Key takeaways
- Med spas sit under four overlapping regimes—corporate practice of medicine, scope-of-practice and delegation rules, good-faith-exam requirements, and HIPAA/OSHA—and no single vendor covers all four.
- The category has three distinct provider types: law firms (legal advice and board defense), compliance consultancies (programs, binders, audits—not legal advice), and HIPAA/OSHA software (self-serve, with real G2 review footprints).
- Match the type to the problem: formation and MSO work needs a law firm; ongoing HIPAA/OSHA hygiene fits software or a consultancy; a board investigation means calling a law firm immediately, before you respond.
- In CPOM states the MSO model is the standard fix for non-physician ownership—but the structure must be state-specific, fair-market-value, and leave the physician in genuine clinical control.
- Vet providers on aesthetics track record, named state coverage, fee structure, and who actually does the work.
- Red flags: template-only compliance kits sold as legal advice, non-attorney services drafting legal structures, and any provider without state-specific guidance.
A med spa is a medical practice wearing a hospitality brand, and regulators treat it that way. Every treatment room sits at the intersection of medical board rules, corporate-ownership law, delegation requirements, and federal privacy and workplace-safety regimes—and the penalties for getting it wrong run from fines to license revocation to criminal referral. Choosing the right compliance and legal partner is therefore not a "nice to have" purchase; it is the decision that determines whether your business structure would survive a board inquiry. This guide explains the three very different types of provider in this category, when you need each one, and how to vet them. Browse the full lineup in our compliance and legal category.
Why med spas are a regulatory minefield
Four overlapping regimes make aesthetics uniquely risky. First, the corporate practice of medicine (CPOM) doctrine: in many states, a non-physician cannot own a medical practice outright, so the common "entrepreneur owns the med spa" model is illegal unless it is restructured—usually through a management services organization (MSO). Second, scope of practice and delegation: who may inject, fire a laser, or perform microneedling varies dramatically by state, and a physician or medical director must delegate and supervise within strict limits. Third, the good-faith exam: most states require a qualified provider to examine and diagnose each new patient before treatment, and skipping or rubber-stamping it is one of the most commonly cited violations in board actions. Fourth, the federal layer: HIPAA governs every photo, chart, and text message containing patient information, while OSHA governs sharps, bloodborne pathogens, and workplace safety. No single vendor covers all four equally—which is exactly why this category is confusing.
The three provider types
Law firms. These are licensed attorneys who can give legal advice, draft enforceable contracts, and represent you before a board or in court. The national aesthetics-first firms are ByrdAdatto (the best-known med spa firm in the country and AmSpa's legal partner), Lengea Law (founded by a med spa operator, with a large startup practice), Cohen Healthcare Law, Jackson LLP, and Frier Levitt. Around them sits a bench of regional and boutique options: Concierge Healthcare Attorneys, Innova Health Law, Little Health Law, Bryant Taylor Law (notable for its productized legal membership), LDG PLLC, and big-firm healthcare groups such as Quarles & Brady, Nixon Gwilt, and Hinshaw. Only this group can defend you in an investigation or give state-specific legal opinions.
Compliance consultancies. Firms like MedSafe, Aesthetic Compliance Experts, Healthcare Compliance Pros, and Medical Director Co build and maintain compliance programs: written policies and binders, mock audits, staff training, OSHA plans, and—in Medical Director Co's case—medical-director placement bundled with MSO structuring support. They are typically cheaper and more operational than law firms, but they are not attorneys and cannot give legal advice or represent you before a board.
HIPAA/OSHA compliance software. MedTrainer, Compliancy Group, and Abyde are self-serve platforms that automate risk assessments, policy libraries, staff training, credentialing, and incident logging. This is the one segment of the category with real G2 review footprints, so you can validate the user experience before buying. Software keeps your ongoing HIPAA and OSHA hygiene documented and audit-ready—but it will not restructure your ownership or tell you whether your RN can legally inject in your state.
When you need which
Match the provider type to the problem. Formation, ownership, and MSO work → law firm. If you are opening, buying, selling, or restructuring a med spa—or a non-physician owns any part of one—you need a healthcare attorney, full stop; this is legal work with license-level consequences. Ongoing HIPAA/OSHA hygiene → software or a consultancy. Once the structure is sound, the recurring work of risk assessments, training logs, and policy updates is well served by Abyde, MedTrainer, or Compliancy Group, or by a consultancy program from MedSafe or Healthcare Compliance Pros if you want humans doing the maintenance. A board investigation, subpoena, or patient complaint → law firm immediately. Do not route this through a consultant or answer the board yourself; call counsel such as ByrdAdatto or Lengea Law before you respond to anything. Most mature med spas end up with both a law firm relationship and a software or consultancy layer—they solve different problems.
