New York's medical spa industry has seen rapid growth, but compliance with state regulations remains a critical issue. Investigations revealed alarming violations, including unlicensed medical procedures and unsafe practices. To address these concerns, New York introduced stricter rules, clarified licensing requirements, and formed a dedicated enforcement task force. Here's what you need to know:
- Medical Procedures Are Regulated: As of March 2025, treatments using energy-based devices (e.g., lasers, radiofrequency) are classified as medical practices, except for laser hair removal. Only licensed medical professionals can perform these services.
- Enforcement Is Increasing: In 2026, inspections of 223 businesses resulted in 87 citations for violations, including unlicensed medical practices and facility safety issues.
- Key Agencies Involved: Compliance requires navigating oversight from the New York Department of State (NYDOS), New York State Education Department (NYSED), and New York Department of Health (NYDOH).
- Strict Ownership Rules: Only licensed physicians can own medical spas, while non-physicians can manage non-clinical operations through Management Services Organizations (MSOs).
To stay compliant, medical spas must adhere to licensing rules, document physician oversight, and maintain proper business structures. Violations can lead to license revocation, hefty fines, or criminal charges.
Key Regulatory Agencies in New York
New York Medical Spa Regulatory Agencies: Roles and Responsibilities
Operating a medical spa in New York means navigating rules from three state agencies. Knowing which agency oversees specific parts of your business is key to staying compliant and avoiding penalties.
The New York Department of State (NYDOS) handles non-medical beauty services like facials and waxing. It licenses individual practitioners (e.g., estheticians, cosmetologists) and business entities. For example, in January 2026, the NYDOS investigated Patricia Rivas, a licensed esthetician in Warwick, NY, who was running an unlicensed salon and performing medical procedures like cosmetic injections. A client developed a MRSA infection and sepsis, leading to an emergency suspension and eventual revocation of Rivas's license.
The New York State Education Department (NYSED) manages licensing for medical professionals such as physicians, registered nurses, and nurse practitioners. It regulates nearly one million practitioners across over 50 professions. If your spa offers treatments like Botox, fillers, or IV therapies, the professionals performing these services must hold NYSED-issued medical licenses. NYSED also issues Certificates of Authorization for professional corporations (PCs) and professional limited liability companies (PLLCs).
The New York Department of Health (NYDOH) focuses on facility safety, public health standards, and prescription monitoring. As part of the state’s medical spa enforcement task force, NYDOH conducts audits on RN protocols, delegation logs, and compliance with prescription regulations. Depending on your procedures, your facility may need to register with this agency.
| Agency | Primary Oversight | Key Responsibilities |
|---|---|---|
| NYDOS | Non-Medical Beauty Services | Licenses estheticians, cosmetologists, and waxing specialists; inspects facilities; prohibits medical procedures |
| NYSED | Medical Professional Licensing | Licenses physicians, RNs, NPs, PAs; issues Certificates of Authorization; enforces Corporate Practice of Medicine |
| NYDOH | Facility Safety & Public Health | Audits RN protocols, oversees prescription monitoring (iSTOP/PMP), and sets telehealth standards |
Since January 2026, these agencies have coordinated efforts through a medical spa enforcement task force. This approach means inspections now cover everything from practitioner licensing to facility sanitation and business compliance.
New York Department of State (NYDOS)
NYDOS oversees the "appearance enhancement" side of your business, which includes five license categories: Cosmetology, Esthetics, Nail Specialty, Natural Hair Styling, and Waxing. Every spa must hold a business license from NYDOS, and individual operators must display their licenses with photographs.
The agency enforces strict safety standards, requiring the use of EPA-approved disinfectants, proper storage of sharp tools, and banning items like credo blades and styptic pencils. Businesses must also display an itemized list of services and prices.
Importantly, NYDOS licensees cannot perform medical procedures. This means no Botox, fillers, or laser treatments beyond hair removal. For example, in January 2026, NYDOS investigated Fei Min, who operated Princess Beauty, LLC in Flushing, Queens. Min, holding only a Cosmetology license, performed over 100 neck injections of a substance alleged to be Botox and stem cells, causing severe blistering and scarring. Min’s license was revoked.
Between January and September 2026, NYDOS inspected 223 businesses advertising "med spa" services, issuing 87 citations for violations like unlicensed medical practices. Investigations uncovered controlled substances, including Fentanyl and Propofol, in some unlicensed facilities.
