The Compliance Crucible: Navigating DOJ Scrutiny, CPOM Tightening, and Telehealth's Evolving State Lines

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

This week's digest reveals a sharpened focus on telehealth fraud, persistent Corporate Practice of Medicine challenges, and the intricate web of state-specific regulations. Healthcare leaders must proactively adapt to intensified enforcement and evolving compliance demands to safeguard their operations.

The healthcare regulatory landscape continues its relentless evolution, demanding constant vigilance from telehealth innovators, expanding practices, and compliance officers alike. This past week has underscored several critical themes: the Department of Justice's unwavering commitment to stamping out telehealth fraud, the persistent and often contradictory challenges of the Corporate Practice of Medicine (CPOM) across states, and the intricate, state-specific requirements governing everything from prescribing controlled substances to obtaining informed consent. For any entity navigating the complexities of modern healthcare delivery, understanding these dynamics is not merely advisable—it is existential.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating CPOM, Telehealth Prescribing, and DOJ Scrutiny in a Dynamic Regulatory Landscape](/blog/compliance-crucible-cpom-telehealth-doj).

DOJ Intensifies Enforcement Against Telehealth Fraud and Kickback Schemes

The Department of Justice (DOJ) is not slowing its pace. Recent enforcement actions signal a continued, aggressive pursuit of healthcare providers and companies engaged in telehealth fraud, illegal kickbacks, and false claims. This isn't just about federal programs; the ripple effect impacts commercial payers and self-pay models as well. The message is clear: the rapid expansion of telehealth, while offering unprecedented access, has also created new vulnerabilities that federal authorities are keen to exploit in their investigations.

For telehealth brands, the primary risk areas remain consistent: billing for services not rendered, billing for medically unnecessary services, or services provided by unqualified personnel. However, the DOJ's scrutiny extends deeply into financial arrangements. Any structure that could be construed as incentivizing referrals through illegal kickbacks—whether disguised as marketing fees, administrative services, or consulting agreements—is a prime target. The Anti-Kickback Statute (AKS) and its safe harbors are not suggestions; they are strict legal requirements. Failure to comply can lead to criminal charges, civil penalties under the False Claims Act (FCA), and exclusion from federal healthcare programs.

Medspas, dental practices, and chiropractic offices that integrate telehealth components or engage in referral relationships are equally under the microscope. Consider a medspa offering weight-loss or hormone-therapy services via telehealth. Every prescription must be medically necessary, based on a legitimate patient-provider relationship, and entirely uninfluenced by illegal inducements. Similarly, dental and chiropractic practices referring patients for durable medical equipment (DME), diagnostic tests, or specialty consultations must ensure these referrals are based solely on clinical need, not on financial incentives. The DOJ's enforcement actions frequently target schemes where providers are compensated for ordering unnecessary items or services, even if they claim to be acting on behalf of a third-party telehealth company. This proactive stance by the DOJ underscores the critical need for robust compliance programs, regular internal audits, and ongoing staff training on fraud, waste, and abuse prevention.

Navigating the Corporate Practice of Medicine (CPOM): State-Specific Nuances

The Corporate Practice of Medicine (CPOM) doctrine remains a cornerstone of regulatory compliance, particularly for rapidly scaling healthcare businesses. This week's intelligence highlights both the strictness of states like New York and the more flexible, yet still demanding, approach seen in Nevada.

New York's Strict CPOM: The PC-MSO Imperative

New York maintains one of the nation's most stringent CPOM doctrines, prohibiting corporations from employing physicians or practicing medicine. For telehealth companies, medspas, dental practices, and chiropractic offices operating in the Empire State, this isn't a guideline; it's a hard rule. Any business model where a non-professional entity directly controls or profits from the delivery of medical services faces high regulatory risk.

The solution for many is a meticulously structured Physician-Controlled Management Services Organization (PC-MSO). The core principle is physician autonomy: the professional entity (PE), owned and controlled by licensed New York physicians, must retain complete clinical authority over all medical decision-making, patient care, and professional employment. The MSO's role is strictly limited to providing non-clinical administrative, technical, and management services. Any perceived influence by the MSO over clinical aspects can trigger violations, leading to investigations by the New York State Education Department (NYSED) Office of Professional Discipline (OPD) or the Office of the Attorney General.

Compliance in New York demands precision in contractual agreements, operational workflows, and financial arrangements. The Management Services Agreement (MSA) must clearly delineate responsibilities, ensuring the PE maintains ultimate authority. Fee structures must be at fair market value and avoid any appearance of illegal fee-splitting. This is particularly critical for practices involved in weight-loss, hormone-therapy, mental-health, sexual-health, dermatology, and primary-care via telehealth, which are under heightened scrutiny.

Nevada's Flexible CPOM: MSO Models with Guardrails

In contrast to New York, Nevada's CPOM enforcement is often considered more flexible, allowing for MSO models, especially for telehealth and medspa businesses. However, this flexibility should not be mistaken for permissiveness. Nevada generally prohibits corporations from employing physicians or controlling medical practice, but its enforcement allows for well-structured MSO arrangements, provided specific guidelines are followed to preserve physician autonomy.

