Navigating the Golden State: California's Complex Healthcare Regulatory Landscape for Telehealth and Medspas

TrueEval

State SpotlightApril 17, 2026

California, a beacon of innovation, also presents one of the nation's most intricate healthcare regulatory environments. For telehealth platforms, medspas, and expanding practices, understanding the Golden State's strict Corporate Practice of Medicine, evolving telehealth rules, and robust enforcement is not merely advisable—it's essential for survival.

11 min read8 views

California's healthcare market is both a land of opportunity and a labyrinth of stringent regulations. For any healthcare enterprise—from burgeoning telehealth startups to established medspa chains and multi-state practice groups—a deep understanding of the California Business and Professions Code, Medical Board of California enforcement trends, and the state's unique legal doctrines is not merely a competitive advantage; it is a foundational requirement for compliant and sustainable operations.

For more on this topic, see our analysis: Navigating the Texas Labyrinth: A Deep Dive into Healthcare Compliance for National Expansion.

The Unyielding Grip of California's Corporate Practice of Medicine (CPOM)

California stands as one of the most rigorous states when it comes to the Corporate Practice of Medicine (CPOM) doctrine. Rooted in the California Business and Professions Code (BPC) Sections 2400 and 2052, this doctrine generally prohibits corporations, or any unlicensed individuals or entities, from practicing medicine, employing physicians, or exercising control over medical decisions. The intent is clear: to safeguard the independent professional judgment of licensed practitioners from commercial influence.

For more on this topic, see our analysis: Navigating the Texas Labyrinth: A Deep Dive into Healthcare Compliance for National Expansion.

What CPOM Means for Your Business:

Telehealth Brands: A national telehealth company that directly employs California-licensed physicians, nurses, or other medical professionals to deliver clinical services within California is highly likely to violate CPOM. Instead, telehealth companies must structure their operations using compliant models, most commonly the Management Service Organization (MSO) model. In this structure, the MSO provides non-clinical administrative, technical, and marketing services to a professional medical corporation (PC) or professional limited liability company (PLLC) that is owned and controlled by California-licensed physicians. Crucially, the MSO cannot influence clinical decisions, dictate pricing for medical services, or engage in fee-splitting. The financial arrangements between the MSO and the PC must be set at fair market value for the services rendered, independent of patient volume or revenue from medical services.
Medspas: This sector faces intense scrutiny under California's CPOM. Any service that constitutes the practice of medicine (e.g., injectables, laser treatments, chemical peels, microneedling with medical devices) must be performed by or under the direct supervision of a licensed physician, registered nurse (RN), physician assistant (PA), or nurse practitioner (NP) operating within their scope of practice. The entity providing these medical services must be a professional medical corporation owned by licensed physicians. Non-physician ownership of a medspa that provides medical services is a direct CPOM violation. The medical director cannot be a mere figurehead; they must be actively engaged in supervision and clinical oversight. Enforcement actions by the Medical Board of California often target medspas with inadequate supervision or non-compliant ownership structures.
Dental and Chiropractic Practices: While these professions have their own specific professional corporation statutes, the core principle of CPOM still applies. Non-licensed entities generally cannot own or control dental or chiropractic practices. Any MSO arrangements must similarly respect the professional independence of the licensed practitioners.

Enforcement History: The Medical Board of California (MBC) is notoriously proactive in CPOM enforcement. They regularly investigate complaints related to unlicensed practice, inadequate supervision, and improper business structures. Penalties can be severe, including license revocation for practitioners, cease-and-desist orders, significant fines, and even criminal charges for the unlicensed practice of medicine. Recent intelligence indicates continued vigilance, particularly in the rapidly expanding telehealth and medspa sectors, where novel business models can inadvertently (or intentionally) run afoul of these long-standing prohibitions.

Telehealth in California: A Dynamic Regulatory Landscape

California has been at the forefront of telehealth adoption, but its regulations are equally robust, aiming to ensure quality and patient safety. The California Telehealth Advancement Act of 2011 (AB 415) laid much of the groundwork, and subsequent legislation and board guidance have refined the rules.

Key Telehealth Regulations and Recent Changes:

Establishing a Valid Patient-Provider Relationship: California generally requires a good faith prior exam to establish a patient-provider relationship before prescribing. This typically means an in-person physical exam or a real-time, interactive audio-visual encounter. Asynchronous (store-and-forward) technology alone is usually insufficient for establishing this initial relationship for prescribing, though it can be used for follow-up care or certain consultations. The Medical Board of California's Telehealth Guidelines emphasize that the standard of care for telehealth must be equivalent to in-person care.
Informed Consent: Providers must obtain informed consent from the patient for telehealth services, including information about the modality, privacy risks, and emergency procedures. This consent should be documented in the patient's medical record.
Licensure: Providers must be fully licensed in California to provide telehealth services to patients located in California. There are no broad interstate compacts or exceptions for out-of-state providers unless specific, limited circumstances apply (e.g., consulting with a California-licensed physician).
AB 32 Implications: Assembly Bill 32 (AB 32), effective January 1, 2022, significantly impacted telehealth by making many of the pandemic-era flexibilities permanent. Key provisions include requiring commercial health plans and Medi-Cal to reimburse for live video and telephone-only (audio-only) telehealth services at the same rate as in-person services for specific CPT codes. While this expanded access and reimbursement, it did not fundamentally alter the core requirements for establishing a patient-provider relationship or the standard of care. It did, however, solidify the role of audio-only telehealth, which previously faced more restrictions.
Medical Board Requirements for Telehealth Providers: The MBC expects telehealth providers to adhere to the same ethical and professional standards as in-person care. This includes proper patient identification, maintenance of medical records, privacy and security (HIPAA compliance), and appropriate follow-up care. Violations related to telehealth often stem from inadequate initial evaluations, failure to maintain continuity of care, or prescribing without a legitimate medical purpose.

