The Medical Spa Legal Framework: Ownership and Compliance

DISCLAIMER: This guide provides general business-planning information and is not legal or medical advice. Medical spa ownership, corporate practice of medicine rules, delegation, supervision, scope of practice, facility requirements, and professional licensing vary by state and service. Confirm the final structure with qualified healthcare counsel and the appropriate licensed professionals in the jurisdiction where the business will operate.

Executive Summary

• A medical spa may be subject to healthcare ownership, professional-practice, delegation, and supervision rules that do not apply to a traditional day spa.

• Corporate Practice of Medicine rules can affect who owns or controls the clinical entity and how non-clinical management services are structured.

• An MSO/MSA structure may separate administrative management from clinical ownership and decision-making where legally appropriate.

• The exact ownership, provider, medical-director, delegation, and facility requirements must be checked state by state.

Introduction

Medical spas sit at the intersection of business operations and regulated clinical services. The legal framework should be resolved before the owner finalizes the service menu, staffing model, equipment purchases, or lease because those decisions can change which professional and regulatory requirements apply.

About Kathryn Moroz

Kathryn Moroz is the President and CEO of Spa Advisors, Inc., with over 30 years of executive experience across the day spa, resort, and medical spa industries. She previously served as Vice President of Merchandising and Training for Elizabeth Arden Red Door Salons and founded Spa Advisors, Inc. in 1997. Her project experience includes Canyon Ranch SpaClub at the Venetian, Paris Spa by Mandara, Atlantis Spa by Mandara, Miraval Resort, Elements Massage, and Woodhouse Spas.

The Corporate Practice of Medicine (CPOM) Doctrine

Corporate Practice of Medicine rules are designed to protect independent clinical judgment from improper non-clinical control. Their application varies by state. In jurisdictions with meaningful ownership restrictions, the business may need a professional entity for the clinical practice and a separate structure for non-clinical management. Ownership eligibility, fee arrangements, control rights, and governance should be reviewed by healthcare counsel before launch.

The MSO/MSA Model Explained

A Management Services Organization (MSO) can be used to provide non-clinical services to a medical entity under a Management Services Agreement (MSA), where the structure is lawful and appropriately documented.

1. The Medical Entity (Clinical)

The clinical entity is responsible for medical decision-making and other functions that must remain under the control of appropriately licensed professionals. The permissible ownership and entity type depend on state law.

2. The Management Entity (Administrative)

The management entity may handle non-clinical functions such as facilities, branding, marketing, administrative staffing support, technology, vendor coordination, and other business services, subject to the limits of state law and the governing agreement.

The Management Services Agreement (MSA)

The MSA defines the relationship between the clinical entity and the management organization. It should clearly separate administrative services from clinical authority and be reviewed for fee-splitting, control, compensation, and other state-specific requirements.

Scope of Practice and Operational Rules

Scope-of-practice and delegation rules determine which licensed professionals may evaluate patients, order or prescribe treatment, perform procedures, use specific devices, and work under a particular level of supervision. These requirements vary by jurisdiction and sometimes by procedure.

State-Specific Operational Review

• Who may own the clinical entity and what entity type is required?

• Which services are considered the practice of medicine?

• Who may diagnose, prescribe, order, inject, or operate each device?

• What supervision, delegation, standing-order, or protocol requirements apply?

• Is a medical director required, and what responsibilities must that role perform?

• What facility, professional, pharmacy, radiation, laser, or other licenses may apply?

• What patient-consent, charting, privacy, advertising, and adverse-event procedures are required?

HIPAA & OSHA Compliance

Medical spas should review whether and how federal and state privacy, record-security, workplace-safety, infection-control, and related healthcare obligations apply to their specific structure and services. These requirements should be incorporated into operating policies rather than treated as an opening-day checklist only.