The Compliance Crucible: Navigating Telehealth, CPOM, and Enforcement in a Shifting Regulatory Landscape

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

The past week has underscored a critical truth in healthcare: regulatory scrutiny is intensifying across all sectors, from telehealth to medspas. This digest offers a strategic overview of key enforcement actions, evolving state regulations, and the persistent challenges of CPOM, providing actionable intelligence for leaders navigating this complex environment.

The healthcare regulatory landscape is not merely evolving; it is undergoing a profound transformation, demanding unprecedented vigilance from telehealth founders, practice owners, and compliance officers alike. The past week's intelligence highlights a critical nexus of challenges: aggressive federal enforcement, a fragmented state-level regulatory patchwork, and the enduring complexities of the Corporate Practice of Medicine (CPOM). For any entity operating in this space, understanding these dynamics is not just about avoiding penalties—it's about ensuring sustainable growth and ethical patient care.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating DOJ Scrutiny, Evolving Telehealth Rules, and CPOM Minefields](/blog/compliance-crucible-doj-telehealth-cpom).

DOJ's Unrelenting Focus: Telehealth Fraud and Kickback Schemes

The Department of Justice (DOJ) continues to signal its zero-tolerance policy for fraud, waste, and abuse within the burgeoning telehealth sector. Recent enforcement actions underscore a clear message: the rapid expansion of virtual care, while beneficial for access, has also opened new avenues for illicit activities, and federal authorities are equipped and determined to prosecute. Our intelligence confirms that the DOJ is particularly vigilant regarding schemes involving medically unnecessary services, billing for services not rendered, and sophisticated kickback arrangements.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating DOJ Scrutiny, Evolving Telehealth Rules, and CPOM Minefields](/blog/compliance-crucible-doj-telehealth-cpom).

For telehealth brands, this means every financial relationship—from lead generators to pharmacies and laboratories—is under intense scrutiny. The Anti-Kickback Statute (AKS) is not a suggestion; it's a foundational pillar of compliance. Agreements disguised as marketing fees, administrative services, or consulting contracts must be meticulously structured to fall within established safe harbors. Failure to do so risks not only civil penalties under the False Claims Act (FCA) but also criminal charges and exclusion from federal healthcare programs. This is not a theoretical risk; it's a present danger, with multi-million dollar settlements and indictments becoming increasingly common. Businesses must conduct rigorous due diligence on all third-party vendors and ensure that compensation arrangements are genuinely fair market value and commercially reasonable, devoid of any direct or indirect inducement for referrals.

Medspas, dental practices, and chiropractic offices integrating telehealth components or engaging in referral networks are equally exposed. Any referral for durable medical equipment (DME), diagnostic tests, or specialty consultations must be based solely on clinical necessity, not financial incentives. The DOJ's enforcement net is wide, catching not just the primary perpetrators but also those who facilitate or benefit from fraudulent schemes. Robust compliance programs, regular internal audits, and ongoing staff training are no longer optional expenditures but essential investments to safeguard your practice's future.

The Enduring Shadow of Corporate Practice of Medicine (CPOM)

The Corporate Practice of Medicine (CPOM) doctrine remains a formidable barrier for many healthcare businesses, particularly those with innovative, non-traditional models like telehealth and medspas. Our recent intelligence highlights the stark contrast in CPOM enforcement across states, from New York's stringent prohibitions to Nevada's more flexible, yet still regulated, approach.

New York's Strict Stance: A Blueprint for Caution

New York maintains one of the nation's most aggressive CPOM doctrines, explicitly prohibiting corporations from employing physicians or directly practicing medicine. For telehealth companies operating or expanding into the Empire State, this mandates a meticulously structured Physician-Controlled Management Services Organization (PC-MSO) model. The professional entity (PE) must be genuinely physician-owned and controlled, retaining absolute clinical autonomy over all medical decision-making, patient care, and professional employment. The MSO's role is strictly confined to providing non-clinical administrative, technical, and management services. Any perceived influence by the MSO over clinical aspects—from treatment protocols to physician hiring—can trigger severe violations from the New York State Education Department (NYSED) or the Office of the Attorney General. This applies equally to medspas, dental practices, and chiropractic offices; all professional services must be delivered by licensed practitioners employed by a compliant professional entity.

