Who may own it, and who may treat the patient.

Nurse practitioner authority

• Full: the NP may evaluate, diagnose and prescribe under the exclusive authority of the state board of nursing. 27 states on this map.
• Reduced: a career-long collaborative agreement with a physician is required for at least one element of practice. 12 states.
• Restricted: career-long supervision, delegation or team management by a physician is required. 11 states.

For an owner, this is a cost line as much as a legal one: in reduced and restricted states, the collaborating or supervising physician is a recurring expense and a single point of failure the day that physician resigns.

Practice ownership: corporate practice of medicine

• Strict: a medical practice must be physician-owned; non-physician owners structure around it with an MSO and a professional corporation. 22 states.
• Moderate: the doctrine exists but is limited, uncodified, or lightly enforced. 12 states.
• Minimal: no meaningful prohibition on non-physician ownership, though only licensees may deliver medical services. 15 states.

These labels compress a genuinely complicated body of law into one word, and several states are actively changing: a few have recently tightened the rules on management services organizations specifically. Use the label to know how hard the question is, then have a healthcare attorney licensed in that state draft the structure.

Who may inject, and the exam that comes first

These two rows travel together. The pattern in most states is that a practitioner authorised to diagnose (a physician, and depending on the state an NP or PA) must evaluate the patient and issue an order, after which a nurse may administer it. What varies is who may perform that evaluation, whether telehealth satisfies it, whether fillers are treated differently from neuromodulators, and whether the supervising practitioner must be physically present.

Several states have no cosmetic-specific board rule at all. Those rows say so. It is the honest answer, and it is also the useful one: in those states the question goes to the board in writing before you build a staffing model on an assumption.

Each state was researched against primary sources first (state board rules, position statements, statutes and administrative code), falling back to well-known secondary sources where no primary source could be located. The nurse practitioner classifications come from the American Association of Nurse Practitioners. Every line carries its sources, so you can check our work rather than take our word.

Where a field could not be confirmed, it says so. We did not infer a rule from a neighbouring state, and we did not repeat a claim we could not trace to a source. Those gaps are real gaps in published guidance, and they are worth knowing about: a state with no cosmetic-specific rule is a state where the answer comes from a board opinion letter, not from a blog.

This is not legal advice and it is not a substitute for the boards. It is a starting point built by operators who place medical directors and pharmacy relationships for clinics, so that the first conversation with your attorney starts from the right question. If a row is wrong or has gone stale, tell us at justin@eventideaw.com and we will correct it and note the date.

Cite it freely. Associations, educators and journalists are welcome to quote or link any row with attribution to this page.

The whole map as a file, so you can check it, chart it, or cite a row without scraping this page. 50 states, 21 columns, every rule paired with its sources.

CSV68 KB, one row per state JSON120 KB, with the field dictionary and methodology

Version 1.0.6Full review 30 July 2026; cells re-verified since then carry their own date, most recently 26 September 2026 Coverage 50 statesRules with no source 0Rules with no government source 84 of 252 populated rule cells (300 schema slots)

The version in the filename is the schema's. med-spa-compliance-v1 freezes the columns and the identifiers: if a column is added, renamed or removed, that is a v2 at a new URL and this file stays where it is. Corrections to a row's content ship in place, move the third number, and are logged below with the date, so a citation can name the revision it read. This is v1.0.6, revised 2026-09-26.

The ownership column is the weakest in the file. 27 of 50 ownership_source values point at commercial compliance guides rather than a statute or a board document, because several states have no primary CPOM instrument to cite: the doctrine is built from case law and board opinion. Treat that column as a pointer for your attorney, not as a citation. Separately: North Carolina and North Dakota have boards that do not use .gov domains, so a missing .gov there is not a missing primary source.

No rule in the file ships without a source. A rule we could not confirm would ship with an empty _source value and the rule text intact, rather than being dropped to make the file look complete; since v1.0.5 there are none.

How to cite: Eventide Aesthetics & Wellness, US State Med Spa Compliance Map, v1.0.6 (revised 2026-09-26), full review 30 July 2026; cells re-verified since then carry their own date, most recently 26 September 2026. eventideaw.com/tools/state-compliance-map

Licence: CC BY 4.0. Reuse it, republish it, chart it, build on it commercially: the one condition is attribution in the form above. The page already invited quotation with attribution; this makes that a licence rather than a promise, so an association or a journalist can redistribute the file without asking. Note what the licence does NOT do: it grants rights in this compilation, and it makes no warranty that any row is current or correct. The rules themselves are public records and the limits in the methodology still apply.

