Navigating the Old Line State: A Comprehensive Guide to Healthcare Compliance in Maryland

2026-08-06

Maryland's unique blend of progressive telehealth policies, robust CPOM enforcement, and significant NP autonomy makes it a distinctive, yet rewarding, state for healthcare operations. This guide offers a deep dive into the state's regulatory landscape, providing a roadmap for telehealth providers, medspas, and traditional practices looking to expand or operate compliantly within the Old Line State.

Maryland, often celebrated for its strategic Mid-Atlantic location and vibrant healthcare ecosystem, presents a dynamic yet complex regulatory environment for healthcare businesses. From its proactive stance on telehealth to its well-defined corporate practice of medicine doctrines and progressive advanced practice provider regulations, understanding the nuances of the Old Line State is paramount for sustainable, compliant growth. For telehealth innovators, expanding brick-and-mortar practices, medspas, and even established providers, Maryland's regulatory framework demands careful attention and a robust compliance strategy.

> For more on this topic, see our analysis: [Navigating the Show-Me State: A Comprehensive Guide to Missouri Healthcare Compliance for Expanding Practices](/blog/missouri-healthcare-compliance-guide).

Maryland's Corporate Practice of Medicine Doctrine: Navigating the Boundaries

Maryland adheres to the Corporate Practice of Medicine (CPOM) doctrine, a foundational principle that generally prohibits corporations, or other lay entities, from employing physicians or exercising control over their medical judgment. This doctrine is designed to protect the integrity of the physician-patient relationship and prevent the commercialization of medical decisions. While Maryland's application of CPOM is not as strictly prohibitive as states like California or Texas, it requires diligent structuring of healthcare entities.

For businesses looking to operate in Maryland, especially those utilizing Managed Service Organization (MSO) models, understanding this doctrine is critical. An MSO can provide administrative and non-clinical support services (e.g., billing, HR, IT, real estate) to a professional medical practice, but it cannot interfere with clinical decision-making or employ licensed medical professionals to deliver patient care. The medical practice itself must remain physician-owned and controlled, ensuring that clinical judgment resides solely with the licensed providers. Violations of CPOM can lead to severe consequences, including license revocation, voided contracts, and civil penalties. Enforcement by the Maryland Board of Physicians (MBP) underscores the importance of correctly structured arrangements.

Key compliance considerations for CPOM in Maryland: * Clear Separation: Ensure a clear legal and operational separation between the MSO and the professional medical practice. Clinical decisions, credentialing, and medical protocols must be controlled by the medical practice. * Fair Market Value: All services provided by the MSO to the medical practice, and any payments or leases between the entities, must be at fair market value to avoid kickback allegations or unlawful profit-sharing. * No Influence on Clinical Judgment: The MSO cannot dictate treatment plans, patient flow, or physician compensation based on referrals or volume in a way that could be construed as influencing medical judgment.

The Evolving Landscape of Telehealth in Maryland

Maryland has been at the forefront of telehealth adoption, especially post-pandemic, making it an attractive state for virtual care providers. The state has moved to codify many temporary flexibilities into permanent law, creating a stable environment for telehealth growth.

Telehealth Definition and Modalities Maryland's definition of telehealth is comprehensive, encompassing various modalities: * Live Interactive Audio-Visual: Real-time two-way audio and visual communication. This is the most common and widely reimbursed modality. * Audio-Only Telehealth: While generally accepted, certain conditions and limitations may apply. Post-PHE, Maryland has maintained coverage for certain audio-only services, particularly for behavioral health, recognizing its importance for access. * Asynchronous (Store-and-Forward): The transmission of recorded health information (e.g., images, pre-recorded video, data) to a practitioner for review at a later time. This modality is also recognized but may have specific use cases and reimbursement limitations.

Licensure Requirements for Telehealth Providers Maryland mandates that any healthcare provider rendering services to a patient located in Maryland must be licensed by the appropriate Maryland professional board. For physicians, this means licensure by the Maryland Board of Physicians (MBP). A significant advantage for physicians is that Maryland is a member of the Interstate Medical Licensure Compact (IMLC). This allows eligible physicians already licensed in another compact state to obtain an expedited Maryland license, significantly streamlining expansion efforts for telehealth platforms and multi-state practices. Practitioners must ensure their licenses are active and in good standing.

Prescribing Standards for Telehealth, Including Controlled Substances Maryland generally permits prescribing via telehealth, provided it is done within the established standard of care and a legitimate patient-provider relationship exists. For controlled substances, the federal landscape, particularly the DEA and HHS extension of telemedicine flexibilities through December 31, 2026, is critical. This extension temporarily allows practitioners to prescribe controlled substances via telehealth without an initial in-person visit, averting the 'telemedicine cliff' for now.

