Key Takeaways

• California med spas that operate through an LLC, that lack a physician-owned professional corporation, that rely on standing orders instead of patient-specific orders, or that use a paper medical director are out of compliance with the state’s Corporate Practice of Medicine doctrine.
• Remediation requires forming a physician-owned PC, transferring the clinical assets to the PC, recasting the existing entity as a Management Services Organization, drafting a compliant MSA, and rebuilding the good-faith exam and standardized procedures workflows.
• 2026 changes have raised the bar. The Medical Board expects patient-specific orders based on a good-faith exam by a licensed prescriber (physician, NP, or PA), not standing orders and RN-only intake. Questionnaire-only telehealth GFE models are treated as insufficient for most med spa services.
• Historical exposure attaches to the practice through B&P § 17200 (unfair competition), B&P § 17500 (false advertising), and — where the medical director’s involvement was largely nominal — B&P § 2264 discipline for the physician of record.
• The California AG’s 2026 enforcement pattern includes personal civil penalties on non-licensee owners. Voluntary remediation is materially stronger than reactive remediation.

If you own a California med spa — Botox, dermal filler, IV therapy, laser and IPL, microneedling, chemical peels, or any combination, and it operates through an LLC, a non-physician corporation, or a structure with a paper medical director, you are in a category the California Medical Board and the Attorney General are paying closer attention to in 2026 than at any point in the past decade. Under the implementation of SB 351 (effective January 1, 2026), the Medical Board and Board of Registered Nursing have sharpened their expectations around good-faith exams, patient-specific orders, standardized procedures, and medical director oversight. Under B&P Code §§ 2052, 2400, and 17200, non-compliant med spa operation is a defined enforcement exposure category, one that the AG’s June 2026 Carbon Health settlement demonstrated can reach non-licensee owners personally.

The remediation path exists. It is more expensive than doing it right the first time, and it takes longer than owners initially expect. But for most non-compliant med spas, remediation is the right decision compared to continuing to operate through a structure that violates California law.

This post is the med spa-specific remediation guide. It sits under the remediation pillar for California treatment businesses generally and covers the med spa-specific issues the general pillar does not address.

Why Now: The 2026 Enforcement Shift

Three developments have changed the practical stakes for med spa remediation in 2026.

SB 351. Effective January 1, 2026, SB 351 codifies California CPOM restrictions with statutory teeth and voids specific non-compete and non-disparagement clauses in employment arrangements involving PE and hedge fund-affiliated MSOs. SB 351’s specific prohibitions target PE and hedge fund buyers, but the AG’s public statements and the settlement pipeline demonstrate that CPOM enforcement is not limited to those entities. Solo entrepreneurs and small operators are exposed to the same underlying doctrine, enforced through B&P §§ 2052, 2400, and 17200.

Carbon Health. The AG’s June 2026 settlement with Carbon Health imposed $4.4 million in penalties on the operating entities and a $100,000 civil penalty on the non-licensee co-founder personally. The judgment identifies specific MSA arrangements — assignable option agreements, exclusive above-market financing, complete MSO authority over hiring and firing clinicians — that the AG considers per se impermissible. Med spa owners can now benchmark their arrangements against a specific list the AG has published through the settlement.

Sharpened GFE expectations. The Medical Board’s and BRN’s 2026 posture on good-faith exams treats standing orders as an enforcement trigger. A compliant med spa needs patient-specific orders written by a licensed prescriber (physician, NP, or PA) based on a good-faith exam that meets the standard of care under B&P § 2242. Questionnaire-only asynchronous models are treated as insufficient for most med spa services. Practices that have been running on RN-conducted intake with a rubber-stamp physician sign-off have to rebuild the GFE workflow as part of remediation.

The Med Spa-Specific Remediation Path

The general seven-step remediation playbook applies. Six med spa-specific considerations warrant additional attention.

