Med Spa Compliance Guide: State-by-State Requirements

Here is a number that should keep you up at night: the average fine for a med spa compliance violation ranges from $5,000 to $50,000 per incident. In some states, violations result in license revocation, criminal charges, or both. The Texas Medical Board alone disciplined over 40 med spa-related practices in 2025.

Compliance in the med spa industry is not a "set it and forget it" exercise. It is a moving target — state boards are tightening regulations, the FTC is cracking down on advertising claims, and HIPAA enforcement shows no signs of slowing down. And unlike a restaurant health code violation where you pay a fine and move on, a med spa compliance failure can permanently end your ability to operate.

The problem is that med spa compliance requirements vary wildly by state. Med spa regulations by state are so different that what is perfectly legal in Florida might shut you down in New York. A marketing campaign that works in Texas could trigger an investigation in California.

This guide covers every med spa compliance dimension you need to understand: ownership structures, medical director requirements, scope of practice, med spa advertising compliance, HIPAA obligations, and the state-specific nuances that trip up even experienced operators. Whether you are starting a med spa or running an established practice, understanding these medical spa legal requirements is the framework that protects your business.

The Med Spa Compliance Landscape in 2026

The regulatory environment for med spas has shifted dramatically in the last three years. Understanding these trends — and how med spa regulations by state are evolving — helps you stay ahead of enforcement actions rather than reacting to them.

Key Regulatory Trends

Increased enforcement across all states. State medical boards are investigating med spas more aggressively than ever. California, Texas, New York, and Florida lead in enforcement actions, but every state has increased oversight. The trigger is usually a patient complaint — and in the age of social media, one unhappy patient can generate a board investigation with a single phone call.

FTC crackdown on aesthetic advertising. The FTC issued updated guidance in 2025 specifically targeting health and wellness advertising. Key changes include stricter requirements for before-and-after photo substantiation, expanded definition of "endorsement" to include influencer partnerships, and higher penalties for non-compliance. Every marketing plan must now include compliance review.

HIPAA enforcement expansion. OCR (Office for Civil Rights) is pursuing smaller breach cases that it previously ignored. Practices with fewer than 500 patients affected are now regularly investigated. The "we're too small to get noticed" defense no longer works.

Scope of practice scrutiny. The most common enforcement action in 2024-2025 was scope of practice violations — providers performing procedures they are not legally authorized to perform. RN injections in restricted states, aestheticians performing medical procedures, and unsupervised mid-level providers are the most frequently cited violations.

The Cost of Non-Compliance

Compare these penalties to the cost of maintaining a compliance program ($10,000-$30,000/year). The math is obvious.

Ownership Structure Compliance

The single most important compliance question in the med spa industry: who is legally allowed to own your practice?

Corporate Practice of Medicine Doctrine

Approximately 35 states enforce some version of the corporate practice of medicine doctrine (CPOM). This doctrine prohibits non-physicians from owning or controlling medical practices — and med spas are classified as medical practices in every state.

States with strict CPOM enforcement:

• California
• New York
• Texas
• Illinois
• Ohio
• New Jersey
• Colorado

States with moderate CPOM enforcement:

• Georgia
• Michigan
• Pennsylvania
• Virginia
• Massachusetts
• Indiana
• North Carolina

States with minimal or no CPOM:

• Florida
• Arizona
• Utah
• Nevada
• Montana
• Oklahoma

What this means practically: If you are not a physician, you cannot directly own a med spa in strict CPOM states. However, virtually every state has legal workarounds through management services organizations (MSOs).

The MSO Model

The management services organization model is the standard legal structure for non-physician-owned med spas. Here is how it works:

1. The medical practice entity — owned by a physician (your medical director) — holds all medical licenses and contracts with providers
2. The MSO — owned by you — provides management services to the medical practice: marketing, billing, scheduling, facility management, HR
3. A management services agreement binds the two entities, with the MSO receiving management fees (typically 75% to 85% of revenue)

This structure is legal in most states when properly executed. "Properly executed" is the critical qualifier. The MSO must genuinely provide management services, and the physician must maintain genuine control over clinical decisions. Sham MSO arrangements — where the non-physician owner controls everything and the physician is a figurehead — are exactly what regulators look for.

