The Compliance Crucible: Navigating Intensified Scrutiny in Telehealth, Medspas, and Controlled Substance Prescribing

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for healthcare businesses is intensifying, with federal and state agencies sharpening their focus on telehealth, medspas, and controlled substance prescribing. This roundup dissects recent enforcement actions, new rules, and critical guidance, offering actionable insights for navigating this complex environment.

The healthcare regulatory environment is in a state of dynamic evolution, characterized by both expanded opportunities and heightened scrutiny. For telehealth operators, medspas, and traditional clinical practices, understanding and proactively responding to these shifts is not merely advisable—it is imperative for sustained viability and risk mitigation. This regulatory roundup distills the most critical recent developments, translating complex legal and policy changes into actionable intelligence for your practice.

> For more on this topic, see our analysis: [Navigating the New Regulatory Frontier: DEA Crackdowns, CPOM Scrutiny, and State-Specific Telehealth Compliance](/blog/navigating-new-regulatory-frontier-dea-cpom-telehealth-compliance).

DOJ and DEA Sharpen Focus on Telehealth Controlled Substance Prescribing

The Department of Justice (DOJ) and the Drug Enforcement Administration (DEA) have unequivocally signaled an intensified enforcement posture regarding telehealth-based controlled substance prescribing. This is not a subtle shift; it's a direct response to perceived abuses during and post-pandemic, with severe implications for non-compliant entities.

Key Developments:

DOJ Enforcement: The DOJ has significantly increased its prosecution of telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This trend underscores the critical importance of strict adherence to federal and state prescribing regulations, particularly the Ryan Haight Act and the 'legitimate medical purpose' requirement for telehealth encounters. The DOJ's actions highlight that mere technical compliance with emergency waivers (like those related to the Ryan Haight Act during the COVID-19 Public Health Emergency, or PHE) is insufficient if the underlying medical practice lacks a legitimate medical purpose or if the platform incentivizes or enables diversion. Penalties can include criminal charges, imprisonment, substantial fines, and exclusion from federal healthcare programs.

DEA Proposed Rules & PHE Flexibilities: The DEA has issued proposed rules outlining requirements for prescribing controlled medications via telehealth, including buprenorphine for opioid use disorder (OUD). These rules aim to balance access to care with diversion prevention. While the initial proposed rule had a stricter stance, the DEA later issued a supplemental proposed rule indicating that the COVID-19 PHE flexibilities would be extended until November 11, 2023, and for an additional year (until November 11, 2024) for patient-prescriber relationships established during the PHE. This extension provides a temporary reprieve but underscores the eventual return to stricter requirements. For new patients, an initial in-person medical evaluation for Schedule II and certain Schedule III-V controlled substances will likely be required, with specific exceptions for buprenorphine. This directly impacts telehealth providers offering OUD treatment, as they must prepare for a future where an initial in-person visit or a referral from a practitioner who has conducted one will be necessary for new buprenorphine patients.

DEA Registration Across State Lines: The complexity of DEA registration for telehealth providers prescribing controlled substances across state lines remains a critical concern. With the expiration of PHE waivers, the regulatory environment is reverting closer to the pre-PHE rules governed by the Ryan Haight Act. Providers must not only be licensed in the state where the patient is located but also hold a DEA registration in that state if they intend to prescribe controlled substances to patients there. This necessitates a robust credentialing and compliance infrastructure to track provider licenses, DEA registrations, and state-specific prescribing rules.

Actionable Implications:

Telehealth Operators: Rigorously re-evaluate patient intake protocols, provider training, and technological safeguards. Ensure every controlled substance prescription is preceded by a comprehensive, individualized medical evaluation that meets federal and state standards, including appropriate physical examinations where necessary. Develop robust protocols to document in-person evaluations (or valid exceptions), track PHE-established relationships, and maintain meticulous records. Invest in compliance software and legal counsel specializing in telehealth and DEA regulations.
Medspas, Dental, and Chiropractic Practices: While direct controlled substance prescribing exposure may be lower, any ancillary telehealth services must comply with general telehealth best practices. If partnering with or referring to telehealth platforms that prescribe controlled substances, ensure those platforms are operating legally to avoid indirect scrutiny.

State Boards Intensify Scrutiny on Telehealth and Medspa Operations

Beyond federal oversight, state medical and professional boards are increasingly active in monitoring and enforcing regulations, particularly in emerging areas like telehealth and medspas. These actions highlight the importance of state-specific compliance and adherence to professional scope of practice.