What each column means

state

Full state name as published by the state. The join key for the other two artefacts on this site: it matches the sheet on the compliance map and the state on the coverage page.

state_code

Two-letter USPS abbreviation, uppercase. Provided so the file joins to census, licensure and claims datasets without a lookup.

np_authority

Nurse practitioner practice authority as classified by the American Association of Nurse Practitioners: Full, Reduced or Restricted. Empty where the map records no classification.

np_rule

What the state requires of nurse practitioners, as summarised from the cited source.

np_source

URL of the document the np_rule summarises. Empty means unconfirmed.

pa_rule

What the state requires of physician assistants.

pa_source

URL for pa_rule. Empty means unconfirmed.

ownership_posture

Corporate-practice-of-medicine posture as assessed from the cited source: Strict, Moderate, Minimal or similar. Empty where the map records no classification.

ownership_rule

Who may own the practice, and under what structure.

ownership_source

URL for ownership_rule. Empty means unconfirmed.

injection_rule

Who may perform cosmetic injections, and under what supervision or delegation.

injection_source

URL for injection_rule. Empty means unconfirmed.

good_faith_exam_rule

Whether an examination must precede treatment, who may perform it, and whether telehealth is accepted.

good_faith_exam_source

URL for good_faith_exam_rule. Empty means unconfirmed.

coming_change_rule

A pending statute or rule change the map has recorded. Empty where none is recorded.

coming_change_source

URL for coming_change_rule. Empty means unconfirmed or none.

medical_board_url

Home page of the state medical board: the body that decides delegation and good-faith-exam questions. This is where an unconfirmed row should be taken.

nursing_board_url

Home page of the state board of nursing: the body that decides what an RN or APRN may perform, which is often the binding constraint on a med spa staffing model.

reviewed

The date of this state's full review against its sources. Cells verified later carry their own date on the map.

map_url

The state's sheet on the compliance map.

coverage_page_url

Eventide's medical-director coverage page for the state.

