Know the legal and liability hoops before you jump through them

Medical spas are the future of cosmetics. Doctors and entrepreneurs across the country are ready to provide top-shelf care that makes patients happier with their looks, but there’s just one snag: Many don’t know how to open a medical spa. 

As a medical practice, medspas are subject to national and state-level rules and regulations that keep patients and practitioners alike safe from profiteering, malpractice, and more. Most of those fall under the corporate practice of medicine doctrine, but there’s plenty more to mind when opening a medspa. Here’s what you need to know.

How to open a medical spa

The corporate practice of medicine doctrine

Let’s start with the big one: What is the corporate practice of medicine doctrine and how does it affect opening a medspa? Essentially, this doctrine, codified into law in most states, means only a licensed physician or physician-owned company can receive payments for medical services. As a result, they’re the only entities that can own a business that provides such services. Because medspas provide medical services, they must then be owned by a physician.

If you’re not a licensed physician but you still want to open a medspa, you can start a management service organization (MSO) and implement a management service agreement (MSA) with a physician. In this arrangement, the MSO handles the business side of things — operations, payroll, hiring, accounting — while the physician controls treatment. Everyone benefits: The MSO shields the physician from some risk (it usually pays for liability insurance) and takes care of administration, while the physician pays the MSO for use of its facilities and maintains the medspa’s legal compliance. All client payments must be made to the physician’s company, and the doctor must make all treatment decisions, but the MSO pockets most of the revenue from the medspa.

Compliance

HIPAA and OSHA are the two main compliance hurdles you’ll face in trying to open your medspa. HIPAA (or the Health Insurance Portability and Accountability Act) concerns the safekeeping of patients’ protected health information (PHI). HIPAA compliance means nobody gets access to patient data unless they need it to do their job. To comply with HIPAA, you’ll need to study the regulations and implement the many security and privacy measures they suggest.

Using a HIPAA checklist can make this task a little more manageable, but it’s also recommended you work with a third-party compliance solution provider or auditor to ensure whatever system you come up with works as intended. While the US Department of Health and Human Services doesn’t recognize any formal HIPAA certifications, you’ll need to continually maintain compliance or potentially face fines and lawsuits.

Occupational Safety and Health Administration (OSHA) standards shift the focus from patients to practitioners. These regulations help keep your employees safe from harm and your business safe from fines. While you must take care around all OSHA regulations, these seven standards merit particular attention in a medspa setting:

• Bloodborne pathogens, including an exposure control plan

• Hazard communication

• Record keeping

• Slips, trips, and falls

• Tuberculosis

• Workplace violence

• Laser safety

Meeting each standard means producing detailed hazard prevention and control procedures, training for employees and management, and detailed record keeping. More specifics for each standard can be found on OSHA's website.

Insurance coverage

On top of compliance, medspas often secure insurance policies in three key areas:

• General liability insurance protects you and your business from lawsuits related to accidents and property damage.

• Professional liability insurance, also known as malpractice insurance, covers lawsuits due to the services and procedures you perform. It protects you if someone claims to have been injured in your care.

• Workers' compensation insurance covers lost wages or medical expenses for employees resulting from a work-related accident.

Generally speaking, you should plan to meet with an insurance agent with a business plan in hand to find the right mix of coverage.

How to open a medical spa in your state

With federal regulations handled, we can move on to the good stuff: state-level quirks and particularities. Following the corporate practice of medicine doctrine will give you a firm foundation in most states, but exactly who can perform what treatments and under what circumstances can throw you for a loop as each state defines the practice of medicine differently. We’ve highlighted some states with particular requirements, but our list is by no means exhaustive. If your state doesn’t appear here, FACE Medical Supply likely offers some introductory information, and the American Medspa Association has a complete list provided you’re willing to pay for membership. As always, it’s highly recommended you talk to a lawyer with experience in the field of medicine before going into business.

