(a) After notice and opportunity for hearing, the secretary of state may deny an application for a certificate of registration, or may permanently revoke a health spa operator’s certificate of registration, on a finding by the secretary that the applicant or certificate holder:
(1) provided false information on an application or other document filed with the secretary;
(2) failed to file or post, or maintain, the security for each health spa location as required by Subchapter D; or
(3) failed to provide the contract disclosure language required by Subchapter G.
(b) The secretary of state may permanently revoke a certificate of registration under Subsection (a) based on the certificate holder’s failure to maintain the required security only after a finding by the secretary that, within the 30-day period following the cancellation or lapse of the security, the certificate holder failed to file or post replacement security in the required amount.