Compliance Pitfalls and How to Avoid Them:

Ignoring the "Good Faith Prior Exam": Many telehealth platforms, particularly those focused on direct-to-consumer models, have faced scrutiny for allegedly prescribing without adequately establishing a patient-provider relationship. Ensure your intake process includes a robust real-time audio-visual evaluation or an in-person component where necessary.
Out-of-State Providers: Do not allow providers not licensed in California to treat California patients via telehealth. This is a clear violation and a common target for enforcement.
Lack of Documentation: Thorough documentation of all telehealth encounters, including informed consent, assessment, treatment plan, and follow-up, is critical. The MBC views poor documentation as a significant indicator of substandard care.

Controlled Substance Prescribing Rules via Telehealth

California's regulations for prescribing controlled substances via telehealth are among the strictest in the nation, even with recent federal adjustments. The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 generally requires an in-person medical evaluation before a controlled substance can be prescribed via the internet, with limited exceptions. While federal waivers during the COVID-19 Public Health Emergency (PHE) temporarily eased this, the DEA's proposed rules signal a return to stricter requirements.

California-Specific Nuances:

Initial In-Person Exam: California has historically aligned with the Ryan Haight Act, generally requiring an in-person medical evaluation for the initial prescription of controlled substances. While the PHE waivers allowed for telehealth-only prescribing, the expiration of these waivers and the DEA's proposed rules (which extend some PHE flexibilities temporarily but aim for a stricter long-term framework) mean practices must plan for a future where an initial in-person visit or a referral from a practitioner who has conducted one will be the norm for new controlled substance prescriptions.
Schedule II and III-V: The stringency applies to Schedule II substances (e.g., Adderall, OxyContin) and generally extends to Schedule III-V as well, particularly for chronic conditions or high-risk medications. The Medical Board of California's "Guidelines for Prescribing Controlled Substances for Pain" emphasize thorough patient evaluation, risk assessment, and monitoring, regardless of the modality.
CURES Database: All prescribers in California are required to register for and utilize the Controlled Substance Utilization Review and Evaluation System (CURES) database before prescribing, ordering, administering, or furnishing a Schedule II, Schedule III, Schedule IV, or Schedule V controlled substance. This is a critical tool for preventing drug diversion and abuse, and failure to check CURES is a common cause for disciplinary action.

Actionable Advice:

Hybrid Models: Prepare for a hybrid care model that integrates in-person evaluations for initial controlled substance prescriptions. This is particularly relevant for telehealth platforms treating conditions like ADHD, chronic pain, or opioid use disorder (OUD).
Robust Protocols: Implement rigorous protocols for controlled substance prescribing, including comprehensive patient history, physical examination (where required), urine drug screening, CURES checks, and detailed documentation of medical necessity and patient monitoring.
Stay Updated: The DEA's final rules on telehealth prescribing of controlled substances are still pending. Practices must stay abreast of these federal developments, as they will directly impact California operations.

Collaborative Practice and Supervision Requirements

California has specific and often complex rules governing collaborative practice and supervision, particularly for advanced practice providers (APPs) like Physician Assistants (PAs) and Nurse Practitioners (NPs).

Physician Assistants (PAs): PAs in California practice under the supervision of a physician. The Physician Assistant Board outlines detailed requirements for supervision, which can be continuous but does not always require the physical presence of the supervising physician. However, the supervising physician is ultimately responsible for the PA's medical practice. The "practice agreement" between the PA and the supervising physician must clearly define the scope of practice and supervisory arrangements.
Nurse Practitioners (NPs): California has moved towards full practice authority for NPs (AB 890), allowing them to practice independently after fulfilling specific transition-to-practice requirements (e.g., 4,600 hours of practice and 3 years of experience under physician supervision). However, many NPs still practice under collaborative agreements or physician supervision, particularly if they have not met the independent practice criteria or are prescribing controlled substances. For NPs who have achieved independent practice, they can operate their own professional corporations, subject to CPOM rules.
Registered Nurses (RNs) and Medical Assistants (MAs) in Medspas: This is a high-risk area. RNs can perform delegated medical procedures (e.g., injectables, certain laser treatments) under the direct supervision of a physician. "Direct supervision" often means the physician must be on-site and immediately available. MAs have a very limited scope of practice and generally cannot perform medical procedures that require independent judgment or advanced training, such as injectables or laser treatments. Misuse of MAs in medspas is a frequent target of MBC enforcement.