Nevada's Nuance: Flexibility, Not Permissiveness

In contrast, Nevada is often cited for its more flexible CPOM enforcement, particularly accommodating Management Services Organization (MSO) models for telehealth and medspa businesses. However, this flexibility is not an invitation for laxity. While MSOs can provide extensive administrative support, the critical compliance point is ensuring the MSO does not exert control over clinical decision-making, physician employment, or engage in illegal fee-splitting. The Nevada State Board of Medical Examiners and other regulatory bodies will scrutinize MSO agreements to ensure the physician-owned professional corporation (PC) retains full control over medical judgments, clinical hiring, and fee setting. For dental and chiropractic practices, similar vigilance is required to maintain professional independence.

DTC Telehealth Weight Loss Brands: A CPOM Hotbed

DTC telehealth weight loss brands face particular scrutiny under CPOM, especially in states like California, Texas, New York, and Ohio. The tension between corporate structure and physician autonomy is acute. Simply contracting with physicians is insufficient; the nature of that contract, the degree of corporate influence on treatment protocols, and revenue-sharing mechanisms are all under the microscope. If a platform dictates specific weight loss treatments or formularies without independent physician judgment, it risks violating CPOM. Similarly, revenue-sharing models tied to prescription volume can be construed as illegal fee-splitting. Auditing business models, physician contracts, and marketing practices with experienced healthcare legal counsel is crucial to avoid license revocations, civil monetary penalties, and criminal charges.

The Patchwork of Telehealth Regulations: State-Specific Nuances

The post-PHE telehealth landscape is characterized by a complex, fragmented regulatory environment. There is no uniform federal standard for establishing a patient-provider relationship or prescribing controlled substances via telehealth, forcing businesses to navigate a state-by-state maze.

Sexual Wellness Platforms and Controlled Substances

Telehealth platforms specializing in sexual wellness, or any area involving controlled substances, face a particularly intricate web of regulations. The DEA's Ryan Haight Act generally requires an in-person medical evaluation for controlled substance prescribing via telemedicine, with limited exceptions. While the DEA has proposed new rules, the landscape remains dynamic. State medical boards often impose additional restrictions, including limits on Schedule II substances, specific documentation requirements, and prohibitions on prescribing controlled substances via telehealth without prior in-person visits. This directly impacts the operational viability of such platforms. Robust state-by-state legal analysis for every jurisdiction is non-negotiable, encompassing medical board rules, pharmacy board regulations, and state statutes.

Chiropractic Telehealth: Defining the Digital Scope

State chiropractic boards are increasingly defining the permissible scope of telehealth for chiropractors. Many states still require an in-person initial visit to establish a legitimate patient-practitioner relationship, limiting fully remote care. This necessitates hybrid models or careful patient vetting. For chiropractic offices integrating telehealth, clear protocols are needed to distinguish services appropriate for virtual versus in-person visits. While telehealth can support follow-ups and lifestyle advice, it generally cannot replace hands-on diagnostic or therapeutic procedures. All virtual interactions must use secure, HIPAA-compliant technology and maintain comprehensive documentation.

Informed Consent: A Foundational, Yet Fragmented, Requirement

Informed consent, a bedrock principle of healthcare, takes on specific, state-specific considerations in telehealth. Our intelligence confirms that there is no single federal standard, requiring a meticulous, state-by-state approach. Telehealth platforms, medspas, dental practices, and chiropractic offices must integrate dynamic consent workflows that present state-specific disclosures. This could include explicit warnings about technology failures, specific language on data privacy, or nuanced requirements for prescribing via telehealth. Failure to capture these nuances can lead to regulatory penalties and malpractice claims. Regular audits and updates to consent forms and processes are essential, especially as post-PHE policies continue to evolve.