"A business that is promoting itself as a 'med spa' or offering 'med spa' services MUST be licensed as a medical facility and licensed professionals must be performing the services."
- New York Department of State
Suspect unlicensed activity? File a Preliminary Statement of Complaint with the NYDOS Division of Licensing Services.
New York State Education Department (NYSED)
NYSED regulates the medical side of your spa through its Office of the Professions. This includes oversight of physicians, registered nurses, nurse practitioners, physician assistants, massage therapists, and acupuncturists.
If your spa provides treatments like Botox, dermal fillers, cryotherapy, hormone replacement therapy, or medical-grade peels, the practitioners must hold NYSED-issued medical licenses. An appearance enhancement license from NYDOS isn’t enough. This ensures that all medical procedures adhere to strict safety protocols.
NYSED also enforces the Corporate Practice of Medicine doctrine, which requires medical services to be delivered through physician-owned entities like PCs or PLLCs. These entities must obtain a Certificate of Authorization from NYSED. As of 2026, the department oversees more than 100,000 professional practice business entities.
"New York's unique system of professional regulation, recognized as a model for public protection, has grown to encompass nearly 1,000,000 practitioners and over 100,000 professional practice business entities in more than 50 professions."
- NYS Office of the Professions
To stay compliant, regularly audit your practitioners' licenses, ensure that only qualified professionals perform medical procedures, and formalize supervision with written clinical protocols and documented physician involvement.
New York Department of Health (NYDOH)
NYDOH focuses on facility safety, public health, and prescription monitoring. While NYSED handles individual licensing, NYDOH ensures that medical practices meet broader public health standards.
The agency audits RN protocols, delegation logs, and compliance with documented medical protocols. It also oversees the Prescription Monitoring Program (PMP/iSTOP) and electronic prescribing (e-Rx) requirements. Practitioners prescribing controlled substances must follow these rules.
Depending on the services your facility offers, you may need to register with NYDOH. The department also sets standards for telehealth services, which many medical spas use for consultations.
To meet NYDOH requirements, keep detailed documentation of RN protocols, procedures, and physician oversight. Ensure compliance with iSTOP/PMP and e-Rx mandates, and verify whether your services require facility registration. Adhering to NYDOH guidelines is essential for aligning your operations with state regulations.
Licensing Requirements for Medical Spa Professionals and Entities
New York has clear rules separating those who perform medical procedures from those who own medical businesses. Knowing these regulations is critical to avoid penalties like license revocation, fines, or even criminal charges. Below, we dive into the licensing standards for both individual practitioners and entities.
Medical Professional Licensing
Every medical spa professional in New York must have an active license from the New York State Education Department (NYSED) that matches the services they provide. Here's a breakdown of what each role is allowed to do:
- Physicians (MD/DO): They can perform all medical and cosmetic procedures and are the only professionals allowed to own medical spas under New York’s Corporate Practice of Medicine doctrine.
- Nurse Practitioners (NPs): They can administer injections and lasers. After completing 3,600 hours of qualifying clinical experience, NPs can practice independently with Full Practice Authority.
- Physician Assistants (PAs): Like NPs, PAs can perform injections and lasers but must work under the supervision of a qualified physician.
- Registered Nurses (RNs): RNs are permitted to handle injections (like Botox and fillers), non-ablative lasers, phototherapy, and superficial skin peels, but only under a patient-specific order from a physician or NP. They are not allowed to perform microneedling or PDO threading.
- Aestheticians: Licensed under the New York Department of State (NYDOS) for "Appearance Enhancement", aestheticians can only perform non-invasive procedures, such as facials, waxing, and superficial peels. They are not authorized to perform medical treatments like Botox, fillers, or microneedling.
"Aestheticians are licensed by the Department of State, not Education, and legally are no different than a medical assistant. They can perform laser hair removal simply because the practice remains unregulated in New York. Like MAs, they cannot perform invasive procedures."
