What You Need to Know 

• For parties launching, expanding or selling a medical spa in New Jersey, it is essential to understand the state’s unique regulatory requirements to avoid potential enforcement actions and costly non-compliance penalties.

• Among the key considerations are those related to business entity structuring and the Corporate Practice of Medicine doctrine, licensing and scope of practice requirements, supervision protocols, privacy and data security issues, financial structuring and billing practices, anti-trust laws, and real estate/zoning requirements.

• Given the complexity of medical spa regulations in New Jersey, it is highly recommended to consult with a healthcare attorney with knowledge of relevant regulatory issues and potential compliance pitfalls.

The medical spa industry is thriving, but with growth comes complexity, particularly in New Jersey where healthcare and professional licensing rules intersect with business and real-estate regulations. For physicians, nurses, or allied health professionals exploring a new medical spa venture, expanding an existing practice, or preparing for a sale, understanding the state’s unique requirements is crucial to avoiding costly enforcement actions.

This Client Alert distills the key legal and operational considerations, including entity structuring, scope-of-practice limits, privacy, billing, antitrust, and zoning, and highlights recent developments related to medical spas, or medspas as they are commonly referred to, in New Jersey.

Business Structure & Corporate Practice of Medicine

Operating through the correct entity and avoiding unauthorized corporate control of a medical practice is foundational. Some key considerations include:

Entity Selection: The Corporate Practice of Medicine (CPOM) doctrine prohibits non-physician entities from owning or controlling medical practices to ensure that clinical decisions are made by licensed healthcare professionals and are not influenced by corporate interests. New Jersey mandates that medical services be offered through a professional entity owned by licensed physicians, such as a professional corporation (PC). As a result, medical spa operators typically organize into two complementary entities: one a PC owned and governed by licensed clinicians to deliver all clinical services, and the other a Management Services Organization (MSO), often established as a corporation or LLC, to oversee non-clinical activities like billing, marketing, human resources, and facility upkeep.

CPOM Prohibitions: Non-providers may not direct or control clinical decisions; fee-splitting or tying compensation to referrals is forbidden. For example, New Jersey’s CPOM regulations forbid professionals with a narrower scope of practice (such as chiropractors, physical therapists, or nurse practitioners) from employing physicians. In the case Allstate Ins. Co. v. Northfield Med. Ctr., P.C., the New Jersey Supreme Court held that a chiropractic-led ownership structure likely violated CPOM because the chiropractor could fire the physician at will and shared more directly in the practice’s profits—demonstrating that true physician control is non-negotiable. 

Risk of Non-Compliance: Violating CPOM not only risks insurers clawing back claims as false submissions, but also exposes physicians, corporate entities, and advising attorneys to professional discipline or fraud charges. For anyone opening a medical spa, it’s essential that physicians hold both legal and practical authority over medical protocols, hiring/firing, and profit distribution. Read more of our CPOM-centered posts.

Recent Developments:

• Oregon SB 951 (effective June 9, 2025) expands CPOM restrictions—prohibiting MSOs and their principals from owning or controlling professional medical entities, with a private right of action for physicians. Under SB 951, MSOs that provide non-clinical support to professional medical entities may no longer be majority-owned, managed, or controlled by the same individuals who hold PC shares or key leadership roles in the practice—effectively closing “friendly PC” loopholes that previously allowed private‐equity and other unlicensed entities to exert significant influence over medical practices. While this does not impact New Jersey’s CPOM restrictions, New Jersey regulators might consider tailored amendments to balance physician autonomy with the operational realities of modern MSO partnerships.
• In June 2025, New Jersey’s Attorney General announced that Ana Velazco, owner of a medical spa in Fair Lawn, agreed to a five-year suspension of her massage and bodywork therapy license and a $15,000 fine after investigators found she performed unlicensed invasive medical procedures—such as suture removal, fluid drainage, Mesolipo injections, and microneedling. The consent order permanently bars Velazco from owning or operating a massage business in the state and mandates that any future practice be under the supervision of a licensed therapist. This case reinforces the perils of blurring non-clinical and clinical roles and the need for airtight entity structures. Medical spa operators must ensure that all medical-grade procedures are conducted only by appropriately licensed entities, structured so that physicians or other authorized clinicians retain true control over clinical activities, to avoid similar sanctions.

