Where to Expand a Med Spa in 2026: States Ranked by CPOM Risk
Not every state treats med spa ownership the same way. Here's how CPOM enforcement and MSO structure requirements stack up across the states that matter most.
Every state has some version of Corporate Practice of Medicine doctrine, every state requires a licensed physician to oversee medical procedures, and every state restricts who can prescribe and inject. What varies sharply — and what should actually drive an expansion decision — is enforcement intensity and how much structural complexity it takes to operate legally.
Here's how the states operators ask about most actually stack up in 2026, and what it means for how you'd need to structure ownership in each.
This is a general compliance overview, not legal advice — verify current requirements with your healthcare attorney and state medical board before making a structural decision.
Strictest: California and New York
California tightened further in 2026. SB 351, effective January 1, codified the state's CPOM doctrine specifically against management companies, private equity groups, and the MSOs they control — explicitly barring MSOs from influencing clinical decisions, patient volume, staffing, or provider hours. A companion law, AB 1415, expanded state review of MSO transactions. For existing California MSO structures, offending contract provisions became void on the effective date. This is now the most consequential state in the country for getting friendly-PC + MSO structure design right, and the state with the least tolerance for getting it wrong.
New York layers its own complexity on top of standard CPOM enforcement: a nurse practitioner needs full practice authority plus more than 3,600 hours of qualifying clinical experience to operate independently within nursing scope — and even then, procedures classified as the practice of medicine (Botox, filler, neuromodulators, most laser devices) still require a physician-owned clinical entity regardless of NP hours. The underlying NP Modernization Act also carries a sunset provision worth tracking before locking in a structure there.
Strict, Actively Enforced: Texas, Georgia, Illinois
Texas requires detailed delegation documentation and mandates that a medical director evaluate patients before treatment — this isn't a paperwork formality, it's an active clinical requirement. Texas has also moved to regulate cosmetic procedures and IV therapy directly under recent rule changes, tightening what was previously a gray area.
Georgia and Illinois both enforce CPOM with real consequences when complaints surface, even though neither generates the volume of new statutory activity California has seen. The friendly-PC + MSO structure is required in both, and it needs to hold up to scrutiny, not just exist on paper.
New and Newly Regulated: Indiana, New Jersey
Indiana became the first state with a comprehensive, med-spa-specific statute — SB 282, effective July 1, 2026, with a registration deadline of January 1, 2027. That's a meaningful shift: most states regulate med spas indirectly through general medical practice law, and Indiana just wrote rules specific to the business model.
New Jersey expanded nurse practitioner autonomy in early 2026 but explicitly excluded aesthetic providers from that expansion — a reminder that "the state loosened NP rules" and "the state loosened med spa rules" aren't always the same headline.
Moderate: Florida
Florida requires the friendly-PC + MSO structure and Health Care Clinic Act registration with the state health agency (or a qualifying exemption), but has also been active in legislating specifically around compounded weight-loss medications and clinical oversight — a sign the state is paying closer attention to this sector than it used to, even without a full CPOM-strictness reputation.
More Permissive: Arizona, Oregon, Washington, Nevada
States with full practice authority for nurse practitioners — Oregon, Washington, and with a controlled-substance nuance, Nevada — allow independent NP ownership without a physician-ownership requirement, which meaningfully simplifies structure. Arizona is generally described as comparatively light on CPOM enforcement relative to states like New York and California, though "lighter" doesn't mean "unregulated" — standard medical practice act, nursing scope, and prescribing rules still apply.
Building an unnecessary friendly-PC structure in a full-practice-authority state doesn't just waste money — it can add months to a launch timeline for no regulatory benefit. Matching structure to the actual state requirement, in either direction, is the point.
What This Means for Expansion Planning
The throughline isn't "avoid strict states" — it's that strictness should change how you structure the entity, not whether you expand there. A few things worth building into any multi-state expansion plan:
Don't copy-paste your structure across states. A CPOM structure built correctly for Texas won't automatically satisfy California's newer MSO-specific restrictions, and vice versa.
Track legislative movement, not just current law. Several of the changes above — California's SB 351, Indiana's SB 282, New York's NP Modernization sunset — all happened or changed within the last 12-18 months. State regulation of this sector is moving fast in 2026, not settling.
Enforcement intensity matters as much as the letter of the law. Two states can have similarly worded CPOM statutes and very different real-world consequences depending on how actively the board investigates complaints.
The Bottom Line
Where you can open a med spa isn't really the question anymore — every state allows it in some structural form. The real question is how much complexity that structure requires, and whether it's built to survive the state's actual enforcement posture, not just its statute. Getting that wrong doesn't show up as a launch delay; it shows up as a shutdown order or a void contract years into operating.