of personal information to include medical information and health insurance information alongside usernames and passwords. Act 33 of 2024, signed 28 July 2024 and effective 26 September 2024, then added an Attorney General notification requirement, mandated twelve months of credit monitoring for certain breaches, and narrowed the medical-information trigger so it applies to information held by a state agency or state agency contractor. For a private med spa the medical-information trigger will usually not reach you; the other categories of personal information you hold still do.

What Are Pennsylvania's Rules on Medical Records Retention for a Med Spa?

Seven years from the last service, with a much longer rule for minors. Unlike most of this page, this one is written down with unusual precision: 49 Pa. Code § 16.95 is a short regulation that decides a surprising number of Pennsylvania disputes.

The retention verdict, and the date that starts the clock

A patient's medical record must be retained for at least seven years from the date of the last medical service for which a medical record entry is required. The measurement point is where practices go wrong. It is not seven years from when the chart was opened, nor from the first visit. Every subsequent treatment resets the clock, so for a patient treated across a decade the seven years runs from their most recent visit — meaning an active patient's earliest records are still live records. Any purge routine built on chart creation date will destroy records you were required to keep.

Minors are the exception that catches cosmetic practices

A minor patient's record must be retained until one year after the minor reaches majority. The rule operates alongside the seven-year rule rather than replacing it, so the safe reading is to keep a minor's record until the later of the two dates. In practice the failure mode is not miscalculation — it is that nobody flagged the chart as a minor's at intake, so it flowed into the ordinary retention queue.

What the record must actually contain

Retention is only half of § 16.95. The regulation also requires records that accurately, legibly and completely reflect the evaluation and treatment of the patient, containing information sufficient to clearly identify the patient, to identify the person making the entry where that person is not the physician — a physician assistant or certified registered nurse practitioner, for example — the date of the entry, and the patient's complaints and symptoms. That "who made this entry" requirement is what makes an unsigned or ambiguously attributed treatment note a regulatory problem rather than untidy record-keeping. Where the person who evaluated the patient and the person who treated them differ, both must be identifiable from the chart alone.

What Does Pennsylvania Require on Advertising and Patient Consent?

On advertising, a standard easier to breach than operators expect. On consent, a statute narrower than they expect — plus two obligations that are broader. These sit together because they are where the gap between what a med spa says and what actually happens becomes a disciplinary matter.

The advertising verdict: a tendency to deceive is enough

Pennsylvania's advertising standard sits inside 49 Pa. Code § 16.61, which treats advertising of a medical business that is intended to or has a tendency to deceive the public as unprofessional conduct, exposing the practitioner to discipline under section 41 of the Medical Practice Act. Read that phrase carefully. The Board does not have to prove intent, and does not have to produce a patient who was actually deceived. An advertisement that merely tends to create a false impression satisfies the standard — a materially lower bar than the false-advertising standard most business owners have in mind.

What that catches on a real med spa website

The standard reaches well beyond invented claims: language implying a treatment is medically supervised in a way it is not; package pricing that obscures what is included; outcome claims a reasonable reader would take as typical when they are not. Most commonly in Pennsylvania, it catches pages written in a voice suggesting a physician performs treatments a delegated nurse performs. That one is doubly exposed, because § 18.402 independently requires the delegation be explained to the patient — so a website implying otherwise cuts against your own compliance record.

The consent verdict: MCARE is narrower than assumed

Pennsylvania's informed consent statute is 40 P.S. § 1303.504, part of the MCARE Act, and it is routinely over-read in aesthetic practice. The statutory duty attaches to a defined list of procedures — principally surgery with related administration of anesthesia, and administering experimental medications or using experimental devices, or approved medications and devices used in an experimental manner. Most cosmetic med spa treatments do not sit on that list. Saying so is not an invitation to skip consent; it corrects the belief that MCARE is the source of your consent obligation, which leads practices to adopt a surgical consent template that fits their treatments poorly.

Who may obtain consent, after the 2021 amendment

Where MCARE does apply, the question of who may take the consent has moved. The Pennsylvania Supreme Court held in 2017 that the duty was the physician's personally and could not be satisfied through staff. The legislature responded with Act 61 of 2021 (act of 30 June 2021, P.L. 330, No. 61), which expressly authorises a physician to delegate obtaining informed consent to another physician or a qualified practitioner — a physician assistant, CRNP, midwife or nurse-midwife, or a registered nurse where authorised to perform the procedure or administer anesthesia — while preserving the patient's right to have the physician performing the procedure answer questions directly, in which case that physician must obtain the consent.

