New York Med Spa Compliance Hub

New York enforces the Corporate Practice of Medicine doctrine. Medical practices that provide medical treatments must be 100% owned by a licensed physician or physicians operating through a professional entity. Non-physicians cannot own, control, or profit from the medical side of the practice.

This includes strict restrictions around using “medical” or “med” in a business name, which is generally reserved for physician-owned entities. This information was last updated February 3, 2026.

No. Unlicensed individuals and non-physician licensees are prohibited from holding any ownership interest in a medical practice in New York. This includes silent partners, profit-sharing tied to medical revenue, or management agreements that influence clinical decision-making.

Improper ownership structures are a primary trigger for enforcement actions.
This information was last updated February 3, 2026.

Nurse practitioners may own nursing practices, not medical practices. While many med spas are NP-led operationally, the medical entity itself must still comply with ownership laws.

Beginning July 1, 2026, NPs must also maintain a collaborative relationship with a physician, which impacts independent ownership models.
This information was last updated February 3, 2026.

An MSO/PC structure is required whenever non-physicians are involved in managing, financing, or operating a medical practice. Because non-physicians cannot own or control medical practices, the physician-owned PC delivers clinical services while the MSO handles non-clinical operations.

The model is only optional when the practice is fully physician-owned with no outside operational or financial control.
This information was last updated February 3, 2026.

Most failures come down to control and money. MSOs often cross the line by controlling hiring and firing of clinical staff, setting prices, dictating protocols, or exerting financial leverage over the PC.

Regulators look at how the practice actually operates—not just what the contracts say.
This information was last updated February 3, 2026.

Percentage-of-revenue fees, per-treatment fees, or fees tied directly to medical services are the highest risk. These structures can be viewed as illegal fee-splitting.

More defensible models use flat fees or FMV-based cost-plus structures tied to administrative services only.
This information was last updated February 3, 2026.

Red flags include MSO control over clinical hiring, treatment pricing, protocols, medical equipment, or access to bank accounts. Any MSO veto power over clinical decisions is problematic.

If the MSO effectively controls the practice, the structure is vulnerable regardless of documentation.
This information was last updated February 3, 2026.

Yes. NPs must complete 3,600 hours under a written practice agreement with a physician. After that, they may practice independently; however, starting July 1, 2026, NPs must maintain a collaborative relationship with a physician.

This change increases scrutiny around NP-only med spa models.
This information was last updated February 3, 2026.

A physician may not enter into practice agreements with more than four NPs who are not located on the same physical premises.

This limit is frequently exceeded in multi-location med spa models.
This information was last updated February 3, 2026.

Yes. PAs must practice under physician supervision and within their defined scope of practice. Supervisory responsibilities must be clearly documented.

Supervision without documentation is considered non-compliant.
This information was last updated February 3, 2026.

A physician may supervise up to six PAs in private practice at one time.

This cap applies regardless of telehealth use.
This information was last updated February 3, 2026.

No. Supervision must be continuous but does not require physical presence. However, the physician must be meaningfully involved and available.

“Paper supervision” is a known enforcement risk.
This information was last updated February 3, 2026.

Treatments involving diagnosis, prescribing, or significant medical judgment must be performed by or delegated from a licensed physician, NP, or PA. Injectables, prescription devices, IV therapy, and advanced lasers all fall into this category.

Delegation must be explicit, documented, and supervised.
This information was last updated February 3, 2026.

Supervision must be meaningful, ongoing, and documented. The supervising provider must have evaluated the patient, authorized treatment, and be available for escalation.

Lack of real oversight is a frequent enforcement issue.
This information was last updated February 3, 2026.

Regulators expect active oversight—not titles. Responsibilities include approving protocols, reviewing charts, overseeing delegation, managing adverse events, and remaining clinically available.

Medical directors who only “lend their license” create significant risk.
This information was last updated February 3, 2026.

Yes. GFEs are required before certain medical aesthetic treatments and must establish a valid provider-patient relationship.

Incomplete or missing GFEs are among the most cited violations.
This information was last updated February 3, 2026.

GFEs must be performed by a licensed physician, nurse practitioner, or physician assistant. RNs cannot independently perform GFEs.

Improper delegation creates serious compliance exposure.
This information was last updated February 3, 2026.

A GFE is required for new patients and should be repeated at least annually or when treatment plans materially change.

Outdated exams are a common audit finding.
This information was last updated February 3, 2026.

Yes. New York permits telehealth GFEs using electronic communication technologies when the standard of care is met.

Documentation requirements remain the same as in-person exams.
This information was last updated February 3, 2026.

Yes. New York law allows asynchronous telehealth when clinically appropriate.

Protocols and provider review must be clearly documented.
This information was last updated February 3, 2026.

Only if the provider is licensed in New York. Treating NY patients without NY licensure is prohibited, even via telehealth.

This is a common misconception among multi-state operators.
This information was last updated February 3, 2026.

Yes, but only under proper delegation and supervision by a licensed provider who has performed the GFE and authorized treatment.

Unsupervised injections constitute unlicensed practice of medicine.
This information was last updated February 3, 2026.

No. Treatments that penetrate beyond superficial skin layers or use prescription devices or drugs are medical procedures.

Misclassification is a frequent enforcement issue.
This information was last updated February 3, 2026.

Possibly, but only if supervision limits, availability, and documentation requirements are met.

Scaling without compliance planning is high-risk in New York.
This information was last updated February 3, 2026.

Yes, provided NY-licensed providers perform the exams and records are integrated at each site.

Centralization does not remove site-level accountability.
This information was last updated February 3, 2026.

Rarely. Residential zoning, certificate of occupancy restrictions, ADA access, and patient safety requirements often prohibit medical services.

These setups frequently trigger both zoning and medical enforcement.
This information was last updated February 3, 2026.

No. Compensation tied to patient volume or treatments raises fee-splitting and kickback concerns.

Flat fees or deliverable-based compensation are safer.
This information was last updated February 3, 2026.

New York has increased inspections driven by complaints, advertising, injuries, and ownership red flags. Common violations include missing GFEs, improper ownership, and inadequate supervision.

Documentation fixes are often the fastest corrective actions—but structural issues require legal remediation.
This information was last updated February 3, 2026.

Founders should work with attorneys who actively practice NY healthcare regulatory law, including CPOM, MSOs, and enforcement defense.

The right attorney helps you structure proactively—not just react to audits.
This information was last updated February 3, 2026.