Unmasking De Facto Control: Navigating CPOM Enforcement in 2025-2026

2026-07-27

Healthcare businesses operating under PC/MSO models face intensified scrutiny as state regulators, notably California's Attorney General, pivot to enforcing 'de facto' control in corporate practice of medicine (CPOM) restrictions. This shift demands a rigorous re-evaluation of operational structures, contractual arrangements, and the delicate balance between management services and professional autonomy. Understanding and mitigating these risks is paramount for sustained, compliant growth in a rapidly evolving regulatory landscape.

The healthcare compliance landscape is undergoing a profound transformation, marked by an increasingly sophisticated and aggressive enforcement environment. For telehealth innovators, multi-state practice owners, medspas, and other healthcare businesses leveraging the Professional Corporation/Management Services Organization (PC/MSO) model, the critical question is no longer simply, "Are we legally compliant on paper?" but rather, "Do our operational realities demonstrate genuine physician control, or are we exhibiting 'de facto' corporate practice of medicine?"

> For more on this topic, see our analysis: [What the FDA's July 2026 Peptide Vote Means for Your Clinic — and the Compliance Traps to Avoid](/blog/fda-peptide-vote-what-it-means-for-your-clinic-compliance).

Recent actions, particularly from the California Attorney General, signal a pivotal shift. Where previous enforcement often focused on surface-level legal ownership, the emphasis is now firmly on actual operational control. This makes understanding the nuances of CPOM, especially in its de facto manifestation, absolutely essential for any healthcare entity scaling nationally or utilizing MSO structures.

> For more on this topic, see our analysis: [Navigating the Labyrinth: Deconstructing Corporate Practice of Medicine Compliance in 2025-2026](/blog/cpom-compliance-2025-2026-multi-state-challenge).

The Bedrock of CPOM: Protecting Clinical Autonomy

The Corporate Practice of Medicine doctrine, or CPOM, is a long-standing legal principle embedded in the statutes and regulations of many U.S. states. Its fundamental premise is that only licensed physicians (or, in some states, other licensed healthcare professionals) can own and operate medical practices and employ other licensed professionals to deliver medical services. The rationale is clear: to safeguard patient care by preventing unlicensed entities from interfering with clinical judgment, dictating treatment protocols, or compromising the physician-patient relationship for financial gain.

While CPOM originated to prevent direct corporate ownership, the evolution of healthcare business models, particularly the rise of telehealth and national practice groups, necessitated innovative structures. The PC/MSO model emerged as the primary vehicle for achieving this. In theory, a Professional Corporation (PC) owned and operated by licensed physicians provides all clinical services, while a Management Services Organization (MSO) – often a non-clinical, investor-backed entity – handles administrative, non-clinical functions like billing, IT, marketing, HR, and facilities management. The MSO charges the PC a fee for these services.

The De Facto Control Conundrum: California's Clarion Call

The theoretical elegance of the PC/MSO model belies a complex reality, one that is now under unprecedented scrutiny. The California Attorney General's recent enforcement actions, including a $2.3 million settlement with a dental services organization, provide a stark illustration of this shift. As noted in recent regulatory intelligence, California has transitioned to active Attorney General enforcement of CPOM restrictions, focusing specifically on contractual arrangements that grant MSOs or investors de facto control over medical practices.

This means that even if the PC is legally physician-owned, regulators are now looking beyond the organizational chart to the substance of the relationship between the MSO and the PC. Indicators of de facto control include:

MSO dictating clinical protocols or treatment plans: While an MSO can provide operational efficiencies, it cannot instruct a physician on how to practice medicine.
MSO controlling physician hiring, firing, or compensation decisions based on non-clinical metrics: Clinical staff decisions must remain firmly within the purview of the licensed professional.
MSO holding ultimate authority over patient records or clinical IT systems: While the MSO can manage the *technical aspects* of an EMR, the PC must retain legal ownership and control over patient data and clinical decision-making within the system.
MSO having disproportionate financial leverage or receiving fees tied directly to clinical service volume rather than fair market value for administrative services: This can create an incentive for the MSO to influence clinical decisions.
MSO controlling practice branding, marketing, or public communications to the extent that it implies the MSO is delivering medical services.

The essence of the California AG's position is that substance over form will prevail. A legally sound PC/MSO structure on paper is insufficient if the practical operations vest ultimate authority in the MSO or its non-licensed investors.

Areas of Heightened Scrutiny & Practical Checklists

To navigate this intensified enforcement environment, healthcare businesses must meticulously review their PC/MSO arrangements across several critical domains:

1. Clinical Decision-Making and Autonomy

Who sets clinical protocols and treatment guidelines? *It must be the PC's medical director or clinical leadership.*
Who owns and controls patient medical records? *The PC must retain legal ownership and ultimate control.*
Are physicians free to exercise independent medical judgment without MSO interference? *Absolutely essential.*
Is there any MSO influence on referral patterns or choice of specialists? *Highly problematic if so.*

2. Provider Employment, Credentialing, and Compensation

Who employs the licensed providers (physicians, PAs, NPs)? *The PC must be the employer of record for clinical staff.*
Who is responsible for credentialing and privileging decisions? *The PC.*
Are compensation models for providers tied to clinical output, quality metrics, or MSO profitability? *Compensation arrangements must be fair market value for services rendered and avoid any hint of incentivizing unnecessary services. Performance bonuses should ideally be tied to quality and patient outcomes, not merely volume.*
Who makes decisions regarding hiring, firing, and disciplinary actions for clinical staff? *The PC's medical leadership.*

