What must a med spa in each state report to the board
The same question, answered for 23 states from each state’s own law. States disagree on this, which is the point — an answer that is right in one is wrong next door. Every entry below is a statute or board rule we verified, most recently Sep 8, 2026.
Facility · part of The Practice Perimeter
| State | What its rule says | Cited to |
|---|---|---|
| Alabama | Not the spa — the physician must notify the Board in writing of any change or added facility location where LLBD procedures occur, and report emergency transfers, unscheduled hospitalizations, third-degree dermal injury or death within three business days. | Ala. Admin. Code r. 540-X-11-.13(1)-(3) (Registration of physicians using lasers) Sep 4, 2026 |
| Alaska | “A person licensed under this chapter shall report in writing to the board concerning the outcome of each medical malpractice claim or civil action in which damages have been or are to be paid by or on behalf of the licensee to the claimant or plaintiff, whether by judgment or under a settlement. | AS 08.64.345 (Reports relating to malpractice actions and claims) Sep 8, 2026 |
| Arizona | Physician misconduct — any information suggesting a doctor is medically incompetent, guilty of unprofessional conduct, or unsafe to practice. Reporting is mandatory for doctors of medicine and health care institutions, and permitted for anyone else. | Ariz. Rev. Stat. § 32-1451(A) (Grounds for disciplinary action; duty to report) Sep 8, 2026 |
| Arkansas | As a required reporter, a med spa's CEO or agent must report to the licensing authority within 7 days any final discipline against a healthcare professional for drug diversion, misuse, or abuse, and any voluntary resignation with such action pending. | Ark. Code Ann. § 17-80-117(a)-(c) (Substance Abuse Reporting Act) Sep 8, 2026 |
| Delaware | Three things, within 30 days: any partial or full loss of hospital privileges for adverse events, unprofessional conduct or competency; any medical society discipline; and any substantiated violence, threat, abuse or neglect — the facility owes this duty too. | 24 Del. C. § 1730(b)(1) Sep 8, 2026 |
| Florida | Yes — for office surgery, the surgeon must report any adverse incident to the Department of Health within 15 days and run a risk-management program analyzing incidents, reviewed at least quarterly. Board filings cover APRN protocols and offsite addresses. | Fla. Admin. Code r. 64B8-9.009(2)(l)-(m) (adverse incident reporting and risk management) Sep 8, 2026 |
| Georgia | The cited rules do not give a full reporting list — they set three duties: licensees must notify the Board in writing of address changes within 30 days, the consulting physician files the laser protocols, and facilities file that physician's details. | Ga. Comp. R. & Regs. 360-35-.03(2) (Renewal requirements — notice of address change) Sep 8, 2026 |
| Hawaii | Not the spa — Hawaii licenses no med spa facility, so reporting falls on licensees: physicians must report out-of-state discipline in writing within 30 days, and any licensee must report liability judgments or sanctions, here or elsewhere, within 30 days. | Haw. Rev. Stat. § 453-8(a)(14) Sep 8, 2026 |
| Idaho | The cited rules name one report — when a licensed establishment or facility ceases operation at its licensed location, the owner or authorized agent must notify the Board, either by signed letter or by submitting the license signed and marked out of business. | IDAPA 24.28.01.125.01 (Out of business — submittal) Sep 8, 2026 |
| Illinois | The cited rules don't settle board reporting — the duty they set is to the local health department: staff are designated reporters and must report unusual infectious-agent cases of urgent public health significance and outbreaks of public health significance. | 77 Ill. Adm. Code 690 (as stated in the IDFPR/IDPH med spa memo) Aug 17, 2026 |
| Indiana | Serious adverse events — a patient death, a life-threatening event, or a hospitalization or its prolongation — must be reported to the board within 15 days. | Ind. Code §25-22.5-12.5-6 (SEA 282, 2026) Jul 26, 2026 |
| Iowa | Each licensee, active or inactive, must file a copy of any adverse malpractice judgment or settlement with the board within 30 days, or face discipline; staff education and training must be verified to the board in writing within 14 days of a board request. | Iowa Admin. Code r. 481—660.1 (Mandatory reporting — judgments or settlements) Sep 4, 2026 |
| Kansas | It is a ground that “The licensee has failed to report to the board any adverse action taken against the licensee by another state or licensing jurisdiction, a peer review body, a healthcare facility, a professional association or society, a governmental agency, by a law enforcement agency or a court for acts or… | Kan. Stat. Ann. § 65-2836(t) Sep 8, 2026 |
