Navigating the Perilous Waters: Anti-Kickback and Stark Law Compliance for Telehealth Referral Models in 2025-2026

2026-07-20

As telehealth models mature, the act of referring a patient can trigger liability under the federal Anti-Kickback Statute and the Stark Law. This guide explains how both laws apply to virtual care referral arrangements, the safe harbors and exceptions that matter, and the warning signs OIG has named for telemedicine arrangements.

The rapid ascent of telehealth has changed how care is delivered, offering new access and convenience. Yet, as virtual care models evolve beyond their initial emergency authorizations into multi-state operations, the foundational pillars of healthcare compliance, particularly the Anti-Kickback Statute (AKS) and the Stark Law, remain firmly in place, presenting real challenges for founders, operators, and investors. Patient referrals in a digital model invite regulatory scrutiny, and they demand a clear understanding of how these laws apply to everything from co-marketing agreements to integrated ancillary services.

> For more on this topic, see our analysis: The Razor's Edge: Navigating Telehealth Controlled Substance Prescribing in 2025-2026.

This article is a guide for telehealth platforms, practice groups that bill federal health care programs, and the laboratories, pharmacies, equipment suppliers and marketing vendors they contract with, on managing the risks in referral arrangements. Ignoring these rules exposes a business to criminal, civil and administrative penalties.

The Immutable Mandates: Anti-Kickback Statute and Stark Law

To navigate telehealth referral compliance, it is essential to first grasp the core tenets of the two primary federal laws governing financial relationships in healthcare: the Anti-Kickback Statute and the Stark Law.

The Anti-Kickback Statute (AKS): 42 U.S.C. § 1320a-7b(b)

Enacted to protect patients and federal healthcare programs from fraud and abuse, the AKS is a broad criminal statute that prohibits the knowing and willful offer, payment, solicitation, or receipt of any remuneration to induce or reward referrals for items or services reimbursable by a federal healthcare program (e.g., Medicare, Medicaid, TRICARE). Its scope is vast, extending to virtually any arrangement where payment is made to induce referrals.

Intent Requirement: A crucial element of an AKS violation is the intent to induce or reward referrals. Even if other legitimate purposes exist for the remuneration, if one purpose is to induce referrals, the statute can be violated. The statute also provides that a person need not have actual knowledge of the AKS or specific intent to violate it (42 U.S.C. § 1320a-7b(h)).
“Remuneration” Broadly Defined: This includes anything of value: cash, free rent, excessive compensation for services, lavish meals, or even subtle benefits. The DOJ case against a Brooklyn adult daycare owner, sentenced for a $3.2 million Medicaid fraud and illegal kickback scheme involving cash bribes for enrollment and billing for services not provided, is a reminder that schemes built on patient inducements and fraudulent billing can end in federal prosecution, imprisonment, restitution and forfeiture.
Penalties: Each violation is a felony punishable by a fine of up to $100,000, up to 10 years in prison, or both (42 U.S.C. § 1320a-7b(b)), and can lead to exclusion from federal healthcare programs. A claim that includes items or services resulting from an AKS violation is a false or fraudulent claim under the False Claims Act (42 U.S.C. § 1320a-7b(g)). Civil monetary penalties can also be imposed.

#### AKS Safe Harbors: Navigating the Permissible

The Office of Inspector General (OIG) has established regulatory safe harbors (42 C.F.R. § 1001.952) that, if all conditions are met, protect certain arrangements from AKS enforcement. Every element of a safe harbor must be met for protection. Key safe harbors relevant to telehealth referral models include:

Employees (§ 1001.952(i)): Amounts paid by an employer to a bona fide employee for furnishing covered items or services.
Personal Services and Management Contracts (§ 1001.952(d)): Among other conditions, the agreement must be in writing and cover the services, and the compensation methodology must be set in advance, consistent with fair market value in arm's-length transactions, and not determined in a manner that takes into account the volume or value of referrals or other business generated between the parties.
Electronic Health Records Items and Services (§ 1001.952(y)): Protects certain arrangements involving the donation of EHR software and services, under strict conditions.
Cybersecurity Technology and Related Services (§ 1001.952(jj)): Added by OIG's final rule published December 2, 2020 (85 FR 77684), effective January 19, 2021, protecting certain donations of cybersecurity technology and services.

The Stark Law: 42 U.S.C. § 1395nn

The Stark Law, or Physician Self-Referral Law, is a strict liability statute (intent is not required for a violation) that prohibits a physician from referring patients for "designated health services" (DHS) payable by Medicare to an entity with which the physician or an immediate family member has a "financial relationship," unless an exception applies. It also prohibits the entity from billing Medicare for services furnished under a prohibited referral.