- Andrew M. Knoll, MD, JD, Cohen Compagni Beckman Appler & Knoll, PLLC
Here’s a quick reference table for clarity:
| Professional Role | Licensing Agency | Permitted Medical Spa Scope of Practice |
|---|---|---|
| Physician (MD/DO) | NYSED | Full scope of medical and cosmetic procedures; ownership. |
| Nurse Practitioner (NP) | NYSED | Medical procedures; can issue orders for RNs. |
| Physician Assistant (PA) | NYSED | Medical procedures under qualified physician supervision. |
| Registered Nurse (RN) | NYSED | Injections, non-ablative lasers, and peels via patient-specific orders. |
| Aesthetician | NYDOS | Non-medical facials, waxing, and superficial peels only. |
| Medical Assistant (MA) | N/A | Non-invasive support; cannot perform injections or lasers. |
Facility and Entity Licensing
Since most spa services fall under medical practice, only physician-owned entities can operate them in New York. The law allows three types of structures: Professional Corporation (PC), Professional Limited Liability Company (PLLC), or Registered Limited Liability Partnership (RLLP).
To open a medical spa, the entity must secure a Certificate of Authorization from the New York State Education Department. After that, it must file professional licensure and address documentation with the New York Department of State.
Non-physicians can still participate in the industry by owning a Management Services Organization (MSO). An MSO handles administrative and non-clinical tasks like billing, marketing, and leasing space. However, the physician owner must maintain full control over clinical operations, including hiring, patient records, and bank accounts. Payments to the MSO must be a flat fee based on fair-market value, not a percentage of medical revenue, to avoid illegal fee-splitting.
"Non-physicians cannot own or control medical practices... The entity must hold a Certificate of Authorization from the New York State Education Department."
Failing to comply with the Corporate Practice of Medicine doctrine or practicing medicine without a license can lead to Class E felony charges.
Corporate Practice of Medicine and Legal Business Structures
This section delves into the Corporate Practice of Medicine (CPOM) doctrine and the legal business structures required for compliance in New York. Under New York's CPOM rules, only licensed physicians are permitted to make medical decisions. Like practitioner licensing, CPOM aims to ensure high standards of patient care by restricting clinical decisions to qualified professionals. New York enforces some of the most stringent CPOM laws in the country, as outlined in Education Law, which reserves the practice of medicine exclusively for licensed physicians. Even elective treatments like Botox, fillers, and certain laser procedures fall under CPOM's scope.
"The underlying goal of CPOM is to protect patients by preventing unlicensed individuals or businesses from influencing medical decisions."
It's a common misconception that hiring a "Medical Director" to oversee treatments and share fees is a legal workaround in New York. In reality, this practice is explicitly prohibited.
Compliant Business Models
To comply with CPOM regulations, physicians must own medical spas through specific legal entities, such as a Professional Corporation (PC), Professional Limited Liability Company (PLLC), or Professional Partnership. Non-physicians, however, can invest in these businesses by forming a Management Services Organization (MSO). The MSO handles administrative tasks like billing, marketing, human resources, and facility leasing, while a separate physician-owned entity provides clinical services. Importantly, the physician must maintain complete control over all clinical decisions.
A properly structured MSO arrangement requires a clear division between administrative and clinical responsibilities. The Management Services Agreement (MSA) should detail which functions are administrative and ensure that the MSO is compensated with a flat fee based on fair-market value. Percentage-based compensation tied to medical revenue is considered illegal fee-splitting under New York law.
Common Violations and Risks
Understanding compliant business structures is essential to avoid the risks of non-compliance. Violating CPOM regulations can lead to severe consequences, including felony charges, loss of medical licenses, and hefty financial penalties. One notable example occurred in June 2015 when the New York State Attorney General reached a settlement with Aspen Dental Management, Inc. The company was found to be dictating clinical care and engaging in illegal fee-splitting. As a result, Aspen Dental Management, Inc. was ordered to pay $450,000 in civil penalties and completely restructure its business model.
"Medical and dental decisions should be made by licensed providers using their best clinical judgment, and should not be influenced by management companies' shared interest in potential profits."
- Eric Schneiderman, former New York Attorney General
Common violations include MSO arrangements where management companies exert excessive control over medical practices, effectively becoming the de facto owners. Other issues include "paper-only" medical directors who provide symbolic oversight without actively participating in patient care, as well as violations of scope of practice. For instance, aestheticians performing injections or deep chemical peels without proper physician supervision can lead to charges of unlicensed medical practice and malpractice claims.
