Med Spa Staff Training Checklist: What Every New Hire Needs Before Opening Day (2026)
Last updated: October 8, 2026
Opening a medical spa means hiring injectors, nurses, aestheticians, device operators and front-desk staff, often all in the same month. Some of the training they need is required by federal OSHA rules that apply to every workplace with blood, chemicals or emergency exits. Some depends on your state. And a surprising amount has to be built around your own clinic: your exposure control plan, your devices, and your medical director’s written protocols. This checklist walks through each piece in plain language, with links to the official sources, and ends with a table you can work from.
The federal basics, and what has to be specific to your clinic
Bloodborne pathogens
Any employee whose job could expose them to blood or other potentially infectious materials needs bloodborne pathogens training when they are first assigned that work and at least once a year after that, within a year of their last training. Under 29 CFR 1910.1030(g)(2), the training must include “an explanation of the employer’s exposure control plan and the means by which the employee can obtain a copy,” and “an opportunity for interactive questions and answers with the person conducting the training session.” The person conducting it must know the subject “as it relates to the workplace that the training will address.”
That is why a generic online video does not meet the rule on its own. It cannot explain your plan, and it cannot answer questions. OSHA addressed computer-based training directly in a June 26, 2003 letter: “A qualified trainer must be immediately available to employees regardless of whether questions are actually asked.” Online lessons can carry the content; someone qualified still has to be on hand for questions while staff take them.
Keep training records for three years, showing the dates, a summary of the content, the trainers’ names and qualifications, and the names and job titles of everyone who attended. Review and update the exposure control plan itself at least once a year.
Hazard communication
Peels, disinfectants and other chemicals bring OSHA’s hazard communication standard into play. Employees who work with hazardous chemicals must be trained when they start and whenever a new chemical hazard is introduced, including how to read labels and safety data sheets. You also need a written hazard communication program.
Emergencies and fire
OSHA requires an emergency action plan and a fire prevention plan when one of its other standards calls for them. With 10 or fewer employees, a plan can be communicated orally. Review the emergency plan with each employee when they start, when their duties under it change, and when the plan changes. If you provide fire extinguishers for staff to use, 1910.157(g) requires training on using them when people start and at least every year.
Protective equipment
Anyone who wears personal protective equipment must be trained before they use it, and retrained when the equipment or the job changes, under 1910.132(f). That includes eye protection around lasers and intense light devices.
Privacy and client records
Whether HIPAA applies depends on how your clinic operates. CMS explains that “providers who submit HIPAA transactions, like claims, electronically are covered” (CMS: Are you a covered entity?). A cash-only med spa that never bills insurance electronically may not be a HIPAA covered entity. If you are covered, HIPAA requires privacy training for your whole workforce. Either way, your state may have its own medical or consumer privacy laws, so ask your attorney which ones reach your clinic, and train every staff member who sees client information on how you protect it.
Laser and device safety
There is no dedicated OSHA laser standard for clinics. OSHA’s own Technical Manual says “OSHA does not have a comprehensive laser standard.” Instead, OSHA cites laser hazards under the General Duty Clause or its protective equipment rules, and employers are then expected to follow industry consensus standards such as ANSI Z136.1. OSHA lists ANSI Z136.3, the standard for safe use of lasers in health care, among the voluntary consensus standards it points to, while noting these are not OSHA regulations.
The Technical Manual describes a laser safety officer with “the authority to monitor and enforce the control of laser hazards,” and says training in laser safety is required for Class IIIB and Class IV laser installations. In practice, that means device-specific training for every operator, and a named person who owns laser safety.
Some states add their own rules. Texas, for example, registers businesses that use Class 3B and 4 lasers for medical use, and registration asks for the laser safety officer’s information. In Illinois, a joint state memo says the use of lasers is the practice of medicine, and anyone delegated laser or light-based procedures must have “appropriate, documented training and education in the safe and effective use of each system.”
Supervision and delegation depend on your state
Who may inject, who may run a device, and who must be in the building are state questions, and the answers differ a lot. A few examples:
- New Mexico. The Medical Board’s rule (16.10.13 NMAC) limits medical assistants to non-incisive, non-ablative devices, only after certification on each device and only when the supervising physician is immediately available on the premises. The physician writes the protocol the assistant follows, and cosmetic injections “shall not be delegated to medical assistants.”
- Oklahoma. The Board of Nursing’s aesthetic procedures guideline says a nurse needs an individualized order and a completed history and physical, and that “standing orders are not an appropriate substitute.” It also says businesses “shall establish and maintain policies and procedures on-site” for the procedures and for emergency interventions.