| Massachusetts | The cited rules do not settle this — they impose no reporting duty on a med spa itself; the annual report of prescriptions dispensed inside and outside Massachusetts, their volume, and states shipped to falls on a retail sterile compounding pharmacy. | Mass. Gen. Laws ch. 112, § 39G(a)(5) Sep 8, 2026 |
| Michigan | Not directly — the cited rules impose no reporting duty on a med spa as such; only a licensed pharmacy, manufacturer, wholesale distributor or broker must report a change in ownership, management, location or PIC within 30 days of the change. | Mich. Comp. Laws § 333.17748(4) Sep 8, 2026 |
| Minnesota | Not the facility — reporting runs to the individual licensee: a physician must report charges brought against their license in another state or jurisdiction, and a practitioner dispensing oral legend drugs for profit must file a statement with the board first. | Minn. Stat. § 147.091 subd. 1(d) Sep 8, 2026 |
| Mississippi | The cited rules do not settle this — they cover only change-of-information duties: cosmetology licensees must notify their board in writing of address or establishment changes within 30 days, and physicians must immediately report a location or address change. | Miss. Admin. Code (Bd. of Barbering & Cosmetology) Rule 5.21 (Change of Information Notification) Sep 8, 2026 |
| New Jersey | The licensee must notify the Board when terminating an affiliation with a general business corporation — and must sever that affiliation where the entity repeatedly fails to keep the required quality-control mechanisms and refuses to add them on request. | N.J.A.C. 13:35-6.16(g) Aug 17, 2026 |
| New Mexico | Two things — payments on New Mexico malpractice actions or claims involving licensees and applicants, and professional review actions. The cited reporting rule covers affected entities generally and sets no other med-spa-specific report to the medical board. | 16.10.10 NMAC (Reporting requirements for licensees, applicants and other persons and entities) Sep 4, 2026 |
| Ohio | The cited rules set no med-spa reporting duty to the board — clinically significant side effects or failure to progress must be reported immediately to the supervising physician, and training documentation retained by both physician and delegate. | Ohio Admin. Code 4731-18-03 Aug 17, 2026 |
| Pennsylvania | A CRNP must notify the Board in writing whenever a prescriptive authority collaborative agreement is updated or terminated, filing the change form and the amended agreement with the Board and paying the prescribed fee. | 49 Pa. Code §21.285 Aug 17, 2026 |
| Texas | The cited rules do not settle this in full — the only reporting duty they name is practitioner reporting of adverse events from compounded drugs supplied for office use, imposed through pharmacy board rules; no form or deadline is given. | Tex. Occ. Code § 562.153 Sep 2, 2026 |
| West Virginia | Only one reporting duty appears in the cited rules — written notice to the board at least 20 days before the proposed opening date so the salon can be inspected, alongside board approval of the premises and payment of all fees. | W. Va. Code §30-27-17(a) Sep 3, 2026 |
Every state, in its own words
Alabama
(1) Every physician who proposes to perform any LLBD procedure in Alabama under these rules shall register with the Board prior to performing any procedure. (2) Registration shall be accomplished on a form provided by the Board. (3) After initially registering, it shall be the obligation of the registrant to notify the Board in writing of any change or addition of facility location where LLBD procedures occur or are offered for use.
Ala. Admin. Code r. 540-X-11-.13(1)-(3) (Registration of physicians using lasers) · verified Sep 4, 2026
The full Alabama answer, with the rest of the section →Alaska
ALASKA PUTS A 30-DAY CLOCK ON THE OUTCOME OF EVERY MALPRACTICE CLAIM, SETTLED ONES INCLUDED. “A person licensed under this chapter shall report in writing to the board concerning the outcome of each medical malpractice claim or civil action in which damages have been or are to be paid by or on behalf of the licensee to the claimant or plaintiff, whether by judgment or under a settlement. This report shall be made within 30 days after resolution of the claim or termination of the civil action.”
AS 08.64.345 (Reports relating to malpractice actions and claims) · verified Sep 8, 2026
The full Alaska answer, with the rest of the section →Arizona
⚠️ ARIZONA MAKES THE REPORT PERMITTED FOR ANYONE AND MANDATORY FOR THE PROFESSION. “Any person may, and a doctor of medicine, the Arizona medical association, a component county society of that association and any health care institution shall, report to the board any information that appears to show that a doctor of medicine is or may be medically incompetent, is or may be guilty of unprofessional conduct or is or may be mentally or physically unable safely to engage in the practice of medicine.”
