Yes. In some states, including California, medical practices must comply with the Corporate Practice of Medicine (CPOM) doctrine. This generally means: 

• Only licensed physicians can own medical practices, with some exceptions 

• Med spas offering medical services must have physician ownership or a compliant MSO (Management Services Organization) structure 

Improper structuring can lead to fines, license risk, and contract unenforceability. 

It depends on state law, but typically: 

• Non-medical cosmetic services (basic facials, some skincare) may be performed by estheticians 

• Medical procedures (Botox, fillers, lasers, prescription treatments) require physician oversight and proper delegation 

California is particularly strict on delegation and written supervision rules. 

Generally, NPs and PAs: 

• Cannot independently own a medical practice in CPOM states like California 

• May operate under physician supervision or MSO arrangements 

However, they may own non-medical aesthetic businesses if structured correctly. 

An MSO is a separate entity that handles: 

• Billing 

• Staffing 

• Marketing 

• Operations 

It allows non-physicians to participate in business operations while keeping medical decision-making with licensed physicians. 

MSO structures are common for: 

• Med spas 

• Multi-location clinics 

• Healthcare startups 

You do not need to be a licensed provider to own an MSO. 

Key risks include: 

• Unauthorized practice of medicine 

• Improper delegation to unlicensed staff 

• Lack of informed consent documentation 

• Advertising violations (misleading claims or before/after photos) 

• Criminal penalties 

Regulators actively investigate cosmetic clinics and med spas. 

Healthcare advertising must avoid: 

• False or misleading claims 

• Guaranteed results (“100% safe,” “no risks”) 

• Misrepresentation of credentials 

Many states also regulate: 

• Before-and-after images 

• Testimonials 

• Discount or Groupon-style promotions for medical services 

HIPAA requires protection of Protected Health Information (PHI), including: 

• Secure storage of patient records 

• Encryption of electronic systems 

• Staff training and privacy policies 

• Business Associate Agreements (BAAs) with vendors 

Even small med spas are fully subject to HIPAA if they handle PHI. 

Yes. Proper informed consent is critical for liability protection and regulatory compliance. 

Consent forms should include: 

• Risks and benefits 

• Alternative treatments 

• Expected outcomes (without guarantees) 

• Post-care instructions 

• Patient acknowledgment and signature 

With some few exceptions, generally, no, not in a medical practice. 

Healthcare businesses must ensure: 

• Proper contractor agreements 

• No employee-level control over ICs 

• Compliance with wage/hour laws 

• Proper supervision rules for clinical work 

   

  Misclassification can trigger audits and penalties. 

Potential consequences include: 

• Board of Medicine investigations 

• Civil fines and penalties 

• Loss of professional license 

• Contract invalidation (leases, vendor contracts, MSAs) 

• Civil lawsuits from patients or competitors 

Proactive compliance is significantly less costly than enforcement action.