Licensing, Scope of Practice & Supervision 

Ensuring each provider practices only within their authorized scope—and that non-physician staff are properly supervised—protects patient safety and mitigates malpractice exposure. Some considerations to know and document:

Permissible Delegations: Under New Jersey law, physicians (MDs and DOs) and physician assistants (PAs) enjoy broad authority to perform, supervise, and delegate medical spa services, including injectables, laser therapies, and chemical peels. Nurse practitioners, called Advanced Practice Nurses (APN) in New Jersey, and PAs may likewise evaluate patients, develop treatment plans, and carry out many of the same procedures under their collaborative practice agreements. Registered nurses are permitted to administer certain aesthetic treatments—such as specific neuromodulator injections or non-ablative laser sessions, but only pursuant to a detailed, physician-signed protocol. In every case, the supervising physician or APN/PA must exercise “direct supervision” under New Jersey rules, meaning they must be immediately available on the premises or via real-time audio/video connection and conduct periodic in-person or chart reviews to confirm compliance with the written protocol.

Unlicensed Personnel: New Jersey strictly prohibits unlicensed personnel or non–healthcare staff from performing or assisting with any medical-grade procedure. For example, individuals without the appropriate license may not inject, peel, or operate lasers, even under remote direction. The State Board of Medical Examiners and Board of Nursing will scrutinize any lapse in documented oversight.

Medical spa operators should strive to maintain up-to-date delegation orders and supervision logs, renew protocols at least annually (or whenever new treatments are adopted), and ensure that physicians retain the final authority over all clinical and safety decisions.

Required Documentation: New Jersey requires APNs and PAs to have written collaboration agreements with a supervising physician before performing any medical‐grade Medi-Spa services. Under N.J.A.C. 13:37-6.3, APNs’ joint protocols must list authorized injectables, lasers, chart‐review frequency, and emergency procedures. Likewise, PAs’ agreements under N.J.A.C. 13:35-2B.10 must define delegated tasks, supervision levels (on-site or virtual), and adverse-event protocols. These agreements ensure treatments occur only with documented physician oversight.

Privacy & Data Security

Medical spas often collect and sometimes monetize sensitive health information. Robust privacy and security practices are mandated by federal law, and a single breach can trigger steep fines and reputational harm. Key Considerations include:

PHI Safeguards: Any medical spa capturing identifiable treatment data (treatment plans, before/after photos) must implement the Health Insurance Portability and Accountability Act’s (HIPAA) administrative, technical, and physical safeguards, including privacy notices, breach-response plans, encryption, and annual staff training. In practice, this means conducting regular risk assessments to identify vulnerabilities in records systems, designating a Privacy Officer to oversee compliance, and maintaining strict access controls so that only authorized personnel can view or modify electronic Protected Health Information (PHI). New Jersey’s breach-notification laws also require prompt patient and regulator alerts. Failure to comply can lead to significant fines and reputational damage.

Marketing Consents: Given that many medical spas obtain referrals and business through their social media posts, it is important for these businesses to obtain separate, documented patient authorizations for the use of images or testimonials. Each release should clearly describe what media will be used (e.g., social media, website, print ads), how long it will remain in circulation, and the patient’s right to revoke consent at any time.

Fraud & Abuse; Billing Compliance

Improper referral incentives or miscoding of services can lead to severe enforcement actions under the Anti-Kickback Statute, Stark Law, and False Claims Act. This section highlights some key elements related to structuring financial arrangements and billing practices to stay compliant. 

Anti-Kickback & Stark: It is important to structure all MSO and physician-compensation arrangements at fair market value, without referral-volume incentives. Any bonus structures, percentage-of-collections models, or other incentives that could be viewed as rewarding referral volume should be avoided.

Billing Segregation: Medical spa businesses should clearly separate cash-pay “cosmetic” services (e.g., Botox, fillers, laser hair removal) from insurer-billed “medically necessary” treatments (e.g., scar revision, lesion removal). Businesses should also implement distinct charge masters or billing codes, maintain separate patient statements or invoices, and train front desk staff to verify the type of payment at scheduling.

