The Compliance Crucible: Navigating CPOM, Telehealth Prescribing, and DOJ Scrutiny in a Dynamic Regulatory Landscape

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

The past week has underscored the intricate and often challenging compliance landscape for healthcare businesses. From navigating strict Corporate Practice of Medicine doctrines to deciphering evolving telehealth prescribing rules and facing intensified DOJ enforcement, staying ahead of regulatory shifts is paramount for operational integrity and growth.

The healthcare regulatory environment is a dynamic and often unforgiving terrain, demanding constant vigilance from telehealth innovators, multi-state practice owners, and compliance officers alike. The past week's intelligence reinforces a critical truth: proactive, granular compliance is not merely an option, but a strategic imperative. We've seen heightened scrutiny across multiple fronts, from state-specific Corporate Practice of Medicine (CPOM) doctrines to the nuanced requirements of telehealth prescribing and the Department of Justice's (DOJ) relentless pursuit of fraud.

> For more on this topic, see our analysis: [Q2 2024 Compliance Briefing: Navigating Telehealth's Regulatory Minefield and CPOM's Persistent Threat](/blog/q2-2024-telehealth-cpom-compliance-briefing).

The Enduring Shadow of Corporate Practice of Medicine (CPOM)

CPOM continues to be a cornerstone of regulatory risk, particularly for rapidly expanding healthcare models like telehealth and medspas. While some states offer more flexibility, the underlying principle remains: clinical decision-making must reside with licensed professionals, free from corporate influence.

Nevada's Nuance vs. New York's Rigor

Our intelligence highlights the stark contrast in CPOM enforcement. Nevada, for instance, maintains a CPOM doctrine but is often considered more flexible, allowing for well-structured Management Services Organization (MSO) models. This flexibility, however, is not an invitation for laxity. The key for telehealth brands and medspas in Nevada is to ensure MSO agreements meticulously delineate administrative support from clinical autonomy. Any arrangement that appears to dictate patient care or improperly share professional fees risks challenge from the Nevada State Board of Medical Examiners.

Conversely, New York stands as one of the nation's most stringent CPOM states. Here, the prohibition against corporate entities practicing medicine or employing licensed professionals to deliver clinical services is absolute. For telehealth companies, this necessitates a robust Physician-Controlled Management Services Organization (PC-MSO) structure. The professional entity (PE) must be physician-owned and controlled, retaining complete clinical autonomy. The MSO's role is strictly limited to non-clinical administrative services. The New York State Education Department (NYSED) Office of Professional Discipline (OPD) and the Office of the Attorney General are vigilant, and non-compliance can lead to severe penalties, including license revocation and criminal charges.

Implications for DTC Weight Loss and Multi-State Expansion

The CPOM doctrine is particularly impactful for Direct-to-Consumer (DTC) telehealth weight loss brands operating in states like California, Texas, New York, and others. The challenge lies in the tension between a corporate platform's structure and the requirement for physician independence. Business models, physician employment agreements, and revenue-sharing mechanisms must be meticulously reviewed to avoid illegal fee-splitting or corporate control over clinical practice. If a platform dictates specific treatment protocols or ties physician compensation to prescription volume, it risks violating CPOM and anti-kickback statutes.

Actionable Insight: For any practice expanding nationally, a state-by-state CPOM analysis is non-negotiable. MSO models, while often effective, must be genuinely structured to preserve physician independence, with clear contractual boundaries and fair market value compensation arrangements. Do not assume that what works in one state will pass muster in another.

The Evolving Labyrinth of Telehealth Prescribing and Patient Relationships

The post-PHE era has ushered in a complex, fragmented regulatory landscape for telehealth, especially concerning the establishment of a valid patient-provider relationship and the prescribing of controlled substances.

Sexual Wellness Platforms and Controlled Substances

Telehealth platforms specializing in sexual wellness face a particularly intricate web of state-specific regulations. The DEA's Ryan Haight Act generally requires an in-person medical evaluation before prescribing controlled substances via telemedicine, with exceptions during public health emergencies. While the DEA has proposed new rules, the landscape remains fluid. Many states impose additional restrictions, including limits on Schedule II substances or prohibitions on prescribing certain controlled substances via telehealth without prior in-person visits. This directly impacts the operational model of sexual wellness platforms, especially if they involve medications that fall under controlled substance classifications.

Chiropractic Telehealth: Defining the Digital Touch

Even for specialties like chiropractic care, state boards are actively defining the scope of telehealth. Many state chiropractic boards require an in-person initial visit to establish a legitimate patient-practitioner relationship, limiting fully remote care from the outset. This often necessitates a hybrid model where initial assessments are in-person, and follow-ups or lifestyle advice can be delivered virtually. For telehealth brands offering chiropractic services, understanding these limitations is crucial to avoid license violations. The rules vary significantly by state, underscoring the need for robust state-specific regulatory intelligence.

Informed Consent Across 50 States

Beyond prescribing, the foundational principle of informed consent in telehealth is far from uniform. There is no single federal standard. Practices must tailor their consent processes to meet the explicit mandates of each jurisdiction where they operate and where their patients reside. This includes specific disclosures about technology failures, data privacy, and the scope and limitations of virtual care versus in-person treatment. The District of Columbia's Board of Pharmacy, for example, emphasizes a proper patient-provider relationship for telehealth prescribing, even for non-controlled substances, and has specific rules for compounding and fulfillment.

