There is no national med spa law. Indiana wrote one, and it starts charging you before the register even opens.

Straight answer first: there is no federal med spa law in the United States, so the rules that decide who has to stand in your treatment room, where you are allowed to inject, and what you can put in a syringe are set by your state. Indiana just became the first state with a dedicated med spa register. Two of its three real costs already applied from 1 July 2026, before the register itself exists, and one of them can quietly delete a revenue line you are running this month.

Who actually makes the rules

Nobody nationally. There is no federal med spa licence, no national register, no single agency you answer to. Ownership rules, supervision rules, scope of practice, advertising, all state law. That is why the honest answer to "what are the med spa regulations" is a question back: which state, and are you a med spa in that state's words or a physician's office?

Two states moved in 2026, from opposite ends. Indiana regulated the facility. California regulated the owner. If you trade in neither, read them anyway, because these are the two templates the next dozen states will copy.

Indiana: the dates that matter

Governor Braun signed Senate Enrolled Act 282 on 5 March 2026. It created a new chapter of the Indiana Code, 25-22.5-12.5, titled Medical Spas.

Three dates, in order:

• 1 July 2026. The chapter took effect. The operating rules below are already law. This is the part people are missing.
• 1 October 2026. The deadline for the Medical Licensing Board of Indiana to publish how you actually register.
• 1 January 2027. From this date a med spa must be registered to do business in Indiana. Operate unregistered and the board can fine you up to $5,000 and still require you to register.

Notice the order. The obligations arrived in July. The form arrives in the autumn. Nobody sent you a letter in between.

What the application asks for

The list itself is short. Your legal name and any name you trade under, your address, your website, the services you intend to provide, whether you compound drugs on the premises, and the name and licence number of your responsible practitioner plus their collaborating physician or supervising practitioner if they have one.

The statute sets no fee, so what the paperwork costs is genuinely not knowable yet. That is fine. The expensive parts are not on the form.

Three costs that never appear on an invoice

None of these three is the register. All three are already in force.

Cost one: someone with a prescription pad has to actually be there

Your responsible practitioner must hold prescriptive authority and have education and training in the specific treatments and medications your spa provides. That means a physician, an advanced practice registered nurse who meets Indiana's requirements, or a physician assistant with delegated prescriptive authority.

Then comes the line worth reading twice. That practitioner must be physically present at the medical spa location for a sufficient amount of time to ensure the spa complies with the chapter. Not reachable. Not on the paperwork. Present.

They also have to ensure every single person working there is licensed for what they are doing, that it sits inside their scope of practice, and that they have been trained for it.

If your current arrangement is a medical director who signs off remotely and visits when there is a problem, that arrangement now has an hourly rate attached to it. Work out what present looks like for your treatment mix, get a number, and put it in your costs before January.

Cost two: your off-site work is finished

This is the one that removes revenue rather than adding cost, and it is the least discussed.

A med spa may not provide its services and cosmetic or lifestyle treatments to a customer at any location other than the medical spa office. The single exception is where the treatment is performed elsewhere for the education or training of people who intend to provide it.

So the Botox evening at a hair salon, the filler night at a gym, the pop-up in a hotel suite, the house call for a good client: all gone as of 1 July 2026. Earlier drafts of the bill would have allowed a physician's office or another licensed health care facility as alternative sites. The version that became law does not. It says the medical spa office.

Cost three: anything you mix yourself now needs a paper trail

The same act added a second new chapter, Indiana Code 16-42-22.5, on compounding from bulk drug substances, also effective 1 July 2026. If you or anyone under a pharmacist's or physician's supervision mixes, dilutes, pools or reconstitutes a drug at your clinic, you are compounding, and it is only lawful when all of the following hold:

• The bulk substance is not research grade (unless it is part of a study approved by an institutional review board) and not veterinary grade.
• It was manufactured by an establishment registered with the FDA as a human drug establishment under 21 U.S.C. 360.
• It arrives with a valid certificate of analysis stating its identity, content and country of manufacture.
• It has had quality control testing.
• The work complies with the federal Food, Drug, and Cosmetic Act and with any applicable chapter of the United States Pharmacopeia.

Records of acquisition, examination and testing must be kept for at least two years after the expiry date of the last lot of compounded drug containing that substance. The Indiana Board of Pharmacy now has primary authority to investigate sourcing, storage, labelling, handling and compounding, and can request compliance documentation from out-of-state pharmacies shipping into Indiana.

Two definitions in there are worth money to you. Amino acids count as bulk drug substances. Vitamins, minerals, herbs, essential oils and extracts do not. And mixing or reconstituting a product exactly as the manufacturer's FDA-approved labelling tells you to is not compounding, nor is adding flavouring. So a manufactured vial reconstituted per label is one thing. Your own amino-acid or peptide blend is another, and it needs a documented supply chain behind it.

