Georgia Expanded Its Cosmetic-Device Rules. My Op-Ed on Why a Definition Isn't Enforcement

Georgia's 2026 rule changes expanded the Composite Medical Board's definition of cosmetic laser services to explicitly include radiofrequency, ultrasound, cryolipolysis, and microwave-based devices, placing them alongside injectables within the practice of medicine. On paper, this closes a real gap. In practice, I do not think it changes very much for patients unless the state also changes how it enforces the rule and how practices are required to disclose their compliance with it. A definition is necessary. It is not sufficient. This piece is about the distance between the two.

Why the expanded definition was necessary

Energy-based devices have been marketed for years with a kind of implicit safety halo — no needle, therefore lower stakes, therefore appropriate for a broader range of operators. That framing was always misleading. Radiofrequency and ultrasound devices can cause burns, scarring, and pigment change when used by someone without the training to select settings for a given skin type, depth, and indication. Cryolipolysis carries its own recognized complications, including a rare but real risk of paradoxical adipose hyperplasia, an outcome that requires surgical correction and that a poorly trained operator would not be positioned to recognize early or explain honestly. Bringing these modalities explicitly under medical-board oversight acknowledges what should have been obvious: the energy delivered to tissue does not become lower-risk because there is no needle involved.

I have watched this gap operate in practice for years. A patient would ask me why a competing med spa could offer a radiofrequency skin-tightening package at a fraction of the price I quote, and the honest answer was often that the other practice was not budgeting for physician oversight, complication management, or the training time it takes to use these devices safely across the full range of Fitzpatrick skin types. The old ambiguity in the law made that price difference look like ordinary market competition. It was not. It was, in a meaningful number of cases, one practice absorbing a cost the other had simply chosen not to pay.

Where I think the rule change falls short on its own

A definition is not an enforcement mechanism. Georgia has not, to my knowledge, paired this expanded scope with a public-facing way for patients to verify, at the point of booking, whether a given med spa's device operation is actually structured the way the rule now requires. Patients are left to do the verification work themselves — asking who is medically responsible, who trained the operator, and how supervision actually functions after hours — with no simple way to confirm the answers against a state record. Compare this to how license verification already works for individual clinicians: a patient can look up a physician's license status in a few seconds through the board's public tool. There is no equivalent for confirming that a given practice's energy-device program is actually supervised the way the rule describes.

I would rather see the state pair this kind of scope expansion with something patients can actually use: a searchable registry of practices attesting to physician oversight for energy-device procedures, similar in spirit to license verification tools that already exist for individual clinicians. Right now the burden of verification sits entirely on the patient, at exactly the moment — mid-consultation, under some sales pressure, often after a deposit has already been discussed — when they are least equipped to do it well. Asking a patient to interrogate a sales-oriented consultation the way a compliance auditor would is not a realistic expectation, and regulators should not design a framework that depends on it.

The practices this rule will not touch

A clearer legal definition changes behavior at practices that intend to comply and were operating in a genuinely ambiguous space. It does very little, on its own, to change behavior at practices that were already operating outside the rules and simply were not being checked. Those practices do not need a new definition to know they are non-compliant — they need an inspection, a complaint that gets investigated, or a licensing action that actually happens. Until enforcement capacity keeps pace with the expanded definition, the rule mainly formalizes an expectation for practices that were already trying to meet it, while leaving the practices most likely to cause harm essentially untouched until a patient is hurt badly enough to generate a complaint.

This is not a criticism unique to Georgia. Every state that has tightened medical-spa oversight in the last decade has run into the same structural problem: writing a clearer rule is comparatively cheap; funding the inspectors, investigators, and licensing staff to enforce it consistently is comparatively expensive, and legislatures tend to fund the cheap half of the problem more readily than the expensive half.

What I would want the next phase of this rule to include

First, a public attestation or registry requirement, so that a patient can confirm, without relying entirely on a sales conversation, that a specific practice has a named physician accepting responsibility for its energy-device program. Second, a complaint-response benchmark — a public commitment to investigate reported violations within a defined window, so that a complaint does not simply disappear into a queue with no visibility. Third, meaningful penalties tied to unsupervised operation of these devices, calibrated so that the cost of non-compliance is not simply absorbed as a rounding error against the revenue a practice earns by skipping physician oversight.

None of this requires reopening the definitional question the board just settled. It requires the next legislative or regulatory cycle to treat enforcement funding as part of the same safety project as the definition itself, rather than as a separate line item that competes with it for attention and gets deprioritized once the headline rule change has already been announced.

Why I still think this is good news for patients

I do not want the critique above to read as dismissal. A clear definition matters even without perfect enforcement, because it changes the baseline conversation. Before this rule, a practice could argue in good faith that energy-based devices existed in a genuine gray zone. That argument is no longer available. It gives compliant practices a clearer standard to point to, gives patients a clearer question to ask, and gives future enforcement action a clearer legal foundation to stand on when it does happen. The definition is the necessary first step. It is simply not the last one, and I do not think the industry or the state should treat it as though it were.

My bottom line

I support the expanded definition without reservation — it reflects the actual risk profile of these devices. But a definition that patients cannot verify and that regulators do not actively enforce is a floor, not a solution. Until Georgia gives patients a direct way to check compliance and gives itself the capacity to act on violations, the practical safety of a given appointment still depends on how carefully that individual patient asks the right questions, which is exactly the burden a good regulatory framework is supposed to lift off the patient's shoulders.

For the practical, patient-facing version of this — the specific questions I would ask before treatment — see my companion article on choosing a Georgia med spa. This piece is about what the state still owes patients beyond the definition itself.

— Dr. Iryna Lazuk, MD, Lazuk Esthetics, Alpharetta, Georgia