Who Can Legally Operate a Laser at a Med Spa? 2026 Enforcement & Liability Guide

Laser hair removal is the single most-requested treatment at American med spas — and lasers, intense pulsed light (IPL), and other energy-based devices now sit at the center of the industry's biggest legal risk. In 2026, regulators stopped treating unlicensed laser operation as a paperwork problem and started treating it as a crime. Patients are being burned and scarred. Operators are being charged with felonies. Facilities are being cited, fined, and shut down. And malpractice insurers are denying claims when the person holding the handpiece was not authorized to hold it.

The uncomfortable truth for many med spa owners is that the rules around who can legally operate a laser are far stricter than the industry's casual hiring practices suggest. A laser is not a beauty tool. In most states it is a medical device, and firing it into a patient's skin is the practice of medicine. This guide lays out, authoritatively and by state-by-state pattern, exactly who may operate a laser, under what supervision, and what happens when a med spa gets it wrong.

The 2026 Laser Enforcement Wave

For years, the gap between what the law required and what med spas actually did was wide and largely unpoliced. Salons added laser hair removal as a side service. Estheticians fired devices with no physician anywhere in the building. Owners assumed that because a treatment was "cosmetic," it fell outside medical regulation. In 2026, that assumption collided with reality.

The Orlando felony case

In Florida, an Orlando-area woman working at a medical spa without any license was charged with 20 felonies after performing laser procedures she had no legal authority to perform. According to investigators, she performed an Endolaser treatment on a patient's chin; the patient left with burns that blistered and progressed to necrotic tissue. Rather than refer the patient to a physician, she saw the patient several more times trying to correct the damage. The charges included multiple counts of practicing medicine without a license and the unlicensed practice of a health care profession. A tip to investigators had earlier flagged the business for letting someone who was "not a nurse practitioner, physician assistant, dentist, or medical doctor" perform medical treatments.

This is the case the entire industry should be studying. It is not a fine or a warning letter — it is a criminal prosecution built around a single laser treatment performed by an unauthorized person. The American Med Spa Association (AmSpa) and trade press covered it precisely because it signals where enforcement is heading.

New York's statewide crackdown

New York took a systemic approach. On January 8, 2026, the New York Department of State issued a statewide consumer warning after investigators inspected hundreds of businesses advertising "med spa" services. Across the inspection program, the state examined more than 200 facilities and issued dozens of citations for violations including unlicensed medical practice. Inspectors documented unlicensed individuals operating devices used for non-ablative skin lasers, laser tattoo removal, and laser-assisted procedures — alongside expired and suspected counterfeit products, improperly stored controlled substances, and unsanitary needle handling.

The legal hook matters most. New York has made clear that a spa allowing an unlicensed individual to operate a Class IIIb or Class IV device is at risk of being charged with aiding and abetting the unlicensed practice of medicine. That reframes the owner's exposure: it is not just the operator who is breaking the law — the facility that put them in front of the laser is too.

Burns, scarring, and the litigation pipeline

Behind the criminal cases sits a steady stream of civil litigation. Laser burns, hyperpigmentation, hypopigmentation, and permanent scarring are among the most common adverse outcomes in aesthetic medicine, and they generate lawsuits and settlements year after year. Plaintiff attorneys have learned exactly what to subpoena: the operator's credentials, the delegation paperwork, the good-faith exam, the device settings used, and the written protocol that was supposed to govern the treatment. When any of those is missing, the case becomes very hard to defend.

The throughline across all three — criminal, regulatory, and civil — is the same. Regulators and courts are asking one question first: was the person operating this laser legally allowed to, and was a physician actually supervising? Everything in this guide is built around answering that question correctly.

Why Operating a Laser Is the Practice of Medicine

To understand who can operate a laser, you first have to understand why the law treats it as medicine. The logic is consistent across most states.

Energy-based devices alter living tissue

A medical laser works by delivering concentrated energy that is absorbed by a target in the skin — melanin in a hair follicle, hemoglobin in a vessel, water in the dermis, or ink in a tattoo. That energy heats and destroys tissue. Any procedure that penetrates or alters living tissue, or that carries a meaningful risk of injury requiring medical judgment, falls within the definition of the practice of medicine in most state medical practice acts. New York's Education Law (section 6521) defines the practice of medicine broadly as diagnosing, treating, operating on, or prescribing for any human disease, pain, injury, deformity, or physical condition — language wide enough to capture firing a laser into a patient's dermis.