The two obligations that reach every treatment

Whatever MCARE's scope, two Pennsylvania obligations apply across your menu. 49 Pa. Code § 18.402 requires that the nature of the service and the fact that it is being delegated be explained to the patient, who must not object — a disclosure most med spa consent forms omit entirely, and the single most commonly missing element we see. And § 16.95 requires a record that accurately and completely reflects the evaluation and treatment, of which the consent conversation forms part.

Are There Facility, Equipment or Sanitation Standards That Apply?

Not as a med spa. Pennsylvania writes no facility standard for medical spas, runs no sanitation inspection of them, and sets no equipment schedule they must meet. Three narrower regimes can switch on; outside those, the standard is whatever you write down and follow.

When Department of Health facility licensure switches on

The Department of Health licenses ambulatory surgical facilities under the Health Care Facilities Act (35 P.S. §§ 448.101–448.904b), with standards at 28 Pa. Code Chapters 51 and 551–571. Application is made under section 807 of the act (35 P.S. § 448.807) with a fee, and the Department issues a licence valid for one year to a facility in compliance. That regime carries real architectural, staffing, infection-control and quality-assurance obligations — and almost no med spa falls inside it. The threshold question is what you perform and under what anaesthesia; a practice contemplating anything in surgical territory should establish its status with counsel first.

The cosmetology salon standards, and their limits

Where a cosmetology or esthetician salon operates as part of your footprint, the Board of Cosmetology's facility rules apply to it. 49 Pa. Code § 7.71 sets the equipment and supplies required for a cosmetology salon and § 7.71a does the same for an esthetician salon — running water accessible to each station, covered waste containers, closed storage for soiled and clean linen, sanitising equipment, a multipurpose fire extinguisher — and under § 7.51 a licence is not issued until a Bureau inspector has inspected the premises. Two limits matter: these govern the salon, not the medical side, and they were written for beauty services, so they say nothing useful about sharps, biohazard waste or medication storage.

What a Pennsylvania Regulator Actually Looks At

People, not premises — and almost always after a complaint rather than on a schedule. Understanding the mechanics changes what you prepare, because what gets requested is narrower and more specific than most operators imagine.

How a matter starts

There is no routine med spa inspection, because there is no med spa licence to inspect against. Matters begin from outside: a patient complaint after a poor outcome, an adverse event serious enough to reach an emergency department, a former employee, or an advertisement that draws attention to a claim the practice cannot support. The complaint goes to whichever board licenses the people involved and is investigated by the Bureau of Professional and Occupational Affairs on that board's behalf.

The first documents requested

An investigation opens narrow. Expect the complete chart for the patient in question — evaluation, order, treatment note, consent, aftercare, follow-up. Expect the credentials of everyone who touched that patient, and the written agreement or delegation authorising them. And expect the question that decides most Pennsylvania matters: show me the basis on which the delegating physician concluded this person was competent to perform this service on this patient. Section 18.402 requires that determination to have been made; a practice that made it genuinely but never wrote it down is materially worse off than one that made it and did.

What the boards can do, and how they act together

Because Pennsylvania regulates people, exposure is distributed across everyone licensed in the room. A board may discipline a licence under section 41 of the Medical Practice Act, and the Commonwealth may act against unauthorised practice under 63 P.S. § 422.10 or seek an injunction under § 422.38. The multi-board structure is what makes a matter expand: one incident involving a nurse injecting under a physician's delegation can open a nursing board file on the nurse and a medical board file on the physician simultaneously, on the same facts, before two different bodies.

The Most Common Pennsylvania Med Spa Compliance Gaps

These are the failures we see repeatedly in Pennsylvania specifically. Each follows from the framework above, which is why they cluster the way they do.

The standing protocol that never became a patient-specific order

Section 21.14 permits an RN to administer a drug ordered for a patient. A general protocol saying the practice offers a treatment is not an order for a patient. The gap shows up as a chart recording a treatment with no identifiable provider evaluation and no patient-specific order behind it. Our guide to who can inject Botox in Pennsylvania works the order-versus-protocol distinction through in detail.