Ariz. Rev. Stat. § 32-1451(A) (Grounds for disciplinary action; duty to report) · verified Sep 8, 2026
The full Arizona answer, with the rest of the section →Arkansas
ARKANSAS ROUTES THE REPORT THROUGH THE EMPLOYER RATHER THAN THE LICENSEE, AND A MED SPA IS A REQUIRED REPORTER. “Required reporter” reaches “any other entity that employs or contracts with healthcare professionals to provide healthcare services to individuals in the State of Arkansas”, and its chief executive officer or official agent “shall report to the appropriate licensing authority the following: (1) A final disciplinary action taken against a healthcare professional as a result of the diversion, misuse, or abuse of illicit drugs or controlled substances as defined by state and federal law by a healthcare professional; and (2) The voluntary resignation of any healthcare professional against whom a disciplinary action arising from the diversion, misuse, or abuse of illicit drugs or controlled substances … if a disciplinary action is pending.” The report “shall be submitted within seven (7) days of the final disciplinary action or voluntary resignation”.
Ark. Code Ann. § 17-80-117(a)-(c) (Substance Abuse Reporting Act) · verified Sep 8, 2026
The full Arkansas answer, with the rest of the section →Delaware
DELAWARE NAMES THREE THINGS AND A 30-DAY DEADLINE, AND THE DUTY IS ON THE FACILITY AS WELL AS THE PHYSICIAN. Every certificate holder and health care facility “has a duty to report to the Board within 30 days: a. Any partial or full removal of hospital privileges based on adverse events, unprofessional conduct or competency issues; and b. Any disciplinary action taken by a medical society against that person; and c. Any reasonably substantiated incidents involving violence, threat of violence, abuse, or neglect by a person toward any other person.”
24 Del. C. § 1730(b)(1) · verified Sep 8, 2026
The full Delaware answer, with the rest of the section →Florida
⚠️ FLORIDA’S OFFICE-SURGERY RULE CARRIES THE ADVERSE-INCIDENT REPORT, AND THE CLOCK IS 15 DAYS. “The surgeon shall report to the Department of Health any adverse incidents that occur within the office surgical setting. This report shall be made within 15 days after the occurrence of an incident” as required by Section 458.351, F.S. The same rule requires the surgeon to run a risk-management program identifying, investigating and analyzing the frequency and causes of adverse incidents, with documentation reviewed no less than quarterly.
Fla. Admin. Code r. 64B8-9.009(2)(l)-(m) (adverse incident reporting and risk management) · verified Sep 8, 2026 · read at Cornell Legal Information Institute
The full Florida answer, with the rest of the section →Georgia
GEORGIA’S COSMETIC-LASER RULE CARRIES ONE ROUTINE REPORTING DUTY AND ATTACHES A CONSEQUENCE TO MISSING IT. “Each licensee shall notify the Board within thirty (30) days, in writing, of all changes of address. Any mailing or notice from the Board shall be considered to be served on the licensee when sent to the licensee’s last address on file with the Board.” These claims survey the cosmetic laser services chapter; they do not survey the medical board’s general reporting rules.
Ga. Comp. R. & Regs. 360-35-.03(2) (Renewal requirements — notice of address change) · verified Sep 8, 2026
The full Georgia answer, with the rest of the section →Hawaii
HAWAII WRITES THE DUTY AS A DISCIPLINARY GROUND RATHER THAN AS AN INSTRUCTION, WHICH IS EASY TO MISS. It is a ground for the medical board to act on a “Failure to report to the board, in writing, any disciplinary decision issued against the licensee or the applicant in another jurisdiction within thirty days after the disciplinary decision is issued”.
Haw. Rev. Stat. § 453-8(a)(14) · verified Sep 8, 2026
The full Hawaii answer, with the rest of the section →Idaho
IDAHO’S REPORTABLE EVENT IS THE PREMISES CLOSING, AND THE DUTY IS THE OWNER’S. “Whenever any establishment or facility ceases operation at the licensed location, the owner(s) or authorized agent of the establishment or facility shall notify the Board by submitting” either “A signed letter by the owner(s) or authorized agent advising that the establishment or facility is out of business” or “The establishment or facility license bearing the signature of the owner(s) or authorized agent and marked out of business”. (The rule prints an effective-date marker between each lettered item, so those are its two clauses quoted separately rather than one continuous sentence.)
