Medical Director Requirements for Med Spas, Explained by State
The phrase "you need a medical director" is everywhere. What it actually means — legally, operationally, state by state — is explained far less often. This article closes that gap.
Why Medical Director Requirements Are So Confusing
Med spa owners Google "medical director requirements" and find a jumble of state-specific statutes, Medical Practice Act sections, nursing board guidance, and laser-safety regulations — most of which are not written for a business owner to parse. The confusion is compounded because:
- Many states regulate the physician supervision function without using the phrase "medical director" at all.
- Requirements differ by service type — the rules for neurotoxin injections may differ from those for fractional laser or for prescription compounded medications.
- NP and PA scope-of-practice is expanding in some states and being litigated in others, creating a moving target.
- CPOM (Corporate Practice of Medicine) doctrine adds a second compliance layer that exists independently of supervision rules.
The result: med spas often have a physician whose name appears on a website and a signed agreement, but the underlying structure does not actually satisfy the legal requirements. That is an enforcement risk, not a technicality.
The Two Distinct Requirements You Must Satisfy
Before diving state by state, it helps to separate two legally distinct requirements that people often conflate:
1. Clinical supervision requirement
Who must supervise the licensed clinicians performing procedures? This is governed by each state's Medical Practice Act, Nursing Practice Act, and/or PA practice act. It determines whether an NP can work independently, how many NPs a physician can supervise, whether that physician must be on-site, and how quickly they must be reachable.
2. Corporate Practice of Medicine (CPOM) requirement
Who can own the entity providing medical services? This is separate from supervision. Even if a state allows full NP independent practice (meaning no physician supervision is required for the NP's clinical work), CPOM doctrine may still require a physician-owned professional entity to provide the licensed medical layer that your business contracts with. These two requirements do not always track each other.
State-by-State Overview: The Major Markets
The following is a general summary based on publicly available statutes and regulatory guidance as of mid-2026. Laws change; always verify current requirements with licensed counsel in your state.
California
California has some of the strictest CPOM enforcement in the country. Business & Professions Code §2052 prohibits the unlicensed practice of medicine, and the Medical Board of California has actively pursued non-physician entities that improperly control physicians. Key points:
- Physician-owned PC required for the medical layer; MSO may handle operations.
- Supervising physician must be "available" — historically interpreted as physically proximate, though telehealth guidance has evolved.
- NPs in California gained full practice authority under AB 890 (effective 2023 for qualifying NPs), but CPOM still requires physician ownership of the PC. An NP cannot own the PC in California.
- Laser procedures are classified by the Medical Board as medical procedures — RNs and NPs may operate them under standing orders or protocols, but physician-owned oversight is required.
Texas
Texas has detailed med-spa guidance from the Texas Medical Board. Highlights:
- Non-surgical medical procedures (including Botox and most aesthetic injectables) require a physician to establish a protocol and be available for consultation — but remote availability via phone is generally sufficient.
- PAs must have a formal supervisory agreement and practice under a physician's license; the ratio limit is generally 7 PAs per physician.
- NPs in Texas require a collaborative practice agreement with a physician for prescribing and for performing delegated medical acts; Texas does not have full NP independence.
- CPOM is enforced through Tex. Occ. Code §165.156 and related provisions. Physician-owned PC + MSO structure is the standard solution.
Florida
Florida regulates med spas under the Department of Health's Medical Quality Assurance framework. Key rules:
- Botulinum toxin (Botox, Dysport, etc.) and dermal fillers are medical procedures requiring prescription and physician oversight.
- NPs in Florida operate under a protocol agreement with a physician (CS-II medications require physician co-signature). Florida is not a full-practice-authority state.
- The Florida Medical Practice Act prohibits fee-splitting and the unlicensed practice of medicine. CPOM violations can result in criminal charges, not just license discipline.
- Remote supervision is widely practiced in Florida for aesthetic services, but the physician must have reviewed and signed protocols and must be reachable during treatment hours.
New York
New York combines strict CPOM enforcement with a physician supervision requirement that is among the most demanding for aesthetic procedures:
- NPs in New York gained independent prescribing authority for qualifying NPs (8,000+ hours experience) under the Nurse Practitioners Modernization Act, but CPOM means the medical entity delivering care must still be appropriately structured.
- Medical spas offering Botox, filler, or laser services must have a physician supervising the specific procedures, not merely "available in the building."
- New York's Office of Professional Medical Conduct has taken enforcement action against unlicensed entities controlling clinical decisions.
Illinois
Illinois has a moderate CPOM framework. The Illinois Medical Practice Act and the Advanced Practice Registered Nurse (APRN) act both apply:
- APRNs (NPs) in Illinois have full practice authority with no physician collaboration requirement — one of the earlier full-practice-authority states.
- Despite full NP independence, business entities offering medical services still need appropriate physician-owned entity structure for CPOM compliance if a physician is involved.
- Medical spas with an NP as sole clinician in a correctly structured entity have more flexibility in Illinois than in California or Texas.
Georgia
Georgia has a relatively permissive CPOM environment and explicit med-spa guidance:
- Georgia's Medical Practice Act allows non-physician-owned entities to employ physicians in limited circumstances, making it one of the more flexible states for med-spa structures.
- NPs must practice under a collaborative physician agreement; Georgia is not a full-practice-authority state.
- The Georgia Composite Medical Board has issued specific guidance on laser procedures, botulinum toxin, and injectable fillers — all require physician delegation or direct physician involvement.