1. Physician-partner sourcing and role. The physician-partner in a compliant med spa is not a paper medical director. The physician holds the professional corporation, employs the clinical staff, conducts (or supervises) the good-faith exams, reviews and approves the standardized procedures, is immediately available during procedures, and manages clinical incidents. For owners who have been running the practice with a paper medical director, remediation typically means either transitioning the paper physician into a substantive role (with corresponding compensation adjustment) or sourcing a new physician-partner willing to take on the actual clinical authority the role requires. The physician’s willingness to be the shareholder of a new PC on terms the owner can live with is the central determinant of whether remediation is viable.
2. Good-faith exam workflow rebuild. Most non-compliant med spas need a GFE workflow rebuild that goes beyond documentation cleanup. The 2026 standard, reflected in Medical Board and BRN guidance and in practitioner analysis, is: a licensed prescriber (physician, NP, or PA) conducts the exam in person or by synchronous video (asynchronous or questionnaire-only exams are insufficient for most med spa services); the exam meets the standard of care under B&P § 2242 (relevant history, examination appropriate to the service, review of contraindications, and clinical judgment on indication); the exam results in a patient-specific order for the specific treatment plan, not a standing order; and the exam is documented in the patient chart in a form that would survive a Medical Board audit. Botox and dermal filler in patients with straightforward histories can, in appropriate circumstances, be evaluated through a well-designed questionnaire reviewed by a qualified prescriber; higher-risk services (laser, IPL, RF microneedling, IV therapy) typically require live evaluation.
3. Standardized procedures rebuild. Where RNs perform delegated clinical functions — injecting neurotoxins and fillers, administering IV therapy, performing laser and IPL treatment — those functions have to be governed by written standardized procedures developed and reviewed under 16 CCR § 1474. The standardized procedures manual has to be specific to the practice, current, signed by the medical director and the executing clinicians, and reviewed on a defined cadence. Generic templates from formation-service kits do not satisfy the standard. Remediation typically includes rebuilding the manual from the practice’s actual services, current equipment, and current staff — not lifting a template.
4. Direct patient billing correction. Non-compliant med spas that have been billing patients through the LLC or non-physician entity have both an ongoing operational defect and a historical exposure. Remediation reconfigures the billing infrastructure so that all patient billing flows to the PC first; the MSO earns its management fee from the PC by invoice, not by sweeping percentage of gross revenue at the merchant-processor level. The AG’s 2026 CPOM guidance has emphasized that MSO revenue “sweeps” through aggregate merchant frameworks are treated as fee-splitting under B&P § 650.
5. Marketing rebuild. Med spa marketing that has represented services as “physician-supervised” or “physician-directed” while the practice actually operated without genuine physician oversight creates false-advertising exposure under B&P § 17500 that is separate from the underlying CPOM issue. Remediation typically includes a marketing audit and rebuild aligned with the practice’s actual clinical structure. Historical marketing exposure — content that has been on the site for months or years — is a separate analysis and may require decisions about takedowns and corrective disclosures.
6. Product supply chain review. Med spas source injectable products (Botox, Xeomin, Dysport, dermal fillers), IV therapy medications, and (for some practices) controlled substances. Sourcing has to run through prescription-authorized channels tied to the physician-of-record. Gray-market injectable suppliers, prescription drugs held without corresponding prescription documentation, and inventory records that do not reconcile are all remediation-priority items. For practices that offer controlled substances (some IV formulations, GLP-1 injections, testosterone), DEA registration of the prescriber is required.

Historical Exposure — Med Spa Considerations

Historical exposure for a non-compliantly-operated California med spa runs through several channels.

CPOM exposure under B&P §§ 2052 and 2400. Operating a business that renders medical services without a compliant licensed structure is a public offense. Public prosecutors may seek civil penalties under B&P § 17200. The AG’s 2026 pattern has demonstrated that CPOM enforcement can reach non-licensee owners personally.

False-advertising exposure under B&P § 17500. Marketing that represented the practice as physician-supervised while the medical director was largely absent, that overstated typical outcomes, that used testimonials without appropriate disclosures, or that misrepresented insurance status is exposed to false-advertising claims. This exposure is separate from CPOM.

Consumer-protection exposure. Refund demands and individual claims based on services rendered by a business not authorized to render them. For practices with substantial patient volume over years of operation, the exposure in this category can be meaningful.

Medical Board discipline for the physician of record. Any physician who served as paper medical director faces potential Medical Board discipline under B&P § 2264 (aiding and abetting the practice of medicine by an unlicensed entity). The physician’s exposure is separate from the owner’s and needs to be addressed as part of remediation planning — sometimes the paper physician does not want to continue the relationship, and the owner needs to source a new physician-partner.

BRN discipline for injecting RNs. RNs who have been injecting without proper standardized procedures or without a compliant good-faith exam supporting the treatment face potential Board of Registered Nursing discipline. Practices that relied heavily on RN-injector staffing have a distinct exposure category on the nursing side.

Payor recoupment. Limited for predominantly cash-pay practices, which most med spas are. More significant for practices that have participated in commercial payor networks or accepted superbill reimbursement.

Common Med Spa Remediation Misconceptions

“I’ll just have my medical director sign a new stack of paperwork.” Documentation cleanup does not remediate the underlying structural problem. If the LLC has been rendering medical services and billing patients, the LLC is not the compliant clinical entity — a new PC has to be formed and the clinical assets transferred to it.

