Navigating the Crossroads: A Deep Dive into Indiana's Complex Healthcare Regulatory Landscape

2026-08-04

Indiana's healthcare sector is vibrant but characterized by a stringent regulatory framework that demands meticulous attention to compliance. This guide offers an authoritative overview of the Hoosier State's key healthcare laws, from its robust Corporate Practice of Medicine doctrine to evolving telehealth and controlled substance prescribing rules, providing a roadmap for providers and investors alike.

The Hoosier State, with its burgeoning healthcare innovation and strategic Midwest location, presents compelling opportunities for growth. Yet, for telehealth founders, brick-and-mortar practices considering expansion, compliance officers, and investors, Indiana's healthcare regulatory landscape is a complex tapestry woven with specific, often stringent, requirements. Ignoring these nuances is not merely a risk; it is an invitation to significant legal and financial peril. To thrive in Indiana's healthcare market, a sophisticated understanding of its unique compliance architecture is paramount.

> For more on this topic, see our analysis: [Tennessee's Healthcare Compliance Compass: Navigating CPOM, Telehealth, and Prescribing for Sustainable Growth](/blog/tennessee-healthcare-compliance-roadmap).

At TrueEval, we consistently advise our clients that a one-size-fits-all approach to multi-state expansion is a critical misstep. Indiana exemplifies why. Its adherence to the Corporate Practice of Medicine (CPOM) doctrine, alongside its distinct rules governing telehealth, controlled substance prescribing, and professional oversight, necessitates a tailored compliance strategy. This analysis serves as your essential guide to understanding and navigating Indiana's intricate healthcare compliance environment.

The Bedrock of Compliance: Indiana's Corporate Practice of Medicine Doctrine

Indiana is widely recognized as a strong Corporate Practice of Medicine (CPOM) state, a foundational principle that dictates who can employ physicians and deliver medical services. The core tenet, derived from common law and reinforced by statutory interpretations, is that only licensed physicians or entities entirely owned and controlled by physicians can practice medicine. This doctrine is codified and supported by various provisions within the Indiana Code, including those governing the practice of medicine (Indiana Code Title 25, Article 22.5) and professional corporations.

What this means in practice is that non-physician-owned entities are generally prohibited from directly employing physicians or controlling clinical decision-making. This has profound implications for how healthcare businesses, particularly those backed by private equity or operated by non-physician entrepreneurs, must structure their operations in Indiana. The traditional model that emerges to navigate CPOM in Indiana is the Management Services Organization (MSO) model.

In an MSO arrangement, the administrative and non-clinical aspects of a practice (e.g., billing, scheduling, marketing, real estate, technology, human resources for non-clinical staff) are managed by a separate, often non-physician-owned, entity (the MSO). The clinical services, however, are provided by a professional medical corporation (PC) or other physician-owned entity, which directly employs the physicians and other licensed providers and holds the necessary medical licenses. The MSO then contracts with the PC to provide management services, typically receiving a fee for these services.

Key compliance considerations for MSOs in Indiana include: * No Control Over Clinical Judgment: The MSO must not interfere with, influence, or control the professional judgment of the licensed clinicians. Clinical decisions, hiring/firing of clinical staff, and professional standards remain solely with the physician-owned entity. * Fair Market Value (FMV) for Services: All financial arrangements between the MSO and the PC must be set at fair market value and documented meticulously. Fees for management services should not be tied to the volume or value of referrals or directly to patient revenues, as this could trigger concerns under federal and state anti-kickback statutes or fee-splitting prohibitions. Indiana law generally prohibits fee-splitting among professionals where one professional pays another for referrals or where a non-professional shares in professional fees, unless specific statutory exceptions apply (e.g., within bona fide employment relationships or partnerships). * Separation of Identities: While the MSO and PC may collaborate closely, they must maintain distinct corporate identities and operational boundaries. Clear contractual delineation of responsibilities is essential.

Enforcement in Indiana, while not always generating headlines akin to states like California, is steady. The Indiana Medical Licensing Board and the Attorney General's office remain vigilant against arrangements perceived to compromise physician autonomy or patient care, especially those that appear to skirt CPOM regulations or involve unlawful fee-splitting. Businesses operating or expanding into Indiana must ensure their MSO structures are meticulously crafted and consistently maintained to withstand scrutiny.

Navigating the Digital Frontier: Telehealth Regulations in Indiana

Indiana has embraced telehealth as a vital component of modern healthcare delivery, yet it has established clear parameters for its use. The state's telehealth statutes and regulations (primarily Indiana Code 25-1-9.5 and Indiana Board of Medicine rules) dictate how virtual care can be delivered and compensated.