IDAPA 24.28.01.125.01 (Out of business — submittal) · verified Sep 8, 2026
The full Idaho answer, with the rest of the section →Illinois
Every member of staff at a med spa is a designated reporter under the IDPH communicable disease rules, and the practice must notify the local health department of any unusual case of a condition caused by an infectious agent that is of urgent public health significance, and of any outbreak of public health significance.
77 Ill. Adm. Code 690 (as stated in the IDFPR/IDPH med spa memo) · verified Aug 17, 2026
The full Illinois answer, with the rest of the section →Indiana
A medical spa must notify the board within 15 days of a patient’s serious adverse event (a death, a life-threatening event, or a hospitalization or its prolongation).
Ind. Code §25-22.5-12.5-6 (SEA 282, 2026) · verified Jul 26, 2026
The full Indiana answer, with the rest of the section →Iowa
Each licensee, including inactive licensees, will report to the board and provide a copy of every adverse judgment and settlement of a claim against the licensee in a malpractice action within 30 days from the date of said judgment or settlement.
Iowa Admin. Code r. 481—660.1 (Mandatory reporting — judgments or settlements) · verified Sep 4, 2026
The full Iowa answer, with the rest of the section →Kansas
KANSAS LISTS THE FAILURE TO REPORT AS ITS OWN GROUND FOR DISCIPLINE, AND THE LIST OF REPORTABLE BODIES IS LONG. It is a ground that “The licensee has failed to report to the board any adverse action taken against the licensee by another state or licensing jurisdiction, a peer review body, a healthcare facility, a professional association or society, a governmental agency, by a law enforcement agency or a court for acts or conduct similar to acts or conduct that would constitute grounds for disciplinary action under this section.”
Kan. Stat. Ann. § 65-2836(t) · verified Sep 8, 2026
The full Kansas answer, with the rest of the section →Massachusetts
⚠️ MASSACHUSETTS PUTS AN ANNUAL VOLUME REPORT ON THE STERILE COMPOUNDER, WHICH IS THE SUPPLY SIDE OF A COMPOUNDED INJECTABLE. “All retail sterile compounding pharmacies shall report to the board, on an annual basis, a list of prescriptions dispensed within and outside of the commonwealth, as well as the volume of these prescriptions.” A pharmacy that ships compounded preparations out of state must also report the names of the states it shipped to.
Mass. Gen. Laws ch. 112, § 39G(a)(5) · verified Sep 8, 2026
The full Massachusetts answer, with the rest of the section →Michigan
MICHIGAN’S REPORTABLE EVENT IS A CHANGE IN THE BUSINESS ITSELF, NOT A CLINICAL ONE. “A pharmacy, manufacturer, wholesale distributor, or wholesale distributor-broker shall report to the department a change in ownership, management, location, or its PIC or facility manager designated under subsection (2) not later than 30 days after the change occurs.”
Mich. Comp. Laws § 333.17748(4) · verified Sep 8, 2026 · read at Internet Archive snapshot — evidence of a page, not the current rule
The full Michigan answer, with the rest of the section →Minnesota
MINNESOTA ALSO WRITES IT AS A GROUND RATHER THAN AS A DUTY, AND IT REACHES CHARGES, NOT ONLY OUTCOMES: a “failure to report to the board that charges regarding the person’s license have been brought in another state or jurisdiction” is itself grounds for disciplinary action, alongside discipline actually imposed elsewhere and a refusal of licensure by another state.
Minn. Stat. § 147.091 subd. 1(d) · verified Sep 8, 2026
The full Minnesota answer, with the rest of the section →Mississippi
MISSISSIPPI PUTS THE SAME DUTY ON BOTH SIDES OF A MED SPA, AND THE COSMETOLOGY VERSION NAMES THE PREMISES. Under the Board of Barbering and Cosmetology’s rules, “A licensed practitioner must in writing notify the Board of any change of address and/or establishment affiliation within thirty (30) days of such change.”
Miss. Admin. Code (Bd. of Barbering & Cosmetology) Rule 5.21 (Change of Information Notification) · verified Sep 8, 2026
The full Mississippi answer, with the rest of the section →New Jersey
A licensee must sever an employment or affiliation where the entity regularly fails to maintain the required quality-control mechanisms and refuses to put them in place on request, and must notify the Board when terminating an affiliation with a general business corporation.