Implementation steps for a compliant MSO:

1. Hire a healthcare attorney (not a general business attorney) to draft your MSO agreement
2. Structure the medical practice as a professional entity (PC, PA, or PLLC depending on state)
3. Ensure the physician owner has genuine authority over all clinical decisions, hiring of clinical staff, and treatment protocols
4. Document the management services the MSO provides — marketing, billing, scheduling, facility management, HR, technology
5. Structure the management fee based on services rendered, not as a percentage of medical revenue (this avoids fee-splitting issues)
6. Maintain separate bank accounts, separate books, and clear financial separation between the entities
7. Review the MSO agreement annually with your healthcare attorney

Common MSO compliance mistakes:

Fee-Splitting Laws

Most states prohibit physicians from splitting fees with non-physicians for medical services. This directly impacts how MSO management fees are structured.

Compliant approach: The MSO charges a flat management fee or a fee based on actual administrative services provided — not a percentage of medical revenue. Some structures use a flat monthly fee that is reviewed and adjusted annually based on the scope of services the MSO provides.

Non-compliant approach: The MSO takes a percentage of every treatment performed. This looks like a kickback for patient referrals, which violates anti-kickback statutes in many states.

The distinction is subtle but legally significant. Have a healthcare attorney structure your MSO agreement — not a general business attorney, and not a template from the internet.

Fee structure comparison:

Medical Director Requirements

Every med spa requires a medical director. The specifics of that requirement vary based on medical spa legal requirements in your jurisdiction, but there are non-negotiable elements across all states. Med spa licensing starts with securing the right medical director — if you are opening a new med spa, this is one of your first compliance tasks.

Universal Requirements

Regardless of state, your medical director must:

• Hold an active, unrestricted medical license (MD or DO) in the state where the med spa operates
• Establish written treatment protocols and standing orders for every procedure offered
• Provide supervision appropriate to the level required by state law
• Review and approve the scope of services offered
• Be available for clinical consultation during operating hours
• Participate in adverse event management and reporting
• Conduct periodic chart reviews and quality assurance
• Be genuinely involved in the clinical operations (not a name-on-paper arrangement)

State Supervision Models

States generally fall into three categories for physician supervision of med spas:

On-site supervision states — The physician must be physically present in the facility during medical procedures:

• New Jersey (for most procedures)
• Parts of New York (depending on procedure type)
• Some procedures in Pennsylvania
• Certain procedures in Tennessee

General supervision states — The physician must establish protocols and be available but does not need to be on-site:

• California
• Florida
• Texas
• Illinois
• Most other states

Collaborative practice states — NPs or PAs can practice with varying independence under a collaborative agreement:

• States with full practice authority for NPs: Alaska, Arizona, Colorado, Connecticut, Hawaii, Idaho, Iowa, Maine, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Mexico, North Dakota, Oregon, Rhode Island, South Dakota, Vermont, Washington, Wyoming, and the District of Columbia
• These states allow NPs to own and operate med spas with no physician involvement (though having a medical director is still advisable for clinical credibility and insurance purposes)

Finding and Compensating a Medical Director

What to look for:

Compensation benchmarks:

Common mistake: Hiring the cheapest medical director available who will never visit your practice. This is the most frequently cited compliance violation in medical board investigations. If your medical director has never set foot in your facility, you are a complaint away from a practice closure.