MSO & medical-director structures 101
In CPOM states (California, Texas, New York, and many others), the fix for non-physician ownership is the MSO model: a physician-owned professional entity holds the medical practice and employs or contracts the clinical providers, while your management company owns the brand, leases, equipment, and non-clinical staff, and charges the practice a management fee. The structure matters because getting it wrong is not a paperwork problem—it can void your contracts, expose the physician's license, and convert your revenue into the illegal practice of medicine. The management fee must be fair-market-value, the physician must retain genuine clinical control, and the agreements must be drafted for your specific state. Every serious firm in this category—ByrdAdatto, Lengea Law, Cohen Healthcare Law—builds these structures routinely. Medical Director Co approaches the same problem from the staffing side: it places vetted medical directors and pairs the placement with MSO structuring support on a flat monthly fee, which suits operators who need both the doctor and the structure at once. However you get there, the medical director must actually supervise—protocols, chart review, availability—not just rent a license.
Questions to ask
- How much of your work is aesthetics? A firm that lives in med spa law will know the delegation rules, board tendencies, and industry deal terms; a generalist will bill you to learn them.
- Which states do you cover, and how? Med spa law is state law. Ask for named experience in your state, not a promise to "research it."
- What is the fee structure? Hourly, flat-fee packages, or a monthly membership—and what exactly is included in each.
- Who actually does the work? Partner, associate, or (at a consultancy) a non-attorney compliance specialist—and who will pick up the phone when the board letter arrives.
- What happens after the documents are delivered? Ongoing counsel, annual reviews, and training, or a one-time handoff.
Red flags
Walk away from template-only "compliance kits" sold as legal advice—a generic MSO agreement or good-faith-exam policy that has not been tailored to your state can be worse than nothing, because it creates false confidence. Be wary of non-attorney services using legal language: consultancies are valuable, but anyone drafting your ownership structure or advising on delegation law without a license is practicing law without one, and you carry the risk. And treat the absence of state-specific guidance as disqualifying; any provider who cannot immediately discuss your state's CPOM position and delegation rules is guessing.
Ready to go deeper? Browse the full compliance and legal category for our independent reviews, see our pricing guide for what this all costs, and if you have narrowed it to the two leading aesthetics-first firms, our ByrdAdatto vs Lengea Law comparison breaks down exactly where each one wins. For how we evaluate every vendor, see our methodology.
Frequently asked questions
Do I need a healthcare lawyer to open a med spa?
In almost every case, yes—at least at formation. Med spas are medical practices, and in corporate-practice-of-medicine states a non-physician cannot simply own one; the ownership must be structured, usually through an MSO, with state-specific agreements. Aesthetics-focused firms like ByrdAdatto, Lengea Law, and Cohen Healthcare Law do this work routinely, and regional boutiques and big-firm healthcare groups cover it as well. Consultancies and software can maintain your compliance program afterward, but only a licensed attorney can design the legal structure and defend it.
What's the difference between a compliance consultancy and a law firm?
A law firm employs licensed attorneys who can give legal advice, draft enforceable state-specific contracts, and represent you before a medical board or in court. A compliance consultancy—MedSafe, Aesthetic Compliance Experts, Healthcare Compliance Pros, Medical Director Co—builds and maintains the operational program: policies, binders, mock audits, and training. Consultancies are typically cheaper and more hands-on day to day, but they are not attorneys, cannot give legal advice, and cannot defend you in an investigation. Most mature med spas use both.
Is HIPAA/OSHA software enough on its own?
No—software solves a different problem. Platforms like MedTrainer, Compliancy Group, and Abyde automate risk assessments, policy libraries, staff training, and incident logging, which keeps your ongoing HIPAA and OSHA hygiene documented and audit-ready. What software cannot do is restructure a non-compliant ownership model, tell you whether your RN can legally inject in your state, or respond to a board inquiry. Treat it as the maintenance layer on top of a sound legal structure, not a substitute for one.
What is an MSO and do I need one?
A management services organization is the standard structure for non-physician med spa ownership in corporate-practice-of-medicine states. A physician-owned professional entity holds the medical practice and clinical staff, while your management company owns the brand, leases, and equipment and charges a fair-market-value management fee. If a non-physician owns any part of your med spa in a CPOM state, you very likely need one—and it must be drafted for your specific state by a healthcare attorney, because a defective MSO can void contracts and expose licenses.
What should I do if my med spa receives a board complaint or investigation letter?
Call a healthcare law firm immediately, before you respond to anything—including what feels like a routine request for records. Board investigations are license-level proceedings, and early answers given without counsel are the most common way operators turn a manageable inquiry into a career-threatening one. This is squarely law-firm territory: firms like ByrdAdatto, Lengea Law, and Frier Levitt handle board defense routinely. A consultancy or software vendor cannot represent you, and this is not the moment to economize.
