In April 2026, the American Medical Association highlighted a study published in the journal Dermatologic Surgery that examined how each U.S. state regulates medical spas. The findings were stark: 36 states had no identified laws or regulations specific to medspas. Forty-four states lacked patient-protection requirements specific to medspas. And 48 states had no identifiable medspa-specific licensure requirements.
Only 12 states — Connecticut, Iowa, Illinois, Indiana, Massachusetts, New Mexico, Oklahoma, Rhode Island, Tennessee, Texas, Utah, and Wisconsin — had any medspa-specific provisions on the books at all.
The study, which analyzed data from Westlaw, Lexis Nexis, PubMed, state government documents, and the American Society of Dermatologic Surgery Association from 2000 to 2024, examined five areas: licensure, medical directors, ownership and operation, patient protection, and scope of practice and supervision. In most states, what it found across every category was either silence or reliance on general medical practice laws that were written decades before the medspa industry existed.
What "no regulation" actually means
The absence of medspa-specific regulation does not mean medspas are unregulated. It means they're governed by the same general laws that apply to all medical practices — laws about the practice of medicine, nursing scope of practice, facility licensing, and physician supervision. Those laws were designed for hospitals, clinics, and physician offices, not for the hybrid medical-aesthetic-retail model that medspas represent.
The practical consequence is gaps. General medical practice laws may not address who can own a medspa, what qualifications a medical director needs to have (or how present they need to be), which procedures can be delegated to which staff members, or what patient-safety protocols are required for specific aesthetic treatments. In states without medspa-specific rules, regulators interpret and enforce the general laws — and interpretations vary.
The American Medical Association reports that approximately 70% of medspas are not affiliated with a traditional physician practice. In a state with clear medspa regulations, that figure prompts enforcement action. In a state with no medspa-specific rules, it may prompt nothing, because the general medical practice act doesn't contemplate the medspa business model specifically enough to clearly prohibit it.
The medical director question
Most states require some form of physician oversight for medical procedures, including those performed in medspas. But "oversight" is a broad concept with no universal definition, and the gap between what oversight means on paper and what it looks like in practice is where patients are most exposed.
In the medspa context, the medical director relationship ranges from genuine, active clinical involvement — a physician who evaluates patients, sets treatment protocols, reviews outcomes, and is present or readily available — to what regulators have started calling "ghost" or "matchmaker" arrangements, where a physician lends their license to a facility they rarely visit in exchange for a fee.
New York's January 2026 investigation specifically identified these arrangements as a systemic problem, and regulators in Georgia and other states have begun targeting them. Holland & Knight's August 2026 compliance analysis notes that regulators are increasingly scrutinizing whether physician oversight is real or nominal — a shift that reflects how common the nominal version has become.
For patients, the question to ask is simple: who is the medical director, are they actively involved in your care, and can you see or consult with them if something goes wrong? If the staff can't answer that question clearly, the oversight may be nominal.
What the FDA is doing differently in 2026
While state oversight has been slow to develop, federal regulators have become more active. The FDA issued its first-ever Drug Supply Chain Security Act (DSCSA) warning letter to a medspa in April 2026, signaling that product sourcing and traceability — not just the medical procedures themselves — are now enforcement priorities. The agency has also pursued enforcement actions against counterfeit botulinum toxin products and unlawfully marketed compounded GLP-1 medications, both of which flow through medspa supply chains.
The FDA's February 2026 proposal to restrict active pharmaceutical ingredients used in compounded products applies directly to medspas that source from compounding pharmacies rather than FDA-approved manufacturers. Any medspa offering injectable products — including neurotoxins, fillers, or weight loss medications — should be able to tell you where the products come from and whether they're FDA-approved. If they can't, or won't, that's a meaningful red flag.
How to protect yourself in any state
The regulatory environment determines how much protection your state provides by default. It doesn't determine how much protection you have if you take an active role. Regardless of your state's regulatory framework, these steps apply everywhere:
Verify the medical director's credentials and involvement. Look up the physician's license through your state medical board's online verification tool. Check for disciplinary actions. Ask the medspa directly whether the medical director is on-site regularly and involved in treatment planning, or whether the relationship is primarily administrative.
Ask about product sourcing. For any injectable treatment — Botox, fillers, GLP-1 medications — ask whether the products are FDA-approved and sourced from authorized distributors. "Compounded" is not a synonym for "counterfeit," but it does mean the product was not manufactured under the same FDA oversight as approved products. You deserve to know which you're receiving.
Understand who is performing your procedure and their qualifications. State scope-of-practice laws determine which procedures can be performed by which provider types — physicians, nurse practitioners, physician assistants, registered nurses, aestheticians. Ask your provider what credentials they hold and confirm those credentials through the appropriate state licensing board. The answer matters more in states without medspa-specific regulations, because the general scope-of-practice rules may be ambiguous about delegation in the aesthetic context.
Request documentation. Ask for written documentation of your treatment plan, the products used (including lot numbers), the provider who performed the procedure, and any pre-treatment assessment. This documentation exists for your protection — if something goes wrong, it's the record that enables accountability. If a practice resists providing it, that reluctance is informative.
Check complaint history. Your state medical board, attorney general's consumer protection division, and the BBB all maintain complaint records. A pattern of complaints — particularly around complications, billing, or provider qualifications — is a signal that warrants attention even if the practice looks good from the outside.
The bottom line
The medspa industry has grown faster than the regulatory frameworks designed to oversee it. In 36 states, no medspa-specific laws exist to close the gap between general medical practice oversight and the reality of how medspas operate. That gap creates risk — not everywhere and not equally, but systematically, and in ways that patients often don't see until something goes wrong. The regulatory picture will eventually catch up. Until it does, the burden of evaluating a medspa's safety falls more heavily on the patient than it should. Understanding what your state does and doesn't regulate is the starting point for exercising that judgment effectively.
Looking for a consumer protection provider?