Change log

• v1.0.6 (2026-09-26): Nine rule cells in five states re-read against their primary texts after the Codex re-audit of 26 September 2026, and the documentation. Texas: ownership_rule now says legal guides describe Texas as limiting ownership of a medical practice to physicians, that physicians and PAs may jointly own a professional association or PLLC with the PAs together holding only a minority interest and a physician controlling and managing the entity (Texas Business Organizations Code section 301.012 and 22 TAC 174.5), that jointly owned entities report to the medical board each year by April 30, and that nonprofit health organizations certified by the medical board are another exception (the unsourced "MSO structures are standard" is gone); good_faith_exam_rule now says the written order the physician approves or writes must include patient selection criteria (22 TAC 169.27), and that in adopting the rule the medical board said statute permits the relationship to be established in person or by telemedicine, with Occupations Code section 111.005 setting the telemedicine conditions, where it used to say telehealth acceptability was unverified; np_rule and pa_rule now say NPs and PAs prescribe under a prescriptive authority agreement with a delegating physician, with the narrow hospital and long-term care facility exception of Occupations Code section 157.054. Alabama: good_faith_exam_rule now states the medical board's telehealth conditions in full: how the relationship must be established, and all three conditions for prescribing a controlled substance by telehealth, including an established legitimate medical purpose. New York: np_rule now says that after 3,600 hours current law removes the written practice agreement and protocol requirements, and that from 1 July 2030 an NP past 3,600 hours may instead keep collaborative relationships with a physician or hospital, attested on a state form (Education Law section 6902(3)(b)); the 1.0.3 entry below described that later text as the current duty. Florida: good_faith_exam_rule now says the telehealth statute lets a provider perform a patient evaluation by telehealth without a physical exam first, and that we found no Florida statute or board rule setting a separate exam requirement for cosmetic procedures; ownership_rule now says that as of 26 September 2026 we found no Florida statute limiting practice ownership to physicians, when a Health Care Clinic license is needed, that the practitioner-owned exemption covers only the license classes the statute lists with a licensed owner supervising the business and legally responsible for its compliance, and that a licensed clinic must appoint a medical director or clinic director who accepts legal responsibility in writing. New Hampshire: injection_rule now says when we searched and which statutes and board rules we searched for a rule naming who may administer cosmetic injectables, and the row links RSA 329 and both boards' rule sets beside its earlier sources. The added sources are linked on the map and the state pages; each changed cell's first source, the one its _source column carries, is unchanged, and so are np_authority and ownership_posture. On the map, Florida's exam column now reads See note, and the count of states whose rule names an examination moves from 36 to 35. The methodology now says each row was read from the documents linked in its sources and summarized, that most sources are state statutes, rules and board pages while some ownership rows rely on published legal guides, and that classifications and dated search results are our assessments; in 1.0.5 the known_gaps field rows_without_a_primary_source was 0 and counted rule cells with no source at all; 1.0.6 publishes that count as rows_without_a_source, which stays 0, and adds the field rows_without_a_government_source: 84 of 252 populated rule cells (300 schema slots) none of whose sources is a government document; it also says that each _source column holds the row's first source, and that the full list of sources for every row is on the compliance map and on the state's coverage page; the field dictionary now describes reviewed as the date of the state's full review against its sources, with cells verified later carrying their own date on the map; and the download block says every rule is paired with its sources, gives the full review date beside the latest cell verification and counts the rules with no government source. The map's Dataset structured data now states the same methodology as its measurementTechnique. The changed cells carry their own verified date, 2026-09-26; no state's review date, column or identifier moves, so this is still med-spa-compliance-v1 at the same URL, and the revision number moves to 1.0.6.
• v1.0.5 (2026-09-23): Seven rule cells that carried no source were read against their primary texts, reworded to what those texts say and cited, so the rows with no source move from 7 to 0. Ohio's good_faith_exam_rule now states the prescriber-patient relationship a PA prescribes within, which includes a history and physical examination (Ohio Administrative Code 4730-2-07), the one an APRN needs (4723-9-10), and the physician evaluation before delegating non-ablative vascular laser (4731-18-03); it says no cosmetic-specific exam rule was found, and that telehealth is allowed for an initial visit that meets the standard of care (Ohio Revised Code 4743.09). Tennessee's good_faith_exam_rule now states the history and physical examination, diagnosis and treatment plan required before prescribing or dispensing, with listed exceptions, in the Board of Medical Examiners' rules (chapter 0880-02) and the Board of Nursing's APRN rules (chapter 1000-04), and physician telemedicine under Rule 0880-02-.16. New Hampshire's good_faith_exam_rule now states the physician-patient relationship required before prescribing, with its exam, history, diagnosis, treatment plan and drug documentation (RSA 329:1-c), the APRN-patient relationship defined the same way (RSA 326-B:2), and RSA 329:1-d. New Hampshire's injection_rule now says no New Hampshire statute or rule names who may administer cosmetic injectables, cites the APRN and PA statutes under which both may administer drugs (RSA 326-B:11 and RSA 328-D:3-b), and says what the Board of Nursing's non-binding scope advisories say. Vermont's good_faith_exam_rule now states that a licensed provider may, within the limits of their license, prescribe after an appropriate examination in person, by live audio-video telemedicine or through transmitted images and records, and that a questionnaire alone is inadequate for a physician's initial evaluation, with one listed exception (Vermont Statutes Title 18 section 9361, Title 26 