What Insurance Does a Med Spa Actually Need?

The Insurance Stack, Not a Single Policy

Ask a med spa owner what insurance they carry and the answer is often "general liability," said with the confidence of someone who has checked a box rather than actually mapped their risk. General liability is real coverage and every business needs it, but a med spa is not just a business that happens to sell facials — it is a business that delivers actual medical treatment, delegated from a physician to non-physician providers, using products that carry real risk of adverse reaction. That combination means the insurance stack has to cover two different things: the ordinary risks of running a commercial space, and the specific risks of delivering medical care. Treating the second as an extension of the first is one of the most common and most expensive insurance mistakes in this industry.

The honest rundown below covers what a compliant med spa actually carries, not the minimum a landlord or a single vendor requires to sign a contract.

General and Commercial Liability

General liability is the baseline every commercial location needs regardless of what happens inside it — it covers third-party bodily injury and property damage that is not tied to the medical treatment itself: a patient who slips in the lobby, a vendor whose equipment damages the space, a visitor injured in a common area. It is necessary, cheap relative to the other categories on this list, and almost universally required by a commercial lease. It is also, by itself, close to useless for the actual clinical risk of a med spa, which is the mistake worth naming directly.

Professional and Medical Malpractice Liability

This is the coverage that actually matters most, and it is the one most often underbuilt. Professional or medical malpractice liability covers claims arising from the treatment itself — an adverse reaction to an injectable, a burn from a device, a missed contraindication that should have been caught during clearance screening. This coverage has to be structured around who is actually delivering care: the supervising physician, and every delegated provider — nurse practitioner, physician assistant, registered nurse, aesthetician performing medical-grade treatments under delegation — needs their own malpractice coverage appropriate to their license and scope, not a single umbrella policy that assumes the business entity is the one practicing medicine.

This is also where the corporate structure and the insurance structure have to match. A physician-owned clinical entity delivering care needs malpractice coverage sized to that entity and its providers; a management company sitting alongside it handling the business side is a different insured with different exposure. Insurance written against the wrong entity, or against the business side only, can leave the actual clinical risk functionally uncovered even though a policy exists somewhere in the file.

Product Liability for Injectables and Devices

Product liability covers claims arising from a defective product — a bad lot of a neurotoxin or filler, a device malfunction — as distinct from a claim that the provider administered a sound product incorrectly, which falls under malpractice instead. In practice, a single adverse event often triggers both questions at once: was the product defective, and was it administered correctly? A med spa carrying only malpractice coverage without product liability, or vice versa, can find itself contesting which policy should respond while a claim sits unresolved. Reputable device and injectable manufacturers and distributors often carry their own product liability coverage, but a clinic's own policy still needs to address the products it stocks, stores, and administers directly.

Employment Practices Liability

• Wrongful termination, discrimination, and harassment claims from current or former employees — categories general liability does not cover at all.
• A meaningful exposure for med spas specifically, given a workforce that mixes licensed clinical staff, estheticians, and front-desk employees, each with different classifications and different expectations.
• Worth carrying from the first hire, not added later once a clinic feels large enough to need it — the claims this coverage responds to do not correlate with company size.

Cyber and Data Liability

A med spa holds protected health information the moment it takes an intake form, and that data carries the same breach exposure any medical practice carries — a compromised EHR, a phishing incident that exposes patient records, a lost device with unencrypted patient data on it. Cyber and data liability coverage addresses the direct costs of a breach — notification, credit monitoring, forensic investigation — as well as the liability exposure that follows one. This is a newer category on most owners' radar than the others on this list, and one insurers increasingly ask pointed questions about before binding a policy at all.

Property and Equipment Coverage

Lasers, injectable inventory, IV supplies, and the buildout itself represent real capital at risk from fire, theft, water damage, or equipment failure. Property and equipment coverage is the most conventional item on this list — the kind of policy any commercial tenant needs — but it is worth pricing against the actual replacement cost of a med spa's equipment specifically, which tends to run higher than a generic retail buildout and is easy to underinsure if the policy was written off a template rather than an actual equipment schedule.

The Common, Dangerous Gap: A Management Company With Only General Liability

The single most common and most dangerous gap in med spa insurance is a management company that carries general liability and calls the insurance question answered, while the physician-owned clinical entity and its providers carry little or no malpractice coverage of their own. This happens because the management company is the entity signing the lease, hiring the front-desk staff, and buying the equipment, so it is naturally the entity whose insurance broker gets called first — but it is not the entity legally delivering medical care, and a general liability policy written for a management company will not respond to a malpractice claim regardless of how the business is structured.

The fix is not complicated once it is named: the physician-owned entity and its providers need their own malpractice coverage, sized to the actual service menu, in addition to whatever the management company carries for the business side. A clinic that has never had this gap pointed out to it by a broker who actually understands the structure is a clinic that should ask the question directly, before a claim forces the answer.

Where MedGrid Fits

MedGrid builds the physician-owned clinical structure with the right entities and delegation in place from day one, which is also the structure a broker needs to see to write malpractice coverage correctly against the entity actually delivering care — rather than a management company's general liability policy standing in for coverage it was never written to provide.