Startup guide · Updated September 2026
Med spa startup checklist
A step-by-step med spa startup checklist covering business entity and licensing, medical director and supervision requirements, clinical protocols, HIPAA compliance, staffing, pricing, software selection, and the 90-day pre-opening plan.
Disclosure: this checklist is published by MedAestheticsOS, which sells medical spa software. The steps apply to any new med spa and any vendor, including us. Where we name our own product it is labelled.
1. Legal foundation and entity setup
Form the right entity
In most states a medical spa must be owned by a physician or structured as a Professional Corporation or MSO/PC arrangement. Confirm your state's corporate practice of medicine rules before signing a lease — this determines who can legally own the practice and take profits.
Register for taxes and licenses
File for an EIN, state sales tax registration (many states tax certain med spa services), a business license, and any local health facility permits. Budget 2–6 weeks; some states require facility inspection before opening.
Secure malpractice and general liability insurance
You need professional liability (malpractice) covering every injector and laser operator, general liability for the premises, and product liability if you retail skincare. Get certificates naming your landlord as additional insured before move-in.
2. Medical oversight and clinical governance
Appoint a medical director
Nearly every state requires a physician medical director for a med spa. Define their duties in writing: protocol approval, chart review cadence, delegation of each procedure, and availability for adverse events. Good-faith exam requirements vary by state — know yours.
Write clinical protocols for every service
Each treatment (injectables, laser, RF microneedling, IV therapy, body contouring) needs a written protocol: indications, contraindications, consent language, step-by-step technique, emergency response, and who may perform it. Protocols must be signed by the medical director.
Build your consent form library
Create procedure-specific informed consent forms covering risks, alternatives, and expected outcomes, plus HIPAA privacy acknowledgments and photo release forms. Consents should be digitally signed, time-stamped, and stored against the patient's chart.
Set up emergency response procedures
Stock an emergency kit appropriate to your services (epinephrine, hyaluronidase for filler reversals, oxygen where required), post emergency protocols at every station, and train staff on escalation. Document drills.
3. HIPAA and data compliance
Choose HIPAA-compliant software from day one
Your charting, messaging, photo storage, and payments touch PHI. Require a signed Business Associate Agreement (BAA) from every vendor, encrypted storage, role-based access, and an audit trail. Retrofitting compliance after opening is far more expensive.
Adopt written privacy and security policies
HIPAA requires documented policies: who accesses charts, how photos are handled, how texts and emails are sent, breach notification steps, and staff training records. Keep a signed training log for every employee.
Lock down photos and marketing consent
Before-and-after photos are PHI. Store them in the chart (not a phone camera roll), get written marketing consent separately from treatment consent, and control which photos can be exported or posted.
4. Space, equipment, and vendors
Design the treatment floor plan
Plan treatment rooms around equipment power and plumbing, a clean utility area, locked storage for controlled products, and a consult space for good-faith exams. Verify zoning allows medical services at your address.
Buy or lease devices with service contracts
For each laser or device: FDA clearance for your intended use, training included, a written service agreement, and loaner terms when the unit is down. Device downtime is lost revenue — negotiate response times.
Set up supplier accounts
Open accounts with authorized distributors for toxins and fillers (direct from manufacturer where possible), skincare lines, and consumables. Verify cold-chain shipping for toxins and set reorder points so you never stock out mid-week.
5. Staffing and training
Hire within scope-of-practice rules
Who can inject, operate lasers, or perform microneedling varies by state — RNs, NPs, PAs, and aestheticians have different scopes. Verify licenses and document delegation from the medical director for every procedure each hire performs.
Build an onboarding and training program
New hires need device training, protocol sign-off, HIPAA training, and software training before touching a patient. Keep signed competency records per procedure — auditors and insurers ask for them.
Set compensation that survives seasonality
Decide hourly vs. commission vs. hybrid for providers, and front-desk incentives for rebooking and retail. Model payroll against conservative booking numbers, not launch-week hype.
6. Pricing, memberships, and revenue systems
Price from cost-per-treatment math
Calculate true cost per syringe, per laser minute, and per room hour, then price for margin — not to match the competitor down the street. Publish pricing where your market allows; hidden pricing loses booking-intent searches.
Launch memberships and packages early
Recurring memberships smooth cash flow and raise lifetime value. Structure packages with expiry and refund rules in writing, and make sure your software can track redemptions and liability automatically.
Set up payments, deposits, and no-show protection
Take cards on file, require deposits for high-value bookings, and enforce a written cancellation policy. New med spas lose 11–14% of booked revenue to no-shows without automated reminders and waitlist backfill.
7. Software stack and opening systems
Pick one platform instead of five tools
You need booking, charting, e-prescribing or order management, consent forms, photo storage, POS, memberships, reminders, and marketing. Stitching separate tools costs more in staff time and HIPAA exposure than a unified platform. Run any candidate through our buyer's guide requirements.
Configure before your first patient
Load your service menu, protocols, consent forms, staff schedules, and membership plans into the system before opening day. Test the full patient journey — book, consent, chart, pay, rebook — end to end.
Turn on reminders and the waitlist on day one
Automated SMS/email confirmations, pre-visit instructions, and post-care follow-ups should run from the first appointment. An active waitlist that auto-fills cancellations pays for the software by itself.
8. Marketing and the 90-day pre-opening plan
Claim local search presence
Set up and verify your Google Business Profile, build location pages with your real services and prices, and collect reviews from day one — 'med spa near me' is the highest-converting search you'll ever win.
Build a founding-client waitlist
Open a pre-launch waitlist 60–90 days out with a founding-member offer. Aim for a full first-two-weeks book before the doors open; an empty opening month is the most common cash-flow killer.
Plan compliant social marketing
Meta, TikTok, and Instagram restrict before/after claims and targeting for medical aesthetics. Learn each platform's healthcare ad policies before spending — rejected ad accounts are slow to recover.
Frequently asked questions
How much does it cost to open a med spa?
Most single-location med spas open for $150,000–$500,000 depending on devices, build-out, and market. Devices are usually the largest line — a single new laser platform can exceed $100,000 — followed by leasehold improvements, initial inventory of toxins and fillers, insurance, and 3–6 months of operating runway. Software, training, and marketing are small by comparison but determine how fast the book fills.
Do I need a medical director to open a med spa?
In nearly every U.S. state, yes. A med spa performs medical procedures, so a physician must oversee protocols, delegation, and (in most states) good-faith exams before treatment. Rules on who can own the practice, supervise injectors, and how present the physician must be vary by state — confirm yours before signing a lease.
What software does a new med spa need?
At minimum: online booking, clinical charting with e-signed consents, before/after photo storage, POS and memberships, automated reminders with a waitlist, and HIPAA-compliant messaging. A unified platform with a signed BAA avoids the integration and compliance gaps of stitching five separate tools together.
How long does it take to open a med spa?
Plan for 4–9 months: entity and licensing (2–6 weeks), lease and build-out (2–4 months), credentialing, insurance, and protocols (parallel), hiring and training (4–8 weeks), and a pre-launch marketing window of 60–90 days. Starting marketing and the waitlist before build-out finishes is what separates a full opening book from a slow first quarter.
Keep going
Medical Spa Software Buyer's Guide →
The 12 capabilities to require, and how to compare platforms without getting sold.
2026 Pricing Study →
Every line item on a med spa software invoice, with method disclosed.
HIPAA-compliant software →
The BAA, encryption, and audit-trail evidence to demand from every vendor.
Revenue Gap Planner →
Model your first-year revenue against capacity before you sign a lease.
Start a 30-day trial →
Configure your menu, protocols, and consents in MedAestheticsOS — no card required.