Medical Director Compliance Checklist

• [ ] Written medical director agreement on file (reviewed by healthcare attorney)
• [ ] Medical director holds active, unrestricted license in your state
• [ ] Treatment protocols documented and signed by medical director for every procedure
• [ ] Standing orders updated at least annually
• [ ] Medical director available during business hours (phone or on-site per state requirements)
• [ ] Chart review schedule established (minimum quarterly, monthly preferred)
• [ ] Adverse event reporting protocol documented and practiced
• [ ] Medical director involvement in clinical staff hiring and credentialing
• [ ] Medical director not overseeing more than 3-4 locations (more raises "genuine oversight" questions)
• [ ] Compensation structure reviewed by healthcare attorney for fee-splitting compliance
• [ ] On-site visit log maintained (dates, duration, activities performed)
• [ ] Annual protocol review meeting documented

Scope of Practice by Provider Type

Who can do what in your med spa is one of the most complex med spa compliance areas — and one of the most commonly violated. Scope of practice violations are the number one reason med spas face disciplinary action. Med spa licensing and credentialing requirements vary dramatically by provider type, and understanding scope protects your providers, your practice, and your patients.

Physicians (MD/DO)

Can perform all procedures within their training and competency. No scope limitations beyond their medical license. However, a family medicine physician performing advanced laser procedures without adequate training creates liability exposure even if technically within their legal scope.

Best practice: Even for physicians, maintain documentation of training and continuing education for every procedure performed. "They have a medical license" is not sufficient documentation in a malpractice case.

Nurse Practitioners (NP/APRN)

Scope varies dramatically by state:

Full practice authority states (25+): NPs can diagnose, treat, prescribe, and perform aesthetic procedures independently. They can own med spas in many of these states.

Reduced practice states: NPs require a collaborative agreement with a physician. They can perform procedures within the scope defined by that agreement.

Restricted practice states: NPs require direct physician supervision for certain procedures. Scope is more limited.

Key compliance steps for NPs in med spas:

1. Verify that the NP's collaborative agreement (where required) specifically includes aesthetic procedures
2. Confirm that the NP has completed training in each specific procedure they perform
3. Document competency assessments for all procedures
4. Maintain training certificates and CE documentation in their credential file
5. Review scope annually against current state regulations (these change)

Physician Assistants (PA)

PAs always require physician supervision, though the level of supervision varies:

• PAs operate under delegated authority from a supervising physician
• The supervising physician must be available for consultation
• Some states limit the number of PAs a physician can supervise (typically 2-4)
• PA scope is defined by the supervising physician's delegation agreement

Implementation step: Create a written delegation agreement specifying every procedure the PA is authorized to perform, the level of supervision required, and the protocol for consulting the supervising physician. Review and update annually.

Registered Nurses (RN)

RNs have the most restricted scope in med spas:

• Can perform laser and light-based treatments in most states under physician delegation
• Cannot inject Botox or dermal fillers in most states (this is the most common and most frequently enforced violation)
• Cannot independently assess patients or determine treatment plans
• Must work under direct or general physician supervision depending on state

Critical compliance note: RN injection of Botox and fillers is one of the most frequently enforced violations in the med spa industry. In states where RNs cannot inject, allowing them to do so exposes you to license revocation, fines, and malpractice liability. States that DO allow RN injections typically require specific delegation protocols and physician oversight.

States where RNs CAN perform injections under delegation:

• Texas (under specific delegation protocols)
• Florida (under physician supervision)
• California (under standardized procedures)
• Several others with specific requirements

States where RNs CANNOT perform injections:

• New York (limited exceptions)
• New Jersey (restricted)
• Several others

Verify your specific state's current regulations before allowing any RN to inject. Regulations change — what was true two years ago may not be true today.

Licensed Aestheticians

• Limited to non-medical aesthetic treatments: facials, chemical peels (superficial only), microdermabrasion, some laser treatments (state-dependent)
• Cannot inject anything
• Cannot perform procedures classified as "medical" under state law
• Some states have created "medical aesthetician" or "master aesthetician" licenses with expanded scope

Common violation: Aestheticians performing microneedling with PRP, medium-depth chemical peels, or certain laser treatments that are classified as medical procedures in their state. When in doubt, check your state's specific classification.