Implications for Your Practice:

Clear Delegation: Ensure all delegated tasks align with the scope of practice for the delegating practitioner and the qualifications of the delegatee. Document all training and competency assessments.
Active Supervision: For PAs, NPs (if not independent), and RNs performing delegated medical acts, ensure the supervising physician is actively engaged and meets all statutory and regulatory requirements for supervision, including chart review and availability.
Medspa Vigilance: Be especially cautious in medspa settings. The line between what an RN can do under supervision and what constitutes the unlicensed practice of medicine for an MA can be blurry but has severe consequences if crossed.

State-Specific Licensing and Registration Requirements

Beyond professional licenses, California imposes several other registration and operational requirements.

Business Entity Registration: All businesses, including professional corporations, must register with the California Secretary of State. Professional corporations (e.g., medical corporations, dental corporations) have specific naming conventions and ownership requirements.
Fictitious Name Permits: If a medical practice operates under a name other than the name of the licensed physician(s) or the professional corporation, it generally requires a Fictitious Name Permit from the Medical Board of California.
DEA Registration: As noted, providers prescribing controlled substances must have a valid DEA registration. If prescribing across state lines, they must also be registered in the state where the patient is located, which typically requires state licensure first.
CLIA Waivers: Any practice performing laboratory tests, even simple point-of-care tests, must comply with Clinical Laboratory Improvement Amendments (CLIA) regulations and obtain a CLIA waiver if applicable.

Recent Enforcement Actions and Notable Cases

The Medical Board of California is one of the most active state boards in the nation. Recent enforcement trends highlight:

Telehealth Prescribing Violations: Cases involving physicians prescribing controlled substances or other high-risk medications (e.g., GLP-1 agonists for weight loss) without adequate patient evaluation, or through platforms that facilitate such practices, are increasingly common. These often result in license suspension or revocation.
Medspa Malpractice and Scope of Practice: Numerous cases involve non-physicians performing medical procedures, physicians failing to adequately supervise, or medspas operating with non-compliant ownership structures. Penalties range from fines to license loss and criminal charges for unlicensed practice.
CPOM Investigations: The MBC actively investigates complaints related to corporate control over medical practices, particularly when MSO agreements are found to exert undue influence over clinical decision-making or involve illegal fee-splitting.

These actions underscore the MBC's commitment to protecting the public and maintaining the integrity of the medical profession. They serve as a stark reminder that regulatory compliance is not a theoretical exercise but a practical necessity with severe consequences for non-adherence.

Key Compliance Pitfalls and How to Avoid Them

Ignoring CPOM: This is the most significant structural pitfall. Ensure your business is legally structured to comply with BPC 2400 and 2052. If you're a non-physician entity, you must utilize a compliant MSO model with a genuinely independent professional medical corporation.
Inadequate Telehealth Patient-Provider Relationship: Do not rely on asynchronous communication alone for initial patient evaluations, especially for prescribing. Implement robust real-time audio-visual protocols.
Out-of-State Licensure: Verify that all providers treating California patients are appropriately licensed by the relevant California board.
"Figurehead" Medical Directors/Supervisors: Medical directors and supervising physicians must be actively engaged, provide genuine oversight, and meet all statutory requirements for supervision. They must not be mere signatories on paper.
Misuse of Staff Scope of Practice: Clearly define and enforce the scope of practice for all clinical staff (RNs, PAs, NPs, MAs). Do not allow staff to perform procedures outside their legal scope or without proper supervision.
Controlled Substance Prescribing Laxity: Adhere strictly to federal and state requirements for controlled substance prescribing, including CURES checks, documentation, and the eventual return to stricter initial exam requirements.
Poor Documentation: Maintain meticulous and comprehensive medical records for all patient encounters, whether in-person or via telehealth.

What This Means For Your Practice

Operating in California's healthcare sector demands a proactive and sophisticated approach to compliance. For telehealth founders, medspa owners, and practice groups considering expansion, this means:

Robust Legal Counsel: Engage experienced California healthcare counsel from the outset to structure your business compliantly and review all operational policies and procedures.
Comprehensive Compliance Programs: Implement a robust compliance program that includes regular training for all staff, internal audits, and mechanisms for identifying and addressing potential violations.
Technology for Compliance: Utilize technology solutions that support compliant workflows, such as secure telehealth platforms, electronic health records (EHRs) with robust documentation features, and systems for tracking provider licensure and DEA registrations.
Stay Informed: The regulatory landscape is dynamic. Continuously monitor updates from the Medical Board of California, the DEA, and state legislative bodies. TrueEval's intelligence platform can be an invaluable resource in this regard.

California offers immense opportunities, but only for those who navigate its regulatory complexities with precision and diligence. By prioritizing compliance, your practice can thrive while upholding the highest standards of patient care and professional integrity.