Med Spa Regulation News for 2026: Important Updates by State

If you run a med spa or want to open one in 2026, you need to know this: regulations are changing fast. What you don't know could actually put your business or license at risk. New state bills, tougher enforcement, shifting supervision, and big telehealth updates are just a few of the updates you can't afford to miss.

Here's a clear breakdown of exactly what's changed and what you need to do to keep your practice compliant.

Overview of Med Spa Regulation News in 2026

The med spa industry is booming. Experts think the number of med spas in the US will hit 13,000 by the end of 2026. Regulators are definitely noticing.

States aren't waiting for problems anymore. They're inspecting, forming task forces, and rolling out new licensing rules. HIPAA enforcement is stricter, too. Practices now need encryption and multi-factor authentication. These basics aren't optional anymore.

Telehealth is getting a lot of attention. The DEA gave a final extension for COVID-19 telemedicine rules until December 31, 2026. That means you've got some time for controlled substance prescribing over telehealth, but this will end, and states are making their own rules now.

As we cover in our Compliance 101 guide, "medical spa regulation is not static; it is in constant flux." If you ignore this, your practice is exposed. Mistakes count just as much as intentional violations.

Key Shifts in Professional Oversight and Licensing

Supervision rules are now more detailed, and they vary a lot state to state.

• Iowa's Medical Spa Oversight Act (HSB 591) says medical directors must be within 60 miles of delegated services and provide at least four hours of direct, on-site supervision every week. That's a hard rule, not just a guideline.
• New Jersey doesn't let practices use "rent-a-doc" arrangements anymore. Now you need written collaboration agreements for APNs and PAs. These agreements have to spell out delegated tasks, emergency plans, and supervision requirements. If the medical director is just a name, that's a big compliance risk here.
• California's AB-890 lets nurse practitioners with six years of experience or a Doctor of Nursing Practice degree own and run a med spa without physician supervision. That's a big deal in a state that's usually strict about Corporate Practice of Medicine.

You can't just hold a license and call it good. Ongoing training and education are a must, and you should track hours for every clinical staff member. Our licensing guide explains how you can build a system to keep up as state rules change.

Operating Standards Across Different States

There isn't one national rulebook for med spas. Your responsibilities depend on the state, and differences are huge.

Stringent Oversight States

• New York is going hard on enforcement. The state's task force has run 223 inspections and cited 87 clinics for violations. Penalties include fines, license suspensions, and even revocation. You need physician ownership, no exceptions. Anything that breaks the skin is considered practicing medicine. Read our New York med spa laws guide for the details.
• Ohio closed over 30 clinics in 2026 for all kinds of violations, including sourcing, storage, records, supervision, drug handling. You need documented physician-approved protocols and real physician oversight, not just a form someone signed once.
• Texas and California only let physicians own the medical business. The medical director has to really be involved, not just let their name be used on paperwork. See our ownership guide for the specifics.

More Permissive States

• Florida and Washington let non-physicians own med spas. You still need a licensed physician as medical director. In Florida, SB 1728 (January 2026) could mean you need a separate pharmacy license if you handle prescriptions. Check our Florida med spa laws guide for what applies.
• Washington's health department is reviewing rules for injectables, microneedling, IV hydration, and energy devices. Nothing final yet, so stay tuned for updates.
• Georgia, Missouri, and Utah have more relaxed rules. Non-physicians can own the business, but a physician director must oversee clinical work. The medical director's decisions on treatment can't be pushed aside. Our ownership guide gives a full breakdown.

Telemedicine and Virtual Consultations

Virtual consults are now routine for pre-qualifying patients, first visits for GLP-1 and HRT, and follow-ups. But you need to know the compliance rules inside out.

The main thing? Your telehealth provider has to be licensed in the same state where the patient is during the visit. Otherwise, it counts as unauthorized practice even if the visit is digital.

Check our Telehealth Consent documentation for what's required. You need to disclose:

• Technology risks
• Privacy limitations
• Telehealth can't replace emergency care

You have to get this all in place before the first virtual visit.

The DEA extended COVID telehealth prescribing rules until December 2026. But that's temporary. Figure out now how your telehealth program will work in 2027. Don't wait until the last minute.

Minimizing Risk Through Proper Documentation

Good documentation protects your practice. If regulators visit, they look at your records. With patient complaints, your paperwork can make or break you. Audits focus on your documentation, too.

HIPAA violations can reach $50,000 per violation, and yearly fines can top $2 million. Cash-pay practices aren't off the hook, you still need to set up controls. You need:

• Encrypted electronic health records
• Limited user access
• Audit trails
• Regular risk checks

Informed consent can't be just a signed form. You have to discuss the procedure, document that the patient understands, and make sure the form covers the procedure's nature, risks, other options, and price. Our Compliance 101 guide explains this fully.

You should also do internal audits. Check billing, documentation, and your supervision records often. Appoint someone to run these audits, and set up a system to fix whatever you find.

How Portrait Helps Med Spas Stay Compliant

It's a lot to stay on top of regulations and run your business at the same time. Portrait is built to make the business side simple. Everything's in one place: EHR, scheduling, payments, inventory. The platform includes tools for MD matching, Good Faith Exam automation, and supervision workflows without the need for clunky add-ons.

If you use the MSO-PC model, our PC Membership connects you with licensed, experienced medical directors across states. We offer SOPs, templates, and keep you up to date when rules change. Our payment solution is CPOM-compliant, so you don't have to stress out about how you process payments.

We're also partnered with ByrdAdatto for legal guidance. Over 1,000 clinics use Portrait. Compliance is a big reason they stay with us.

Staying Ahead with Med Spa Regulation News in 2026

The news isn't letting up. Arizona, Iowa, Indiana, and Florida all dropped new bills in early 2026. Other states will follow. You can't just react anymore, you need to stay on top of changes before they hit.

• Monitor state law updates all the time
• Run regular internal audits
• Get your medical director actively involved
• Find legal counsel that specializes in medical spas

If you need to find a lawyer, read our guide to picking a med spa lawyer.

Set up alerts for state bulletins and industry changes. Review your policies every year, and update them sooner if rules change. Compliance is ongoing; it's not something you do once. Staying updated keeps your practice safe and successful.

Get help with compliance through your software. Book an intro call to see how Portrait supports compliance for your practice.