Beyond the Cash Register: Why Medical Spas Face Real Healthcare Regulatory Risk

Key Takeaways

• As the medical spa industry continues to grow, regulators and investors alike are paying closer attention to how these businesses are structured and operated. While they may currently operate outside the traditional insurance reimbursement model, they remain subject to a complex web of healthcare, privacy, consumer protection and corporate practice regulations.
• Compliance gaps involving ownership structures, provider supervision, fee arrangements, patient privacy, marketing practices and data security can create significant risk, which often become a focal point during investor due diligence and can negatively impact valuation, delay deals or create costly remediation obligations.
• Building a strong compliance foundation today can reduce regulatory exposure and position the business for a more successful future transaction. Medical spas and other aesthetic healthcare providers should take a proactive approach to compliance by evaluating their corporate structure, provider arrangements, privacy and marketing practices, and overall governance framework.

Providers who do not seek reimbursement from government payors may not face all of the same regulatory risks as providers who participate in federal and state governmental healthcare programs, but medical spas and other healthcare providers operating in the cash-pay space are far from outside regulators’ focus. Medical spas and other aesthetic medical practices involve the delivery of professional services (i.e., medicine and nursing), and that single fact triggers a web of state and federal regulatory requirements that can create significant liability, impede growth and threaten deal value.

This article explores some key regulatory risks facing medical spas, what private equity and other investors scrutinize before writing a check, and why taking proactive regulatory and compliance steps pays dividends—both in day-to-day operations and when it comes time to sell.

The Regulatory Landmines

Corporate Practice of Medicine

Many states prohibit non-physicians from owning or controlling entities that practice medicine. This is arguably the most consequential regulatory issue in the med spa space. The regulatory frameworks vary by state, often requiring a patchwork of structures for an enterprise that can be difficult to navigate. The consequences of violating state corporate practice of medicine doctrines can include voiding of contracts, loss of licensure for collaborating physician and civil (or even criminal) liability.

Compliant structures typically involve a “friendly PC” or professional entity model in which a licensed physician holds the ownership and control of the professional entity and enters into a management services arrangement with the business entity. But these arrangements must be carefully structured to avoid being deemed a sham or the alter ego of the non-professional business entity. Certain states, like California, are currently fixated on corporate practice issues, which means medical spas need to stay informed of enforcement and legislative updates in real time that may impact their compliance in a given state.

Fee-Splitting Prohibitions

Closely related to corporate practice of medicine restrictions, many states prohibit the sharing of professional fees between physicians and non-physicians. Management fees calculated as a percentage of revenue, profit-sharing arrangements with non-physician owners or compensation models tied to the volume of procedures performed can all run afoul of these laws depending upon state laws. Penalties vary by state but can include fines, civil penalties, license revocation and criminal prosecution.

State Medical Board Oversight and Supervision Requirements

Even though no federal payor may be involved, state medical boards retain full authority over the practice of medicine and other health professions. This means:

• Scope of practice issues. States vary widely on which procedures nurse practitioners, physician assistants, registered nurses, and aestheticians may perform, and under what level of physician supervision. A Botox injection administered by an RN without proper physician oversight may constitute unlicensed practice of medicine in some states.
• Supervision and delegation. Many states require that a physician be physically present on-site, or at minimum available within a defined timeframe, when certain procedures are being performed. “Renting” a physician’s license—where a doctor lends their name to a practice they rarely visit—is a well-known enforcement target.
• Advertising and informed consent. State boards regulate how medical services are marketed. Misleading claims about qualifications, results or the nature of procedures can trigger disciplinary action.

Federal and State Anti-Kickback Statutes

While these statutes are most commonly associated with government-payor fraud, their reach is broader than many assume. The Federal Anti-Kickback Statute applies to services reimbursable by any federal healthcare program. Many states’ Anti-Kickback Statute equivalents are additionally limited in applicability to government dollars, like Medicaid. If a medical spa also treats any patients whose services are covered by a federal program, even incidentally, kickback exposure could exist, though states with all payor kickback statutes (i.e., Ohio and Illinois) may be implicated even where the medical spa does not take reimbursement from Medicaid. Moreover, referral arrangements between med spas and referring physicians, joint venture structures and marketing arrangements can implicate these laws if any federal healthcare program dollars touch the arrangement, even tangentially. As such, while the Federal Anti-Kickback Statute and state equivalents may not receive as much focus in the med spa and aesthetics space as in other specialties, it remains an important consideration for any business relationships with referral sources and vendors.

HIPAA and Data Privacy

Medical spas can be “covered entities” under HIPAA if they transmit health information electronically in connection with a standard transaction covered under HIPAA’s administrative simplification rules, regardless of payor source. MSOs supporting such practices can then become subject to HIPAA as business associates. Understanding whether a medical spa practice is subject to HIPAA and, if so, ensuring compliance should be another regulatory focal point for medical spas. In addition to federal HIPAA requirements, individual states may have enacted their own health information privacy and security laws that impose additional or more stringent obligations, and these must be separately evaluated for compliance.

State Consumer Protection and Pharmacy Laws

Compounding, dispensing and administering prescription medications (including neurotoxins, dermal fillers and weight-loss injectables) are subject to state pharmacy laws. Improper sourcing of products—including use of foreign-sourced or gray-market injectables—can result in FDA enforcement action, state disciplinary proceedings and civil liability.