How to open a medical spa in California

California observes the corporate practice of medicine doctrine. It additionally mandates that medical spas incorporate as professional corporations rather than LLCs. At medspa facilities, all treatments categorized as the practice of medicine must be performed either by a licensed physician or by a registered nurse (RN) or physician assistant (PA) under the supervision of a physician. Those treatments include, but may not be limited to: Botox, laser hair removal, spider vein removal, tattoo removal, and any dermabrasion penetrating deeper layers of skin such as scar removal, blemish, and wrinkle treatments.

Licensed aestheticians and cosmeticians can perform microdermabrasion without supervision so long as it stays on the surface of the skin. That lets them treat fine lines, wrinkles, scars, acne, age spots, and melasma, among other things.

How to open a medical spa in Illinois

Illinois observes the corporate practice of medicine doctrine, so a physician must own the entire medical corporation or LLC. Physicians must examine each patient before many medspa procedures including laser treatments. They’re also the only personnel who can administer Botox, chemical peels, collagen injections, colonics, liposuction, microdermabrasion (except superficial or light procedures, intended only to remove dead skin, oil, and other debris from the surface of the skin), dermaplaning, microblading, microneedling, and radio frequency treatment.

Cosmetologists and estheticians can perform these treatments under physician supervision, but they can only refer to themselves as “assistants” rather than as cosmetologists or estheticians.

How to open a medical spa in Texas

Texas observes the corporate practice of medicine doctrine. All medical spas must receive an operator's certificate of registration from the Texas Secretary of State. They will then be listed on the Secretary of State's website. If your business hopes to operate as both a salon and a medical office, it will also need to be licensed as a cosmetology salon by the Texas Department of Licensing and Regulation.

At Texas medspas, a licensed physician or a supervised mid-level practitioner such as a PA must examine each patient and issue an order for treatment. Physicians cannot delegate treatments to estheticians, and estheticians can't use lasers in treatment.

How to open a medical spa in Pennsylvania

Pennsylvania observes the corporate practice of medicine doctrine. A physician, PA, or advanced practice registered nurse (APRN) must perform an initial physical assessment before ordering treatment. Those same personnel (plus RNs) can perform procedures designated as "the practice of medicine," which generally means anything that goes beneath the very top layer of skin. Pennsylvania doesn't have an exact line that, when crossed, signals the move from cosmetics to medicine, so it's best to err on the side of caution.

Pennsylvania explicitly prohibits non-physicians from hiring a licensed physician as its medical director just so that they can delegate treatments to other, lower-level medical professionals. Also, aestheticians can't administer lasers even when supervised by a physician.

How to open a medical spa in Florida

Florida is one of the few states that does not place restrictions on who can own a medspa. With that said, non-physician owners still have to satisfy certain requirements. All medspas must be supervised by a physician, but a physician can only supervise one location outside their primary practice, and that location must be within 75 miles of their primary practice and submitted to the Florida Board of Medicine.

Treatment-wise, laser or light-based hair removal services must be performed either by a licensed physician, by a PA under supervision of a physician, or by a nurse practitioner (NP) under a protocol signed by a physician. Whoever performs the procedure must have an electrologist license. PAs and NPs can order and perform injections such as Botox provided they do so under protocols written and reviewed by the supervising physician. Registered nurses and medical assistants can’t inject under any circumstances.

How to open a medical spa in Georgia

Georgia observes the corporate practice of medicine doctrine — at least, in general. It repealed its single, specific law outlining that doctrine and instead has many individual laws codifying components of the doctrine. But the Georgia Composite Medical Board — the relevant enforcement authority — has never taken action against medspas that don't strictly follow that doctrine. So, in practice, non-physicians have been allowed to own medspas provided their corporate structures prohibit interference with the clinical judgment of a physician. No incentives to order ill-advised treatments, basically.

Physicians must personally administer any procedure considered the practice of medicine. Such treatments include body sculpting and Botox, among others. A physician can also personally supervise a lower-level medical professional or delegate to a mid-level one. Assistant laser practitioners can perform cosmetic laser services such as hair removal without supervision, but other laser services must be done under on-site supervision of a physician or a senior laser practitioner. Finally, APRNs can own medspas, but they can't hire physicians (full-time or contract) to delegate treatments to them.

Wherever you’re aiming to open, remember that there’s no substitute for individualized legal advice from an experienced attorney.