> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Med spas and aesthetics

> The highest CPOM-enforcement-risk vertical: rent-a-medical-director arrangements, good faith exams, who may inject by state, cash-pay chargeback exposure, and product supply-chain compliance.

Medical spas deliver medical treatments — neuromodulator and filler injections, lasers, chemical peels, body contouring — in a retail environment, frequently owned or operated by non-clinicians. That combination makes aesthetics **the vertical where CPOM enforcement is most active in practice**, and where the "rent-a-medical-director" arrangement is the recurring failure pattern.

## Why the risk concentrates here

Four factors compound:

1. **Non-clinician ownership is the norm.** Med spas are frequently founded by aestheticians, business operators, or nurses who cannot lawfully own a medical practice in a CPOM state.
2. **The services are medical.** Injecting a prescription neuromodulator is the practice of medicine, regardless of the retail setting. So is operating certain lasers, in most states.
3. **Medical direction is often nominal.** The "medical director" who visits monthly, has never seen a patient, and receives a flat fee is the *Northfield* fact pattern in a different industry.
4. **Enforcement is visible.** Boards and attorneys general have pursued med spa arrangements specifically, and the industry's retail visibility makes it easy to find.

**"We have a medical director" is not a structure.** If a non-licensee owns the business, employs the injectors, controls the clinical protocols, and pays a physician a stipend to be listed, that is precisely the arrangement the doctrine prohibits, and it is the one enforcement actions describe. The medical director role is a *component* of a compliant structure, not a substitute for one.

## What a compliant structure looks like

The same MSO-PC architecture as any other medical business:

* **A professional entity owned by a licensee** who may lawfully own a medical practice in that state, typically a physician
* **The PC employs or contracts with the clinical staff** who perform medical treatments
* **The PC owns the medical records** and controls clinical protocols
* **The MSO**, owned by the non-clinician founder, provides space, equipment, non-clinical staff, marketing, and administration
* **An MSA** with a genuine clinical carve-out
* **Payer money and patient payments for medical services land in the PC's account**

The retail products and non-medical services (skincare retail, facials in some states) may sit in the MSO. Drawing that line precisely is a state-law question.

**California's SB 351** applies to medical practices generally, including aesthetics, and its enumerated prohibitions on management-entity control of clinical staff oversight, equipment selection, and patient volume map directly onto how med spas typically operate.<sup>1</sup>

## The good faith exam

A requirement med spas most often fail.

Before a prescription treatment — neuromodulators and dermal fillers are prescription products — a **licensed practitioner must perform a good faith examination** establishing a physician-patient relationship, evaluating the patient, and determining that treatment is appropriate.

State variation covers:

* **Who may perform it**, physician only, or a supervised NP/PA
* **Whether it may be done via telehealth**, permitted in some states, not others, sometimes with conditions
* **How often it must be repeated**, per treatment, per course, or periodically
* **What must be documented**

**A standing order is not a good faith exam.** Neither is a form the patient fills in. Nor is a physician reviewing a chart after treatment. Where the exam is required before treatment, treatment delivered without it is unlawful practice, and the injector as well as the entity is exposed.

## Who may inject

Varies substantially by state, and it is the operational question that determines your staffing model:

| Question                                              | Why it matters                                                                 |
| ----------------------------------------------------- | ------------------------------------------------------------------------------ |
| May an RN inject under supervision?                   | The most common staffing model; permitted in many states with conditions       |
| May an aesthetician inject?                           | Generally **no**, this is the clearest bright line, and a frequent violation   |
| What supervision level is required?                   | On-site, immediately available, or general, differs by state and by treatment  |
| Must the supervising clinician be physically present? | Some states require it for specified procedures                                |
| Who may operate which lasers?                         | Frequently a separate rule from injectables, with its own delegation framework |
| May an NP or PA supervise?                            | Depends on state scope-of-practice rules                                       |

Get this in writing from counsel per state. Building a staffing model on an incorrect assumption means every treatment delivered is a potential violation.

## Cash-pay, and why chargebacks matter more here

Med spas are predominantly cash-pay, which removes most of the payer machinery this wiki describes, and replaces it with a different set of problems.