DC's Pharmacy Board: Telehealth Prescribing and Compounding

The District of Columbia Board of Pharmacy's regulations offer a microcosm of state-level detail, emphasizing proper patient-provider relationships for telehealth prescribing, even for controlled substances. Medspas prescribing injectables or topical treatments must ensure their practices align with DC's requirements, including comprehensive patient records and verification of prescription legitimacy. For practices involved in compounding, strict adherence to USP standards and DC compounding regulations is mandatory. Any medication fulfillment must occur with DC-licensed entities, underscoring the need for vetting partner pharmacies.

Supervision and Delegation: The Washington State Example

The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) provide a strong example of how states are tightening rules around physician and ARNP supervision and delegation, particularly in telehealth and medspa settings. For telehealth brands, this means more than just a paper agreement; it demands a robust, documented process for ongoing collaboration, chart review, and availability for consultation. Systems must be in place to facilitate effective communication and escalation.

Medspa businesses are significantly impacted, as aesthetic procedures are often performed by PAs and ARNPs. The WMC and NCQAC rules require supervising practitioners to ensure PAs/ARNPs have the necessary training and competency for each procedure, including understanding complications and emergency protocols. Meticulous records of delegation agreements, training, and ongoing supervision are crucial. Non-compliance can lead to disciplinary action against all involved practitioners and legal liability for the practice.

Billing and Coding: Navigating Commercial Insurance and Self-Pay

Telehealth billing and coding compliance is a critical risk management function, not just an administrative task. Missteps can lead to claim denials, recoupments, audits, and severe penalties, including False Claims Act violations.

Commercial Insurance: Providers must stay abreast of payer-specific telehealth policies, which vary widely by plan and state. Accurate use of CPT/HCPCS codes, appropriate telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and correct place of service (POS) codes (e.g., 02 for telehealth from a location other than the patient's home, 10 for telehealth in the patient's home) are paramount. Documentation must clearly support the billed services, including medical necessity, modality, and patient consent.

Self-Pay Models: While seemingly simpler, self-pay models introduce challenges around price transparency and consumer protection. The No Surprises Act, for instance, mandates good faith estimates for uninsured and self-pay patients. Telehealth businesses must provide clear, upfront pricing for all services, avoiding deceptive marketing practices to prevent consumer complaints and regulatory scrutiny from state attorneys general.

What This Means For Your Practice

The current regulatory environment demands a proactive, sophisticated approach to compliance. For telehealth founders and operators, this means embedding compliance into your core business model from inception, not as an afterthought. For brick-and-mortar practice owners expanding nationally, it requires a granular understanding of each state's unique legal landscape. Healthcare compliance officers must be empowered with resources to conduct continuous audits and implement dynamic training programs. Medspa, dental, chiropractic, and wellness practice owners must recognize that the lines between traditional and virtual care are blurring, and regulatory scrutiny applies across the spectrum.

Key Actions:

Conduct State-Specific Regulatory Audits: For every state you operate in or plan to, perform a deep dive into CPOM, telehealth prescribing, supervision, and informed consent requirements. This is especially critical for multi-state operations.
Fortify Your MSO/PC Structures: If utilizing an MSO model, ensure your agreements and operational workflows unequivocally preserve physician autonomy and comply with state-specific CPOM doctrines, particularly in strict states like New York.
Review All Financial Arrangements: Scrutinize all vendor contracts, referral agreements, and compensation structures for AKS and Stark Law compliance. Document fair market value and commercial reasonableness for all transactions.
Standardize and Localize Consent: Develop a robust, dynamic informed consent process that adapts to the specific requirements of each state where your patients reside.
Invest in Billing and Coding Expertise: Ensure your billing practices are meticulously aligned with commercial payer policies and federal/state self-pay transparency rules. Train staff on correct CPT/HCPCS codes, modifiers, and POS indicators.
Implement Robust Compliance Programs: Foster a culture of compliance through ongoing training, clear policies and procedures, and regular internal and external audits. This is your primary defense against enforcement actions.

The regulatory crucible is heating up, but with strategic foresight and diligent compliance, your practice can not only navigate these challenges but also emerge stronger, more resilient, and poised for ethical growth in the evolving healthcare ecosystem. TrueEval stands ready to be your partner in this journey, transforming regulatory complexity into actionable intelligence.