Key Developments:

Michigan Board of Medicine Enforcement: The Michigan Board of Medicine is actively monitoring and enforcing regulations related to telehealth and medspa operations. Disciplinary actions often stem from issues like unprofessional conduct, scope of practice violations, and inadequate supervision. For telehealth brands, this means ensuring all practitioners are appropriately licensed in Michigan, patient-provider relationships are established in accordance with state law (e.g., proper initial evaluations, informed consent), and prescribing practices adhere to Michigan's Public Health Code (MCL 333.16101 et seq.) and administrative rules (Michigan Administrative Code R 338.2301 et seq.). Medspa operators face unique challenges related to scope of practice and delegation, requiring active medical director engagement and appropriate on-site supervision.

District of Columbia Telehealth Prescribing: The District of Columbia has specific regulations governing the establishment of a valid provider-patient relationship via telehealth, which is a prerequisite for prescribing. Practitioners must adhere to these standards, including a real-time, interactive audio-visual examination for initial patient encounters, with limited exceptions. This directly impacts business models relying on asynchronous or audio-only initial consultations, as they are generally insufficient for initiating a prescribing relationship.

Chiropractic Telehealth Regulations: State chiropractic boards across all 50 states and D.C. are issuing guidance and regulations on telehealth for chiropractic care. These often define permissible services, require patient consent, and specify documentation standards. The ability to conduct initial consultations, establish a patient-provider relationship, and deliver certain therapeutic interventions remotely varies significantly by state. Practices must meticulously review their state's chiropractic board rules regarding the definition of a 'physical examination' and whether it can be adapted for telehealth.

Actionable Implications:

Telehealth Operators: Implement robust credentialing processes to verify state licensure for all practitioners. Develop state-specific clinical protocols that align with board requirements for establishing patient-provider relationships and prescribing. Ensure technology platforms support required interaction modalities (e.g., real-time audio-visual). Regularly audit compliance with state-specific administrative rules.
Medspa Operators: Ensure medical directors are actively engaged and providing direct, on-site supervision as required by state law. Clearly delineate services that can only be performed by a physician, those that can be delegated under supervision, and those outside the scope of non-medical personnel. Avoid misrepresentation of services or provider qualifications. Proactive internal audits and comprehensive staff training are essential.
Dental and Chiropractic Practices: Ensure all services, including any adjunctive or telehealth offerings, remain strictly within the defined scope of practice for their respective licenses. Any delegated tasks must be performed by appropriately trained and supervised personnel. Meticulously review state board rules for telehealth allowances and limitations.

Corporate Practice of Medicine (CPOM) Remains a High-Stakes Challenge

The Corporate Practice of Medicine (CPOM) doctrine continues to be a significant regulatory hurdle, particularly for innovative business models like direct-to-consumer (DTC) telehealth and medspas. States vary in their enforcement, but the underlying principle—protecting clinical independence from corporate influence—is consistently applied.

Key Developments:

Iowa's Strict CPOM: Iowa maintains a strict CPOM doctrine, prohibiting corporations and non-licensed entities from employing physicians or controlling medical decision-making. This significantly impacts telehealth providers and medspas, requiring careful adherence to professional corporation (PC) models or meticulously structured Management Service Organization (MSO) arrangements. Direct employment of Iowa-licensed providers by a national telehealth company that is not itself an Iowa-licensed PC is likely non-compliant. Medspas providing medical services must typically be owned by licensed professionals, with the medical director genuinely overseeing and supervising services.

Kentucky's Moderate CPOM: Kentucky is considered a moderate enforcement state for CPOM. While generally recognized and enforced, specific statutory exceptions or common practices allow for certain compliant structures. Telehealth providers and medspas must ensure the entity providing medical services is professionally owned and controlled. MSOs can provide administrative support but cannot dictate clinical decisions, employ licensed professionals who render medical services, or share professional fees. The MSO agreement must clearly delineate clinical and administrative functions.

CPOM for DTC Telehealth Weight Loss Brands: DTC telehealth weight loss brands, especially those prescribing medications like GLP-1 agonists, face critical CPOM challenges. The tension between scalable, technology-driven business models and laws designed to protect the physician-patient relationship from commercial influence is acute. Clinical decisions, prescribing, and patient care protocols must remain solely under the control of licensed medical professionals, not corporate entities or non-clinician management. MSO models must be meticulously structured to avoid any influence over clinical decision-making, fee-splitting, or direct employment of clinical staff, with financial relationships at fair market value for administrative services.

