Med spas and aesthetics

Medical spas deliver medical treatments — neuromodulator and filler injections, lasers, chemical peels, body contouring — in a retail environment, frequently owned or operated by non-clinicians. That combination makes aesthetics the vertical where CPOM enforcement is most active in practice, and where the “rent-a-medical-director” arrangement is the recurring failure pattern.

​

Why the risk concentrates here

Four factors compound:

1. Non-clinician ownership is the norm. Med spas are frequently founded by aestheticians, business operators, or nurses who cannot lawfully own a medical practice in a CPOM state.
2. The services are medical. Injecting a prescription neuromodulator is the practice of medicine, regardless of the retail setting. So is operating certain lasers, in most states.
3. Medical direction is often nominal. The “medical director” who visits monthly, has never seen a patient, and receives a flat fee is the Northfield fact pattern in a different industry.
4. Enforcement is visible. Boards and attorneys general have pursued med spa arrangements specifically, and the industry’s retail visibility makes it easy to find.

“We have a medical director” is not a structure. If a non-licensee owns the business, employs the injectors, controls the clinical protocols, and pays a physician a stipend to be listed, that is precisely the arrangement the doctrine prohibits, and it is the one enforcement actions describe. The medical director role is a component of a compliant structure, not a substitute for one.

​

What a compliant structure looks like

The same MSO-PC architecture as any other medical business:

• A professional entity owned by a licensee who may lawfully own a medical practice in that state, typically a physician
• The PC employs or contracts with the clinical staff who perform medical treatments
• The PC owns the medical records and controls clinical protocols
• The MSO, owned by the non-clinician founder, provides space, equipment, non-clinical staff, marketing, and administration
• An MSA with a genuine clinical carve-out
• Payer money and patient payments for medical services land in the PC’s account

The retail products and non-medical services (skincare retail, facials in some states) may sit in the MSO. Drawing that line precisely is a state-law question. California’s SB 351 applies to medical practices generally, including aesthetics, and its enumerated prohibitions on management-entity control of clinical staff oversight, equipment selection, and patient volume map directly onto how med spas typically operate.¹

​

The good faith exam

A requirement med spas most often fail. Before a prescription treatment — neuromodulators and dermal fillers are prescription products — a licensed practitioner must perform a good faith examination establishing a physician-patient relationship, evaluating the patient, and determining that treatment is appropriate. State variation covers:

• Who may perform it, physician only, or a supervised NP/PA
• Whether it may be done via telehealth, permitted in some states, not others, sometimes with conditions
• How often it must be repeated, per treatment, per course, or periodically
• What must be documented

A standing order is not a good faith exam. Neither is a form the patient fills in. Nor is a physician reviewing a chart after treatment. Where the exam is required before treatment, treatment delivered without it is unlawful practice, and the injector as well as the entity is exposed.

​

Who may inject

Varies substantially by state, and it is the operational question that determines your staffing model: Get this in writing from counsel per state. Building a staffing model on an incorrect assumption means every treatment delivered is a potential violation.

​

Cash-pay, and why chargebacks matter more here

Med spas are predominantly cash-pay, which removes most of the payer machinery this wiki describes, and replaces it with a different set of problems. The controls that matter:

• Statement descriptor matching the brand the patient recognizes
• Signed informed consent covering expected outcomes and their variability
• Documented before-and-after expectations, including that results vary
• A written refund and touch-up policy the patient signs
• Immediate receipts
• Refund fast when you’re wrong, cheaper than winning a dispute, and far cheaper than losing one

See Chargebacks and Prevent chargebacks. Packages and memberships create a further wrinkle: money collected for treatments not yet delivered is deferred revenue, and it is a liability. If the patient disputes or the business closes, that money was never yours. Account for it as deferred revenue, not as cash earned.

​

Product supply chain

An enforcement area distinct from CPOM and easy to get wrong. Prescription products — neuromodulators, dermal fillers, and injectable pharmaceuticals — must be:

• Purchased from authorized distributors, not grey-market or overseas sources
• Ordered under a prescriber’s authority, typically the medical director or a supervising physician
• Stored per manufacturer requirements, with temperature control and documentation
• Traceable by lot, for recalls and adverse events

Purchasing non-FDA-approved or foreign-sourced product is a federal issue, separate from any state licensing question, and it has resulted in criminal enforcement. It is not a cost-saving strategy. In an MSO-PC structure, who buys the product? Prescription products should generally be purchased by or under the authority of the PC, the entity with prescriptive authority, not by the MSO. This is a detail that gets missed when the MSO handles all purchasing as a matter of course.

​

Do you even implicate CPOM?

Worth asking, because the answer varies with your service mix: A pure aesthetics business with no medical services may not need a professional entity at all. A business offering both usually needs the medical services in a PC and may keep the non-medical services in the MSO, with the line drawn by counsel, and drawn precisely.

​

Launch pitfalls

1. Treating a medical director stipend as the whole compliance strategy
2. Skipping or delegating the good faith exam improperly
3. Aestheticians injecting, the clearest violation available
4. Non-clinician ownership of the entity delivering medical services
5. Grey-market product
6. Treating package prepayments as revenue rather than deferred liability
7. Ignoring chargeback ratios until the processor imposes a reserve
8. Assuming cash-pay means no kickback exposure, state all-payer anti-kickback and fee-splitting statutes frequently reach commercial and cash arrangements, including referral and marketing deals. See Stark and anti-kickback.
9. No good faith estimate for self-pay patients, the No Surprises Act’s GFE requirement applies regardless of whether you bill insurance. See The No Surprises Act.

​

Sources

1. Cal. S.B. 351 (2025), effective January 1, 2026. Summary: Quarles, California Cracks Down.