Unlicensed Staff

Can perform only non-medical tasks: scheduling, check-in, consent form distribution, comfort measures. They cannot perform any treatment that penetrates the skin, uses medical devices, or requires clinical judgment. Period.

Scope of Practice Summary Table

Important: This table is a general guide. Your specific state may differ. Always verify with your state medical board and healthcare attorney.

Med Spa Advertising Compliance

Your marketing is a med spa compliance surface area that many owners overlook — until they receive a cease-and-desist letter. Med spa advertising compliance is one of the fastest-growing enforcement areas, and every marketing checklist item should include compliance review.

FTC Advertising Rules

The Federal Trade Commission regulates advertising claims across all industries, including med spas. Key rules:

No false or misleading claims: Every claim in your advertising must be truthful and substantiated. "Guaranteed results" is almost never substantiated. "Typical results" must reflect what a typical patient actually experiences.

Before-and-after photos:

• Must represent typical results, not best-case scenarios
• Must not be digitally altered to exaggerate results
• Must include appropriate disclaimers: "Individual results may vary"
• Patient must provide written consent for use of their images
• HIPAA release must be separate from the general consent form
• Photography standards must be consistent (same lighting, angle, distance)

Testimonials and reviews:

• Must reflect genuine patient experiences
• Cannot fabricate or incentivize positive reviews (this violates both FTC guidelines and most review platform terms of service)
• If a testimonial is atypical, it must include a disclaimer about typical results
• Paid endorsements or influencer partnerships must be clearly disclosed

Pricing claims:

• "50% off" must reference a genuine regular price that was actually charged to patients
• "Lowest prices" claims must be verifiable
• "Free consultation" must actually be free — no hidden assessment fees
• Specials and promotions must honor advertised terms

State Medical Board Advertising Rules

Many state medical boards have additional advertising rules for medical practices:

Common state-level restrictions:

• Cannot use the term "board certified" unless the provider holds certification from an ABMS-recognized board
• Cannot imply specialization without formal specialty training
• Some states restrict the use of patient testimonials for medical services entirely
• Must include the name and license number of the supervising physician in certain states
• Cannot advertise treatments that are not within the scope of practice of the providers who perform them

Implementation steps for advertising compliance:

1. Maintain a master list of every claim made in your advertising (including social media, ad copy, website, and print)
2. Verify each claim against FTC guidelines, state medical board rules, and platform policies
3. Ensure all before-and-after photos have documented patient consent and HIPAA authorization
4. Review all influencer content for proper disclosure before it goes live
5. Audit your Google Ads and Facebook Ads quarterly for compliance
6. Document your compliance review process (who reviewed, when, what was approved/changed)

Social Media Compliance

Social media creates unique compliance challenges for med spas. Your social media strategy must account for these:

• Patient photos posted on Instagram, TikTok, or Facebook require HIPAA-compliant authorization
• Comments and DMs about treatment outcomes can constitute medical advice
• Staff posting about procedures or patients on personal accounts is a HIPAA risk
• Influencer partnerships must comply with FTC disclosure requirements
• Claims made in captions, stories, and reels are held to the same standard as print advertising
• UGC content from patients still requires your compliance review before reposting

Practical social media policy for compliance:

1. All patient images require a signed HIPAA photo/video release (separate from treatment consent)
2. No patient information in captions (not even first names without explicit consent)
3. All treatment claims must be clinically accurate and include disclaimers
4. Staff social media policy must prohibit posting patient information on personal accounts
5. DMs that involve clinical questions must be directed to an in-office consultation
6. All hashtags and claims in captions are reviewed for accuracy
7. Reposted patient content requires the same HIPAA authorization as practice-created content

Digital Marketing Compliance Checklist

HIPAA Compliance

HIPAA applies to every med spa because you are a covered entity providing healthcare services. There are no exemptions based on practice size. Every aspect of your operations — from your EMR system to your CRM to your booking software — must comply.