Key elements of Indiana's telehealth framework include: * Established Patient-Provider Relationship: Indiana requires that an appropriate patient-provider relationship be established before a healthcare provider can deliver telehealth services. This generally means the provider must have sufficient information to diagnose and treat the patient safely and effectively, which typically involves a comprehensive history and, when necessary, a physical examination. While the law permits establishing this relationship through an initial telehealth encounter, the standard of care for an in-person visit applies to a telehealth visit. This is a critical point of distinction from states with more permissive initial encounter rules. * Permitted Modalities: Indiana law explicitly recognizes live two-way audio-visual communication as a primary modality for telehealth. While audio-only telehealth is permitted in some contexts, particularly for behavioral health, its scope is more limited than full audio-visual. Asynchronous (store-and-forward) technology is also recognized but requires appropriate safeguards and patient consent. * Informed Consent: Providers must obtain informed consent from patients for telehealth services, ensuring patients understand the nature of telehealth, its limitations, potential risks, and privacy protections. This consent should be clearly documented in the patient's medical record. * Licensure: Perhaps the most critical requirement: Indiana requires all healthcare professionals providing telehealth services to patients located in Indiana to be licensed in Indiana. This aligns with the long-standing principle that healthcare is regulated at the state level based on the patient's location at the time of service. Indiana is a member of the Interstate Medical Licensure Compact (IMLC), which streamlines the licensing process for eligible physicians already licensed in a compact state, significantly easing multi-state expansion for physician-led telehealth platforms. * Reimbursement: Indiana has specific laws regarding telehealth reimbursement by private payers, generally requiring coverage for services delivered via telehealth if those services would be covered in-person. The recent CMS finalization of a permanent telehealth services list and expanded coverage (as highlighted in our recent intelligence) provides additional federal clarity for Medicare beneficiaries, which Indiana providers must integrate into their billing practices.

Professional Practice and Oversight: Medical Board Requirements and Collaborative Models

The Indiana Medical Licensing Board (IMLB) is the primary regulatory body overseeing physicians, physician assistants, and other licensed professionals. Its rules govern the standard of care, professional conduct, and the specific requirements for practicing within the state, including via telehealth.

Medical Board Requirements for Telehealth Providers: The IMLB holds telehealth providers to the same standard of care as traditional in-person care. This means that if a physical examination is deemed necessary for proper diagnosis or treatment according to professional standards, and it cannot be performed adequately via telehealth, the provider must either refer the patient for an in-person exam or decline to provide care via telehealth. Violations of the standard of care, regardless of modality, can lead to disciplinary action.

Collaborative Practice and Supervision Requirements: Indiana maintains distinct requirements for mid-level practitioners: * Nurse Practitioners (APRNs): Indiana does not grant full practice authority to Nurse Practitioners. APRNs must operate under a collaborative agreement with a supervising physician. This agreement outlines the scope of practice, protocols, and supervision requirements, ensuring physician oversight. This significantly impacts the operational models of practices relying heavily on APRNs, particularly in primary care or specialty areas where autonomy is sought. * Physician Assistants (PAs): PAs in Indiana must operate under a supervision agreement with a collaborating physician. The agreement specifies the PA's scope of practice, which is delegated by the supervising physician and generally limited to the physician's own scope. Indiana has modernized some aspects of PA supervision, moving towards a more team-based approach, but direct oversight remains a fundamental component.

These requirements mean that practices utilizing APRNs or PAs must establish and meticulously maintain robust collaborative or supervision agreements, ensuring they meet IMLB specifications. Any deviation can result in disciplinary action against both the supervising physician and the mid-level provider.

Controlled Substances: A High-Stakes Compliance Area

Prescribing controlled substances in Indiana, especially via telehealth, is a highly regulated activity. Providers must navigate both federal (DEA) and state (Indiana) laws.

DEA Telehealth Flexibilities: The recent extension by the DEA and HHS of telemedicine flexibilities for controlled substance prescribing through December 31, 2026, is a critical lifeline for telehealth providers. This temporarily waives the requirement for an initial in-person medical evaluation before prescribing controlled substances via telehealth. However, this is a temporary measure. Providers must understand that the DEA intends to finalize permanent rules, including a 'Special Registration for Telemedicine,' and future requirements could revert to stricter in-person visit mandates. Practices should prepare for potential shifts by the end of 2026.
Indiana-Specific Rules: While the DEA extension provides federal cover, Indiana law also contains provisions regarding controlled substance prescribing (Indiana Code Title 35, Article 48). Critically, Indiana mandates the use of its Prescription Drug Monitoring Program (PDMP), known as INSPECT, for all Schedule II, III, IV, and V controlled substance prescriptions. Providers must consult INSPECT before issuing such prescriptions and at regular intervals for ongoing treatment. Failure to do so is a common compliance pitfall.
Legitimate Medical Purpose: Both federal and state law emphasize that controlled substances must be prescribed for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. This requires thorough patient evaluations, proper documentation, and ongoing monitoring. For telehealth, this often means ensuring robust diagnostic capabilities and a clear treatment plan, even if the initial encounter is virtual. Prescribing based solely on an online questionnaire without a synchronous audio-visual encounter or sufficient medical history is highly risky and likely to draw regulatory attention.

Recent Enforcement Context: The DEA's proposed expansion of List I chemical definitions (seen in our intelligence) underscores the agency's broad and proactive approach to drug control. While not directly impacting common telehealth prescribing, it highlights the intensive regulatory environment surrounding *all* aspects of controlled substances, reminding providers of the vigilance required to avoid diversion and maintain compliance. Any deviation from prescribing best practices can lead to severe penalties, including license suspension, fines, and criminal charges.