For telehealth brands and medspas, the MSO model involves a non-physician-owned entity providing administrative services to a physician-owned professional corporation (PC). The critical compliance point is ensuring the MSO does not exert control over clinical decision-making, physician employment, or fee-splitting. Agreements must be meticulously drafted to delineate clear boundaries, explicitly stating the PC retains full control over medical judgments, clinical staff, and professional fees. Any arrangement that dictates patient care or improperly shares professional fees could be challenged by the Nevada State Board of Medical Examiners.

Dental and chiropractic practices in Nevada face similar CPOM considerations, requiring MSO models to be structured with the same vigilance to maintain professional independence. While Nevada offers a more accommodating environment, robust legal counsel is essential to design models resilient against CPOM challenges.

CPOM for DTC Telehealth Weight Loss Brands: A National Challenge

Direct-to-Consumer (DTC) telehealth weight loss brands face significant CPOM challenges across multiple states, including California, Texas, New York, and others. The tension between a corporate platform and physician autonomy is acute. Simply contracting with physicians is insufficient; the nature of that contract, the degree of corporate influence on treatment protocols, and how fees are structured are all under scrutiny. If a platform dictates specific weight loss treatments or formularies without independent physician judgment, it risks violating CPOM. Revenue-sharing models tied directly to volume or type of prescriptions can be construed as illegal fee-splitting.

Medspas, dental practices, and chiropractic offices expanding into telehealth, particularly for weight loss, must also be aware. The integration of telehealth introduces complexities, especially when leveraging third-party technology platforms. Ensuring licensed professionals retain ultimate clinical authority and that business arrangements comply with state-specific CPOM and fee-splitting laws is critical. Non-compliance can result in severe penalties, including license revocation, civil monetary penalties, and even criminal charges.

The Patchwork of Telehealth Regulations: Prescribing, Supervision, and Consent

Beyond CPOM, the operational complexities of telehealth are largely defined by a fragmented, state-specific regulatory environment. This impacts everything from prescribing controlled substances to supervision of advanced practice providers and the fundamental requirement of informed consent.

Navigating State-Specific Telehealth Regulations for Sexual Wellness and Controlled Substances

Telehealth platforms specializing in sexual wellness, or any area involving controlled substance prescribing, face a particularly complex patchwork of state-specific regulations. The lack of a uniform federal standard for establishing a patient-provider relationship via telehealth and prescribing controlled substances across state lines is the primary challenge.

Sexual wellness platforms must navigate varying requirements for initial in-person exams, synchronous audio-visual communication, and permissible prescribing methods. Some states may allow audio-only for established patients, while others mandate video for all initial consultations. Failure to adhere can lead to allegations of unlawful practice of medicine or improper prescribing.

Regarding controlled substances, the DEA's Ryan Haight Act generally requires an in-person medical evaluation before prescribing via telemedicine, with exceptions during public health emergencies. While the DEA has proposed new rules post-PHE, the landscape remains dynamic. State medical boards often impose additional restrictions, including limits on Schedule II substances, specific documentation requirements, and prohibitions on prescribing controlled substances via telehealth without prior in-person visits. This directly impacts how a sexual wellness platform can operate, especially if it considers prescribing medications that fall under controlled substance classifications.

Compliance strategies must include robust state-by-state legal analysis for every jurisdiction. This involves reviewing medical board rules, pharmacy board regulations, and state statutes related to telemedicine. Developing clear protocols for patient intake, identity verification, informed consent, and documentation that meet the most stringent requirements across all operating states is crucial.

Telehealth for Chiropractic Care: State Board Regulations

State chiropractic boards are increasingly defining the scope of telehealth for chiropractors. For telehealth brands offering chiropractic services, many states require an in-person initial visit to establish a legitimate patient-practitioner relationship, limiting fully remote care from the outset. This often necessitates a hybrid model or careful patient vetting. Chiropractic offices integrating telehealth must have clear protocols for determining which services are appropriate for virtual versus in-person visits, as hands-on diagnostic or therapeutic procedures generally cannot be replaced by telehealth. Secure, HIPAA-compliant technology and comprehensive documentation are non-negotiable.

Washington State: Supervision and Delegation for PAs and NPs

The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have established specific requirements for physician and advanced registered nurse practitioner (ARNP) supervision and delegation, particularly relevant for telehealth and medspa services. For telehealth brands, this means more than just having a supervising physician on paper; it requires a robust, documented process for ongoing collaboration, chart review, and availability for consultation. Medspa businesses are particularly impacted, as the rules dictate that delegating physicians or collaborating ARNPs must ensure the PA or ARNP has the necessary training and competency for each procedure, including understanding complications and emergency protocols. Meticulous records of delegation agreements, training, and ongoing supervision are essential. Non-compliance can lead to severe disciplinary action and legal liability.

Telehealth Informed Consent Requirements Across All 50 States and D.C.

