Med Spa Laws by State: What Changed in 2025 and 2026, and What an Inspector Opens the Binder to Check

The most detailed public record of what a med spa inspection looks for was published in New York between December 2025 and January 2026. It names categories and puts a percentage on each one.

It also describes businesses that were picked in advance because they appeared to be operating outside medical licensure. That part gets dropped every time the numbers are quoted. One dataset is appearance enhancement businesses offering medical procedures. The other is fifteen locations selected because they appeared to inject without a doctor-owned or nurse-practitioner-owned Professional Corporation. Neither is a survey of licensed clinics.

What they do show is which documents an inspector opens the binder to find, and that list lines up closely with what four jurisdictions have now written down. This post reads the primary instruments, prints the places where two official versions of the same dataset disagree, and ends with a document drill you can run in an afternoon.

Every source on this page was read on 19 August 2026. We make med spa software, so we have an obvious interest in you keeping licensing and clinical records in a system that can produce them on demand. The statutes and inspection findings below hold regardless of whose software you run them in.

What New York published, and who those 223 businesses were

The New York State Department of State issued a press release on January 8, 2026, "New York Department of State Issues Warning to Consumers after Investigations of Med Spa Service Providers." The core sentence: "In total, 223 businesses have been inspected throughout New York State. Of the businesses inspected, 87 were cited for possible violations concerning, among other issues, the unlawful practice of medicine."

Three qualifications travel with that number. The unit is "businesses," and DOS describes the population as appearance enhancement businesses offering medical procedures, meaning DOS-licensed cosmetology and esthetics businesses rather than licensed medical practices. The 87 were cited for possible violations, and DOS states that "The majority of inspections are still pending hearing and awaiting resolution." And this is not a new posture: DOS describes its Division of Licensing Services as "continuing to inspect these types of businesses as part of their annual inspection program."

On findings, the release reports "expired and suspected counterfeit products, as well as the presence of controlled substances, including Fentanyl, Xylocaine, and Propofol," plus sharps containers holding used needles. Read that list as the department's wording rather than a classification. Xylocaine is a brand of lidocaine, which does not sit on the federal controlled substance schedules.

The operational point is narrow. DOS describes this work as an annual inspection program, so an inspection of a licensee in that category need not begin with a complaint about your business.

The fifteen inspections, and the criterion that explains the 100 percent

The New York City Council's Oversight and Investigations Division published "Moving The Needle: A Joint Enforcement Operation Against Improperly Licensed Medspas in NYC" in December 2025. Between June and September 2024, OID coordinated inspections of fifteen medspas across all five boroughs, three in the Bronx, four in Brooklyn, three in Manhattan, four in Queens and one on Staten Island, working with the DOS Bureau of Licensing Services, the DOH Bureau of Investigations and the DOH Bureau of Narcotic Enforcement, with advisory support from NYSED.

The headline is that "all 15 of the inspected businesses received DOS violations." Read the methodology on page 4 before repeating it. All fifteen held appearance enhancement business licenses, and each "appeared to be offering medical procedures such as the application of Botox and fillers without being registered as a doctor- or nurse practitioner-owned Professional Corporation through NYSED." The third criterion was "customer reviews, complaints, and prior disciplinary actions." The sample was selected on the finding, so the 100 percent unlicensed-procedures figure is close to tautological.

The detail that should interest anyone marketing a clinic is how targets were found. The report describes an Instagram advertisement that "depicted a woman matching the appearance of the cosmetologist that OID and state officials identified as the owner of the business, seemingly injecting an individual." Social advertising was an enforcement lead. What your treatment posts show someone doing, and who that person is licensed to be, is part of your public compliance surface.

On outcomes, "the DOS Licensing Division initiated disciplinary proceedings against all 15 businesses. Four cases have already been adjudicated, resulting in license revocations through consent orders." Eleven were still pending. One vocabulary warning: every use of "consent" in that report means a consent order, a negotiated disciplinary settlement. There is no informed-consent violation category anywhere in its appendix.

The violation categories, and the three renderings that disagree

The table shows the categories from the report's executive summary, the share of the fifteen cited in each, and where a second official rendering of the same dataset prints a different number.

Start with the 86 percent, the most misread number in the set. The report's appendix defines the category as "Safety Records Missing (MSDS / Disinfectant Invoices)" and lists three findings under it: no invoices for disinfectants, no Material Safety Data Sheets, and MSDS not produced for inspection. That is chemical hazard paperwork under cosmetology rules. It is not patient charts or clinical documentation, and anyone telling you 86 percent of med spas were missing patient records has misread the appendix.

Then the disagreements. The executive summary says 63 percent for chemical and fire safety; the body of the same report and the Council press release of December 11, 2025 both say 66 percent. The summary says 46 percent for labeling; the body says one-third. The press release omits the 86 percent category entirely. We print the summary figures because they are the fullest list, and flag the conflicts rather than picking a winner.