The treatment requires medical judgment

Choosing whether a patient is a safe candidate for a laser is not a cosmetic decision. It requires assessing skin type (Fitzpatrick classification), medication use (isotretinoin, photosensitizers), history of keloids or herpes, recent sun exposure, and realistic outcomes. Selecting device parameters — wavelength, fluence, pulse duration, spot size, cooling — and adjusting them safely demands trained clinical judgment. When that judgment is wrong, the patient is burned. Because the decision is medical, the law requires a medical professional to make it or to delegate it under supervision.

What this means in practice

Because laser treatment is medicine, three things must be true in most states before a beam ever fires: a physician (or, where allowed, an NP/PA) must delegate the procedure; a good-faith exam must establish the patient is an appropriate candidate; and the person operating the device must be authorized and trained to do so within their scope of practice. Skip any one of these, and the treatment is — legally — being performed without the structure the law requires. For the broader framework of medical oversight that wraps around all of this, see our guide to med spa medical director requirements.

Class IIIb vs Class IV: Device Classification and Why It Matters

Regulators increasingly write their rules around laser hazard class, so operators need to understand the terminology — and a common point of confusion.

Two different classification systems

There are two separate "class" systems, and people mix them up constantly. The FDA assigns cosmetic lasers and IPL devices a medical-device class (typically Class II, cleared through 510(k) premarket notification) based on regulatory risk. Separately, lasers carry a safety hazard class — Class I through IV — based on their potential to injure the eye and skin. When New York and other regulators reference "Class IIIb or IV devices," they mean the safety hazard class, not the FDA device class.

What Class IIIb and Class IV mean

• Class IIIb: Output roughly 5 to 500 milliwatts. Can cause eye injury from direct or specular (mirror-like) reflected beam exposure. Hazardous but generally not an immediate skin-burn or fire risk from diffuse reflection.
• Class IV: Output above 500 milliwatts. Can cause severe, permanent eye and skin injury, ignite flammable materials, and produce hazardous diffuse reflections. Most aesthetic treatment lasers — hair removal, ablative and non-ablative resurfacing, tattoo removal — are Class IV.

Why the class drives the rules

The higher the hazard class, the more safety controls the law and recognized standards require: wavelength-specific protective eyewear for everyone in the room, a controlled-access treatment area with warning signage, beam-path management, device interlocks, and a designated Laser Safety Officer. Because nearly every device a med spa uses for active treatment is Class IV, the practical takeaway is simple: assume the strictest tier applies. Regulators who key supervision, registration, and facility rules to "Class IIIb or IV" are, in effect, regulating essentially every meaningful laser in your building.

The Supervision Spectrum: Who Delegates, Who Operates

The most common mistake med spa owners make is collapsing two different roles into one. "Who can operate a laser" actually has two answers, because two distinct functions are involved: delegation and operation.

Who can delegate

Delegation is the act of a licensed prescriber authorizing a treatment and taking medical responsibility for it. In every state, a physician (MD or DO) can delegate laser treatment. In states with broader mid-level scope, a nurse practitioner or physician assistant may also delegate or order laser treatment, sometimes independently and sometimes only under a collaborative or supervisory agreement with a physician. The delegating provider is the one whose license is on the line, and the one who must ensure a good-faith exam was performed.

Who can operate

Operation is the act of actually performing the treatment — holding the handpiece, selecting settings, and firing the device. Who may operate, and under what level of supervision, varies widely:

• Physicians, NPs, and PAs may operate within their scope in essentially every state.
• Registered nurses (RNs) may typically operate under physician delegation and supervision, with the required proximity of that supervision differing by state.
• Licensed estheticians and certified laser technicians may operate in some states under direct or indirect physician supervision, but in other states they may not operate medical lasers at all.
• Unlicensed staff — front desk, medical assistants without specific authorization — generally may not operate medical lasers anywhere.

The supervision proximity question

Even when an operator is authorized, the supervising provider must meet the state's required level of presence. This ranges from on-site supervision (the physician or supervising provider physically present in the facility) to direct supervision (immediately available) to general supervision (reachable, with treatment performed under standing orders). The Florida cases that drew national attention in 2026 frequently involved "remote" physicians who had delegated treatments at facilities they rarely if ever visited — exactly the arrangement regulators are now scrutinizing. Getting the operator right but the supervision proximity wrong is still a violation.

The Good-Faith Exam Requirement

If there is one requirement med spas violate most often, it is the good-faith exam (GFE). It is also the one regulators and plaintiff attorneys look for first.

What a good-faith exam is

A good-faith exam is a medical evaluation of the patient by a licensed provider — physician, NP, or PA, depending on state law — performed before any prescription or medical treatment, including laser procedures, to establish that the patient is an appropriate candidate. It is not a formality. It must include a review of medical history, current medications, relevant contraindications, and the specific risks of the planned treatment, and it must be documented in the chart. The GFE is what creates the provider-patient relationship that makes delegation legitimate.