| Violation Category | Specific Non-Compliant Action | Potential Legal Consequence |
|---|---|---|
| Ownership | Non-physician or general business corporation owning a med spa | Business closure, felony charges, and legal sanctions |
| Compensation | Fee-splitting or percentage-based management fees | Insurance reimbursement clawbacks and invalidated contracts |
| Supervision | Using a "Medical Director" for nominal or remote oversight | Loss of medical license and civil lawsuits |
| Scope of Practice | Aestheticians performing injections or deep chemical peels | Unlicensed practice of medicine charges and malpractice claims |
sbb-itb-02f5876
Steps to Maintain Compliance in Your Medical Spa
Staying compliant in New York’s medical spa industry demands constant diligence and a structured approach. Recent inspections by the New York City Council’s Oversight and Investigations Division, in collaboration with the NYS Department of Health and the Department of Education, revealed troubling findings. Between June and September 2024, inspections of 15 medical spas across NYC uncovered that every single business had health and safety violations, 73% lacked medical oversight during procedures, and 60% were operating without required liability insurance. By the end of 2025, these lapses led to the closure of four businesses.
"Every New Yorker must be able to trust that city businesses they visit comply with state legal regulations to protect consumers' health and safety. Yet, this joint investigation revealed that too many medspas are openly disregarding the law and endangering their customers." - Adrienne Adams, Speaker of the NYC Council
With New York’s dedicated medical spa enforcement task force now conducting surprise inspections, compliance is no longer just a best practice - it’s a necessity to keep your business operational.
Conducting Internal Compliance Audits
Regular internal audits are a cornerstone of compliance. Plan monthly audits and assign responsibilities to your clinical leadership team. Use the NYSED Office of the Professions License Lookup to confirm that all provider licenses are active, unrestricted, and in good standing. Alarmingly, during a 2024 inspection, 26% of med spas were found to have expired credentials.
Create a scope of practice matrix that ties each service - like Botox, fillers, laser treatments, and IV therapy - to the appropriate license and supervision level. This helps avoid common violations, such as unlicensed aestheticians performing medical procedures. Your audits should ensure that aestheticians are not conducting treatments like microneedling, injectables, or using medical-grade lasers.
Also, review your corporate structure. Confirm that your clinical entity operates as a physician-owned Professional Corporation (PC) or Professional Limited Liability Company (PLLC). Ensure that any Management Services Organization (MSO) involved does not interfere with clinical decision-making. For Nurse Practitioners, verify they’ve met the required 3,600 hours of clinical experience for independent practice or maintain collaborative agreements if they haven’t. Similarly, keep updated supervisory agreements on file for Physician Assistants.
Maintaining Proper Documentation
Once compliance is verified through audits, thorough documentation ensures you stay on track. Documentation lapses were a major factor in the closure of four NYC medical spas in 2025. Records must clearly demonstrate physician oversight. Keep a compliance binder that includes up-to-date NP agreements, PA supervisory agreements, and RN protocols for easy access during inspections.
Each medical procedure should have documented medical assessments, including patient history, examinations, and contraindication checks, performed by licensed practitioners (MDs, DOs, NPs, PAs, or RNs under a care plan). Use treatment-specific informed consent forms for procedures like Botox, fillers, lasers, and IV therapy. These forms should outline dosing, safety measures, and emergency protocols for complications such as vascular occlusion or anaphylaxis.
Additionally, maintain a Quality Assurance (QA) program that includes regular chart reviews, injector competency assessments, and incident logs documenting investigations and resolutions. For energy-based devices, keep training certificates, competency evaluations, device calibration records, and test-spot logs for all Class IIIb and Class IV devices. These records are critical, especially since 53% of inspected locations failed hygiene standards and 46% had product labeling issues.
Reviewing Advertising and Marketing Practices
Your marketing materials must align with your compliance efforts. Regulators treat these materials as legal documents, so accuracy is non-negotiable. Review all advertisements to ensure they reflect actual provider credentials and avoid misleading titles.
"Regulators look at what you do, not what you call it." - Lengea Law
Keep an archive of all marketing materials to provide evidence of compliance if investigated. Avoid using “spa” in your business name if operating as a medical practice, as this can mislead consumers about the nature of your services. Ensure all advertising accurately represents provider qualifications and does not exaggerate outcomes or safety claims. Pricing and promotional materials should be truthful and avoid guaranteeing results.
"The idea that Botox, lasers, or injectables are 'routine' or 'non-invasive' does not remove them from medical regulation in New York." - Lengea Law
Using Practice Management Software for Compliance
With New York's enforcement task force ramping up inspections, relying on manual compliance tracking just doesn’t cut it anymore. As mentioned earlier, strict regulations demand a more efficient way to manage licenses and documentation. In January 2026, a statewide investigation of 223 businesses led to 87 citations for possible violations, including practicing medicine without proper authorization.
