Short answer: Starting a medical spa is a jurisdiction- and procedure-specific healthcare business project, not a standard salon launch. Before leasing space or buying equipment, verify ownership, facility, professional licensing, scope, supervision, prescribing, consent, privacy, record, insurance, and product requirements with the relevant regulators and qualified advisers.
Scope and legal note: This guide was revised on September 1, 2026 from primary US regulator sources. It is educational, not legal, medical, tax, or compliance advice. State rules differ, product authorization is use-specific, and local requirements can change. Confirm the current rules for every jurisdiction and procedure.
| Area | Questions to resolve | Evidence to retain |
|---|---|---|
| Ownership and facility | Who may own the entity? Is a facility or clinic license required? | Regulator guidance, entity records, permits, and counsel review |
| Clinical authority | Who may evaluate, prescribe, delegate, supervise, and perform each procedure? | Licenses, scope analysis, protocols, supervision records, and credentials |
| Products and devices | Is the exact product or device authorized for the intended use? | Current FDA labeling, device status, supplier records, and training |
| Consent and records | What consent, assessment, documentation, photography, and retention rules apply? | Approved forms, signed records, policies, and retention schedule |
| Privacy and security | Does HIPAA apply? What other privacy, breach, and consumer rules apply? | Applicability analysis, risk assessment, agreements, controls, and training |
There is no single nationwide answer in the sources reviewed. State regulators describe different ownership, supervision, facility, delegation, consent, and documentation requirements. For examples, review the guidance from the Medical Board of California, the Massachusetts medical-spa advisory, and the Oregon Medical Board.
Do not infer the rule from a neighboring state or from the job title used by another business. Map each proposed procedure to the applicable professional scope, prescriber relationship, delegation rule, supervision level, facility requirement, and emergency plan. Confirm the result with the responsible boards and qualified counsel.
Review the exact product, device, indication, operator, setting, and claims. The FDA provides separate information for aesthetic and cosmetic devices, dermal fillers, botulinum-toxin products, and medical lasers.
Authorization is product- and use-specific. An authorized device category does not make every device, indication, marketing statement, or operator compliant. Retain current labeling, supplier and lot records, maintenance documentation, adverse-event procedures, training, and the clinical basis for the intended use.
No primary source was found for the earlier universal startup range or market-size claims. Build a procedure- and location-specific model from written quotes.
Use low, base, and high scenarios. Keep quoted costs separate from assumptions, record the quote date, and model the cash timing of deposits, inventory, payroll, and collections. Do not treat a market forecast as evidence that a local clinic will reach a specific revenue or valuation.
HIPAA applies to covered entities and business associates, not automatically to every business that handles health-related information. Use HHS covered-entity and business-associate guidance to determine status, and review the Security Rule for risk-based safeguards when it applies.
A vendor calling a portal “HIPAA secure” does not complete the analysis. Verify the system’s role, data flows, access, logging, encryption, backup, incident handling, subcontractors, data return and deletion, and any required business-associate agreement. Other state privacy, biometric, medical-record, consumer, and breach rules may apply even when HIPAA does not.
HHS states that HIPAA does not set a general medical-record retention period; state law generally governs medical-record retention. See the HHS retention FAQ. HIPAA’s six-year retention rule for specified compliance documentation is a different requirement.
Create a schedule by record type and jurisdiction, covering clinical records, consent, photographs, prescriptions, device and lot data, incidents, accounting, employment, privacy documentation, and litigation holds. Confirm the schedule with qualified advisers and the applicable boards.
Separate clinical records and authority from general business operations. Depending on the verified requirements, a stack may need role-based access, clinical documentation, e-prescribing or order controls, product and lot tracking, consent, secure communication, scheduling, payments, inventory, accounting, audit logs, and retention controls.
Do not assume one general CRM can serve as the clinical system of record. Document which system owns each record, who can access it, how data moves, which agreements apply, and how exports and deletion work.
This guide does not identify one universal federal “med-spa license.” Federal product and device rules can apply, while ownership, professional, facility, supervision, consent, and record requirements are often state-specific.
Do not use a general answer. Scope depends on the jurisdiction, professional license, exact procedure, product or device, delegation, supervision, and setting. Verify with the responsible boards.
Not automatically. Determine whether the business is a covered entity or business associate and identify other applicable privacy and record laws.
There is no universal cost in this guide. Build a local, procedure-specific model from current quotes, regulatory requirements, staffing, insurance, technology, inventory, buildout, and working capital.
No primary source was found for the prior 30%-40% med-spa claim. Measure reminders, deposits, cancellations, and attendance using defined local cohorts.
Mako offers general client, scheduling, billing, and operating workflows. Before using any product in a medical setting, verify its current scope, data handling, agreements, safeguards, integrations, and suitability for every intended record and procedure.
Related reading: Member Retention Strategies: How Top Gyms Keep Clients for Years; Google Business Profile: The Complete Local SEO Guide for Service Businesses; How to Calculate Member Lifetime Value; Client Retention for Salons: 10 Strategies to Boost Rebooking Rates.