section 1354 and Title 8 section 4098a). West Virginia's good_faith_exam_rule now states that prescribing without an ongoing provider-patient relationship is unprofessional conduct for physicians and PAs, and how the telehealth rules let physicians, PAs and APRNs establish that relationship where the standard of care allows (the West Virginia Code of State Rules, including the Board of Medicine's final 2023 licensing and discipline rule (11 CSR 1A), and West Virginia Code 30-3-13a). Montana's good_faith_exam_rule now states the telemedicine relationship and history rule for physicians and PAs (Administrative Rules of Montana 24.156.813), the Board of Nursing's medical spa FAQ, and Montana Code 37-2-305. Separately, the good_faith_exam_rule cells of Alabama, Minnesota and Arkansas drop a leading "Required" that the rest of each cell does not support (they describe a relationship or a prescription, not a required examination); no other word moves. Each cell's first source fills its _source column; the others are linked on the map and the state page. The changed cells carry their own verified date, 2026-09-23; no state's review date, column, identifier or classification moves.
• v1.0.4 (2026-09-23): Texas only: five rule cells re-read against the Texas statutes and the Texas Medical Board's rules in Title 22 of the Texas Administrative Code, chapter 169, and Texas's review date. Texas's good_faith_exam_rule said a physician, PA or APRN must establish the practitioner-patient relationship and order treatment before delegation, and cited the board's home page; it now says what 22 TAC 169.26(c) requires before a delegated cosmetic procedure, that a physician, or a PA or APRN acting under a physician's delegation, establish a practitioner-patient relationship, complete and maintain the medical record, disclose who will perform the procedure and their title, and have a person trained in basic life support present, and what section 169.27 adds, that the written order the physician approves or writes sets patient selection criteria. good_faith_exam_source cites section 169.26, with section 169.27 linked beside it on the map and the state page. Telehealth acceptability is still unverified and the cell still says so. Texas's np_rule no longer says NPs prescribe "only" through a prescriptive authority agreement, because the statute it cites does not say only; np_source is still the AANP state resource sheet, which supports the Restricted classification and the no-independent-practice fact, and Texas Occupations Code section 157.0512, the delegation of prescribing through a prescriptive authority agreement, is linked beside it on the map and the state page. Texas's pa_rule now reads "PAs prescribe through a physician-delegated, signed prescriptive authority agreement, under physician supervision", which is what section 157.0512 governs, and pa_source moves from the board's home page to section 157.0512. Texas's delegation rule keeps its wording and its first source, the board's medical spa page, and the map and the state page now also link 22 TAC 169.25, which makes nonsurgical medical cosmetic procedures including cosmetic injection the practice of medicine that may be delegated and supervised, and 169.26, the onsite-or-available duty. Texas's ownership rule is respelled organizations (it read organisations); its ownership_source is still the secondary compliance guide, because the physician-only ownership rule is still carried on that guide's reading and section 162.001 speaks only to the exception, and the map and the state page now also link Texas Occupations Code section 162.001, under which the board certifies the non-profit health organizations the rule names as its exception. Texas's reviewed date moves from 30 July 2026 to 23 September 2026, the day its rows were re-read, as the review line on the Texas sheet shows; every other state's review date is unchanged, and the map's answer on how current it is now says that rows re-verified since 30 July carry their own date in this change log. No column, identifier, classification or board URL changed, and the count of rule cells with no primary source is still 7, so this is still med-spa-compliance-v1 at the same URL; the bytes at that URL did change, so the revision number moves to 1.0.4. The compliance map and the Texas coverage page were regenerated in the same commit, so the page and the file still state each rule identically.
• v1.0.3 (2026-09-19): Eleven rule cells reworded or resourced against their primary documents, and the count of rule cells with no primary source moves from 10 to 7. New York's nurse practitioner rule said NPs may prescribe without a collaborative agreement; the Education Department's practice-requirements page says an NP practises under written practice protocols and a written practice agreement with a collaborating physician until 3,600 hours of experience are completed, and documents collaborative relationships after that, so the rule now says both and the source moves from the AANP classification page to the New York State Education Department. The AANP classification itself is unchanged and is still what np_authority records. California's ownership rule said non-physicians may not own a medical practice and cited SB 351; the Medical Board's own medical spa guidance states the ownership split directly, so the rule now states it as the board does, a majority of the stock held by California-licensed physicians, no more than 49 per cent held by other licensed health care professionals and no lay ownership at all, and the source moves to that guidance document. The SB 351 attribution is removed because it was not verified. Alabama's exam rule now carries the medical board's telehealth conditions in full, including the originating-site alternative it omitted, and Alabama's delegation rule stops saying only CRNPs and PAs may inject: the board notice governs DELEGATION under an approved protocol and says nothing about a physician injecting personally. Texas's delegation rule now states what the medical board states, that cosmetic injection is the practice of medicine and may be delegated to a person with appropriate training, with the onsite-or-available condition and the emergency-appointment duty, and the source moves from the board's home page to the board's own medical spa page. Tennessee's delegation rule now names the figures in the board position statement, four hours on site a week and charts signed within seven days, and says they apply to supervisees other than NPs and PAs. Utah's exam rule said an in-person evaluation is expressly required before tattoo removal; the statute says no such thing. It requires, for a nonablative cosmetic medical procedure other than hair