Actionable Implications:

Telehealth Founders & Operators: Proactively engage legal counsel experienced in multi-state CPOM analysis. Structure your business to ensure clinical decision-making, employment of licensed practitioners, and receipt of professional fees remain within the purview of a professionally owned and controlled entity (e.g., PC or PLLC). If utilizing an MSO model, ensure the agreement clearly separates clinical and administrative functions, avoids fee-splitting, and establishes fair market value for services.
Medspa Owners: Ensure your ownership structure complies with state CPOM laws. If non-physician owned, verify that medical services are provided by a separate, professionally owned entity or through a compliant MSO arrangement that respects professional independence. The medical director must be genuinely engaged and not a mere figurehead.
All Practices Expanding Nationally: Conduct a comprehensive CPOM analysis for every state of operation. Non-compliance can lead to severe penalties, including license revocation, corporate dissolution, civil penalties, and even criminal charges for illegal practice of medicine.

CMS Expansions and Their Impact

While enforcement intensifies in some areas, the Centers for Medicare & Medicaid Services (CMS) continues to expand telehealth services, signaling a long-term commitment to virtual care.

Key Developments:

Expanded Telehealth Services and Provider Eligibility: CMS has continued to expand the list of services eligible for Medicare reimbursement when furnished via telehealth, along with broadening the types of providers who can deliver these services. These updates reflect a sustained commitment to integrating telehealth into the permanent healthcare landscape, moving beyond pandemic-era flexibilities. This creates growing market opportunities but also necessitates meticulous attention to billing codes, documentation, and compliance with evolving originating and distant site rules.

Actionable Implications:

Telehealth Brands: Capitalize on expanded reimbursement opportunities by ensuring your systems can accurately capture and submit claims for newly eligible services. Stay current with specific CPT codes added to the Medicare telehealth services list and any associated modifiers.
Medspas & Chiropractic Offices: If you incorporate medical services or have licensed medical professionals on staff, explore new avenues for patient engagement and follow-up care through telehealth. Ensure the scope of practice aligns with state licensure and Medicare's specific service definitions for telehealth. Understand which CPT codes are designated as telehealth-eligible and ensure services align precisely with those definitions.
All Practices: Invest in robust compliance infrastructure and ongoing staff training to navigate billing, documentation, and technology requirements (HIPAA-compliant platforms). Failure to comply can result in claim denials, audits, and potential fraud and abuse investigations.

What This Means For Your Practice

The current regulatory climate demands a proactive, multi-faceted compliance strategy. The days of viewing compliance as a reactive measure are over. For telehealth operators, medspas, and clinical practices, the message is clear:

1. State-Specific Due Diligence is Non-Negotiable: Understand and adhere to the nuances of each state's professional board regulations, CPOM doctrines, and telehealth laws. A 'one-size-fits-all' approach is a recipe for non-compliance. 2. Robust Compliance Infrastructure: Implement comprehensive compliance programs that include regular internal audits, detailed policy and procedure manuals, and continuous staff training. This is particularly crucial for controlled substance prescribing and patient-provider relationship establishment. 3. Active Medical Director Engagement: For medspas and other practices utilizing delegated services, ensure your medical director is genuinely engaged, providing active supervision, and is not merely a name on paper. 4. Legal Counsel as a Strategic Partner: Engage experienced healthcare regulatory counsel early and often. Proactive legal review of business structures, MSO agreements, and clinical protocols can prevent costly enforcement actions down the line. 5. Stay Informed: The regulatory landscape is constantly shifting. Subscribe to agency updates, monitor legal publications, and leverage resources like TrueEval to stay ahead of changes.

The increasing convergence of federal and state enforcement, coupled with evolving regulations, creates a complex but navigable environment. By prioritizing compliance and adopting a forward-looking perspective, healthcare businesses can not only mitigate risk but also build a foundation for sustainable growth and trusted patient care.

The Compliance Crucible: Navigating Intensified Scrutiny in Telehealth, Medspas, and Controlled Substance Prescribing

DOJ and DEA Sharpen Focus on Telehealth Controlled Substance Prescribing

State Boards Intensify Scrutiny on Telehealth and Medspa Operations

Corporate Practice of Medicine (CPOM) Remains a High-Stakes Challenge

CMS Expansions and Their Impact

What This Means For Your Practice

Further Reading