Colorado, Arizona, and the Mountain West
Colorado and Arizona both have full NP practice authority. Arizona is particularly permissive — a qualified NP can operate an independent medical practice without any physician involvement. Colorado requires a standardized procedure and evidence of advanced practice. Both states still have anti-fee-splitting laws and general business integrity requirements, but the physician supervision structure is less prescriptive than California or Texas.
What Your Medical Director Agreement Must Actually Say
A medical director agreement that satisfies compliance has these components — in writing, not just in conversation:
Explicit scope of services
The agreement must list the specific services the physician is responsible for overseeing. "Aesthetic procedures generally" is not enough. If you add GLP-1 weight management (read our full guide on how to add GLP-1 services to your med spa), the agreement scope must be amended before launch.
Clinical authority language
The physician must retain the right — and in fact the obligation — to override any administrative decision that affects patient safety. The agreement cannot subordinate the physician's clinical judgment to your business operations. If a patient should not receive a procedure, the physician can say no without fear of contract termination on that basis.
Supervision ratios and availability
Spell out how many clinicians the physician supervises, maximum patient volume, and whether supervision is on-site or remote. If remote, define the response time and the circumstances under which on-site presence is required.
Protocol review and training obligations
The physician must review and sign all standing orders and clinical protocols. Training records for supervised clinicians should be maintained and available for inspection. An agreement that says "physician reviews protocols annually" is better than one that is silent on the subject; quarterly is better still for high-volume practices.
Fair market value compensation
Physician compensation must be at fair market value — determined independently, not as a percentage of revenue generated by the services they oversee. This is not just a federal anti-kickback concern; most state fee-splitting statutes independently prohibit percentage-based compensation arrangements. MDside charges flat, fair-market-value management fees, which keeps this structure clean.
What Happens When You Get This Wrong
CPOM and supervision violations are not hypothetical risks. In the past five years, state attorneys general and medical boards have taken enforcement action ranging from:
- Cease-and-desist orders requiring immediate halt of services
- License suspension or revocation for the supervising physician
- Civil penalties against the business entity (in some states, criminal charges)
- Required disgorgement of revenue earned under an improper structure
The most common trigger is not malicious fraud — it is an agreement that was drafted without CPOM expertise and a physician who was listed on a website but not genuinely supervising. Regulators are increasingly sophisticated about the difference.
How MDside Addresses This State by State
Building compliant physician structures independently in multiple states requires forming separate PCs in each state (most states require the PC to be organized under that state's law), credentialing local physicians, and maintaining agreements that evolve as state law changes. That is a significant legal and operational overhead for a growing med spa group.
MDside's nationwide physician network includes physicians credentialed and licensed in every major market, operating under pre-built PC structures that have been reviewed for state-specific CPOM compliance. The MSO management agreement your business executes is drafted to work across state lines while respecting each state's individual requirements.
If you are operating in multiple states or planning expansion, book a discovery call to map out which structures you need and which MDside can provide directly. We will also show you how the setup process works so there are no surprises.
And if your compliance question is specifically about security, HIPAA, and data handling — not just physician licensing — those are covered under a separate but equally important framework that we address with every partner.
Frequently asked questions
Does every med spa need a medical director?
If your med spa offers any prescription-only treatments — injectables like Botox and fillers, prescription-strength chemical peels, laser procedures classified as medical devices, or any compounded medication — you need licensed physician oversight in virtually every U.S. state. The specific title "medical director" may or may not be legally required, but the underlying physician supervision function always is.
Can a nurse practitioner serve as a medical director for a med spa?
In full-practice-authority states (currently about 27 states plus DC), an NP can independently supervise certain services without physician oversight. However, even in those states, CPOM laws typically still require a physician-owned professional entity to provide the licensed medical layer. An NP cannot be a "medical director" in the CPOM-compliance sense — they can be the supervising clinician under a physician-owned PC, but the PC itself must be physician-owned.
What must a medical director agreement include?
A valid medical director agreement should specify: the specific services covered and the physician's clinical authority over them; supervision ratios and response-time requirements; the physician's obligation to review protocols, train staff, and review adverse events; compensation at fair market value with no fee-splitting or referral arrangements; and a termination clause that does not compromise patient care continuity. Agreements missing scope-of-services language or that describe the physician as merely "available" are frequently the ones that generate regulatory problems.
What is the Corporate Practice of Medicine doctrine and which states have the strictest rules?
CPOM doctrine prohibits non-physician entities from employing physicians or directing their clinical decisions. California, Texas, New York, Illinois, and Florida are considered high-enforcement states with detailed CPOM statutes or strong regulatory guidance. States like Georgia and Colorado have weaker or more permissive CPOM frameworks, though federal anti-kickback principles still apply. In all states, the safest structure is a physician-owned PC with a separate MSO handling business operations.
How often must a medical director physically be present at my med spa?
Physical presence requirements vary widely. California requires the supervising physician to be "available" — traditionally interpreted as on-site or reachable within a short travel distance. Texas and Florida have published guidance allowing telehealth-based supervision for certain services. A handful of states require a physician on-site for certain laser procedures regardless of NP or PA scope. Your legal counsel should review your state's Medical Practice Act and any applicable board guidance before relying on remote supervision alone.
Does my medical director agreement need to cover every service line, including new ones like GLP-1?
Yes. A medical director agreement that covers aesthetic services (Botox, lasers, peels) does not automatically extend to medical weight management, hormone therapy, or other prescription-based programs. Each material service expansion should trigger a review and amendment of the agreement scope, signed by the supervising physician. Treating a GLP-1 program as administratively identical to filler injections is one of the most common compliance mistakes med spas make when entering the weight-loss market.