The Minimum HIPAA Requirements

Privacy Rule compliance:

• Written privacy policies and procedures
• Notice of Privacy Practices provided to every patient
• Patient authorization forms for any use of PHI beyond treatment, payment, and healthcare operations
• Minimum necessary standard — staff access only the patient information needed for their role
• Patient right to access their medical records within 30 days of request

Security Rule compliance:

• Risk analysis conducted annually (this is the most commonly missing requirement)
• Administrative safeguards: security officer designated, workforce training, access management
• Physical safeguards: facility access controls, workstation security, device/media controls
• Technical safeguards: access controls, audit controls, integrity controls, transmission security

Breach Notification Rule:

• Notification to affected individuals within 60 days of discovering a breach
• Notification to HHS (the Department of Health and Human Services)
• For breaches affecting 500+ individuals: notification to media outlets in affected states

Common HIPAA Violations in Med Spas

These are the violations we see most frequently — and the ones that generate the most enforcement actions:

HIPAA and Your Tech Stack

Every software tool that touches patient data requires HIPAA compliance:

HIPAA Compliance Costs

Budget for these annual HIPAA compliance expenses:

The alternative — a HIPAA breach — averages $400,000 in penalties, legal fees, and remediation costs. The compliance investment is obvious.

Med Spa Regulations by State: Quick Reference

California

• Ownership: CPOM strictly enforced. Non-physicians must use MSO model
• Medical Director: MD or DO required. Must establish standardized procedures
• NP Scope: Full practice authority (as of 2023). Can perform aesthetic procedures under standardized procedures
• RN Scope: Can perform injections under specific standardized procedures signed by supervising physician
• Advertising: Medical Board of California actively monitors advertising. "Board certified" claims scrutinized. Unlicensed advertising as a "doctor" is a criminal offense.
• Key Risk: The Moscone-Knox Professional Corporation Act restricts who can be shareholders in medical corporations

Texas

• Ownership: CPOM enforced but MSO model well-established
• Medical Director: Physician required with delegation protocols
• NP/PA Scope: Operate under supervisory/delegation agreements. RNs can perform laser procedures and certain injections under specific delegation
• Advertising: Texas Medical Board has specific advertising rules. Must include physician name in medical advertising.
• Key Risk: Texas has aggressive enforcement — TMB investigates complaints quickly and penalties are significant. Over 40 disciplinary actions against med spas in 2025.

Florida

• Ownership: More permissive. No CPOM doctrine. Non-physicians can own med spas through proper structuring
• Medical Director: Required. Physician must be available but not necessarily on-site
• NP Scope: Full practice authority after transition period. NPs can own med spas
• Advertising: Standard FTC rules apply. Department of Health monitors healthcare advertising
• Key Risk: Florida's permissive environment attracts operators who push boundaries — regulators respond with targeted enforcement actions. The franchise model is popular but adds compliance layers.

New York

• Ownership: Strictest CPOM enforcement in the country. MSO structures heavily scrutinized
• Medical Director: Must be substantially involved — not just a name on paper. Recent enforcement has targeted "ghost" medical directors
• NP Scope: Reduced practice — requires collaborative agreement with physician
• Advertising: New York Education Department regulates professional advertising. Specific restrictions on before/after images
• Key Risk: New York's Office of Professional Medical Conduct (OPMC) actively investigates med spas. Penalties include license revocation. Several high-profile closures in 2024-2025.

Illinois

• Ownership: CPOM enforced. MSO model required for non-physician ownership
• Medical Director: Required with written protocols and availability for consultation
• NP Scope: Full practice authority (as of 2023). Collaborative agreement no longer required after transition period
• Advertising: Illinois DFPR regulates healthcare advertising
• Key Risk: Illinois requires specific informed consent disclosures for cosmetic procedures

Arizona

• Ownership: No CPOM doctrine. Non-physicians can own med spas with proper medical director arrangement
• Medical Director: Required for medical procedures
• NP Scope: Full practice authority. NPs can own and operate independently
• Advertising: Arizona Medical Board has specific advertising guidelines
• Key Risk: Relatively permissive but enforcement is increasing as the market grows