Informed consent in telehealth is a complex, state-specific issue with no single federal standard. For telehealth brands, medspas, dental practices, chiropractic offices, and other healthcare businesses, a meticulous, state-by-state approach is required. A general consent form is insufficient; practices must tailor their consent processes to meet the explicit mandates of each jurisdiction. This means integrating dynamic consent workflows that can present state-specific disclosures, such as potential technology failures or specific data privacy language. Regular review and updates are critical as regulations evolve. If a virtual consultation leads to an in-person procedure, the initial telehealth consent may need to address the scope and limitations of the virtual interaction versus the in-person treatment. A comprehensive audit of current consent practices against every state's requirements, including content, method of obtaining, and specific information conveyed, is essential.

District of Columbia Pharmacy Board Regulations: Telehealth Prescribing, Compounding, and Fulfillment

For telehealth brands operating in the District of Columbia, understanding the DC Board of Pharmacy regulations is critical. The emphasis on a proper patient-provider relationship, even if established via telehealth, is foundational. Providers must ensure initial patient assessments meet prescribing standards, particularly for controlled substances. Medspas and aesthetic practices prescribing medications via telehealth must ensure their practices align with DC's requirements, including comprehensive patient records and verifying prescription legitimacy. For compounding, strict adherence to USP standards and DC compounding regulations is non-negotiable. Any medication fulfillment must occur with DC-licensed entities. Robust internal policies and training are necessary to ensure all practitioners understand and comply with DC's telehealth and pharmacy regulations.

Navigating Telehealth Billing and Coding Compliance

Telehealth billing and coding compliance is a critical risk management function. Missteps can lead to claim denials, recoupments, audits, and severe penalties, including False Claims Act violations.

For commercial insurance, providers must stay updated on each payer's specific telehealth policies, which vary widely by plan and state. This includes understanding covered services, acceptable modalities (audio-only vs. audio-visual), eligible providers, and any state-specific parity laws. Accurate use of CPT/HCPCS codes, telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth provided from a location other than the patient's home, 10 for telehealth provided in the patient's home) is paramount. Documentation must clearly support the billed services, including medical necessity, modality, and patient consent.

Self-pay models introduce challenges around price transparency and consumer protection. The No Surprises Act mandates good faith estimates for uninsured and self-pay patients. Telehealth businesses must provide clear, upfront pricing for all services and avoid deceptive marketing practices to prevent consumer complaints and regulatory scrutiny from state attorneys general or consumer protection agencies.

Implementing robust internal controls, staff training, and regular audits are essential. For practices operating across state lines, the complexity multiplies, as state-specific regulations for both insurance and self-pay can vary significantly. Investing in compliance expertise and technology that can adapt to evolving payer rules and regulatory mandates is vital for sustainable growth.

What This Means For Your Practice

This week's regulatory intelligence paints a clear picture: the era of 'move fast and break things' in healthcare is over, if it ever truly existed. The regulatory environment is maturing rapidly, and enforcement is becoming more sophisticated and aggressive. For telehealth founders and operators, brick-and-mortar practice owners expanding nationally, healthcare compliance officers, medspa, dental, chiropractic, and wellness practice owners, and healthcare investors and advisors, several actionable insights emerge:

Proactive Compliance is Non-Negotiable: Do not wait for an enforcement action. Conduct regular, comprehensive audits of your business model, contractual agreements (especially MSO and physician contracts), billing practices, and marketing materials. Ensure every aspect aligns with federal and state regulations.
State-Specific Intelligence is Paramount: There is no 'one-size-fits-all' solution. Every state presents unique challenges, from CPOM doctrines (e.g., NY vs. NV) to telehealth prescribing rules (e.g., controlled substances, patient-provider relationship) and informed consent requirements. Invest in robust regulatory intelligence to understand and adapt to the specific nuances of each jurisdiction where you operate or plan to operate.
Robust Documentation and Internal Controls: Meticulous record-keeping is your first line of defense. Ensure all patient encounters, prescribing decisions, supervision activities, and billing entries are thoroughly documented and support medical necessity. Implement strong internal controls and provide ongoing training to all staff on compliance policies and procedures.
Scrutinize Financial Arrangements: The DOJ's focus on kickbacks means every financial relationship—with lead generators, pharmacies, labs, or other vendors—must be structured to comply with AKS and Stark Law. Ensure compensation is fair market value, commercially reasonable, and not tied to referrals or volume.
Invest in Legal and Compliance Expertise: The complexity of these regulations demands specialized knowledge. Engage experienced healthcare legal counsel and compliance professionals to vet your models, draft agreements, and advise on evolving requirements. This investment is far less costly than the penalties associated with non-compliance.

Looking Ahead

The regulatory landscape will continue to evolve, particularly as federal agencies finalize post-PHE telehealth rules and states continue to refine their own frameworks. We anticipate continued DOJ scrutiny, further clarification on CPOM enforcement, and an increasing emphasis on patient safety and quality of care in virtual settings. Staying ahead requires not just awareness, but a deeply embedded culture of compliance that permeates every aspect of your operation. TrueEval remains committed to providing the insights and infrastructure necessary to navigate this complex terrain, ensuring your practice thrives within the bounds of the law.