<Note>
  💉 **Chargeback exposure is materially higher in aesthetics than in general medicine.** High ticket sizes, elective procedures, outcome-dependent satisfaction, and a retail purchase mentality combine to produce dispute rates well above medical practice norms, and card networks monitor dispute ratios with real consequences.
</Note>

The controls that matter:

* **Statement descriptor** matching the brand the patient recognizes
* **Signed informed consent** covering expected outcomes and their variability
* **Documented before-and-after expectations**, including that results vary
* **A written refund and touch-up policy** the patient signs
* **Immediate receipts**
* **Refund fast when you're wrong**, cheaper than winning a dispute, and far cheaper than losing one

See [Chargebacks](/concepts/payments/chargebacks) and [Prevent chargebacks](/guides/payments/prevent-chargebacks).

**Packages and memberships** create a further wrinkle: money collected for treatments not yet delivered is **deferred revenue**, and it is a liability. If the patient disputes or the business closes, that money was never yours. Account for it as deferred revenue, not as cash earned.

## Product supply chain

An enforcement area distinct from CPOM and easy to get wrong.

Prescription products — neuromodulators, dermal fillers, and injectable pharmaceuticals — must be:

* **Purchased from authorized distributors**, not grey-market or overseas sources
* **Ordered under a prescriber's authority**, typically the medical director or a supervising physician
* **Stored per manufacturer requirements**, with temperature control and documentation
* **Traceable by lot**, for recalls and adverse events

Purchasing non-FDA-approved or foreign-sourced product is a **federal** issue, separate from any state licensing question, and it has resulted in criminal enforcement. It is not a cost-saving strategy.

**In an MSO-PC structure, who buys the product?** Prescription products should generally be purchased by or under the authority of the **PC**, the entity with prescriptive authority, not by the MSO. This is a detail that gets missed when the MSO handles all purchasing as a matter of course.

## Do you even implicate CPOM?

Worth asking, because the answer varies with your service mix:

| Service                                | Medical?                        |
| -------------------------------------- | ------------------------------- |
| Neuromodulator and filler injection    | **Yes**, prescription products  |
| Prescription-strength chemical peels   | Generally yes                   |
| Most medical-grade laser treatments    | Generally yes                   |
| Microneedling                          | Depends on depth and state      |
| Body contouring devices                | Depends on the device and state |
| Basic facials, waxing, retail skincare | Generally no                    |

A pure aesthetics business with no medical services may not need a professional entity at all. A business offering both usually needs the medical services in a PC and may keep the non-medical services in the MSO, with the line drawn by counsel, and drawn precisely.

## Launch pitfalls

1. **Treating a medical director stipend as the whole compliance strategy**
2. **Skipping or delegating the good faith exam** improperly
3. **Aestheticians injecting**, the clearest violation available
4. **Non-clinician ownership of the entity delivering medical services**
5. **Grey-market product**
6. **Treating package prepayments as revenue** rather than deferred liability
7. **Ignoring chargeback ratios** until the processor imposes a reserve
8. **Assuming cash-pay means no kickback exposure**, state all-payer anti-kickback and fee-splitting statutes frequently reach commercial and cash arrangements, including referral and marketing deals. See [Stark and anti-kickback](/concepts/compliance/stark-and-anti-kickback).
9. **No good faith estimate for self-pay patients**, the No Surprises Act's GFE requirement applies regardless of whether you bill insurance. See [The No Surprises Act](/concepts/compliance/no-surprises-act).

## Sources

1. Cal. S.B. 351 (2025), effective January 1, 2026. Summary: Quarles, [California Cracks Down](https://www.quarles.com/newsroom/publications/california-cracks-down-new-laws-governing-the-corporate-practice-of-medicine-and-pe-deals).


## Related topics

- [The corporate practice of medicine doctrine](/concepts/model/cpom.md)
- [The friendly PC, explained](/concepts/model/the-friendly-pc.md)
- [Chargebacks: when patients dispute card payments](/concepts/payments/chargebacks.md)
- [Enforcement, and what happens when structures fail](/concepts/model/enforcement-and-risk.md)
- [Run a CPOM self-audit](/guides/compliance/run-a-cpom-self-audit.md)
- [Prevent chargebacks](/guides/payments/prevent-chargebacks.md)
- [Set up card payments](/guides/payments/set-up-card-processing.md)
- [California — CPOM & MSO reference](/reference/legal/states/california.md)
- [Card dispute reason codes](/reference/banking/chargeback-reason-codes.md)