Opening plans do not usually fail on a missing item. They fail on sequence. Several things on this list take weeks or months, several cannot be started until something else exists, and the ones with the longest lead times are the ones most often left until the build is finished.
Work the list in this order. The grouping is by what blocks what, not by department.
1. Entity and tax, because everything else names it
Nothing below can be applied for until there is an entity to name on the form.
- Articles of organization or incorporation for the professional entity, formed in the right state and the right form. In several states a foreign professional entity may not render services at all, so this is a structural decision rather than a filing preference.
- EIN for each entity, and the operating agreement or bylaws.
- The management company, if you are using a PC-MSO structure, and the management services agreement between them. See how it works.
- Registered agent, and foreign qualification anywhere you will operate.
2. Facility and state licensure, the long poles
These have lead times and they gate opening day.
- State facility licensure or an exemption certificate. In Florida this is the Health Care Clinic Act, and the exemption is something you apply for rather than something you have. See Florida AHCA clinic licensure.
- Board certificate of registration for the professional entity, where the state requires one before the secretary of state will act.
- CLIA certificate, if anything in the building will produce a test result. One in-office test is enough to need one. See CLIA waiver for in-house labs.
- DEA registration for the address, if controlled substances will be held there. It is per location, not per company. See DEA registration by location.
- State controlled-substance registration, which is separate from the federal one in many states.
3. Clinical governance, which is what a board asks for
This is the set most commonly assembled after opening, and it is the set that decides how an inspection or a complaint goes.
- Medical director agreement, with duties expressed as dated, recurring acts.
- Protocols per service line, approved and version-dated.
- Delegation documents naming individuals and acts.
- Standing orders where they are the right instrument, which is not always. The three documents do different jobs: see standing orders, protocols and delegation.
- Good faith exam workflow, with the exam captured as a clinical act rather than an intake form.
- Emergency protocols, including adverse event response and the condition-specific ones your menu requires.
- Consent forms per treatment, and a separate photo authorization if you will market with images.
4. People
- Licensure verification for every clinician, primary source, with a re-verification cycle.
- Credentialing file per clinician, and the collaborative or supervisory agreements the state requires.
- Employment or contractor agreements, with the clinical and non-clinical roles properly separated.
- Training records, including device training and emergency protocol training, with dates.
- Business associate agreements with every vendor touching patient data, if you are a covered entity. See business associate agreements.
5. Money and the stack
- Bank accounts per entity, kept genuinely separate. Commingling is the single most common finding in diligence later.
- Payment processing, and the underwriting questions that come with a health-adjacent merchant category.
- Certification where your advertising channels require it, which for some categories gates the ability to advertise at all.
- Vendor contracts for devices, products and software, with the data terms read rather than skimmed.
6. Insurance
- Professional liability for each clinician, and confirmation in writing that the medical director role as described falls inside the covered scope.
- Entity coverage, because claims are usually pleaded against the practice as well as the clinician.
- General liability, property, cyber, and employment practices for the management company.
- Tail arrangements agreed in advance where any policy is claims-made.
The sequencing that actually bites
Four items commonly arrive too late because they cannot be rushed at the end:
- Board certificates, where a state requires one before the entity filing completes.
- DEA registration, which is per address and cannot be applied for before the address exists.
- CLIA, if there is any testing at all in the plan.
- Facility licensure or the exemption certificate, which is a filing with a queue behind it.
Start those four the week the lease is signed. Everything in groups three through six can be built while they are pending. Nothing in group two can be compressed because the build finished early.
What this means for you
Put the four long-lead items on the critical path and give them an owner with a date, because they are the only things on this list that can move an opening day. Build the clinical governance set while you wait rather than after you open, since that is the set a board will ask for and the one that is hardest to reconstruct later. Keep one register of what exists, where it lives and when it expires or needs review, and treat that register as the deliverable rather than the individual documents. Then re-run the whole list before each new location, because almost every item on it is per site rather than per company.
Related reading
Frequently asked questions
What is the longest lead time when opening a med spa?
Usually the licensure items: a state board certificate of registration where one is required, facility licensure or an exemption certificate, DEA registration for the address, and CLIA if any testing will happen on site. Start those when the lease is signed rather than when the build finishes.
Do I need a CLIA certificate for a med spa?
Only if the site performs testing, but the threshold is low. Under 42 CFR § 493.3 there is no minimum-volume exception, so a single in-office test such as a dipstick or finger-stick makes the site a laboratory needing a certificate that matches what it performs.
Does each location need its own DEA registration?
Yes, where controlled substances are handled there. 21 CFR § 1301.12(a) requires a separate registration for each principal place of business or professional practice at one general physical location. It is per address rather than per entity or per prescriber.
What clinical documents should exist before opening?
A medical director agreement with dated recurring duties, protocols per service line with version dates, delegation documents naming individuals and acts, the good faith exam workflow, emergency protocols, and consent forms. Assemble them before opening rather than after.
What is the most common gap found later?
Commingled banking between the professional entity and the management company, and clinical governance documents that were never version-dated or approved. Both are cheap to fix at the start and expensive to reconstruct during diligence or a board inquiry.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.