"New York medical spas are now a priority enforcement target." - Lengea Law
Here’s how the right tools can simplify compliance tracking, supervision documentation, and patient management.
Tracking Licenses and Certifications
During inspections in 2024, 26% of med spas were flagged for expired credentials. These violations can result in hefty fines. Prospyr offers automated alerts that notify you 60–90 days before a license or certification expires, helping you avoid operating with outdated credentials.
The platform also provides analytics tools to perform digital audits of provider licenses. This ensures that MDs, DOs, NPs, PAs, and RNs are working within their legal scope. For example, you can cross-check services like Botox, fillers, laser treatments, and IV therapy with the required license type. This centralized system allows you to demonstrate compliance quickly during inspections - no more scrambling through manual records.
Supervision and Documentation
New York regulators emphasize that supervision must be "real, not nominal". They’re cracking down on so-called "paper medical directors" who lend their licenses without actively overseeing practices. Prospyr’s EMR integration and AI-powered note creation tools help document physician oversight for each procedure. These tools log the approved protocol, the licensed provider involved, and the active participation of the Medical Director.
The platform also secures sensitive records with HIPAA-compliant encryption and password-protected access. This is crucial, as HIPAA violations can result in fines of up to $1.5 million annually. During inspections in 2026, investigators uncovered unsafe practices, including the storage of controlled substances like Fentanyl and Propofol in unlicensed facilities.
"The right medspa software reduces human error, improves patient experience, and protects your business from legal issues." - AestheticsPro
Patient Management and Reporting
Prospyr’s digital intake and reporting tools build on strong documentation practices to further ensure compliance. For instance, digital intake forms guarantee that every patient undergoes a medical consultation and signs informed consent before any procedure. The practice analytics tools also help pinpoint compliance gaps by tracking which services are performed, who performs them, and the protocols followed.
The reporting features make it easy to maintain a Quality Assurance program. This can include regular chart reviews and incident logs. When inspectors show up, you can quickly generate reports detailing your license verification process, supervision documentation, and patient safety measures. This level of preparedness is essential, given that New York regulators are now conducting inspections and issuing subpoenas without needing prior complaints.
Conclusion
New York requires medical spas to operate under physician-owned entities, such as PCs or PLLCs, and adhere to strict supervision guidelines. These regulations are in place to protect patients, maintain professional integrity, and ensure businesses operate responsibly. To enforce these standards, the state has established a dedicated task force to inspect facilities statewide.
"Whether you are launching a new med spa or operating an established one, compliance is not a box-checking exercise. It is foundational to protecting your business, your licenses, your reputation, and your patients." - Lengea Law
Failing to comply with New York's Corporate Practice of Medicine doctrine can result in Class E felony charges and hefty financial penalties. Beyond the legal risks, non-compliance endangers your patients and could lead to the loss of your ability to operate.
To navigate these challenges, tools like Prospyr offer solutions by automating license management, documenting physician oversight, and maintaining HIPAA-compliant records. Features like automated alerts, digital audit trails, and secure patient intake forms help ensure readiness for inspections while keeping the focus on delivering quality care.
FAQs
Does my med spa need to be a PC or PLLC to offer Botox or lasers in New York?
In New York, med spas are required to be owned by a licensed physician, as mandated by the state's corporate practice of medicine laws. This means the business must typically be set up as a PC (Professional Corporation) or PLLC (Professional Limited Liability Company) under the ownership of a medical professional. These rules are in place to ensure that the facility adheres to state medical practice standards.
What’s the fastest way to confirm a provider’s NY license and scope before scheduling a treatment?
The fastest way to check a provider’s New York license and scope is through the online verification tool offered by the New York State Education Department. This service gives you instant access to key licensure information. If you need written certification or more detailed verification, additional resources are available on their website.
How can a non-physician legally invest in or run a med spa in New York without violating CPOM?
In New York, corporate practice of medicine (CPOM) laws prevent non-physicians from owning or running medical spas. These laws ensure that only licensed healthcare professionals can oversee and control medical practices.
However, non-physicians can still be involved through Management Service Organizations (MSOs). MSOs handle non-medical support services, like administrative tasks or marketing, while leaving medical decisions and ownership strictly in the hands of licensed physicians. These arrangements must carefully follow regulations to maintain compliance.