Who can perform it and when

In most states the GFE must be performed by the delegating provider or another authorized licensed professional — not by the laser operator if that operator is an RN or technician without prescriptive authority. Some states permit the exam to occur via telehealth if it meets the standard of an in-person evaluation; others are tightening that allowance precisely because "remote" exams were being used to paper over absentee supervision. The exam must occur before treatment — a GFE signed after a burn occurs is worthless and, in litigation, actively harmful.

Why skipping it is so dangerous

When a laser patient is injured, the absence of a documented good-faith exam tells a regulator or jury that no medical professional ever determined the patient was safe to treat. It converts an unfortunate outcome into clear evidence of a system that bypassed medical judgment. A properly documented GFE, by contrast, demonstrates that a licensed provider evaluated the patient, identified the risks, and authorized the treatment — which is exactly the structure the law is designed to require.

State-by-State Patterns: Strict, Moderate, and Registration States

Laser regulation is set state by state, and the variation is significant. Rather than memorize 50 statutes, it helps to recognize the patterns. For a broader overview of how the rules differ across the country, see our guide to med spa regulations by state.

Strict states: physician-centric, narrow operator pool

In strict states, only physicians, NPs, PAs, and sometimes RNs may operate lasers, and supervision requirements are demanding. New York is the clearest current example — it treats laser operation as the practice of medicine and is actively prosecuting facilities that let unlicensed people run Class IIIb/IV devices. See our New York laser safety guide for the specifics. In these states, estheticians generally cannot operate medical lasers, and the safest posture is to assume every active device requires a licensed clinical operator under close physician oversight.

Registration states: licensing the facility and the technician

Texas exemplifies the registration model. Laser and laser-device services must be registered with the state, and laser hair removal in particular runs through a structured certification system: facilities must register, designate a Laser Safety Officer, employ a certified laser hair removal professional, and maintain a written contract with a consulting physician. The Texas DSHS radiation-control program oversees laser device registration. Our Texas laser safety guide breaks down the certificate tiers and facility requirements in detail.

Moderate states: delegation with broader operator pools

Many states fall in the middle: laser operation is still delegated medicine, but a wider range of professionals — including trained RNs and, in some cases, estheticians under direct supervision — may operate. Arizona and Georgia illustrate this pattern, where physician delegation and supervision rules govern who may operate but the operator pool is somewhat broader than in the strictest states. Review our Arizona laser safety guide and Georgia laser safety guide for state-specific operator and supervision rules.

The Florida cautionary tale

Florida deserves its own mention because it produced 2026's marquee enforcement case. Florida treats laser procedures as medical, requiring physician involvement and supervision, yet a permissive market and absentee "remote" medical directors created exactly the conditions for the unlicensed-operator disasters now being prosecuted. Our Florida laser safety guide covers the state's requirements and the supervision gaps that regulators are closing. The lesson Florida teaches every state: a permissive-looking market is not the same as a legal one, and enforcement can arrive suddenly.

The Laser Safety Officer and Facility Requirements

Beyond who operates the device, the law and recognized standards regulate the environment in which lasers are used.

What a Laser Safety Officer does

A Laser Safety Officer (LSO) is the individual responsible for overseeing a facility's laser safety program. The LSO's duties include maintaining hazard controls, ensuring appropriate protective eyewear is available and used, managing controlled access to treatment rooms, overseeing device maintenance and calibration logs, training staff on safe operation, and leading incident response when an adverse event occurs. The widely followed ANSI Z136 laser safety standards — which inspectors and plaintiff experts treat as the benchmark of reasonable care — call for a designated LSO wherever Class IIIb or IV lasers are in use.

Where an LSO is legally required

Texas explicitly requires a designated LSO for registered laser hair removal facilities, with qualifications that include laser-radiation-safety education, familiarity with the devices in use, and knowledge of laser hazards and emergency situations. Even in states that do not name an LSO by statute, designating one is a low-cost, high-value step: it demonstrates that your facility meets the recognized standard of care, and it gives you a single accountable person for the safety program that protects both patients and the practice.

Facility and environmental controls

A defensible laser facility maintains, at minimum: wavelength-appropriate protective eyewear for the operator, patient, and anyone else in the room; signage and controlled access during treatment; device maintenance, calibration, and service records; logs tracking which device was used at which settings for each patient; and written emergency procedures for burns and ocular injuries. These controls are not bureaucratic overhead — each one is a piece of evidence that, after an adverse event, shows you ran a safe program.