- Illinois. The same joint memo treats Botox, chemical peels beyond superficial ones, microneedling and radio frequency as the practice of medicine, outside an esthetician’s scope.
- Rhode Island. The medical spa law (R.I. Gen. Laws § 23-105-2) requires a medical director who keeps written protocols for each cosmetic procedure on site for the health department to inspect.
The common thread: your medical director’s written protocols set who does what, and your staff need to be trained on them, by name and by version, before they treat clients. When a protocol changes, the training changes with it.
What changed in 2025 and 2026
| Where | When | What changed |
|---|---|---|
| Texas | Effective September 1, 2025 | Elective IV therapy may be delegated only to a physician assistant, advanced practice registered nurse or registered nurse acting under adequate physician supervision (HB 3749, “Jenifer’s Law”). |
| Rhode Island | Effective June 30, 2025 | Medical spas need a medical director, written protocols kept on site, and a medical director whose training is not only a device maker’s program (§ 23-105-2). |
| California | Signed October 6, 2025 | Private equity groups and hedge funds that invest in a medical practice may not interfere with or control its doctors’ health care decisions (SB 351; Governor’s signing list, author’s summary). |
| Illinois | Memo updated October 30, 2025 | Lists procedures that are the practice of medicine and limits med spa ownership to physicians, and for some services APRNs (IDFPR and IDPH memo). |
| New York | Announced January 8, 2026 | The Department of State reported 223 businesses inspected and 87 cited for possible violations, including the unlawful practice of medicine (NY Department of State). |
| Florida | March 13, 2026 | SB 1728, on licensing medical spas, died in the Senate Health Policy committee (Florida Senate). |
| Oklahoma | Approved March 24, 2026 | Board of Nursing guideline: individualized orders and a completed history and physical for aesthetic procedures; standing orders are not a substitute (guideline P-25). |
| Federal (FDA) | April 1, 2026 | A warning letter to a Southlake, Texas med spa found it “dispensed significantly more Botox units than documented purchases” from the manufacturer (FDA warning letter). |
| Indiana | From January 1, 2027 | State registration for medical spas opens under Senate Bill 282 (Indiana Professional Licensing Agency). |
The checklist
Where a column says “good practice,” the federal rule does not require that record, but it is the one you will want when someone asks.
| Training | Who needs it | When | Records to keep |
|---|---|---|---|
| Bloodborne pathogens, built on your exposure control plan | Everyone with possible exposure to blood | Before exposure tasks, then within a year of the last training | Dates, content summary, trainer names and qualifications, attendee names and job titles; keep 3 years |
| Hazard communication | Everyone who works with hazardous chemicals | At hire and when a new chemical hazard arrives | Written program; dated training record is good practice |
| Emergency action and fire plans | Everyone the plan covers | At hire, when duties change, when the plan changes | The plan (written if more than 10 employees); dated review record is good practice |
| Fire extinguisher use | Staff expected to use extinguishers you provide | At hire and every year | Dated training record is good practice |
| Protective equipment | Everyone who wears it | Before first use; again when gear or tasks change | Written hazard assessment; dated training record is good practice |
| Privacy and client records | Everyone who sees client information | At hire and when policies change | Documented training if HIPAA applies; good practice either way |
| Laser and device safety | Every device operator, per device | Before first use of each device | Device-specific training record; check your state’s rules |
| Supervision and written protocols | All clinical staff | Before treating clients; again when a protocol changes | Who trained on which protocol version, and when |
| Responding to an adverse reaction | All clinical staff | Before treating clients; refresh yearly | Dated record with a knowledge check is good practice |
| Booking, consultations and scripts | Front-desk staff | At hire | Dated record is good practice |
Build the lesson library from your own procedures
Most of this list cannot be bought off the shelf because it is about your clinic: your exposure control plan, your devices, your medical director’s protocols, and how your front desk handles a consultation. The fastest way to cover it is to turn the documents you already have into short lessons with a knowledge check, so each new hire learns the same thing the same way, and you can see who has finished what.
That is what we build at Lasso Learn. Send us your procedures, handbook and device manuals, and we turn them into interactive lessons in days. Staff take them on their own phones by QR code or PIN, in English or Spanish, and every completion is recorded with a date, score and certificate, so the record is ready for an inspector. See med spa new-hire training.
About this article
This is general information as of October 8, 2026, not legal advice. Rules for medical spas vary by state and are changing quickly. Check your own state’s requirements with your medical director and your attorney before you rely on any of it.