Designated Health Services (DHS): Defined at 42 C.F.R. § 411.351: clinical laboratory services; physical therapy, occupational therapy and outpatient speech-language pathology services; radiology and certain other imaging services; radiation therapy services and supplies; durable medical equipment and supplies; parenteral and enteral nutrients, equipment and supplies; prosthetics, orthotics, and prosthetic devices and supplies; home health services; outpatient prescription drugs; and inpatient and outpatient hospital services. Many telehealth models generate orders for these services.
Financial Relationship: Encompasses both ownership/investment interests and compensation arrangements.
Strict Liability: The absence of intent to defraud is not a defense.
Penalties: Payment is denied for services furnished under a prohibited referral, and amounts collected must be refunded. Billing for a service the person knows or should know was referred in violation carries a civil money penalty of up to $15,000 per service, and a circumvention scheme such as a cross-referral arrangement carries up to $100,000 per arrangement (42 U.S.C. § 1395nn(g)).

#### Stark Law Exceptions: Carving Out Legitimate Arrangements

Like AKS safe harbors, Stark exceptions must be met precisely. Unlike a safe harbor, though, a Stark exception is not optional: if a financial relationship exists and no exception is fully met, the referral is prohibited regardless of intent. Relevant exceptions for telehealth often include:

In-Office Ancillary Services (42 U.S.C. § 1395nn(b)(2)): Allows physicians to refer for certain DHS (like lab tests or imaging) when the services are personally performed or supervised by the referring physician or another physician in the same group practice, furnished in qualifying locations, and billed by the physician, the group, or an entity wholly owned by them. Durable medical equipment (other than infusion pumps) and parenteral and enteral nutrients are excluded. This is difficult for multi-state telehealth, where the ordering physician is often far from the place the service is furnished: the location, supervision and billing conditions must each be satisfied for every referred service, and a virtual "group" that does not meet the group practice definition cannot rely on the exception at all.
Bona Fide Employment Relationships (§ 1395nn(e)(2)): Protects compensation paid to physician employees when the conditions of the exception, including fair market value and no compensation tied to the volume or value of referrals, are met.
Personal Service Arrangements (§ 1395nn(e)(3)): Protects independent contractor arrangements that are set out in writing, signed by the parties and specify the services; last at least one year; and pay compensation that is set in advance, does not exceed fair market value, and is not determined in a manner that takes into account the volume or value of referrals.

Where Telehealth Referral Models Go Wrong

On July 20, 2022, OIG issued a Special Fraud Alert warning practitioners to use caution before entering arrangements with "purported telemedicine companies." OIG described schemes in which companies paid physicians and nonphysician practitioners to order or prescribe durable medical equipment, genetic testing, wound care items or prescription medications for patients they had little or no interaction with and without regard to medical necessity. The alert lists suspect characteristics, which OIG says are illustrative and not exhaustive:

Patients are identified or recruited by the telemedicine company, a telemarketing company, sales agents, call centers, health fairs, or internet, television or social media advertising for free or low out-of-pocket cost items or services.
The practitioner does not have sufficient contact with or information from the patient to meaningfully assess the medical necessity of what is ordered or prescribed.
The company pays the practitioner based on the volume of items or services ordered or prescribed, sometimes described as payment per medical record reviewed.
The company furnishes items and services only to federal health care program beneficiaries and accepts no other insurance.
The company claims to serve only patients who are not federal program beneficiaries but may in fact bill federal programs.
The company furnishes only one product or a single class of products, restricting the practitioner's treatment options to a predetermined course.
The company does not expect practitioners to follow up with patients, nor does it give them the information needed to do so.

OIG also notes that practitioners can be personally liable for submitting or causing the submission of claims for medically unnecessary items they ordered.

A second federal statute reaches beyond federal programs. The Eliminating Kickbacks in Recovery Act (18 U.S.C. § 220) makes it a crime to solicit, receive, pay or offer remuneration for referrals to a recovery home, clinical treatment facility or laboratory, with respect to services covered by a health care benefit program, which can include private insurance. Penalties are up to $200,000, up to 10 years in prison, or both, for each occurrence. A telehealth practice that orders laboratory testing should review its lab relationships under both statutes.

Building a Defensible Referral Model

For a telehealth platform or practice group, the practical controls follow from the rules above:

Map every financial relationship. List each arrangement between your clinicians, the clinical entity, the management company, and any lab, pharmacy, equipment supplier or marketing vendor. A relationship you have not mapped is one you cannot test against a safe harbor or exception.
Pay clinicians for their work, not their orders. Compensation per consult or per hour, set in advance and consistent with fair market value, is far easier to defend. Compensation per prescription, per order or per record reviewed is the pattern OIG flagged.
Keep clinical judgment with the clinician. No protocol, script or software default should steer a clinician to a single product or vendor. Clinicians should have enough information, and enough contact with the patient, to decide whether an item is medically necessary, and should be able to follow up.
Document fair market value. Keep written agreements, signed before services begin, with the support for how each fee was set.
Separate marketing from referrals. Paying a marketer per patient referred for items or services payable by a federal program is a classic AKS risk; volume-based marketing fees deserve review by counsel before launch.
Audit and correct. Review arrangements at least annually and whenever the business model changes, and fix any arrangement that no longer meets every element of its safe harbor or exception.

Scope Your Program

AKS and Stark questions are fact-specific, and many states add their own anti-kickback, self-referral and fee-splitting rules on top of the federal framework. If you are designing or expanding a telehealth referral model and want the clinical and compliance structure built around these rules from the start, scope your program with TrueEval.