What is unambiguous is that license display (93 percent) and expired or unlicensed practitioners (26 percent) are two separate categories. The first is what hangs on the wall. The second is whether the credential behind it is live. Note also that product expiry sits in the sanitation category rather than labeling, so those two shares should not be added together. None of this generalises to a licensed clinic, but all of it tells you what gets asked for and how easy each item is to fail on paperwork alone.

Indiana wrote registration and a fifteen-day clock into statute

Indiana Senate Enrolled Act No. 282, 124th General Assembly, Second Regular Session, is titled "Compounding drugs; registration of medical spas." Section 4 reads: "IC 25-22.5-12.5 IS ADDED TO THE INDIANA CODE AS A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY 1, 2026]: Chapter 12.5. Medical Spas." Of the four instruments read for this post, it is the only one that puts a registration duty, a designated practitioner, an adverse event notice and a public database in a single chapter.

Three dates get collapsed into one constantly. The chapter is effective July 1, 2026. IC 25-22.5-12.5-3(b) requires the board to "establish a registration procedure for medical spas not later than October 1, 2026." Section 3(a): "Beginning January 1, 2027, a medical spa is required to be registered under this chapter in order to do business in Indiana." Section 3(c) allows a fine of up to five thousand dollars for operating unregistered.

Scope is the trap. Section 1(a) defines a medical spa as a facility offering medical health care services, using prescription drugs for intravenous, intramuscular or subcutaneous delivery, and holding itself out as focused on cosmetic or lifestyle treatments. Section 1(b) then states: "The term does not apply to the following: (1) A physician's office. (2) A facility or practice that is otherwise licensed by the state." Read Section 1 before assuming you must register.

Section 5(a) requires a designated responsible practitioner with prescriptive authority and "education and training in the health care services and treatments being performed and medications being dispensed or administered." Section 5(b) sets the presence obligation as being "physically present at the medical spa location for a sufficient amount of time to comply with the responsibility of ensuring that the medical spa complies with the requirements of this chapter." There is no percentage and no hours figure, so there is no number to schedule against.

Section 6(b) is the clock: notify the board "not later than fifteen (15) days after the occurrence of a patient's serious adverse event." Section 6(a) defines that narrowly as jeopardy to health requiring medical or surgical intervention, or death, a life threatening occurrence, or inpatient hospitalization or its prolonging. The notice carries the patient name, medication or treatment, date, nature and location, and the patient's medical records. It is not a fifteen-day clock for every adverse event.

Two provisions get little attention and both bite. Section 9 prohibits treating a consumer at a location other than the medical spa office except for education or training, which reads onto pop-up, mobile and offsite event models. Section 4(a) requires the board to "establish and maintain a public data base" carrying the Section 3(b) information for every registered med spa, redacting only personally identifying health information. Section 3(b) requires the legal name, "Any name under which the medical spa does or will do business in Indiana," the address, the website, the service list and the responsible practitioner's name and license number.

Read that twice if you run several brands from one entity. New York already treats the mismatch as citable: the Council appendix carries an "Unauthorized Business Name" category covering operating under a name not matching the licensed business name. One provenance caveat: a March 5, 2026 signing date circulates in trade summaries, the enrolled act's signature block is blank, and we found no primary source confirming that date, read on 19 August 2026.

Rhode Island and Texas moved earlier, on different axes

Rhode Island's Medical Spas Safety Act, R.I. Gen. Laws chapter 23-105, was enacted as P.L. 2025, ch. 308, section 1, effective June 30, 2025. It regulates conduct rather than registration.

Section 23-105-2(a)(1) requires medical director training in cosmetic medical procedures, then adds a limit that is easy to miss: training programs provided by "a manufacturer or vendor of a medical device or supplies shall not be a medical director's, supervising physician's, supervising PA in collaboration with a physician's, or CNP's only education" in the service or the devices used. Section 23-105-2(a)(4) makes the medical director responsible for written office protocols for each cosmetic medical procedure, which "shall be kept on site at the medical spa for review and/or inspection by the department." Section 23-105-2(f) reserves ablative laser and ablative energy device procedures to physicians, physician assistants and certified nurse practitioners.

Section 23-105-2(c) is the per-patient documentation duty, and it is the cleanest legal basis in the whole source set for a records checklist. The supervising clinician must perform an initial assessment, produce a written treatment plan including diagnoses and device specifications, "Obtain patient consent and document the patient's consent, in the patient's medical record," and maintain the records.

Facility licensure there is not yet live. Section 23-105-3 directs that "The department shall, by July 1, 2026, promulgate rules and regulations" implementing the chapter, "which rules and regulations shall provide for, though not be limited to, the licensing of medical spas as healthcare facilities." We found no primary source confirming those rules have been promulgated, read on 19 August 2026.