Telephone Consumer Protection Act (TCPA) Risks

Medical spas often rely on aggressive, high-volume marketing campaigns, including repeated promotional texts and calls, auto-dialers, prerecorded messages and broad lead-generation efforts. These practices can trigger the Telephone Consumer Protection Act (TCPA), particularly where consent is absent, deficient, revoked or not properly documented, or where opt-out requests are not honored. TCPA lawsuits may be brought on an individual or class basis, and statutory damages can be significant, making even routine marketing campaigns a material regulatory and litigation risk.

Artificial Intelligence and Emerging Technology Risks

Medical spas are increasingly using AI tools for patient consultations, treatment recommendations, patient intake and marketing content. That use can create new regulatory and liability risks, including scope-of-practice concerns if an AI tool is used to make or materially influence clinical decisions without appropriate licensed-provider review; state medical board scrutiny regarding delegation, supervision, informed consent, and professional judgment; and FDA considerations for AI-driven devices or software that may be regulated as medical devices. Practices also must address privacy, bias, accuracy, documentation and vendor oversight, because inaccurate or unsupported outputs may result in patient harm, consumer-protection claims, professional discipline or other liability.

What Investors and Private Equity Firms Scrutinize

Private equity has transformed the med spa and aesthetics space over the last decade, and sophisticated investors have developed detailed due diligence playbooks. When a PE firm evaluates a medical spa platform or add-on acquisition, it looks closely at the following:

Corporate structure and ownership. A non-compliant structure is often a deal-killer or results in significant purchase price reductions.

• Is the professional entity model compliant in every state where the business operates?
• Are the management services agreements properly structured, with fair market value compensation and appropriate allocation of clinical versus administrative responsibilities?

Provider agreements and supervision. Investors want to see evidence of active medical director involvement—documented chart reviews, supervision protocols and proof of on-site presence.

• Are all arrangements with critical professional appropriately documented?
• Do they reflect actual practice?
• Is physician supervision real and demonstrable, or merely on paper?

Compliance programs and allocation of responsibilities. The MSO and PC should coordinate compliance activities while preserving the PC’s authority over clinical and professional matters.

• Are comprehensive compliance programs in place addressing fraud, waste and abuse, TCPA, consumer protection, and vendor relationship management?
• Do those programs include a HIPAA compliance plan (if applicable) with documented data security protocols and annual security risk assessments?
• In an MSO-PC structure, are compliance responsibilities clearly delineated so that risks are appropriately allocated and each organization understands which entity is responsible for policies, training, monitoring, incident response, vendor oversight and remediation?

Regulatory history. Any history of medical board investigations, consent orders, malpractice claims involving scope-of-practice issues, or patient complaints raises red flags that require explanation and remediation.

Scalability within the regulatory framework. Investors are building multi-state platforms. They need to know that the operating model can be replicated across jurisdictions with varying regulatory requirements. A structure that works in Texas may be non-compliant in California or New York.

Employment and independent contractor classification. Misclassification of providers as independent contractors—common in the med spa space—creates tax liability, benefits exposure and can undermine the supervision framework that supports regulatory compliance.

The Value of Engaging Sophisticated Counsel Early

Building a Compliant Foundation

This includes:

• Designing a corporate structure that respects the corporate practice of medicine doctrine and fee-splitting prohibitions in your state
• Drafting management services agreements, provider agreements and medical director agreements that reflect economic and operational reality
• Developing supervision protocols and delegation frameworks tailored to your service mix and the jurisdictions in which you operate
• Developing and implementing a strong general and HIPAA/state data privacy and security compliance program proportionate to your operations
• Developing policies and procedures on advertising and marketing practices that stay within medical board guidelines

The cost of building compliance framework correctly from the start is a fraction of the cost of unwinding a non-compliant structure under time pressure during a transaction—or worse, under the scrutiny of a state medical board investigation.

Positioning for a Future Exit

Even if a sale is years away, the decisions you make today directly affect your future enterprise value. Buyers pay premiums for companies with clean regulatory profiles and may discount—or altogether walk away from—targets with structural compliance deficiencies that require costly remediation or create indemnification exposure.

Work can be done for your practice now to ensure your business is structured with an eye toward the diligence process a buyer will eventually conduct. Documentation can be organized and complete. Compliance programs can be mature and demonstrable. Corporate structures can be defensible. When a letter of intent arrives, you will be ready—and your purchase price will reflect it.

The Bottom Line

The absence of government payor dollars does not mean the absence of government regulation. Medical spas sit at the intersection of healthcare law, corporate law, data security and privacy and consumer protection—and the regulatory complexity of the space continues to grow as new treatments, new delivery models and new state regulations enter the picture. Operators who invest in compliance infrastructure and experienced counsel are not only protecting themselves from enforcement risk, they are building businesses that command premium valuations in an increasingly sophisticated M&A market.

Benesch’s Healthcare team helps healthcare businesses navigate complex regulatory requirements while positioning their organizations for growth, investment and successful transactions. We are available to help organizations assess risk, strengthen compliance programs, and support future growth initiatives.