NC Med Spa Medical Director Requirements: Who Supervises What

A med spa medical director in North Carolina is the licensee who carries clinical responsibility for the treatments a practice delivers: who may perform them, what supervision each one needs, and who signs the order behind an injection. North Carolina sets those answers through two boards rather than one statute.

Two boards set the rules, not one statute

North Carolina splits med spa oversight between the Medical Board, which governs physicians and the procedures it treats as surgery, and the Board of Nursing, which governs what an RN or LPN may perform and under whose order. As of October 2026 both speak through position statements rather than a single med spa statute.

That distinction matters, because a position statement is not a rule with a penalty schedule attached. It is the board's stated expectation, and what an investigator reads when a complaint arrives. Treating it as optional is one mistake; reading it as a statute is another.

Ownership sits in a third document. The Medical Board's position statement on the corporate practice of medicine, amended September 2025, says businesses practicing medicine in North Carolina must be owned in their entirety by holders of active NC licenses, which is why practices here run on medical director structures.

Lasers: the Medical Board calls it surgery

Laser treatment is surgery in North Carolina. The Medical Board's position statement on laser surgery, adopted July 1999 and amended May 2021, treats the destruction, incision or other structural alteration of human tissue using laser technology as surgery, which is what sets who may perform it and who has to be reachable while they do.

On supervision the statement is specific and deliberately flexible: "The responsible supervising physician should be on site or readily available to the person actually performing the procedure." The board adds that what counts as readily available depends on a variety of factors, and that it expects the physician to respond quickly to emergencies and questions.

Before a first laser hair or tattoo removal treatment, the statement says good medical practice requires the patient be examined by a physician, physician assistant or nurse practitioner, with a history and a focused physical examination. Those procedures may be performed by a physician, or by an individual the physician designated as adequately trained and bears full responsibility for.

Nurses, injectables, and the on-site question

Injectables sit with the Board of Nursing rather than the laser statement. Its position statement on cosmetic and aesthetic dermatological procedures puts neuromodulator and dermal filler injections, chemical peels, microdermabrasion, sclerotherapy, aesthetic and hair removal lasers, micropigmentation and light treatments inside RN and LPN scope, provided the procedure is prescribed or ordered by a practitioner with prescriptive authority.

The difference between the two nursing licenses is physical presence. An RN does not need the ordering practitioner on site. An LPN does: the board calls for on-site supervision by an RN, physician, NP or PA. Either license requires documented training and demonstrated competency in the technique.

Laser appears in both documents, which is where practices get confused. The nursing statement lists aesthetic and hair removal lasers inside nursing scope; the laser statement adds its own supervision standard and examination on top. Plan to the stricter reading, and let a healthcare attorney settle which governs a given service.

Delegating to staff who are not licensed

Delegation to unlicensed staff runs through the statute. The Medical Board's own Forum article on delegating medical tasks points to N.C. General Statute 90-18(c)(13), which lets a physician delegate an act, task or function that is permitted by law or established by custom, to a person trained and qualified to do it, under the physician's supervision.

The soft edge is that phrase, established by custom, and the board says plainly that it has not adopted a precise interpretation of it. Training may be formal or informal. Supervision may be direct, or satisfied by the licensee's acknowledgement of responsibility for the worker's actions.

This row carries the least written guidance. An owner who cannot name the task, its training record and the physician who accepted responsibility is relying on a custom nobody checked.

Who may do what, and what has to exist first

Four license levels and one unlicensed category cover almost every line on a Charlotte med spa menu, and each needs something in place before the treatment happens: an order, an examination, a training record, or a supervising physician who is reachable. The table is the short version.

What belongs on the website, and what Charlotte practices publish

A practice's medical director belongs on the website as plain text: the name, the credential and the role, on a page a reader and a crawler can both read. When Mirastart measured 20 Charlotte-area med spa homepages on September 4, 2026, 16 named a medical director or credentialed provider that way, and three named nobody at all.

The twentieth case looks fine in a browser, which is why it is worth knowing about. That practice named a provider in a way that did not survive into raw HTML, so a crawler saw no name. Two of the 20 backed the name with a Person node.

Two reasons to fix it, and one is not marketing. A patient choosing between practices wants to know who is clinically responsible, which the ownership statement makes a real question here. An answer engine reads the same text, and cannot repeat a name it cannot find.

What the site should not do is turn a credential into a claim the rules do not support. Copy implying a physician is present throughout a treatment, when the arrangement is readily available instead, needs an attorney's eyes first.

What this looks like when it runs

Local SEO and Google Business Profile optimization is the buyer criterion this sits under, and the credential layer is part of it: the medical director named with their credential as plain text on the site, the same name and role on the Business Profile, and a Person node where the practice publishes structured data.

Mirastart builds that layer. Provider and credential text in team and treatment pages, the profile rebuilt field by field with every service listed, structured data naming the practice and the person, and booking that runs from the page all run in production for Charlotte businesses today.

Reporting is where to hold any agency, ours included. A local search report leading with keyword positions measures the agency. One leading with consults booked from search, naming which pages and profile fields moved, measures the practice.

On privacy, the controls are worth checking on anyone you hire: patient information stays out of ad platforms and pixels, form submissions land in a system the practice owns, and we sign a business associate agreement where an engagement touches protected health information. The practice remains the covered entity.