Performing cupping therapy legally in the United States means meeting requirements from three different directions at once: a state healthcare license that authorizes the technique within its scope of practice, federal workplace safety rules for anything involving potential blood exposure, and honest marketing that can be substantiated with scientific evidence. No single federal statute governs cupping, so the legal requirements for cupping therapy come from state licensing boards, OSHA, the FTC, and, for many practices, HIPAA. Getting any of them wrong exposes a practitioner to consequences ranging from license revocation to six-figure federal penalties.
Who Can Legally Perform Cupping
Most states fold cupping into the scope of an existing healthcare license rather than issuing a standalone credential. The usual routes are an acupuncture license, a massage therapy license, or in some states a physical therapy or chiropractic license. A practitioner without one of those underlying credentials who performs cupping on paying clients risks charges for unauthorized practice of a healthcare profession, which is a criminal offense in every state. Penalties range from misdemeanors to felonies depending on the jurisdiction, and can include fines and jail time.
Licensing boards also set continuing education hours that must be completed at each renewal cycle. Requirements vary by state and profession, but they typically cover both clinical technique and ethics. Missing the deadline creates a lapsed license, and any cupping performed during that gap counts as unauthorized practice.
Boards enforce professional conduct through complaint investigations and audits. When a board finds a violation, it can suspend or permanently revoke a license, issue cease-and-desist orders against unlicensed operators, and impose administrative fines. These tools work independently of criminal prosecution, so a single incident can generate both a board action and criminal charges.
Dry Cupping and Wet Cupping Are Regulated Differently
The legal distinction between the two techniques carries more weight than many practitioners realize. Dry cupping uses suction alone and does not break the skin. Because it is non-invasive, most states allow any licensed bodywork professional who meets basic competency standards to perform it, and it accounts for the majority of sessions in wellness and rehabilitation settings.
Wet cupping adds small controlled incisions in the skin before or after suction, drawing out a small amount of blood. That single change pushes wet cupping into a much more restricted category. Breaking the skin creates bloodborne pathogen risks, triggers stricter OSHA requirements, and in many jurisdictions qualifies as a medical procedure. States that restrict wet cupping typically limit it to physicians, certain advanced-practice acupuncturists, or other providers with specific clinical authorization. A massage therapist who performs wet cupping without that authorization can face charges for practicing medicine without a license, which carries steeper penalties than a standard licensing violation.
Some boards publish explicit guidance on cupping. Others address it only through general scope-of-practice language that requires interpretation. Confirm your state board’s position on both techniques in writing before offering either one.
OSHA Bloodborne Pathogen and Sanitation Duties
Any practice with potential exposure to blood or bodily fluids must comply with OSHA’s Bloodborne Pathogens Standard at 29 CFR 1910.1030. This applies to wet cupping directly, and to dry cupping whenever there is a reasonable chance of skin breakdown or contact with open wounds. The standard requires employers to develop and maintain a written Exposure Control Plan designed to eliminate or minimize employee exposure, and to review and update it at least once a year.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
The practical obligations that shape day-to-day operations include:
- Providing gloves, gowns, face shields, and other personal protective equipment at no cost to employees whenever there is occupational exposure to blood or infectious materials.
- Decontaminating reusable cupping instruments with a method known to destroy bloodborne pathogens, such as autoclaving. Many clinics avoid the issue entirely by using single-use disposable cups.
- Disposing of contaminated sharps and regulated waste in closable, leak-proof containers labeled with the universal biohazard symbol or color-coded red.
- Offering the hepatitis B vaccine to all employees with occupational exposure within ten working days of their initial assignment.
- Providing bloodborne pathogen training at initial assignment and at least annually thereafter for every employee with potential exposure.1Occupational Safety and Health Administration. 29 CFR 1910.1030 – Bloodborne Pathogens
OSHA enforces through inspections and citations. For 2026, a single serious violation carries a maximum penalty of $16,550, and willful or repeat violations can reach $165,514 per instance.2Occupational Safety and Health Administration. OSHA Penalties State and local health departments may run their own inspections under separate authority, with additional administrative fines for sanitation failures.
Treatment rooms should be sanitized with hospital-grade disinfectants between every client session. Tools that are not single-use belong on sterile drapes to prevent contact with unsanitized surfaces. These are the baseline practices health inspectors look for, and a single documented lapse can become the centerpiece of a later negligence claim.
Screening Clients for Contraindications
Your legal duty of care extends past technique. It includes screening every client for conditions that make cupping dangerous. Failing to screen is one of the fastest routes to a malpractice claim, because the injuries are foreseeable and the screening itself is simple.
Cupping is contraindicated for individuals with hemophilia or other bleeding disorders, cancer, organ failure, or an implanted electronic device such as a pacemaker. It should not be applied over areas with deep vein thrombosis, open wounds, bone fractures, varicose veins, skin lesions, or inflamed skin. Patients on anticoagulant medication face elevated bleeding risks, and those with cardiovascular disease or acute infections require extra caution. Cupping is generally not recommended for pregnant patients, pediatric patients, or geriatric patients. Patients with elevated serum cholesterol face a higher risk of cupping-related cardiovascular events, and skin that is oozing, excoriated, or infected can lead to elevated D-dimer levels suggesting blood coagulation complications.3National Center for Biotechnology Information. Cupping Therapy – StatPearls
Build a standardized intake questionnaire that covers every known contraindication, and do not proceed without reviewing it before each session. If a client’s answers raise a flag, refer them to their physician before treating. That signed questionnaire becomes your primary defense if a client later claims you failed to screen properly.
