1. What happens if a med spa violates CPOM rules?

CPOM violations can invalidate your ownership structure, contracts, and revenue model, exposing the business to shutdowns, fines, clawbacks, and forced restructuring, often retroactively.

2. What regulatory risks does a non-compliant med spa face?

Non-compliance can trigger audits, license suspension or revocation, forced business restructuring, revenue clawbacks, civil penalties, and in severe cases, practice shutdown. Regulators can unwind years of transactions if the ownership or compensation structure violates CPOM or medical practice laws.

3. Can non-physician owners influence treatment offerings or pricing?

Non-physician owners may set business pricing, but cannot influence which treatments are offered, how they are performed, or when they are medically appropriate. Crossing this line is a common and serious compliance failure.

4. Do all treatments require physician supervision or a medical director?

In most states, yes. The required level of supervision depends on the procedure and state law. Offering medical treatments without proper physician oversight can result in license discipline and practice closure.

5. Why are prepaid packages and memberships a compliance risk?

Prepaid services create deferred revenue, consumer protection obligations, and state-specific legal exposure. Misrecording them as revenue or using unlawful expiration terms can trigger audits, refunds, and regulatory penalties.

6. What is the fastest way regulators identify a non-compliant med spa?

Regulators look for mismatches between documents and reality, who controls clinical decisions, how physicians are paid, how revenue is recorded, and whether marketing claims align with medical records.

What happens if a med spa violates CPOM rules?

CPOM violations can invalidate your ownership structure, contracts, and revenue model, exposing the business to shutdowns, fines, clawbacks, and forced restructuring, often retroactively.

What regulatory risks does a non-compliant med spa face?

Non-compliance can trigger audits, license suspension or revocation, forced business restructuring, revenue clawbacks, civil penalties, and in severe cases, practice shutdown. Regulators can unwind years of transactions if the ownership or compensation structure violates CPOM or medical practice laws.

Can non-physician owners influence treatment offerings or pricing?

Non-physician owners may set business pricing, but cannot influence which treatments are offered, how they are performed, or when they are medically appropriate. Crossing this line is a common and serious compliance failure.

Do all treatments require physician supervision or a medical director?

In most states, yes. The required level of supervision depends on the procedure and state law. Offering medical treatments without proper physician oversight can result in license discipline and practice closure.

Why are prepaid packages and memberships a compliance risk?

Prepaid services create deferred revenue, consumer protection obligations, and state-specific legal exposure. Misrecording them as revenue or using unlawful expiration terms can trigger audits, refunds, and regulatory penalties.

What is the fastest way regulators identify a non-compliant med spa?

Regulators look for mismatches between documents and reality, who controls clinical decisions, how physicians are paid, how revenue is recorded, and whether marketing claims align with medical records.

TABLE OF CONTENTS

This checklist provides a high-level compliance framework for U.S. med spas, organized around six regulatory pillars commonly examined by medical boards, auditors, and enforcement agencies. It is designed as a self-assessment tool to help identify structural and operational risk areas, not as legal advice.

1. Ownership & CPOM Compliance

2. Licensing & Scope of Practice

Ownership structure has been reviewed and approved by healthcare counsel

MSO / PPMC agreements are properly executed and current

Physician entity retains full authority over clinical decisions

Non-physician owners do not exercise clinical control

Med spa operations comply with all applicable state-specific medical spa and aesthetic medicine laws

Licensure and scope-of-practice requirements are reviewed for estheticians and all non-physician service providers

All clinical staff are properly licensed and practicing within scope

3. Medical Director & Physician Supervision

Medical director duties are clearly defined and actively performed

Physician supervision requirements meet state-specific standards

4. Clinical Documentation & Informed Consent

Patients receive and acknowledge written disclosure of procedure risks and limitations

Treatment expectations and aftercare requirements are reviewed before consent

Medical records document patient understanding prior to consent

Executed consent forms are securely retained and audit-ready

5. HIPAA & Data Privacy

Patient data handling complies with HIPAA and state privacy laws

Staff are trained on HIPAA and data privacy requirements

Access to PHI is restricted, monitored, and regularly reviewed

Data security policies are reviewed and updated as risks evolve

6. Financial, Tax & Fee-Splitting Compliance

Patient data handling complies with HIPAA and state privacy laws

Staff are trained on HIPAA and data privacy requirements

Access to PHI is restricted, monitored, and regularly reviewed

Data security policies are reviewed and updated as risks evolve

Advertising and marketing claims comply with medical advertising rules

Frequently Asked Questions

Med Spa Compliance Survival Checklist: A Regulatory Risk Framework

The following framework provides a comprehensive roadmap for navigating the complex regulatory environment governing the medical aesthetic industry. By prioritizing clinical integrity and administrative adherence, practitioners can effectively mitigate liability and ensure long-term operational sustainability. This checklist serves as a strategic instrument for aligning your business objectives with the highest standards of patient safety and state-specific legal mandates.

Bookkeeping Pricing

Schedule a Consultation

Legal Disclaimer

This content is for general informational purposes only and does not constitute legal, medical, or financial advice. Laws and regulations vary by state, and readers should consult qualified legal and healthcare professionals before making business or clinical decisions.

Published on January 29th, 2026 | Written by Marc Pamatian

Schedule a Consultation

Ready to find out how your business having its own Chief Bookkeeping Officer can help?

1. Ownership & CPOM Compliance

2. Licensing & Scope of Practice

Ownership structure has been reviewed and approved by healthcare counsel

MSO / PPMC agreements are properly executed and current

Physician entity retains full authority over clinical decisions

Non-physician owners do not exercise clinical control

Med spa operations comply with all applicable state-specific medical spa and aesthetic medicine laws

Licensure and scope-of-practice requirements are reviewed for estheticians and all non-physician service providers

All clinical staff are properly licensed and practicing within scope

3. Medical Director & Physician Supervision

Medical director duties are clearly defined and actively performed

Physician supervision requirements meet state-specific standards

4. Clinical Documentation & Informed Consent

Patients receive and acknowledge written disclosure of procedure risks and limitations

Treatment expectations and aftercare requirements are reviewed before consent

Medical records document patient understanding prior to consent

Executed consent forms are securely retained and audit-ready

5. HIPAA & Data Privacy

Patient data handling complies with HIPAA and state privacy laws

Staff are trained on HIPAA and data privacy requirements

Access to PHI is restricted, monitored, and regularly reviewed

Data security policies are reviewed and updated as risks evolve

6. Financial, Tax & Fee-Splitting Compliance

Patient data handling complies with HIPAA and state privacy laws

Staff are trained on HIPAA and data privacy requirements

Access to PHI is restricted, monitored, and regularly reviewed

Data security policies are reviewed and updated as risks evolve

Advertising and marketing claims comply with medical advertising rules

Frequently Asked Questions

1. What happens if a med spa violates CPOM rules?

2. What regulatory risks does a non-compliant med spa face?

3. Can non-physician owners influence treatment offerings or pricing?

4. Do all treatments require physician supervision or a medical director?

5. Why are prepaid packages and memberships a compliance risk?

6. What is the fastest way regulators identify a non-compliant med spa?

Med Spa Compliance Survival Checklist: A Regulatory Risk Framework

Get the New Attorney Financial Checklist PDF

Schedule a Consultation

Chief Bookkeeping Officer

Contact Us