N.J.A.C. 13:35-6.16(g) · verified Aug 17, 2026 · read at Cornell Legal Information Institute
The full New Jersey answer, with the rest of the section →New Mexico
this part defines the requirements for affected entities to report to the board: (1) payments relating to malpractice actions or claims arising in New Mexico involving licensees and applicants; (2) professional review actions;
16.10.10 NMAC (Reporting requirements for licensees, applicants and other persons and entities) · verified Sep 4, 2026
The full New Mexico answer, with the rest of the section →Ohio
Adverse event reporting is a required component of the eight-hour curriculum every delegated nurse must complete, and documentation that the training was satisfactorily completed must be retained by both the delegating physician and the person delegated to.
Ohio Admin. Code 4731-18-03 · verified Aug 17, 2026
The full Ohio answer, with the rest of the section →Pennsylvania
A CRNP must notify the Board in writing whenever a prescriptive authority collaborative agreement is updated or terminated, filing the change form and the amended agreement with the Board and paying the prescribed fee. An agreement that quietly lapses is a live compliance gap, not a paperwork one.
49 Pa. Code §21.285 · verified Aug 17, 2026 · read at Cornell Legal Information Institute
The full Pennsylvania answer, with the rest of the section →Texas
THE CONDITIONS SIT ON THE PHARMACY, NOT THE PRACTICE. To dispense and deliver a compounded drug for office use a pharmacy must VERIFY THE SOURCE OF THE RAW MATERIALS; comply with applicable UNITED STATES PHARMACOPOEIA guidelines INCLUDING THE TESTING REQUIREMENTS, and with HIPAA; comply with all applicable competency and accrediting standards as determined by the board; and comply with board rules “including rules regarding the REPORTING OF ADVERSE EVENTS BY PRACTITIONERS and recall procedures for compounded products”. That last clause reaches back to the practice: adverse-event reporting is a practitioner duty imposed through the pharmacy’s rules.
Tex. Occ. Code § 562.153 · verified Sep 2, 2026
The full Texas answer, with the rest of the section →West Virginia
Prior to opening a salon, any person, firm or corporation owning and/or operating a salon, and any person, firm or corporation practicing in a field authorized by this article, shall meet the following requirements to acquire a salon license to do business: the salon has been approved by the board as having met all the requirements and qualifications for the place of business as are required by this article; notify the board, in writing, at least twenty days before the proposed opening date, so there can be an inspection of the salon; and pay all applicable fees.
W. Va. Code §30-27-17(a) · verified Sep 3, 2026
The full West Virginia answer, with the rest of the section →Which states this covers
23 of the 51 states for which we publish statute-cited rules. That is not every state, and nothing above should be read as describing one that is not listed — the answer genuinely differs, so a neighbouring state is not a guide. We monitor all 50 state legislatures plus the FDA and the Federal Register daily; the cited rule set is narrower than the monitoring and is growing on its own timetable.
What we track in every state →Just one state?
Solo-State — your state, watched.
A dated, source-linked Compliance Brief for your state — the changes that touch your practice, the what-to-do wherever a change calls for one, and the review checklists, in one document you can print and hand over. Kept current by watching your state daily, plus federal and nationally-significant alerts. Upgrade to All-Access anytime.
or $390/yr (2 months free)
Every plan includes all federal FDA, FTC & Federal Register coverage. The label is what we hold that is specific to that state — we scan all 50 state legislatures daily and add state items as they surface.
Scoped to your state · cancel anytime · secure Stripe checkout
Get regulatory changes as they publish
We scan all 50 state legislatures daily, plus the FDA and the Federal Register. Free weekly Brief — what changed, in plain language, with the source.
Free · unsubscribe in one click · we never sell your address
MedSpaRadar is regulatory monitoring and reference: it summarizes public laws, regulations and agency actions and links each to its source. It is not legal, medical, or compliance advice, and using it creates no attorney-client relationship. A summary can lag its source or leave out detail, and monitoring itself can be interrupted — so an absence of alerts means nothing reached you, not that nothing happened. Read the cited source, check its effective date, and confirm any change to your operations or clinical practice with qualified health-law counsel and your medical director. Legislative data via LegiScan (CC BY 4.0).