Everything a Med Spa or Aesthetic Practice Needs

Some states bar lay people and lay companies from owning a medical practice or controlling medical decisions, a rule known as the corporate practice of medicine. California is a clear example. Its Medical Board explains that lay persons and lay entities may not own any part of a medical practice, that physicians must own the practice or work for a physician-owned practice or medical corporation, and that no stock in a medical corporation may be owned by a lay person, with no more than 49 percent owned by other licensed health care professionals such as nurses and physician assistants. The Board also warns that management, franchise and MSO arrangements are illegal when an unlicensed person or company controls medical records, hiring of clinical staff, coding and billing, or the choice of equipment and drugs, and that a lay-owned business hiring a medical director is prohibited.

Other states draw these lines differently. Because this is a legal question, we work alongside your attorney: your attorney decides the structure, and we handle the entity filings, tax registrations, organizational NPI, management agreement logistics and every other setup step in the right order.

A medical director is not a name on a wall. The Medical Board of California describes paper-only supervision, where a physician lends a license to a business for a monthly fee, as a violation of the law, and says supervision means to oversee, direct, inspect and evaluate. A supervising physician should be capable of performing the procedures being delegated, must ensure that the people performing them are trained and competent, and remains responsible for complications, emergencies and back-up plans. When nurses work under standardized procedures the physician need not be in the facility, but must be immediately reachable and close enough to help when needed, and the location must be a medical setting under the physician's control, not a salon or spa.

Supervision rules are set state by state. We document the delegation protocols, competency records and emergency plans your state requires and keep them current as staff and services change.

Who may inject, use a laser or perform the first exam is set by state law and each state's medical and nursing boards, and the answers differ. In California, the Medical Board says physicians may inject Botox or direct registered nurses or physician assistants to do so under supervision, that registered nurses and physician assistants may use lasers and intense pulsed light devices under supervision, and that unlicensed staff, including medical assistants, may not use prescriptive drugs or devices at all. Estheticians may perform non-medical skin treatments but not medical procedures. Nurses may not set up a practice in a salon, hire a physician supervisor or perform medical procedures independently.

The prior examination, often called the good faith exam, follows the same pattern. In California an appropriate prior examination is required before prescriptive drugs or devices are used and may not be delegated to registered nurses, while nurse practitioners under standardized procedures and physician assistants may be delegated the exam. California's Board of Registered Nursing has since added two categories of nurse practitioners who may practice within a defined scope without standardized procedures, so we confirm the current rule for each clinician before you build a schedule around it. In Kentucky, the Board of Nursing says aesthetic procedures may be performed by a nurse as part of a medically prescribed plan of care, and that a licensed practical nurse may not independently order products, prescribe or perform procedures such as Botox or dermal fillers. We check your state's board guidance before you hire, and we license every clinician you bring on.

Every clinician who examines, prescribes or performs a procedure needs a current license in the state where the patient is treated, and nurse practitioners and physician assistants need any collaborative or supervision agreements their state requires. A prescriber who orders controlled substances, for example for medical weight loss, needs a DEA registration in that state. Your location may need its own business or facility licenses, and in California, for example, an esthetician working in a physician's practice needs an establishment license from the Board of Barbering and Cosmetology.

We prepare and track every license, renewal and registration for your team, prepare collaborative and supervision agreements from our templates for your attorney to review, and keep a single record of who is licensed for what.

Cosmetic treatments carry the same duty of informed consent as any other medical procedure. The Medical Board of California says patients must at least be told the nature of the treatment, its risks, complications and expected benefits, including its likelihood of success, and the alternatives, including no treatment. It also says that the standards for medical records, confidentiality and delegation apply to cosmetic medicine exactly as they do elsewhere.

Our legal template library includes intake, consent and financial policy forms, and our EHR captures intake and consent online before the visit, so each signed consent sits in the chart with the treatment note, product and lot details your protocols call for.

Most aesthetic treatments are paid for by the patient, so a med spa may never bill an insurer. Practices that also provide medical services, such as dermatology or medical weight loss visits, may want their clinicians in network for those services. Each payer credentials each clinician on its own application, and each clinician needs an individual NPI linked to the practice.

When that applies, we credential your clinicians with the plans you choose, keep CAQH profiles attested and track every re-credentialing date. When it does not, we set up the practice to run on cash pay from the start.

Self-pay patients have pricing rights under federal law. Providers must give uninsured and self-pay patients a good faith estimate of expected charges when care is scheduled at least three business days ahead or when the patient asks for one, and a patient whose bill comes in at least $400 above the estimate can dispute it through a federal process. We build those estimates into scheduling so they go out automatically.

Memberships, packages and prepaid treatment series are common in aesthetic practices, and each needs clear terms on what is included, renewal, cancellation and unused credits. Our patient portal runs memberships and recurring billing on your own domain, our payment processing takes cards, HSA and FSA cards and ACH, and our billing team reconciles memberships and cash collections with the rest of your revenue.

The Federal Trade Commission says the same legal principles apply to marketing any health-related product, that health and safety claims need competent and reliable scientific evidence, and that testimonials reporting results more dramatic than people can generally expect are likely to be deceptive. A line like results not typical does not cure a misleading claim.

Before-and-after photos are patient information. Full-face photographs and comparable images are among the identifiers HIPAA lists, and a covered entity needs the patient's written authorization to use protected health information for marketing. That authorization must describe the information, who may use and receive it, the purpose, an expiration date or event, and the patient's signature and date. We collect those authorizations before any photo is used and write ad copy and page content that stays within these limits.

HIPAA applies to providers who conduct standard electronic transactions, such as billing insurance electronically. Some cash-only practices fall outside it, but state privacy laws still apply. A covered practice must run an accurate and thorough assessment of the risks to the electronic patient information it holds, including photos on tablets and phones, booking tools and marketing platforms, and train its whole workforce on security.

We confirm whether HIPAA applies to your practice, run the risk assessment, write your privacy and security policies, collect business associate agreements and keep patient information out of ad platforms and analytics.