Texas took a different route. House Bill 3749, known as Jenifer's Law, from the 89th Legislature, adds Occupations Code Chapter 172, "Provision of Elective Intravenous Therapy," effective September 1, 2025. It passed the House on May 16, 2025 by 117 to 2 and the Senate on May 27, 2025 by 31 to 0. Section 172.051(b) lets a physician delegate administering elective intravenous therapy to a physician assistant, an advanced practice registered nurse, or a registered nurse, each under adequate physician supervision. Section 172.051(a) limits delegation of prescribing or ordering to a physician assistant or APRN.

Scope decides who this touches. Section 172.001(2)(C) defines elective intravenous therapy as therapy not administered in a physician's office, a licensed health facility, a licensed mental hospital or a state hospital, so the practical target is the standalone IV bar and the mobile drip business. The chapter also folds these arrangements into the Section 157.0512(c) cap on prescriptive authority agreements and removes the 157.0512(d) exception, which constrains how many sites one physician can cover.

The four state actions, side by side

This table shows each instrument, its operative dates, its substance and the exclusion that decides whether it applies to you.

There is no single model being copied. Indiana registers businesses. Rhode Island regulates the medical director and the chart. Texas regulates a delegation act. New York enforces existing licensing law through an annual inspection program. A compliance plan built around any one of them misses the other three.

The exclusions column is doing more work than the requirements column. Whether you sit inside or outside those carve-outs depends on your corporate structure and your treatment sites, not your signage.

Chronology matters too. Rhode Island acted in June 2025 and Texas in September 2025, both before Indiana. If you see Indiana described as the first mover or the template the others followed, the dates say otherwise.

The 36-state number, and where it comes from

An American Medical Association scope-of-practice article dated April 6, 2026 is headlined "36 states lack regulatory oversight of med spas." Its body sentence is narrower: "Nearly three-quarters of states, 36, have zero regulations or laws in place for medical spas." Those are not the same claim. A state with no med spa specific statute still has a medical practice act, scope-of-practice rules and a board with authority over everyone who injects.

The AMA attributes the count to Malik AM, Ferrante AM, Booker BM, Council ML and Michalski-McNeely BM, "Medical Spa Legislation, Regulations, and Guidelines in the United States," Dermatologic Surgery, 2025 Jul 10;51(8):785-790, doi 10.1097/DSS.0000000000004648, PMID 40304398. We retrieved the complete abstract on 19 August 2026 and found no count of states in it. Its results are qualitative: "Significant variability exists in state regulations regarding medical spa ownership, roles of physician supervisors, and scope of practice for NPPs." The publisher returned HTTP 402 on the full text, so we could not check whether a table inside yields 36.

Two further notes. The article is a narrative review rather than original empirical research, its methods draw in part on materials from the American Society for Dermatologic Surgery Association, which advocates for physician-led med spa care, and it is copyright the American Society for Dermatologic Surgery. That does not make it wrong. It does mean an interested party sits in the chain, and you should say so when you repeat it. The survey also predates Indiana's 2026 chapter, so the count is stale by at least one state.

What your software has to do

Set vendors aside. Here is the specification the four instruments imply, written as requirements rather than features.

You need a per-patient record holding the initial assessment, the written treatment plan with diagnosis and device specification, and the documented consent, printable for one visit as one document. That is the Rhode Island Section 23-105-2(c) duty as a data requirement. Splitting those elements across a chart, a scheduling note and a signed PDF in an inbox is how one request turns into a search across systems. Where the line falls between your clinical system and your operations system is worth deciding deliberately, and we have written about where practice software ends and an EMR begins.

You need credential expiry stored as dates, for every licensed person, with a warning before the lapse rather than a discovery after it. Twenty-six percent of the New York City locations were cited for an unlicensed or expired practitioner, including an expired nurse practitioner license used to perform procedures. That is a calendar failure, not a clinical one.

You need to know, for any past date, which practitioner performed which service at which location. No New York instrument we read imposes a supervision log, so treat this as a practical inference rather than a legal requirement. But the cited oversight findings are the absence of an on-site physician and an inability to verify who was injecting, and a visit record that carries the performing practitioner answers both without argument.

You need your legal entity name, every trading name and your site list held as one authoritative record, because Indiana Section 3(b) publishes each of them. Multi-site operators also need to see which services are live where, since Indiana registers a service list per med spa and Section 9 restricts treatment to the med spa office. If you run more than one site, per-location control of services and staff keeps the registry and the reality identical.

Finally, you need to assemble an adverse event packet fast: patient name, treatment, date, nature and location, and the medical records. Fifteen days is not long if those live in four systems.

A document drill you can run this afternoon

Pick three completed visits from the last ninety days at random and try to produce every row below for them inside thirty minutes. The table lists the document, the instrument or finding it comes from, where the source says it belongs, and how current it has to be.