Maryland generally aligns with federal rules but maintains its own Prescription Drug Monitoring Program (PDMP), which all prescribers are required to consult before prescribing Schedule II-V controlled substances. Practices must ensure: * Legitimate Medical Purpose: All prescriptions, especially for controlled substances, must be issued for a legitimate medical purpose in the usual course of professional practice. * Patient Evaluation: A thorough evaluation, including medical history and assessment of the patient's condition, must precede any prescription. * Documentation: Meticulous documentation of the telehealth encounter, rationale for prescribing, and patient education is non-negotiable.

Consent and Patient Privacy Informed consent for telehealth services is a cornerstone of Maryland's regulations. Patients must be made aware of the nature of telehealth, its limitations, and their privacy rights. Given recent federal enforcement actions by the FTC against Hims & Hers and GoodRx regarding deceptive health data sharing and billing practices, patient privacy is under intense scrutiny. Healthcare businesses in Maryland, especially those operating digitally, must: * Transparent Privacy Policies: Ensure privacy policies are clear, comprehensive, and accurately reflect all data handling practices, particularly concerning third-party advertising or analytics. * Explicit Consent: Obtain explicit and informed consent for any data use or sharing beyond direct treatment, especially when integrating with advertising or analytics platforms. * HIPAA and HBNR Compliance: Rigorously comply with HIPAA and the Health Breach Notification Rule (HBNR). The GoodRx case signals that the FTC is actively enforcing the HBNR against digital health platforms, imposing substantial penalties for misrepresenting privacy practices.

Reimbursement and Parity Maryland has a strong telehealth parity law for commercial insurers, mandating coverage for telehealth services at rates equivalent to in-person services, subject to certain conditions and limitations. Medicaid also covers a broad range of telehealth services. The CMS finalization of the permanent Medicare Telehealth Services List and expanded coverage provides further stability and reimbursement opportunities for Medicare beneficiaries in Maryland. Practices should: * Verify Payer Policies: While parity exists, specific services covered and administrative requirements can vary by payer. * Appropriate Coding: Ensure correct CPT and HCPCS coding for telehealth services, including modifier usage (e.g., GT, 95). * Documentation for Medical Necessity: Maintain robust documentation demonstrating medical necessity for all services rendered via telehealth to support claims and withstand audits (as highlighted by the DOJ's focus on telemedicine fraud).

Professional Practice and Supervision Requirements

Maryland's regulatory environment for advanced practice providers offers significant opportunities for efficient staffing and service delivery.

Physician Assistants (PAs) PAs in Maryland operate under the supervision of a licensed physician. The Maryland Board of Physicians sets forth specific requirements for supervisory agreements, scope of practice, and delegation of tasks. While direct, on-site supervision is not always required, the supervising physician retains ultimate responsibility for the care provided by the PA. Practices employing PAs must ensure a robust supervisory plan is in place, regularly reviewed, and documented.

Nurse Practitioners (NPs) Maryland is notable for its progressive stance on Certified Registered Nurse Practitioner (CRNP) autonomy. CRNPs in Maryland are authorized to practice independently after completing 18 months or 1,000 hours of clinical practice as a CRNP under an Attestation Statement signed by a collaborating physician or another CRNP. Once this period is met, the CRNP can practice independently without a formal collaborative agreement or direct supervision, significantly expanding their ability to provide care. This autonomy is a major advantage for practices looking to leverage the full scope of NP capabilities, particularly in primary care, mental health, and specialized areas like medspas.

Other Healthcare Professionals Maryland has separate regulatory boards for various other healthcare professions, including dentists, chiropractors, physical therapists, and registered nurses. Each board establishes its own licensing, scope of practice, and supervision requirements. Businesses must ensure that all providers operate strictly within their professional scope and adhere to their respective board's regulations.

Controlled Substances: Maryland's Layered Approach

Beyond the federal Controlled Substances Act (CSA) enforced by the DEA, Maryland maintains its own stringent regulations for controlled substances, aiming to combat diversion and abuse.

Prescription Drug Monitoring Program (PDMP): Maryland's PDMP is a critical tool. All prescribers are mandated to register with and utilize the PDMP before prescribing Schedule II-V controlled substances to monitor patient prescription history and identify potential misuse or diversion.
Telehealth Prescribing Limitations: While the federal DEA extension provides temporary flexibility for telehealth prescribing of controlled substances, practices must remain vigilant regarding future permanent rules, including the proposed 'Special Registration for Telemedicine'. Maryland state law generally permits this under the current federal waiver, but state boards maintain oversight regarding the establishment of a bona fide patient-provider relationship and adherence to the standard of care.
Specific Dispensing and Inventory Rules: Maryland pharmacies and dispensing practitioners must adhere to state-specific rules for inventory, security, record-keeping, and dispensing of controlled substances.

Compliance with both federal and Maryland's state-specific controlled substance laws is non-negotiable. The DEA's continuous efforts to prevent diversion, as exemplified by its proposed expansion of List I chemical definitions, signals a broader regulatory vigilance that impacts the entire healthcare supply chain.

Licensing and Registration: The Gateway to Practice

Operating legally in Maryland requires meticulous attention to state-specific licensing and registration requirements for both individual providers and, in some cases, facilities.