No competency file behind a delegation

The physician must know the delegatee is competent. Asked how, too many practices can offer only a vendor training certificate. Build a real file per clinician: licence verification, device- and product-specific training records, supervised case counts, a dated competency sign-off by the delegating physician, and periodic re-verification.

Nobody owns compliance

The structural gap behind the rest. With no licence and no inspection, compliance has no external forcing function, so it belongs to whoever is named and given time for it. Where the answer is "the medical director, in theory", the answer is nobody. The operational version of this list is our Pennsylvania med spa compliance checklist.

Has Anything Changed? Pennsylvania's Stable Framework in 2026

No material change — and we want to be precise about that rather than manufacture urgency. Pennsylvania's framework in 2026 is the framework it has had for years, and an evergreen page that says so plainly is more useful than one implying otherwise.

What we checked

We checked the 2025–2026 session of the Pennsylvania General Assembly for med-spa-specific legislation, and the two medical boards, the nursing board and the cosmetology board for regulatory activity redrawing scope, delegation or facility requirements. We found no med-spa-specific statute, no licensing scheme, and no amendment altering who may perform or be delegated a cosmetic medical service. The Medical Practice Act of 1985, the Osteopathic Medical Practice Act, the two parallel delegation rules, the Professional Nursing Law and the Cosmetology Law all continue to govern in the form described here.

What actually moved, and when

The most recent change that genuinely touches a Pennsylvania med spa is not a med spa rule at all. It is Act 33 of 2024, amending the Breach of Personal Information Notification Act effective 26 September 2024 — two years after Act 151 of 2022 had broadened the definition of personal information. Before that, Act 61 of 2021 on who may obtain informed consent. Both are worth knowing; neither is a 2026 development, and presenting either as one would be dishonest.

What is pending but is not law

The proposal that would change the most is the recurring effort to give qualified nurse practitioners practice authority independent of a collaborative agreement. It has been introduced across multiple sessions without being enacted, so Pennsylvania CRNPs still collaborate under written agreements today. We track its status in our Pennsylvania ownership guide, where it would bite first. Until something passes, plan against the law as it is.

Summary: Pennsylvania Med Spa Regulation in Plain Terms

Pennsylvania does not license medical spas and has no statute naming them. It regulates practitioners and acts instead, through the Medical Practice Act of 1985 and its osteopathic counterpart, the Professional Nursing Law and the Cosmetology Law — administered by four boards housed in the Department of State's Bureau of Professional and Occupational Affairs. The Department of Health reaches you only through drug and device registration or, rarely, ambulatory surgical facility licensure.

The registrations you actually file are ordinary business filings, plus a professional entity form determining who may own you. No medical director is required by title, but § 18.402 imposes real, documentable duties on the delegating physician — competency, patient-specific risk, disclosure of the delegation, responsibility and proportionate availability. HIPAA applies conditionally, on the standard-transaction test at 45 CFR 160.103, and Pennsylvania's own confidentiality duty under § 16.61 applies either way. Records run seven years from last service, longer for minors. Advertising is judged by whether it tends to deceive. No facility standard exists for the category, so your written protocols are the standard.

The organising idea worth carrying away: in a state that inspects nothing in advance, your documentation is your licence. Pennsylvania will never tell you beforehand that you are compliant; it will only ever ask you to prove it afterwards. Start from the Pennsylvania compliance hub for the deep guides behind each section, and turn every requirement here into a document you could hand a reviewer without hesitating.

This guide is a general, descriptive summary of Pennsylvania med spa regulation as of September 2026 and is provided for informational purposes only. It is not legal advice, and it is not a substitute for guidance from qualified Pennsylvania healthcare counsel on your specific structure, staffing and service menu — particularly on HIPAA covered-entity status, entity ownership, and whether any Department of Health registration or licensure applies to your operation. Regulations, board interpretations and enforcement practices change; confirm current requirements with the Pennsylvania Department of State, the State Board of Medicine, the State Board of Osteopathic Medicine, the State Board of Nursing, the State Board of Cosmetology and the Pennsylvania Department of Health before acting.