“I’ll switch to standing orders that cover more treatments.” Standing orders are moving in the opposite direction of California regulatory posture in 2026. The Medical Board and BRN expect patient-specific orders based on a good-faith exam. Broadening the standing-order coverage is not remediation; it deepens the exposure.

“My medical director says the current structure is fine.” A medical director who is telling the owner the current LLC-based structure is fine either (a) does not understand the CPOM analysis or (b) is not the medical director this owner needs going forward. A candid conversation about the structure and the physician’s role, with California-specific counsel, is a prerequisite to remediation.

“I’ll just move to a state without CPOM.” Practices located in California and treating California patients are subject to California CPOM regardless of where the owner or the corporate parent is domiciled. Multi-state expansion is a substantive analysis that requires state-by-state PC formation and cannot be used to sidestep California law.

“I’ll wait until enforcement actually shows up at my door.” Reactive remediation is materially more expensive than voluntary remediation and materially weaker as an enforcement-mitigation posture. Enforcement that does show up often shows up with subpoenas and public complaints, at which point the options narrow.

When to Bring Counsel Into the Remediation

As soon as you recognize the structure is not compliant. Not after a Medical Board inquiry, not after a BRN complaint, not after an AG contact, not after a patient refund demand or a payor audit. The Attorney General’s 2026 enforcement pattern — Art Center Holdings amicus in March, Aspen Dental settlement in May, Carbon Health with personal penalty on the non-licensee founder in June, has made clear that CPOM enforcement is expanding, and expanding in ways that reach individual owners.

Bay Legal, PC represents non-licensee owners of California med spas through structural remediation, GFE and standardized procedures rebuild, marketing audit, historical exposure analysis, and post-remediation compliance discipline. Call (650) 668-8000 or schedule a consultation at baylegal.com/contact.

Frequently Asked Questions

I own a med spa through an LLC. Am I in trouble?

The candid answer is that most likely yes, at least from a compliance standpoint. An LLC cannot render medical services in California under Cal. Corp. Code § 17701.04(e), and every core med spa service (Botox, dermal filler, laser, IPL, IV therapy, chemical peels above superficial depth) is the practice of medicine. Whether the compliance issue translates into practical enforcement risk depends on the specific facts. Continuing to operate non-compliantly while you decide is not a neutral position.

Do I have to fire my current medical director to remediate?

Not necessarily. If the current medical director is willing to transition from a paper role to a substantive one — actually conducting or supervising good-faith exams, reviewing and approving standardized procedures, being immediately available during procedures, and managing clinical incidents, then the same physician can be the shareholder of the new PC going forward. If the current medical director is unwilling or unable to take on that role, remediation requires sourcing a new physician-partner. That conversation is often uncomfortable but necessary.

Do I need to rebuild the good-faith exam workflow, or can I just document the exams better?

For most non-compliant med spas, workflow rebuild is what the current standard requires, not just documentation cleanup. The 2026 posture from the Medical Board and BRN treats standing orders and RN-only intake as insufficient for most med spa services. Patient-specific orders based on a good-faith exam by a licensed prescriber (physician, NP, or PA) are the operational baseline. Well-designed questionnaires reviewed by a qualified prescriber can support GFE for lower-risk services (Botox, filler in straightforward patients); higher-risk services (laser, IPL, IV therapy, RF microneedling) typically require live evaluation.

What is the historical exposure for the RN who has been injecting?

RNs who have been injecting under a defective standardized procedures framework, without a compliant patient-specific order, or without proper delegation from a prescriber face potential Board of Registered Nursing discipline. The RN’s exposure is separate from the owner’s and the physician’s, and it depends on the fact pattern — including whether the RN reasonably relied on the medical director’s authorization and whether the standardized procedures manual was in place at all. Remediation planning should include an assessment of the RN’s exposure and, where appropriate, a conversation with counsel about the RN’s role going forward.

Can I keep the trade name, website, and social media I’ve built?

The trade name, website, and marketing IP can remain with the surviving entity (the new MSO) as non-clinical assets, provided the Fictitious Name Permit under B&P § 2415 is updated to reflect the new PC’s use of the brand name for clinical operations. Historical marketing content that misrepresents the clinical structure needs a rebuild as part of remediation. Reviews and testimonials that overstate typical results or imply broader clinical authority than the current structure has need to be addressed on transition.

Talk to a California Med Spa Remediation Attorney

Bay Legal, PC represents non-licensee owners of California med spas through structural remediation and historical exposure mitigation. If you own or operate a med spa through an LLC or non-physician entity, or if you inherited a non-compliant structure when you acquired the practice, call (650) 668-8000 or schedule a consultation at baylegal.com/contact.