The Liability of Getting It Wrong: Criminal, Civil, and Board

The cost of non-compliance comes in four distinct forms, and a single bad outcome can trigger all of them at once.

Criminal liability

This is the newest and most alarming exposure. When an unlicensed or unauthorized person operates a laser, the operator can be charged with the unlicensed practice of medicine — a serious crime, charged as a felony in the Orlando case. Critically, the facility and its owners can also face criminal exposure for aiding and abetting the unlicensed practice of medicine, the theory New York has adopted. A business owner who hires an unlicensed technician to run a Class IV laser is not a bystander in the eyes of these regulators.

Civil liability

Burns, scarring, and pigment changes drive malpractice and personal-injury suits. In civil litigation, the plaintiff's attorney builds the case around the documentation gaps: no good-faith exam, no written protocol, an unauthorized operator, no record of device settings. Each gap is presented as proof that the practice fell below the standard of care. Settlements and verdicts in laser-injury cases can be substantial, and they fall on the practice and, potentially, its owners personally.

Regulatory and board action

State agencies can inspect, cite, fine, and order a facility to cease operations — as New York's inspection program demonstrated. Separately, the supervising physician's license is at risk: medical boards can discipline a physician for inadequate or absentee delegation, including signing off on treatments at facilities they do not actually oversee. A medical director facing board discipline will withdraw immediately, leaving the practice unable to legally operate.

Insurance denial

The financial backstop most owners assume they have often is not there. Malpractice carriers routinely exclude coverage for incidents where the treatment was performed by an unauthorized person or without a written protocol. When the operator was unlicensed, the insurer can deny the claim outright, leaving the business and its owners to pay the judgment themselves. For a deeper look at how this exposure flows through to the physician overseeing the practice, see our analysis of medical director requirements and oversight obligations.

Building a Defensible Laser-Operation Program

The good news: every risk above is addressable with a documented program. A defensible laser-operation program has a small number of essential components, all of which should be written, signed, and followed.

Map your operators to your state's rules

Start with a scope-of-practice matrix: list every laser and energy-based device you use, and for each, document who is legally authorized to operate it in your state, what supervision level is required, and which provider delegates it. Verify and track the license or certification of every operator. This single document answers the regulator's first question before they ask it.

Lock in delegation and the good-faith exam

Put your delegation relationship in writing through standing orders signed by the delegating physician (or NP/PA where permitted), and require a documented good-faith exam before every course of laser treatment. Build the GFE into your intake workflow so a treatment cannot proceed without it. These two documents — delegation and GFE — are the backbone of legitimacy.

Standardize the treatment itself

Each laser service needs a written SOP covering candidate selection and contraindications, test spots where appropriate, device-parameter ranges, step-by-step technique, post-treatment care, and adverse-event recognition and management. When every operator follows the same protocol, outcomes are consistent and, if an injury occurs, you can show exactly what the standard was. If you are starting from scratch, building these from a vetted foundation is dramatically faster than drafting them yourself.

Documentation and Training Your Med Spa Needs

A laser program is only as defensible as the paper trail behind it. Here is the documentation set every laser-offering med spa should maintain.

The core document set

• Laser-operation SOPs for each device and service, signed by the medical director.
• Delegation and supervision agreements with standing orders specifying who may operate under what oversight.
• Good-faith exam and informed-consent forms completed and charted before treatment.
• Scope-of-practice matrix and license-verification records for every operator.
• Laser Safety Officer designation and safety program, including eyewear and access controls.
• Device maintenance, calibration, and per-patient settings logs.
• Adverse-event and burn-management protocols with a referral pathway to a physician.

Training and competency

Authorization on paper is not enough — operators must be trained and their competency documented. Require manufacturer or accredited device training before any new operator treats independently, document a competency assessment, and keep records of continuing education. After an injury, the difference between "we hired someone and handed them the laser" and "we trained, tested, and documented every operator" is often the difference between a defensible case and an indefensible one.

The fastest compliant path

Most compliant med spas do not write all of this from a blank page. They start with professionally written, physician-reviewable SOPs and templates — laser-operation protocols, delegation and supervision forms, good-faith-exam and consent documents, and LSO checklists — and have their medical director review, customize, and sign them for their specific devices and state. That turns a months-long project into a one-to-two-week one, and it is exactly the documentation regulators and insurers expect to see.

Laser hair removal and energy-based treatments are not going anywhere — they remain the most in-demand services in aesthetics. But the era of treating them as casual beauty services is over. In 2026, the line between a thriving laser practice and a felony case is the answer to one question: can you prove the right person operated the device, under the right supervision, with a good-faith exam on file? Build the program that lets you answer yes.