Recent Developments

• In Advisory Opinion 25-03 (posted June 11, 2025), the U.S. Department of Health and Human Services Office of Inspector General (OIG) reviewed a proposed arrangement between a MSO and an affiliated professional corporation providing telehealth staffing and administrative services. The OIG concluded that the arrangement met all elements of the “personal services and management contracts” safe harbor at 42 C.F.R. § 1001.952(d)—including a written, one-year agreement, a clear description of services, fixed fair market value-based fees negotiated at arm’s length, and commercial reasonableness irrespective of referrals. This opinion highlights that when MSO contracts are carefully documented, priced at fair market value, and explicitly decoupled from referral incentives, they can safely coexist with the Anti-Kickback Statute.

Antitrust Considerations 

Collaborating with other providers or negotiating group-rate contracts can cross the line from pro-competitive clinical integration into illegal “price-fixing.” It’s important to be mindful of: 

Collaborations & Pricing: Medical spas must steer clear of any agreements with competitors to set service prices, divide markets, or limit output—classic “price-fixing” or “market allocation” that is automatically illegal. For example, if two or more medical spas agree to charge the same fee for Botox treatments or divide geographic territories to avoid competing with one another, that would likely constitute illegal “price fixing.” 

Provider Networks: Any coordination with other medical spa operators, physician groups, or payers over fee schedules, contract terms, or referral arrangements risks triggering an antitrust investigation. Even informal discussions about typical charges or preferred insurer rates can be construed as an attempt to standardize pricing or disadvantage certain competitors. To minimize risk, it’s important to keep all negotiations and contract-bargaining separate and unilateral and to avoid any multi-party communications that could suggest concerted action on rates or terms.

Recent Developments:

• In June 2025, the Federal Trade Commission’s (FTC) Health Care Division issued an updated “Topic and Yearly Indices of Health Care Antitrust Advisory Opinions,” a comprehensive compendium that organizes all Commission and staff opinions by subject and year. This update signals that any joint venture proposal involving shared contracting or integration with payers will receive heightened review. Medical spa operators considering group purchasing, shared protocols, or joint negotiations, should ensure their arrangements are clearly pro-competitive and well documented.

Real Estate, Zoning & Facility Requirements

A medical spa’s physical location must comply with local zoning and health regulations. Misclassification can lead to costly enforcement actions or forced relocation. Key considerations include: 

Zoning Classification: It’s important to confirm the municipality’s “medical office” vs. “spa” use permit requirements to avoid enforcement actions. Securing the correct use permit or variance often involves submitting floor plans, a business description, and proof of professional licensure to the planning or zoning board, and failure to do so can result in fines, cease‐and‐desist orders, or forced relocation. If the medical spa uses a business name other than the name of the physician or the corporate name, the facility may need to register it as a fictitious business name or that the medical spa is "doing business as" (dba) that business name. It’s also wise to confirm any signage, parking, and accessibility requirements tied to medical use permits, as these may differ from those for traditional spas.

OSHA & Sanitation: Depending on the services offered by the medical spa, treatment rooms must be outfitted to meet OSHA’s Bloodborne Pathogens Standard, which includes having approved sharps‐disposal containers, an exposure control plan, and staff training records on file. Beyond sharps, readily accessible hand‐washing stations or alcohol‐based dispensers, a stocked first‐aid or emergency kit (including eye‐wash solutions), and regularly updated Safety Data Sheets for all chemicals and topical agents are required. It’s important to perform routine facility inspections and maintain maintenance logs in the event of a compliance audit.

Conclusion

The regulatory landscape for medical spas in New Jersey is multifaceted and evolving. A proactive compliance strategy centered on the right entity structure, clear delegation protocols, robust privacy and billing controls, antitrust vigilance, and proper facility permits will safeguard the medical spa’s practice and patients alike. If you’re launching, expanding, or selling a medical spa, it is highly advisable to consult with knowledgeable healthcare counsel who can assist you with translating these requirements into operational policies, updating your agreements, and navigating any related legal issues.

Please contact the author of the Alert with questions or to discuss your specific business circumstances.

To read more about legal, regulatory and ethical issues of interest to the healthcare industry, subscribe to our Healthcare Perspectives blog.

Sukrti Thonse
Associate, Corporate and Healthcare 
sthonse@greenbaumlaw.com
732.476.2480