In April, we shared with you our thoughts on what to consider before opening in or investing in a medical spa, thinking about corporate structure, scope of practice, licenses and registrations, referral restrictions, HIPAA and data privacy, and more.

This month, we’re focusing on how states are beginning to regulate in this area, so owners and operators can hit the ground running in terms of compliance—or relax and breathe deep, knowing they are ahead of the plan. 

In March 2024, the state of Rhode Island introduced S 2870, the Medical Spas Safety Act, providing (within the definition of “cosmetic medical procedure”) that:

  • The performance of cosmetic medical services is the practice of medicine and surgery; and
  • A cosmetic medical service shall be performed by a qualified licensed or certified non-physician only if the services have been delegated by a medical director, supervising physician, supervising physician’s assistant (PA) or supervising advanced practice registered nurse (APRN) who is responsible for onsite supervision of services performed.

The Rhode Island legislation, which would add a Chapter 100 to Title 23 of the General Laws entitled Health and Safety, mandates that all cosmetic medical procedures—defined as medical procedures or treatments which alter or reshape normal structures of the body or ablate/remove living tissue to improve physical appearance—shall only be performed at a licensed medical spa. The legislation also directs that certain of these procedures (e.g., using ablative lasers) shall only be performed by physicians, or by others if under the direction of an onsite medical director.

23-100-2 Protection of Patients in a Medical Spa: The Specifics

The protections of the Rhode Island legislation include provisions relating to:

Medical Directors. Each medical spa shall appoint a medical director who shall be:

  • Trained in the indications for, and performance of, cosmetic medical procedures, including all medical devices or instruments that can alter or cause biological change or damage to the skin or subcutaneous tissue;
  • Responsible for implementing policies and procedures to ensure quality patient care;
  • Responsible for the delegation and supervision of cosmetic procedures;
  • Responsible for developing and maintaining written office protocols for each cosmetic medical procedure (protocols to be kept on site at the medical spa for review and/or inspection by the Rhode Island Department of Health);
  • Responsible for the oversight of all cosmetic medical procedures performed by physicians, PAs, APRNs, and non-physicians; and
  • Responsible for ensuring that supervisory physicians, PAs, APRNs, and more are properly trained in the safe and effective performance of all cosmetic and medical procedures performed at the medical spa.
  • The medical director is also responsible for reporting all complications to the Rhode Island Department of Health.

Supervising Physicians, PAs, APRNs. These individuals, who perform cosmetic medical procedures or supervise cosmetic medical procedures delegated to and performed by a non-physician, non-PA or non-APRN, shall be trained in the indications for, and performance of, the cosmetic medical procedure. An APRN who performs or supervises cosmetic medical procedures shall be accredited by the state board of nursing. Supervising physicians, PAs, or APRNs shall:

  • Perform an initial assessment of the patient;
  • Prepare a written treatment plan for each patient, which shall include, as applicable, diagnoses, course of treatment, and specifications for any device being used;
  • Obtain patient consent, if the cosmetic medical procedure(s) are being performed by a non-physician, non-PA or non-APRN, documenting the credentials and names; and
  • Create and maintain medical records in a manner consistent with applicable laws and regulations and accepted medical practice.

Non-physicians, non-PAs and non-APRNs. Shall only perform cosmetic medical procedures:

  • For which they have the requisite training; and
  • Which have been delegated to them by a supervising physician, PA, or APRN.

All providers. Shall, in the performance of their duties relative to cosmetic medical procedures:

  • Review and follow written protocols for each delegated cosmetic medical procedure;
  • Verify that the supervising physician, PA, or APRN has assessed the patient and given written treatment instructions;
  • Review the cosmetic medical procedure with each patient;
  • Notify the medical director, supervising physician, PA or APRN, before the patient leaves or as they become aware, of any adverse events or complications, following up with the patient post-procedure as appropriate;
  • Document all relevant details of the performed cosmetic procedure;
  • Satisfy any requirements of licensing boards.


State regulation in this area remains sparse, but the issues remain on states’ regulatory radars. A Connecticut statute on medical spas, C.G.S.A. § 19a-903c, requires a licensed physician, PA, or APRN, employed or by contract, with the education, training, and experience, to perform cosmetic medical procedures; these individuals must perform an in-person physical assessment prior to the procedure at the medical spa. Other requirements relate to posting information/providing notice regarding the individuals and their qualifications.

Tennessee’s Board of Medical Examiners maintains an online registry for medical spas as required by T.C.A. § 63-6-105—including any physician-owned practice that advertises or holds itself out as a medical spa or a physician-owned practice that primarily engages in the performance of elective cosmetic medical services. Tennessee also has a Patient Safety Cosmetic Medical Procedures Act, T.C.A. § 63-1-153, that is mainly limited to signage; the law requires any entity doing business as or advertises as a medical spa to display the name of the medical director or supervising physician, with certifications (or lack thereof.)

Even Rhode Island’s S 2870 may not succeed. On April 23, the state’s Committee on Health and Human Services recommended that the measure be held for further study, and the state’s Regular Session ends June 30. However, Rhode Island’s legislation demonstrates an increase in states’ interest in the oversight of medical spas.

Yet as we mentioned in our last post, laws and regulations are constantly evolving for the health care industry, including for medical spas. The applicability of these laws and regulations to medical spas should be analyzed on a case-by-case basis. If you are considering opening or investing in a medical spa practice, you should consult with a health care attorney to ensure compliance with state regulations.

EBG Staff Attorney Ann W. Parks contributed to the preparation of this post.

Back to Health Law Advisor Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Health Law Advisor posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.