Informed Consent and Clinical Records
Every client should sign a written informed consent form before treatment begins. The form should explain in plain language what the procedure involves, the expected aftereffects like temporary bruising and suction marks, and the risks. For wet cupping, the consent must also address the skin incision, bleeding, and infection risk. A vague or overly technical form does not meet the legal standard. The client needs to understand what they are agreeing to and choose voluntarily based on that understanding.
Signed consent is the practitioner’s primary shield if a client later files a complaint or malpractice claim. Consent showing the client was informed of the specific risks being alleged makes it significantly harder to argue negligent disclosure. Consent forms that are missing, unsigned, or written in impenetrable jargon lose most of that protective value.
Clinical records for each session should document, at minimum, the date of service, the specific body areas treated, the technique used, any adverse reactions reported by the client, and the practitioner’s observations. There is no single federal retention period. Each state sets its own, and the range across states typically falls between five and ten years. Verify the specific retention period for your state and license type, and default to the longer end if there is any ambiguity. The malpractice statute of limitations may extend past the minimum retention period, so destroying records too early can leave a practitioner without documentation when they need it most.
When HIPAA Applies
HIPAA applies to any healthcare provider who transmits patient information electronically in connection with standard healthcare transactions such as insurance claims.4U.S. Department of Health and Human Services. Covered Entities and Business Associates An acupuncturist or massage therapist who bills insurance electronically, uses electronic health records, or transmits patient data digitally is almost certainly a covered entity. A cash-only practice that keeps only paper records may fall outside HIPAA’s reach, but state privacy laws still apply.
For covered practitioners, the Security Rule requires policies protecting the confidentiality, integrity, and availability of electronic patient health information. That means safeguards appropriate to the size and complexity of the practice, identification of threats to patient data security, and employee training on compliance. The rule does not prescribe a single technical solution, but the safeguards must be reasonable and documented.5Centers for Medicare & Medicaid Services. HIPAA Basics – Privacy, Security, and Breach Notification Rules
For a small cupping practice, compliance often comes down to fundamentals: encrypted devices, password-protected records systems, a written privacy policy, and staff training. The HHS Office for Civil Rights enforces HIPAA, and one of the most common violations it finds is the absence of these basic safeguards.
Advertising and Health Claim Rules
This is where many cupping practitioners get into trouble without realizing it. The Federal Trade Commission enforces truth-in-advertising rules under Section 5 of the FTC Act, which prohibits deceptive practices in commerce, and Section 12, which specifically targets false advertising for health-related products and services.6Federal Trade Commission. Health Products Compliance Guidance These rules cover cupping practitioners and the clinics that market their services.
Any claim about health benefits must be backed by competent and reliable scientific evidence, which the FTC defines as research conducted and evaluated by qualified experts using methods generally accepted in the relevant scientific field. Anecdotal evidence, client testimonials, and references to traditional or historical use do not satisfy this standard on their own. A website claiming cupping “detoxifies the blood” or “cures chronic pain” without adequate scientific backing is making exactly the kind of claim the FTC targets.6Federal Trade Commission. Health Products Compliance Guidance
The FTC evaluates the overall impression an advertisement creates, not just its literal text. Medical imagery, clinical-sounding language, before-and-after photos, and client testimonials can all create implied health claims that the advertiser must be able to substantiate. A disclaimer buried at the bottom of a webpage does not cure a misleading headline.
Enforcement consequences include court orders stopping deceptive claims, mandatory corrective advertising, bans on marketing health services, and consumer refunds or civil penalties. In January 2025, the FTC ordered one alternative medicine company to pay more than $5.1 million in refunds and civil penalties for deceptive health marketing.7Federal Trade Commission. Health Claims Liability extends past the practitioner to anyone involved in creating or distributing the advertising, including marketing agencies and endorsers.
The safest approach: describe what cupping involves, cite published research where it exists, and avoid specific claims about curing, treating, or preventing any medical condition unless you have the clinical evidence to back it up. “May help with muscle recovery” is defensible if supported by research. “Eliminates toxins” is not.
Professional Liability Insurance
Professional liability insurance is not legally required in every state, but operating without it is a serious financial gamble. A single malpractice claim from a burn, infection, or allergic reaction can generate defense costs and settlements that would bankrupt most solo practitioners or small clinics.
A standard policy for a cupping practitioner typically bundles malpractice coverage with general liability protection for incidents like slips and falls in the treatment room. Cupping is sometimes included as a standard covered modality under an acupuncture or massage therapy policy, but some insurers treat it as an optional add-on that requires separate election. Confirm in writing that your specific policy covers cupping before relying on it. Annual premiums for massage therapists and acupuncturists generally range from under $100 to around $1,900, depending on coverage limits, location, and modalities covered.
Practitioners who maintain electronic patient records should also consider cyber liability coverage. A data breach involving patient health information triggers notification obligations under HIPAA and state breach notification laws, and response, notification, and regulatory costs add up quickly. Licensing boards, landlords, and insurance networks increasingly require proof of coverage as a condition of doing business, so treat insurance as a non-negotiable operating cost even in states that do not mandate it.