removal, that a physician, nurse practitioner or physician assistant develop the treatment plan and evaluate the patient in person or by live telemedicine before a protocol or series begins, and that is what the rule now says. Both Utah rows move off a republished secondary copy of section 58-1-506 and onto the statute on the legislature's own site; no other Utah row was repointed, and the physician assistant row still cites section 58-70a-307. Three rows that carried no source now carry one. Montana's delegation rule is the Board of Nursing's medical spa FAQ, which lets RNs and LPNs with appropriate training, education and supervision inject prescribed medications as part of a medical treatment plan and bars them from prescribing or diagnosing; the FAQ is guidance, not a rule, and the cell says so. Nebraska's delegation and exam rules are both the Board of Nursing's aesthetic nursing advisory opinion, which lets an RN perform Level II and III procedures only after a licensed practitioner assesses, diagnoses and prescribes, and does not accept standing orders; the opinion is non-binding, and both cells say so. Montana's exam row and both New Hampshire rows are still unsourced and are unchanged. No column, identifier, classification, board URL or per-state review date changed, so this is still med-spa-compliance-v1 at the same URL; the bytes at that URL did change, so the revision number moves to 1.0.3. The eleven corrected rows, and the two corrected on 18 September, now carry their own verification date in the store, and the state pages say that a corrected row is dated here rather than at the 30 July review. The compliance map and all fifty state coverage pages were regenerated in the same commit, so the page and the file still state each rule identically. The Codex re-audit of the same day narrowed two of these readings before publication: California's rule names California-licensed physicians, as the Medical Board's guidance does, and Nebraska's two rows use the advisory opinion's own term, a licensed practitioner, because no definition of that term as a nurse practitioner or physician was verified. The revision number does not move again, because 1.0.3 has not been published.
• v1.0.2 (2026-09-19): Two coming_change_rule cells reworded against the primary text, and their coming_change_source cells filled. Indiana's row was checked against Senate Enrolled Act 282 of 2026 (Public Law 136-2026), which adds Indiana Code 25-22.5-12.5 effective 1 July 2026: the claim that this was the first state med-spa registration statute is removed, because neither the act nor the bill record says so; "registration opens around October 2026" is corrected to the statutory duty, which is that the board shall establish a registration procedure not later than October 1, 2026 (Sec. 3(b)); registration is required to do business from January 1, 2027 (Sec. 3(a)); the responsible practitioner duty is stated as the act states it, on a registered medical spa, and with both qualifications the act requires, prescriptive authority and education and training in the services, treatments and medications concerned (Sec. 5(a)); the notice to the board is due not later than fifteen days after the occurrence of a patient's serious adverse event (Sec. 6(b)); and the exemptions cover a physician's office and a facility or practice otherwise licensed by the state (Sec. 1(b)). The source now filed in coming_change_source, and linked from Indiana's row on the map, is the enrolled act itself on iga.in.gov. Rhode Island's row was checked against Public Laws 2025 chapters 308 and 309, codified at Rhode Island General Laws chapter 23-105: the act took effect upon passage on 30 June 2025, the medical director requirement is 23-105-2(a), the ablative device restriction is 23-105-2(f), and the rulemaking deadline in 23-105-3 is a specific date, 1 July 2026, that has passed, so "implementing regulations due in 2026, re-check this row once those land" is replaced by what we found when we checked on 18 September 2026, which was no medical spa rule in the Rhode Island Code of Regulations or on the Department's rulemaking agenda. That last sentence is our own dated observation of the public listings on that date and is not something the statute says; the searches behind it are recorded in ledger row F-14. The source now filed in coming_change_source, and linked from Rhode Island's row on the map, is chapter 23-105 itself on webserver.rilegislature.gov. The count of rule cells with no primary source moves from 12 to 10. No column, identifier, classification, board URL, review date or other cell changed, so this is still med-spa-compliance-v1 at the same URL; the bytes at that URL did change, so the revision number moves to 1.0.2. The compliance map and both state coverage pages were regenerated in the same commit, so the page and the file still state each rule identically.
• v1.0.1 (2026-09-10): Punctuation only, across 26 rule cells in 20 states. Where a rule opened with a label and an em dash before its detail, the em dash is a colon: "Required: provider must perform and document an initial history and physical evaluation". Rhode Island's pending-change row became two sentences. No rule, classification, source, board URL, review date or column changed, and no cell gained or lost a word. The columns and the identifiers are what v1 freezes and neither moved, so this is still med-spa-compliance-v1 at the same URL; the bytes at that URL did change, so the revision number moves to 1.0.1 and a citation can say which revision it read. The compliance map was retyped in the same commit, so the page and the file still state each rule identically. The field dictionary's two board_url descriptions, the methodology note, the ownership gap note and the attribution string were repunctuated the same way.
• v1.0.0 (2026-09-01): Montana ownership_source repointed from the rules.mt.gov gateway deep link (now a 301 to a search page) to the search URL it resolves to. Rule text and classification unchanged; no column added, renamed or removed, so this stays 1.0.0.
• v1.0.0 (2026-08-08): Licence set to CC BY 4.0 (was a pointer to the site terms, which is not a data licence). Data unchanged: no column added, renamed or removed, so this stays v1.0.0. Known gaps expanded to name the ownership column's reliance on secondary sources and to record that two states' boards are not on .gov domains.
• v1.0.0 (2026-08-08): First published release. 50 states; 21 columns; nurse practitioner authority, physician assistant framework, corporate-practice-of-medicine posture, cosmetic injection delegation, good-faith-examination requirement, pending changes, both board URLs, and a primary source per rule. Content as verified 30 July 2026.