Actionable Insight: Develop dynamic consent workflows that can present state-specific disclosures. For prescribing, especially controlled substances, conduct a meticulous state-by-state legal analysis. Ensure your providers are licensed in the patient's state and are fully aware of and compliant with that state's specific telehealth and controlled substance prescribing guidelines. Do not assume federal guidance preempts stricter state rules.

Supervision, Delegation, and Billing: The Operational Underpinnings

Effective and compliant healthcare delivery relies heavily on appropriate supervision, delegation, and accurate billing practices.

Washington State's Clear Directives

The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have provided clear directives on supervision and delegation for Physician Assistants (PAs) and Advanced Registered Nurse Practitioners (ARNPs), particularly relevant for telehealth and medspa services. These regulations demand a robust, documented process for ongoing collaboration, chart review, and availability for consultation. For medspas, this means meticulous records of delegation agreements, training, and ongoing supervision, especially for procedures involving injectables or lasers. Non-compliance can lead to disciplinary action against both the practitioner and the supervising physician/ARNP.

Billing and Coding: The Financial Lifeline and Liability

Telehealth providers must meticulously adhere to complex billing and coding regulations for both commercial insurance and self-pay patients. The nuances of CPT/HCPCS codes, appropriate modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth, 10 for patient's home) are critical. Missteps lead to claim denials, recoupments, and audit triggers. For self-pay models, the No Surprises Act mandates good faith estimates, and clear, upfront pricing is essential to avoid consumer complaints and regulatory scrutiny. The absence of a federal standard for telehealth billing means payer policies vary widely by plan and state, demanding constant monitoring.

Actionable Insight: Implement robust internal controls, staff training, and regular audits for billing and coding. For PAs/ARNPs, ensure your supervision and delegation protocols are not just on paper but actively practiced and meticulously documented. For self-pay, prioritize price transparency and clear communication with patients.

DOJ Intensifies Enforcement: The High Stakes of Compliance

The Department of Justice (DOJ) continues to aggressively pursue enforcement actions against healthcare providers and companies engaged in telehealth fraud, illegal kickbacks, and false claims. This is not a fleeting trend but a sustained commitment to safeguarding federal healthcare programs.

Telehealth Fraud and Kickback Schemes

For telehealth brands, the primary risk areas include billing for services not rendered, medically unnecessary services, or services provided by unqualified personnel. The DOJ is particularly vigilant about arrangements that incentivize referrals through illegal kickbacks, often disguised as marketing fees or administrative services. Any financial relationship with lead generators, laboratories, pharmacies, or other service providers must be meticulously structured to comply with the Anti-Kickback Statute (AKS) and its safe harbors. Violations can lead to criminal charges, civil penalties under the False Claims Act (FCA), and exclusion from federal healthcare programs.

Medspas, dental practices, and chiropractic offices integrating telehealth components or engaging in referral relationships are also under the microscope. For example, a medspa offering weight-loss services via telehealth must ensure all prescriptions are medically necessary and not influenced by illegal inducements. The DOJ's enforcement often targets schemes where providers are paid for ordering unnecessary items or services.

Actionable Insight: Implement robust compliance programs with regular audits and ongoing staff training on fraud, waste, and abuse prevention. Scrutinize all third-party vendor relationships and compensation arrangements to ensure they are fair market value, commercially reasonable, and do not directly or indirectly induce referrals. Engage legal counsel to vet complex financial arrangements.

What This Means For Your Practice

The current regulatory environment demands a sophisticated, multi-faceted compliance strategy. For telehealth founders, multi-state practice owners, and compliance officers, the key takeaways are clear:

Granular State-Level Intelligence: There is no one-size-fits-all solution. Every state presents unique challenges regarding CPOM, telehealth prescribing, informed consent, and scope of practice. Invest in robust regulatory tracking and legal counsel to navigate this complexity.
Robust Business Structuring: For CPOM-heavy states, MSO or PC-MSO models are essential, but they must be genuinely compliant, preserving physician autonomy and avoiding any hint of corporate control over clinical decisions or illegal fee-splitting.
Meticulous Documentation and Protocols: From patient intake and informed consent to prescribing practices, supervision agreements, and billing, every step must be clearly documented and align with state and federal regulations. This is your primary defense in an audit or enforcement action.
Proactive Risk Mitigation: Compliance is not a reactive measure. Regularly audit your operations, train your staff, and engage with legal experts to identify and mitigate risks before they escalate into costly enforcement actions. The cost of proactive compliance pales in comparison to the penalties for non-compliance.
Ethical Foundation: Beyond the letter of the law, a strong ethical foundation that prioritizes patient safety and legitimate medical necessity will serve as your best defense against allegations of fraud and abuse.

The regulatory landscape is not static; it is constantly evolving. Staying informed, adaptable, and committed to a culture of compliance is the only sustainable path forward for healthcare businesses in this dynamic era.