Georgia

• Ownership: CPOM enforced. MSO model standard
• Medical Director: Required. Must be actively involved in clinical oversight
• NP Scope: Reduced practice — requires physician collaboration
• Advertising: Georgia Composite Medical Board oversees advertising
• Key Risk: Recent legislative changes have tightened NP supervision requirements

Colorado

• Ownership: CPOM applies but MSO model well-accepted
• Medical Director: Required for medical procedures
• NP Scope: Full practice authority
• Advertising: DORA (Department of Regulatory Agencies) oversees healthcare advertising
• Key Risk: Colorado's informed consent requirements for aesthetic procedures are among the most detailed in the country

Additional State Notes

Nevada: No CPOM. NPs have full practice authority. Growing med spa market with increasing regulatory attention.

Washington: No CPOM. NPs have full practice authority. Relatively permissive but active enforcement of scope violations.

Oregon: NPs have full practice authority. MSO model not required for NP-owned practices.

Tennessee: CPOM enforced. On-site supervision required for certain procedures. Recent enforcement actions against med spas.

South Carolina: CPOM enforced. Medical director must be involved in clinical operations. Increasing enforcement activity.

For states not listed: Consult a healthcare attorney licensed in your state. State regulations change frequently, and a state not known for enforcement today may increase scrutiny tomorrow.

Building a Med Spa Compliance Program

Med spa compliance is not a one-time project. It is an ongoing program that addresses medical spa legal requirements as they evolve. Here is the framework for building one that protects your practice.

Step 1: Hire a Healthcare Attorney

Not a general business attorney. A healthcare attorney who specializes in medical spa or aesthetic medicine compliance. They will:

• Structure your ownership entity and MSO (if applicable)
• Draft your medical director agreement
• Review your scope of practice for each provider type
• Ensure your consent forms are state-compliant
• Review your marketing materials for compliance
• Advise on regulatory changes that affect your practice

Budget: $5,000 to $15,000 for initial setup and $2,000 to $5,000 annually for ongoing counsel.

How to find one: Ask your state medical society for referrals. Look for attorneys who specifically mention "medical spa," "aesthetic medicine," or "healthcare regulatory" in their practice areas. National firms like ByrdAdatto and Dike Law Group specialize in medical aesthetics.

Step 2: Designate a Compliance Officer

Someone in your organization must own compliance. In smaller practices, this can be the practice manager or office manager. Their responsibilities:

• Maintain compliance documentation
• Conduct quarterly compliance audits
• Manage HIPAA compliance program
• Coordinate staff training
• Track regulatory changes in your state
• Manage incident reporting

Implementation step: Create a formal compliance officer designation letter, define their responsibilities in writing, and give them authority to stop non-compliant activities. If compliance is "everyone's job," it is nobody's job.

Step 3: Create a Compliance Calendar

Step 4: Document Everything

In a compliance investigation, documentation is your defense. If it is not documented, it did not happen.

Critical documentation to maintain:

• Treatment protocols signed and dated by medical director
• Staff training records with topics, dates, and attendees
• Consent forms for every patient, every treatment
• HIPAA authorization forms for marketing use of patient images
• Incident reports for adverse events
• Equipment maintenance logs
• Provider credential files with licenses, certifications, and training records
• Compliance audit reports and corrective action plans
• Medical director on-site visit logs
• Scope of practice verification for every provider

Storage requirements: Maintain compliance documentation for a minimum of 7 years (longer in some states). Store digital records in a HIPAA-compliant system with access controls and audit trails. Maintain backup copies.