3. Financial Arrangements and Management Fees

Is the MSO's management fee structured at fair market value for the administrative services provided? *Fees should be consistent with prevailing rates for similar services and not directly tied to the PC's clinical revenue or profits, beyond what covers the cost of services plus a reasonable margin.*
Does the MSO receive any direct portion of professional fees generated by the PC? *This is a significant red flag and highly suggestive of CPOM violation.*
Are loans or financing arrangements between the MSO and PC transparent, commercially reasonable, and properly documented? *Avoid arrangements that create undue financial dependence or control by the MSO.*

4. Marketing, Branding, and Public Communications

Whose name appears on patient-facing materials, websites, and advertising? *The PC's name and the names of the licensed professionals delivering care should be prominent. Avoid branding that suggests the MSO is the healthcare provider.*
Who approves marketing claims related to clinical services or patient outcomes? *The PC's medical director or clinical leadership must have final say to ensure accuracy and avoid misleading claims (a focus of FTC enforcement, as seen with TruHeight).*
Does the MSO dictate the practice's unique selling proposition in a way that implies clinical control? *The clinical differentiators should originate from the PC.*

5. Facility, Equipment, and Technology Control

Who makes decisions about the clinical features of physical spaces or telehealth platforms? *The PC should have input and final say over tools impacting patient care.*
Who owns or leases clinical equipment? *While MSOs can lease equipment to PCs, the PC must have operational control over its use.*
Who controls the patient experience flow from a clinical perspective? *The PC, even if the MSO provides the technological infrastructure.*

Multi-State Complexity: A Patchwork of Laws

The challenge of CPOM is amplified for healthcare businesses operating across state lines. Unlike federal laws, CPOM is a state-specific doctrine, meaning what is permissible in one state may be strictly prohibited in another. For instance:

Strong CPOM States: States like California, Texas, New York, and New Jersey have historically robust CPOM enforcement and are often seen as leading the charge on de facto control. These states generally prohibit non-physician ownership and employment of physicians.
Moderate CPOM States: Many states permit certain exceptions or have less stringent interpretations, sometimes allowing specific corporate forms or employment models for non-physician providers.
Lax CPOM States: A few states have largely repealed or never adopted strong CPOM doctrines, offering more flexibility for corporate structures.

This disparate landscape means a "one-size-fits-all" MSO agreement or operational model is a recipe for non-compliance. Each state where a PC/MSO operates must be individually assessed for its specific CPOM rules, exceptions, and the prevailing enforcement climate.

Enforcement Trends and Consequences

The consequences of CPOM violations are severe and far-reaching:

Civil Penalties and Fines: Settlements like the California AG's $2.3 million action demonstrate significant financial exposure.
Injunctions and Operational Disruptions: Regulators can order practices to cease operations or restructure, leading to immense business disruption.
License Revocation: Physicians found to be participating in CPOM violations can face disciplinary action, including suspension or revocation of their medical licenses.
Criminal Charges: In egregious cases, particularly those involving fraudulent billing facilitated by improper corporate structures (as highlighted by the DOJ's National Health Care Fraud Takedown and the Coeur d’Alene physician sentencing), CPOM violations can contribute to evidence of broader healthcare fraud schemes, leading to criminal prosecution.
Reputational Damage: Enforcement actions invariably lead to negative publicity, severely damaging a practice's trust and market standing.

The trend is clear: state attorneys general, medical boards, and other regulatory bodies are increasingly sophisticated in identifying and prosecuting arrangements that circumvent the spirit, not just the letter, of CPOM laws. The 2025-2026 outlook suggests continued aggression against structures that blur the lines between clinical autonomy and corporate influence.

Navigating the Landscape: A Proactive Compliance Framework

For healthcare businesses aiming for compliant, sustainable growth, a proactive and meticulously structured approach is indispensable:

1. Comprehensive Legal Review: Engage experienced healthcare counsel in *each* state of operation to review and, if necessary, revise all MSO agreements, professional service agreements, employment contracts, and other operational documents. Ensure they unequivocally vest clinical control in the PC and its licensed professionals. 2. Operational Alignment: Go beyond the documents. Conduct internal audits to assess actual operational practices. Do the day-to-day realities of your practice reflect physician control over clinical decision-making, hiring, and patient care? Are clinical protocols set by the medical director, not the MSO? 3. Medical Director Empowerment: Ensure your medical director holds genuine authority and responsibility for all clinical aspects of the practice. This includes robust oversight of quality, patient safety, and provider performance, uninfluenced by MSO objectives. 4. Financial Transparency and Fair Market Value: All financial arrangements between the PC and MSO must be transparent, documented, and based on fair market value for services rendered, adhering to anti-kickback and Stark Law principles where applicable. 5. Clear Communication and Branding: Meticulously review all public-facing communications to ensure that the licensed medical practice (PC) is clearly presented as the provider of medical services, not the MSO. Avoid any language that might imply the MSO is directly offering medical care. 6. Ongoing Training and Education: Regularly educate all staff – clinical and administrative – on the principles of CPOM and the specific roles and boundaries of the PC and MSO.

What This Means For Your Practice

The era of passively relying on boilerplate PC/MSO agreements is over. For telehealth platforms, medspas, multi-state dental groups, and other innovative healthcare delivery models, the coming years will demand an unprecedented level of diligence in CPOM compliance. The shift to scrutinizing "de facto control" means that simply having a physician owner on paper is no longer enough; the operational reality must reflect genuine professional autonomy.

Failure to adapt carries not only the risk of substantial financial penalties but also the existential threat of operational shutdown and reputational ruin. TrueEval understands these intricate challenges. Our infrastructure and insights are designed to help you build and maintain compliant PC/MSO structures that withstand intense regulatory scrutiny, ensuring your focus remains on delivering quality patient care while scaling responsibly and securely. Proactive compliance is not just a shield against enforcement; it is a foundational pillar for sustainable growth in the modern healthcare economy.