The Compliance Crucible: Navigating DEA Scrutiny, CPOM Landmines, and Telehealth's Evolving Landscape

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The past week has seen a torrent of critical compliance developments, from intensified DEA enforcement on telehealth prescribing to complex state-level Corporate Practice of Medicine challenges. Healthcare executives must navigate this intricate regulatory web to ensure sustainable growth and mitigate significant risks. This digest cuts through the noise, offering actionable intelligence for your practice.

The healthcare regulatory landscape is a dynamic and often unforgiving terrain, demanding constant vigilance from even the most sophisticated operators. The past week has underscored this reality, with significant movements from federal agencies like the DEA and DOJ, coupled with persistent state-level challenges in areas like telehealth and Corporate Practice of Medicine (CPOM). For telehealth founders, national practice owners, and compliance officers, understanding these shifts isn't just good practice—it's essential for survival and strategic growth.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating DEA Scrutiny, CPOM Landmines, and Telehealth's Evolving Frontier](/blog/compliance-crucible-dea-cpom-telehealth-frontier).

This week's digest synthesizes critical intelligence, offering a clear-eyed view of the compliance crucible facing the industry. We'll explore heightened enforcement, the enduring complexities of CPOM, and the evolving framework for telehealth, providing the insights you need to stay ahead.

DEA and DOJ Intensify Scrutiny on Telehealth Prescribing

The Department of Justice (DOJ) and the Drug Enforcement Administration (DEA) are sending an unmistakable message: telehealth prescribing of controlled substances is under unprecedented scrutiny. This isn't merely about technical compliance; it's about demonstrating a legitimate medical purpose for every prescription, a standard the DOJ is rigorously enforcing.

Recent intelligence highlights the DOJ's increased focus on prosecuting telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This trend underscores the critical importance of strict adherence to federal and state prescribing regulations, particularly regarding the Ryan Haight Act and the legitimate medical purpose requirements for telehealth encounters. For telehealth brands, this means a rigorous re-evaluation of patient intake protocols, provider training, and technological safeguards. Every prescription for a controlled substance must be preceded by a comprehensive, individualized medical evaluation that meets federal and state standards, including appropriate physical examinations where necessary or explicitly waived by emergency provisions.

Simultaneously, the DEA has been grappling with the permanent framework for telehealth prescribing post-Public Health Emergency (PHE). While the initial proposed rules suggested a return to strict in-person requirements for most controlled substances, the DEA later issued a supplemental proposed rule extending the PHE flexibilities until November 11, 2023, and for an additional year (until November 11, 2024) for patient-prescriber relationships established during the PHE. This extension provides a temporary reprieve but underscores the eventual return to stricter requirements. Telehealth platforms must prepare for a future where an initial in-person visit or a referral from a practitioner who has conducted one will likely be necessary for new buprenorphine patients and other Schedule II and certain Schedule III-V controlled substances.

Actionable Insight: Compliance infrastructure is paramount. Practices must develop robust protocols to document in-person evaluations (or their exceptions), track patient-prescriber relationships established during the PHE, and ensure proper record-keeping for all controlled substance prescriptions. For multi-state operators, this means holding a DEA registration in each state where a patient is located if controlled substances are prescribed. Failure to comply can lead to DEA investigations, license revocation, civil monetary penalties, and even criminal charges.

Corporate Practice of Medicine (CPOM): A Persistent Hurdle for Growth

The Corporate Practice of Medicine (CPOM) doctrine continues to be a significant, often underestimated, barrier for healthcare businesses, particularly those with innovative or scalable models like telehealth and medspas. This week, we saw specific emphasis on states like Kentucky and Iowa, both of which maintain strict CPOM doctrines.

Iowa's stringent CPOM doctrine generally prohibits non-licensed entities from employing licensed healthcare professionals, owning medical practices, or otherwise exercising control over clinical judgments. This means traditional corporate structures where a lay entity directly employs physicians, dentists, or advanced practice providers are largely impermissible. For telehealth brands, this necessitates careful structuring, often requiring the formation of an Iowa professional corporation (PC) or professional limited liability company (PLLC) owned by licensed Iowa professionals, which then contracts with the telehealth platform for administrative and technical services. Medspas in Iowa face similar scrutiny; any entity providing medical services must typically be a professional entity owned by licensed professionals, with the medical director actively overseeing operations.

Kentucky also maintains a CPOM doctrine, albeit with some nuances. While considered a moderate enforcement state, the principle remains: corporations cannot generally employ physicians or control medical decision-making. Telehealth providers and medspas must ensure that the entity providing medical services is professionally owned and controlled. Management Service Organization (MSO) models are common, but the MSO agreement must clearly delineate the separation of clinical and administrative functions, ensuring the MSO does not exert undue influence over the professional entity, dictate clinical decisions, or engage in improper fee-splitting.

DTC Telehealth Weight Loss Brands face particularly acute CPOM challenges. The rapid growth of this sector, often involving the prescription of GLP-1 agonists, has attracted significant regulatory attention. The core challenge lies in the tension between a scalable, technology-driven business model and state laws designed to protect the physician-patient relationship from commercial influence. Practices must ensure that all clinical decisions, prescribing, and patient care protocols remain solely under the control of licensed medical professionals, not corporate entities or non-clinician management. The financial relationship between the MSO and the professional entity must be structured at fair market value for administrative services, independent of the volume or value of referrals or medical services.