Put your own numbers on the off-site rule

Do this on paper, it takes five minutes and it is the highest-value thing on this page.

Pull your last three months of appointments and count only the ones performed somewhere that is not your own premises. Multiply by your average ticket for those treatments.

If that is fifteen appointments a month at a $400 ticket, you are looking at $6,000 a month of revenue that is no longer lawful to earn that way, roughly $72,000 a year of top line. Your numbers will be different. The point is that this is a line item, not a technicality, and if the events were profitable because someone else supplied the room, the margin on them was probably better than your in-clinic average.

There are only three honest responses: bring that demand into the clinic with a reason to travel (an event evening on your own premises, a package, a members' night), replace it with capacity you can actually fill, or accept the loss and reprice. Our guide to raising prices covers the third without shedding your best clients, and the break-even calculator tells you how many in-clinic appointments have to replace it.

The definition is partly a marketing test

Now the part that will annoy you, because it is in the statute in black and white.

You are a medical spa in Indiana if you do all three of these: offer medical health care services, use prescription drugs for intravenous, intramuscular or subcutaneous delivery, and hold yourself out as a facility focused on cosmetic or lifestyle treatments. The statute names them: weight loss, wellness, longevity, cosmetic and aesthetic treatments including botulinum toxin and dermal fillers, hair loss, hormone therapies, parenteral nutrient therapies, and non-surgical laser or energy devices for rejuvenation, anti-aging or hair removal.

And you are not a medical spa if you are a physician's office, or a facility otherwise licensed by the state.

Read that again. Two clinics can do identical injections, on identical clients, with identical risk, and only one of them is inside the chapter, because the third limb of the test is about how you present yourself and the carve-out is about what kind of entity you are. That is a real feature of the law, not a loophole to build a plan on: the advertising rules still bite (a registered spa must comply with Indiana's health care provider advertising chapter, and the board can suspend a registration for breaching it), the licensing boards still police scope of practice, and restructuring your entity to duck a register is exactly the kind of thing a regulator and a buyer both notice. But it does tell you what this law is really sorting: the retail-branded end of aesthetics, not the clinical risk.

Serious adverse events now have a clock

If a patient suffers a serious adverse event, you must notify the board within 15 days. Serious means jeopardy to health requiring medical or surgical intervention, or death, a life-threatening occurrence, or hospitalisation (including a longer stay than planned). The notice includes the patient name, the medication or treatment involved, the date, the nature and location of the event, and the medical records.

Fifteen days is not long if the first you hear of it is a phone call from a family member. Whoever answers your phone needs to know that a serious complication is a reportable event with a deadline, not just a clinical problem.

California went at the other end of the business

Different target, same year. California's SB 351, signed on 6 October 2025 and in force since 1 January 2026, added Division 1.7 to the Health and Safety Code and aims squarely at who is allowed to be in charge.

A private equity group or hedge fund may not interfere with a physician's or dentist's professional judgement, including decisions on diagnostic tests, referrals, overall responsibility for a patient, or how many patients they see and how many hours they work. It also cannot control the ownership of patient record content, hiring and firing of clinical staff, payer contracting, coding and billing, or the selection of medical equipment.

Two consequences an owner-operator should care about. First, if your exit plan involves selling into a physician-adjacent management platform, the structure that platform can operate in California is now narrower. Second, non-compete and non-disparagement clauses in provider contracts are unenforceable there, with narrow exceptions including genuine sale-of-business covenants. If you were relying on a non-compete to keep your best injector, in California you are relying on nothing.

Your registration will be public, and buyers read public things

The last piece is the one nobody has priced.

The Indiana board must establish and maintain a public database of the registration information for every registered med spa, with health identifiers redacted. Your legal entity, your trading name, your services, and your named responsible practitioner will be searchable by anyone with a browser. Separately, the state must publish a report twice a year, by 1 March and 1 September, covering compounding oversight, including counts of facilities such as med spas that handle compounded drugs and a summary of deficiencies and violations found.

A buyer valuing your clinic looks at the profit a new owner would keep, your owner earnings, and then at how much of it survives contact with reality. Until now, a med spa's compliance story in due diligence was whatever the seller's folder contained. From 2027 in Indiana it is a public record: registered or not, which practitioner is named, whether they are still licensed.

That cuts both ways, and the direction depends on you. A clinic whose register entry is clean, whose responsible practitioner is properly contracted, and whose compounded lines have certificates of analysis behind them just became easier to buy, which is the whole game with transferability. A clinic whose revenue leaned on off-site events, a remote medical director and a supply chain nobody documented just became a page of questions, and questions come off the price.