Step 5: Train Your Staff

Annual compliance training is not optional. Cover these topics with all staff:

1. Scope of practice for each provider level (with specific examples)
2. HIPAA privacy and security rules (with real scenarios)
3. Proper documentation requirements
4. Adverse event reporting procedures
5. Social media and marketing compliance
6. Patient consent procedures
7. What to do if a regulatory inspector visits
8. How to handle patient complaints that could become board complaints

Training implementation:

• Schedule quarterly 30-minute training sessions (annual comprehensive + quarterly refreshers)
• Use role-specific training (clinical staff get scope training, front desk gets HIPAA training)
• Document attendance with sign-in sheets
• Use quizzes or competency checks to verify understanding
• Keep all training records for 7+ years

Step 6: Prepare for Inspections

When a regulatory inspector arrives — and eventually one will — your response determines the outcome.

Before an inspection happens:

• Create an inspection response protocol (who to call, what to provide, what not to say)
• Keep all documentation organized and accessible
• Ensure your compliance officer can locate any document within 15 minutes
• Train your front desk on how to receive an inspector (politely, professionally, and without volunteering information)

During an inspection:

• Cooperate fully but do not volunteer information beyond what is asked
• Contact your healthcare attorney immediately
• Designate one person (compliance officer or practice manager) as the inspector's point of contact
• Document everything the inspector asks for and reviews
• Do not alter, destroy, or hide any documents

After an inspection:

• Document the visit immediately (who came, what they asked for, what they reviewed)
• Review findings with your healthcare attorney
• Implement corrective actions promptly and document them
• If violations are found, respond within the required timeframe with a corrective action plan

What Happens When Compliance Fails

The consequences are real and escalate quickly:

First offense (minor violation): Warning letter, corrective action plan, potential fine of $1,000 to $10,000

Repeated or serious violations: Fines of $10,000 to $50,000 per violation, mandatory practice changes, probation

Severe violations (scope of practice, unlicensed practice): License suspension or revocation, practice closure, criminal charges, personal liability for owners and medical directors

HIPAA breaches: Fines of $100 to $50,000 per violation (up to $1.5 million per year for identical violations), criminal penalties for willful neglect, public notification requirements

Real-world examples from 2024-2025:

• A Texas med spa fined $75,000 for allowing RNs to inject Botox without proper physician delegation
• A New York med spa closed after investigation revealed the medical director had never visited the facility
• A California med spa fined $25,000 for before-and-after advertising that did not include required disclaimers
• A Florida med spa owner personally fined $50,000 for HIPAA violations related to patient photos on social media
• An Illinois med spa paid $35,000 in penalties after an aesthetician was found performing microneedling classified as a medical procedure
• A Georgia practice lost its medical director arrangement after a fee-splitting investigation, forcing temporary closure

Compliance and Your Marketing Strategy

Compliance is not separate from marketing — it shapes it. Every marketing decision you make has compliance implications:

The compliant marketing advantage: Practices that build med spa advertising compliance into their marketing from the start never face ad account shutdowns, FTC investigations, or cease-and-desist letters. Compliance is a constraint that forces better marketing — more specific, more honest, more trustworthy.

Compliance Is a Competitive Advantage

Most med spa owners see compliance as a cost center. The best operators see it as a competitive advantage.

When your compliance program is airtight, you can:

• Market with confidence, knowing your claims are defensible
• Scale to multiple locations without regulatory risk multiplying
• Attract better medical directors who want to associate with compliant practices
• Negotiate better insurance rates with documented compliance programs
• Sleep at night knowing a disgruntled employee's complaint will not unravel your business
• Build a practice that is acquirable — buyers pay premiums for compliant operations (see how to sell a med spa)

Med spa compliance is not sexy. But losing your practice to a preventable violation is not either.

The practices that dominate their markets long-term are not the ones that cut corners on med spa licensing and compliance to save money. They are the ones that build compliance into their DNA and use it as a foundation for aggressive, confident growth.

Get Your Practice Reviewed

We work exclusively with med spas, and compliance shapes every marketing recommendation we make. Our free marketing audit includes a review of your advertising compliance, social media practices, and digital presence for regulatory risk.

You do not need a compliance problem to get ahead of one.

Get Your Free Marketing Audit