Actionable Insight: For any healthcare business operating or expanding into CPOM states, a thorough legal review of your corporate structure, MSO agreements, and operational policies is non-negotiable. Non-compliance can lead to severe penalties, including license revocation for professionals, corporate dissolution, significant fines, and even criminal charges. Proactive legal counsel with expertise in state-specific CPOM nuances is essential.

State Boards Define Telehealth Boundaries: Michigan and DC Lead the Way

While federal agencies tackle controlled substances and broad fraud, state boards are meticulously defining the operational parameters for telehealth and specialized practices like medspas and chiropractic care. This week, Michigan and the District of Columbia offered clear examples of this trend.

Michigan's Medical Board is actively monitoring and enforcing regulations related to telehealth and medspa operations. Disciplinary actions often stem from issues like unprofessional conduct, scope of practice violations, and inadequate supervision. For telehealth brands, this means a heightened focus on ensuring all practitioners are appropriately licensed in Michigan, that patient-provider relationships are established in accordance with state law (e.g., proper initial evaluations, informed consent), and that prescribing practices strictly adhere to Michigan's Public Health Code. Medspa operators face unique challenges related to scope of practice and delegation, with the Board expecting clear delineation of services and active, often on-site, supervision by medical directors.

In the District of Columbia, specific regulations govern the establishment of a valid provider-patient relationship via telehealth, which is a prerequisite for prescribing. Practitioners must adhere to these standards, including a real-time, interactive audio-visual examination, to ensure compliance. This means asynchronous modalities or audio-only consultations are generally insufficient for initiating a prescribing relationship, particularly for new patients or new conditions. The standard of care for telehealth must be equivalent to that of in-person care, demanding thorough assessment, comprehensive documentation, and appropriate follow-up.

Chiropractic practices are also seeing increased guidance from state boards on telehealth. Regulations often define what services are permissible via telehealth, require patient consent, and specify documentation standards. The ability to conduct initial consultations, establish a patient-provider relationship, and deliver certain therapeutic interventions remotely varies significantly by state. This directly impacts the scope of services that can be offered virtually, influencing business models for telehealth-focused chiropractic brands.

Actionable Insight: State-specific regulations are the bedrock of compliant telehealth and specialized practice operations. Businesses must regularly review their operational policies and procedures against specific state public health codes and administrative rules. This includes robust credentialing, clear patient consent processes, and technology platforms that support required interaction modalities. Proactive internal audits and comprehensive staff training on state-specific compliance are essential to mitigate enforcement risks.

CMS Expands Telehealth: Opportunity Meets Compliance Complexity

On a more positive note for access, the Centers for Medicare & Medicaid Services (CMS) has continued its trajectory of expanding telehealth services and provider eligibility under Medicare. These updates reflect a sustained commitment to integrating telehealth into the permanent healthcare landscape, moving beyond pandemic-era flexibilities. This ongoing expansion means a growing market opportunity for telehealth brands, as more services become reimbursable, potentially increasing patient access and revenue streams.

However, this expansion also necessitates meticulous attention to billing codes, documentation requirements, and compliance with originating and distant site rules, even as some of those rules have been relaxed. Providers must ensure their systems can accurately capture and submit claims for these newly eligible services. Medspas and chiropractic offices that incorporate medical services or have licensed medical professionals on staff may find new avenues for patient engagement and follow-up care through telehealth, provided their scope of practice strictly aligns with state licensure and Medicare's specific service definitions.

Actionable Insight: Capitalizing on CMS telehealth expansion requires robust compliance infrastructure. Businesses must stay current with the specific CPT codes added to the Medicare telehealth services list, understand any associated modifiers (e.g., 95 for synchronous telehealth, GT for asynchronous), and adhere to evolving rules regarding patient consent, technology requirements (HIPAA-compliant platforms), and state-specific licensure for providers delivering care. Failure to comply can result in claim denials, audits, and potential fraud and abuse investigations.

What This Means For Your Practice

The current regulatory environment demands a proactive, multi-faceted compliance strategy. The days of 'move fast and break things' are over for healthcare. Instead, success hinges on a deep understanding of federal and state regulations, a robust compliance infrastructure, and a commitment to ethical practice.

1. Audit Your Telehealth Prescribing Protocols: Given the intense DOJ and DEA scrutiny, immediately review all protocols for controlled substance prescribing via telehealth. Ensure every prescription has a documented legitimate medical purpose, and that your processes align with the latest DEA guidance, including the extended PHE waivers and future in-person requirements. 2. Re-evaluate Your Corporate Structure in CPOM States: If you operate in or plan to expand into states like Iowa or Kentucky, engage specialized legal counsel to scrutinize your corporate structure, MSO agreements, and physician employment/contracting models. Ensure clear separation of clinical and administrative functions and fair market value compensation. 3. Strengthen State-Specific Telehealth Compliance: Review state board regulations for every state you operate in, particularly regarding the establishment of patient-provider relationships, acceptable modalities (e.g., audio-visual requirements in DC), and scope of practice for all licensed professionals, including those in medspas and chiropractic care. 4. Optimize for CMS Telehealth Expansion: Stay abreast of CMS updates on eligible telehealth services and ensure your billing and documentation systems are configured to capture and submit claims compliantly. This is an opportunity for growth, but only with meticulous adherence to Medicare rules.

The regulatory landscape is not merely a hurdle; it is a framework that, when understood and respected, enables sustainable and ethical growth. TrueEval is committed to providing the intelligence and tools you need to navigate this complexity with confidence, transforming compliance from a burden into a strategic advantage.