Who May Operate an Energy Device in a Med Spa
Published September 24, 2026 · 6 minute read · General information, not legal advice. Your licensing regulators decide what applies to you.
Device brochures call their products "cosmetic," "non-invasive," or "no downtime." None of those words settles who may operate the device.
This guide covers lasers, IPL, radiofrequency (including RF microneedling), HIFU and other focused ultrasound, cavitation, cryolipolysis, and electromagnetic muscle stimulation. It lists what a practice needs to verify for each device and what paperwork a device service should carry.
Who decides
Who may operate an energy device, under what level of supervision, and after what training is decided by the bodies that license the people involved: your nursing and medical regulators, and whichever regulator licenses estheticians or cosmetologists where you practice.
Some jurisdictions also register lasers or IPL devices, or license the people who operate them, through a radiation control program or health department that sits apart from the professional regulators. The regulator directory lists those programs outside the US, along with the US federal device agency.
The manufacturer, the distributor, and the trainer who installed the device do not decide it. A training certificate from a device company is a record that training happened. It is not a scope of practice determination.
What to verify for each device
Run through these per device, not per category. Two RF devices can be classified differently and have different answers.
Classification and intended use. Record the device's classification and the intended use and indications in its regulatory documentation (in the US, confirm clearance in the FDA device database). File a copy. Use outside the device's stated indications is a prescriber decision. Record it as one, make sure consent covers it, confirm your insurer covers it, and keep it out of marketing claims.
Who may operate it where you practice. For each device and each procedure you plan to offer on it, record what your regulators say about which license types may perform it. Record the source, the date you checked, and who checked. If the answer depends on how invasive the procedure is (depth, whether the skin is broken, or whether the procedure is ablative), note which version of the procedure you are asking about.
Supervision level. Whether a prescriber needs to be on site, reachable, or has only to have authorized the protocol is also a question for your regulators. Record the answer per device and per operator license type, using the terms explained in what medical director supervision means.
Training record. What training each operator completed, from whom, on what date, and who observed them treating before they worked alone. Manufacturer training is one line in that record.
Who authorizes treatment parameters. Every device has settings. Someone has to decide, in writing, which parameters are used for which skin types, indications, and patient factors, and what the operator does when a patient falls outside those. That person is whoever your regulators recognize as authorized to set parameters for that procedure (in a delegated arrangement, the accountable prescriber). It is never the device representative. A parameter sheet left behind by a device representative can be a starting point for the prescriber's review.
The records a device service needs
These are the documents a reviewer, an insurer, or a new operator would expect to find for each device the practice runs.
Device register. One entry per device: make, model, serial number, classification, intended use and indications, date acquired, location, any registration number issued by a licensing authority, and the date the register was last checked against the room.
Per-operator training record. For each operator and each device: training source and date, supervised treatments with the observer's name, the date they were signed off to operate independently, who signed, and the revalidation date.
Treatment record. Per encounter: device, handpiece, the parameters used, the area treated, skin assessment, test spot where the protocol calls for one, patient response, and any deviation from the authorized parameters with the reason.
Safety officer designation. For lasers and IPL, where required, a named person responsible for laser safety in the practice, with the date of designation, their training, and what they are responsible for. Whether the role is required, and what training it needs, depends on the jurisdiction.
Eyewear and controlled-area records. Which eyewear goes with which device and wavelength, where it is kept, inspection dates, and how the treatment room is controlled during use (signage, door, windows, and who may be present).
Service and calibration log. Every service visit, calibration, repair, and software update, with the date, who performed it, and what was done. If a device has missed a service on the manufacturer's schedule, check it against the service log before the device is used again.
Adverse event record. Burns, pigment changes, blistering, eye exposures, and anything else that went wrong, with the patient's care afterward, who was notified, and what changed in the protocol as a result. Some events may also need reporting to the manufacturer or a regulator, which is part of what to verify.
Where practices go wrong
The usual pattern is that a device arrives, the device representative trains whoever is available, the practice uses the representative's settings, and the device goes on the menu the following week. Nobody checked whether the operator's license covers the procedure where the practice sits, the prescriber never saw the parameters, and the only record of training is a certificate in a drawer.
The fix is mostly a matter of order. Verify first, then have the prescriber authorize the protocol and parameters, then train and sign off operators against that protocol, and only then book patients.
The same sequence applies when something changes. A new handpiece, a software update that adds treatment modes, a new indication the practice wants to offer, or a new operator with a different license type each reopens the verification. Record the change in the device register, check whether the answers you recorded still hold, and have the prescriber sign any revised parameters before the change reaches a patient. Mark old parameter sheets as superseded and keep them, so the treatment records made under them can still be read against the version that applied at the time.
A telehealth platform used for another service line will not cover device services unless its contract says so, so check what a telehealth prescriber covers before relying on one. What a medical director is accountable for covers the prescriber's role in authorizing parameters.
The records described here are in the Energy Device Operations Module and the device treatment records.
This week
- Write a register entry for each device you own, including its classification and the date you last checked it against the room.
- For one device, find out who set the parameters in use today and whether a prescriber has signed them.
- Check each operator's training record for the observer's name and the date they were signed off to operate independently.
- Pull the service log for each device and compare the last service date with the manufacturer's schedule.
- Energy Device Operations Module, $29
- Laser and IPL Safety Add-on, $14
- Laser, IPL and RF Microneedling Treatment Record, $9
Questions this guide answers
Can a nurse or esthetician operate a laser in a med spa?
It depends on the device, the procedure, and your jurisdiction. Who may operate a device, under what supervision, and after what training is set by your licensing regulators and, for some devices, a separate radiation or device licensing authority, not by the manufacturer.
Is RF microneedling a cosmetic or a medical procedure?
The label on the brochure does not decide it. Whether a procedure is treated as the practice of medicine or nursing is a question for your regulators, and the answer can differ between device types and between places.
What records does a med spa need for a laser or IPL device?
A complete device file usually includes a device register, a training record per operator, a treatment record per encounter, a laser safety officer designation, eyewear and controlled-area records, a service and calibration log, and an adverse event record. Whether a safety officer is required depends on the jurisdiction.