Score the drill by time, not pass or fail. Anything taking more than five minutes is a process problem you can fix before anyone asks. Anything you cannot produce at all is the row to work on this month.

Two rows fail quietly. Credential currency is one: a license is valid until the day it is not, and only a date field with an alert catches a lapse before an inspector does. Name consistency is the other: your licensed entity, your registered DBAs, your signage, your booking page and your social handle should resolve to the same business, and Indiana's public database will make any drift visible from a phone.

Then check scope. Indiana excludes a physician's office and any facility otherwise licensed by the state. Texas Chapter 172 excludes IV therapy given in a physician's office or licensed facility. Rhode Island's facility licensure depends on rules we found no published confirmation of, read on 19 August 2026. Read Section 1 of the instrument that covers you, confirm with your own counsel, then decide which rows are legal duties and which are good practice. If you are testing systems while you do it, our comparison of med spa platforms covers what to check during a trial.

Frequently asked questions

What do state inspectors check at a med spa?

The most detailed published list is the appendix of the New York City Council's December 2025 report on fifteen inspected medspas. Its categories are medical procedures without proper licensure, license display, safety records meaning MSDS and disinfectant invoices, medical oversight, chemical and fire safety, liability insurance on the premises, sanitation and hygiene, product labeling, and unlicensed or expired practitioners. Those fifteen were selected because they appeared to operate outside medical licensure, so the list shows what inspectors examine rather than what a licensed clinic typically fails.

Does my state require med spa registration?

Indiana does, from January 1, 2027, under IC 25-22.5-12.5-3(a), added by Senate Enrolled Act 282 and effective July 1, 2026. The board must publish a registration procedure by October 1, 2026 and may fine an unregistered operator up to five thousand dollars. Indiana's definition excludes a physician's office and any facility otherwise licensed by the state, so registration is not universal even there. For any other state, read your own medical practice act and board rules rather than a national summary.

What is Indiana's fifteen-day adverse event reporting requirement?

IC 25-22.5-12.5-6(b) requires a med spa to notify the board no later than fifteen days after a patient's serious adverse event. Section 6(a) defines that narrowly as jeopardy to health requiring medical or surgical intervention, or death, a life threatening medical occurrence, or inpatient hospitalization or the prolonging of one. The notice must include the patient name, the medication or treatment involved, the date, the nature and location, and the patient's medical records. It is not a fifteen-day clock for every adverse event.

Do I have to display licenses at a med spa?

In New York, license display was the second most cited category in the Council's inspections, at 93 percent of the fifteen locations. Specific findings include posted expired licenses, photocopied or otherwise invalid copies, failure to post the Department of State license sign under 160.10(d), failure to affix photographs to business and operator licenses, and failure to file an address change. Those are appearance enhancement business rules. Display duties elsewhere come from your own state board, so check the rule that names your license type.

What counts as proof of medical oversight?

No New York instrument we read imposes a supervision log or an attendance-evidence standard, so treat this as practice rather than law. What the Council report's oversight category records is no physician present on site during procedures, owners acknowledging no physician was present or contracted, no identified physician or nurse practitioner, and an inability to verify the credentials of the people injecting. A per-visit record naming the performing practitioner, plus a live credential check, answers all four.

Which states have med spa specific laws right now?

We read primary instruments for three: Indiana IC 25-22.5-12.5, Rhode Island chapter 23-105, and Texas Occupations Code chapter 172, which is a delegation statute for elective intravenous therapy rather than a med spa act. New York is enforcing existing licensing law rather than a new statute. A widely quoted American Medical Association article dated April 6, 2026 says 36 states have no med spa laws, sourced to a 2025 narrative review whose abstract contains no such count. Verify your own state directly.

Is Rhode Island licensing med spas as healthcare facilities?

Not on the strength of the statute alone. R.I. Gen. Laws section 23-105-3 directs the department to promulgate rules by July 1, 2026 that shall provide for the licensing of medical spas as healthcare facilities. That makes licensure dependent on rulemaking rather than immediately operative. We found no published confirmation that those rules have been promulgated, read on 19 August 2026. Check the Rhode Island Department of Health directly before relying on a secondary summary that says the regime is live.

Who can administer elective intravenous therapy in Texas?

Under Occupations Code section 172.051(b), effective September 1, 2025, a physician may delegate administering elective intravenous therapy to a physician assistant, an advanced practice registered nurse, or a registered nurse, each acting under adequate physician supervision. Delegation of prescribing or ordering under section 172.051(a) is limited to a physician assistant or an APRN. Section 172.001(2)(C) excludes therapy administered in a physician's office, a licensed health facility, a licensed mental hospital or a state hospital, so the chapter targets standalone and mobile IV businesses.