Licensure and Beyond: State-Specific Operational Hurdles

Beyond professional licensure and CPOM, healthcare businesses in Indiana must consider several other state-specific registration and operational requirements:

Business Registration: All entities operating in Indiana must register with the Indiana Secretary of State. This includes forming the appropriate business entity (e.g., LLC, Corporation) and maintaining annual filings.
Facility Licensing: Certain types of healthcare facilities (e.g., ambulatory surgical centers, hospitals, nursing homes, some specialized clinics) require specific licensing from the Indiana Department of Health (IDOH). While many direct-to-consumer telehealth or medspa practices may not fall under these specific facility licenses, it's crucial to assess if the services or physical footprint triggers any IDOH requirements.
Professional License Maintenance: All licensed professionals must adhere to continuing education (CME) requirements and timely license renewals. The IMLB actively monitors compliance with these requirements.
Data Privacy & Security: While HIPAA is federal, Indiana law may have additional nuances regarding patient data. Furthermore, as demonstrated by the FTC's actions against Hims & Hers, GoodRx, and NextMed for deceptive data sharing and billing practices, any healthcare entity, regardless of state, is under intense scrutiny regarding consumer privacy. Businesses in Indiana must have transparent privacy policies, secure data handling protocols, and obtain explicit, informed consent for any data sharing, especially with third-party advertising platforms. Indiana's Attorney General is empowered to investigate unfair or deceptive trade practices, and these federal enforcement actions serve as a blueprint for potential state-level investigations.

Key Compliance Pitfalls and Strategic Mitigation

For any healthcare organization operating or expanding into Indiana, several common compliance pitfalls demand immediate attention:

1. Improper MSO Structuring: Failing to adhere to CPOM by exerting undue control over clinical decisions or engaging in unlawful fee-splitting. Mitigation: Ensure MSO agreements are rigorously reviewed by counsel specializing in Indiana healthcare law, maintain clear separation of clinical and administrative functions, and establish FMV for all services. 2. Telehealth Licensure Non-Compliance: Providing telehealth services to Indiana residents without proper Indiana licensure for each provider. Mitigation: Verify all providers hold active Indiana licenses or are eligible and apply for IMLC expedited licensure. Implement robust credentialing processes. 3. Inadequate Patient-Provider Relationship: Initiating treatment via telehealth without establishing an appropriate patient-provider relationship, especially for prescribing. Mitigation: Adhere to IMLB standards, ensuring initial consultations gather sufficient information, and refer for in-person care when clinically necessary. 4. Controlled Substance Prescribing Deviations: Ignoring INSPECT requirements, failing to document legitimate medical purpose, or misunderstanding the temporary nature of DEA flexibilities. Mitigation: Mandate INSPECT checks, establish clear protocols for prescribing controlled substances via telehealth, and keep abreast of upcoming DEA permanent rules. 5. Deceptive Advertising and Billing: Making unsubstantiated claims, using fake reviews, or implementing opaque billing/cancellation processes. Mitigation: Conduct thorough reviews of all marketing materials, ensure pricing is transparent, and make cancellation processes simple and clear. This is directly relevant given the FTC actions against NextMed and Hims & Hers, which underscore a national focus on consumer protection. 6. Data Privacy Lapses: Sharing patient data without explicit consent or robust security, as highlighted by the GoodRx and Hims & Hers cases. Mitigation: Implement strong data governance, conduct regular privacy audits, and ensure all third-party vendor agreements include stringent data protection clauses.

What This Means For Your Practice

Indiana offers a dynamic environment for healthcare businesses, but its regulatory landscape demands respect and rigorous attention to detail. For telehealth providers, medspas, dental practices, chiropractic offices, and healthcare investors, navigating this environment successfully requires a proactive, informed, and continuously adaptable compliance strategy.

TrueEval recommends the following actionable steps:

Conduct a thorough legal review of your proposed operational structure, particularly your MSO agreements, to ensure full compliance with Indiana's CPOM and fee-splitting prohibitions.
Implement a robust provider credentialing and licensing process that verifies Indiana licensure for all clinicians delivering care to Indiana residents.
Develop comprehensive telehealth policies and procedures that align with IMLB standards for establishing patient relationships, informed consent, and documentation.
Establish stringent controlled substance prescribing protocols, including mandatory INSPECT checks and adherence to both federal (DEA) and state requirements, anticipating future changes to DEA telehealth rules.
Audit all patient-facing communications, marketing, and billing practices to ensure transparency and avoid any deceptive claims or unfair practices, learning from recent FTC enforcement actions.
Prioritize data privacy and security, ensuring your data handling practices align with HIPAA, HBNR, and any applicable state laws, with explicit consent for data sharing.

Indiana's commitment to patient safety and professional standards is clear. By embracing a sophisticated, data-driven compliance strategy from the outset, your practice can not only mitigate risk but also build a foundation for sustainable, ethical, and successful growth in the Hoosier State. The landscape is complex, but with the right guidance, it is entirely navigable.