Maryland Board of Physicians (MBP): Oversees the licensure of physicians and physician assistants. As mentioned, Maryland's membership in the IMLC significantly simplifies multi-state licensure for eligible physicians.
Maryland Board of Nursing: Responsible for licensing Registered Nurses (RNs) and Certified Registered Nurse Practitioners (CRNPs).
Other Professional Boards: Dentists, chiropractors, pharmacists, physical therapists, and other licensed professionals are regulated by their respective state boards. Practices must ensure that all providers hold current, active, and unencumbered Maryland licenses relevant to their profession and scope of practice.
Facility Licensure: Depending on the type of service, certain facilities (e.g., ambulatory surgical centers, clinics performing complex procedures) may require specific facility licensure from the Maryland Department of Health (MDH) or other agencies. This is particularly relevant for medspas offering advanced procedures.

Key Compliance Pitfalls and Strategic Mitigation

Maryland's regulatory landscape, while generally progressive, presents several areas of heightened risk for healthcare businesses.

1. CPOM Violations: Improperly structured MSO agreements or any perceived interference in clinical decision-making by a lay entity can trigger investigations by the MBP. Mitigation: Engage experienced healthcare legal counsel to structure compliant MSO and management agreements that clearly delineate clinical and administrative responsibilities, ensuring physician control over medical practice.

2. Data Privacy Breaches and Deceptive Practices: The FTC's enforcement actions against Hims & Hers and GoodRx serve as stark warnings. Sharing sensitive health information without explicit, informed patient consent, or engaging in deceptive billing/subscription practices, will lead to severe penalties. Mitigation: Conduct regular audits of data flows, review and update privacy policies to ensure transparency and accuracy, and implement robust patient consent processes for all data usage. Ensure billing and cancellation processes are clear and unambiguous.

3. Fraud, Waste, and Abuse (FWA): The DOJ's national healthcare fraud takedown, with its specific focus on telemedicine and Medicaid fraud, signals an aggressive enforcement environment. Billing for services not rendered, upcoding, unbundling, or lacking medical necessity documentation are significant risks. Mitigation: Implement a comprehensive FWA compliance program, including regular billing audits, staff training on coding and documentation, and robust internal controls. Ensure all services, especially those provided via telehealth, are meticulously documented for medical necessity.

4. Controlled Substance Mismanagement: Failure to comply with PDMP requirements, inappropriate prescribing through telehealth (especially post-PHE when federal flexibilities may change), or inadequate inventory controls can lead to DEA and state board actions. Mitigation: Train all prescribers on current federal and state controlled substance laws, mandate PDMP utilization, and establish clear internal protocols for prescribing, dispensing, and safeguarding controlled medications.

5. Quality Control for Compounded Medications: While not specific to Maryland, the FDA's nationwide recall of compounded glutathione due to elevated endotoxin levels underscores the critical need for supply chain vigilance. Practices utilizing compounded injectables, common in medspas, must ensure their compounding pharmacies adhere to stringent quality control and sterility testing. Mitigation: Vet all suppliers thoroughly, request proof of quality assurance, and have clear protocols for patient notification and product retrieval in the event of a recall.

6. AI Integration and Accountability: As AI tools become more prevalent, the FSMB guidance emphasizing human accountability means Maryland practitioners using AI for diagnosis, treatment recommendations, or administrative tasks remain solely responsible for patient outcomes. Mitigation: Develop clear policies for AI use, ensure adequate clinician training, meticulously document AI-assisted decisions, and maintain human oversight in all clinical applications.

What This Means For Your Practice in Maryland

Operating in Maryland offers significant advantages, particularly for practices looking to scale through telehealth or leverage advanced practice providers. The state's membership in the Interstate Medical Licensure Compact and the relative autonomy of Nurse Practitioners provide pathways for efficient provider recruitment and expanded service delivery.

However, these opportunities come with a robust regulatory framework. A proactive and comprehensive compliance program is not merely a legal obligation but a strategic imperative. This includes:

Legal Counsel: Engage experienced Maryland healthcare attorneys to structure your entity, review MSO agreements, and ensure CPOM compliance.
Compliance Officer/Team: Designate a dedicated compliance professional or team responsible for staying abreast of Maryland-specific regulations and implementing internal policies.
Ongoing Training: Provide regular training for all staff on data privacy, billing integrity, controlled substance rules, and ethical use of technology.
Technology & Data Governance: Invest in secure, compliant technology platforms and establish strong data governance policies to protect patient information.
Auditing and Monitoring: Regularly audit your billing, clinical documentation, and operational practices to identify and rectify potential non-compliance before it escalates into an enforcement action.

Maryland's commitment to patient access and innovative care is evident in its forward-thinking policies. By prioritizing rigorous compliance, healthcare businesses can confidently navigate this intricate landscape, build trust, and thrive within the Old Line State's dynamic healthcare market. The environment is ripe for growth, but only for those who approach it with an unwavering commitment to regulatory excellence and patient safety.