Medical Director Oversight and Liability: Responsibilities, State Rules and a Credentialing Checklist

A medical director is not a name on a website. For telehealth brands, med spas and multi-state practices, the medical director is the licensed physician who sets clinical standards, supervises or collaborates with other clinicians, and answers for the quality of care. When that role is thin on paper and thinner in practice, both the physician and the business carry the risk.

This article covers what the role involves, how three large states shape it, where liability comes from, and how to credential a medical director and document their oversight.

What a medical director is responsible for

Duties vary with the practice and the state, but most arrangements cover:

• Clinical protocols. Writing and approving treatment protocols, standing orders and prescribing guidelines, and reviewing them on a schedule.
• Supervision and collaboration. Overseeing nurse practitioners, physician assistants and nurses within the limits each state sets.
• Scope and licensure. Making sure each clinician is licensed in the patient's state and works within scope.
• Quality and safety. Reviewing charts, adverse events and complaints, and following through on corrective action.
• Prescribing oversight. Setting rules for higher-risk medications, and for controlled substances if the practice prescribes them.
• Credentialing. Taking part in vetting the clinicians who will practice under the program.

The common thread is clinical authority. The medical director's decisions on clinical matters must actually be theirs.

How state law shapes the role

Requirements differ by state. Three examples show how much.

California. Business and Professions Code section 2400 says "Corporations and other artificial legal entities shall have no professional rights, privileges, or powers." This is the basis of California's corporate practice of medicine doctrine: a lay-owned company cannot practice medicine or control clinical decisions, so a medical director's clinical authority cannot be subordinate to a business owner.

Texas. Nurse practitioners and physician assistants prescribe under a prescriptive authority agreement with a delegating physician. Occupations Code section 157.0512 requires the agreement to describe a quality assurance and improvement plan with chart review (the number of charts set by the physician and the APRN or PA) and periodic meetings. Those meetings must cover patient care, changes to care plans, referrals and improvement; must be documented; and must "take place at least once a month in a manner determined by the physician" and the APRN or PA. They do not have to be face to face.

New York. New York is a strict corporate practice of medicine state. Under Business Corporation Law section 1507, a professional service corporation may issue shares only to individuals authorized to practice the profession in New York, and under Education Law section 6512, aiding or abetting an unlicensed person to practice a profession is a class E felony. A business that wants physician services in New York contracts with a physician-owned practice; it does not employ the physician to practice medicine.

Run this analysis for every state you serve. Our state compliance guides list the sources we opened for each reviewed state.

Where liability comes from

Negligent supervision. A medical director who approves unsafe protocols, ignores warning signs, or fails to supervise as required can face malpractice claims and discipline. A practice can also be liable for those working on its behalf.

Corporate practice of medicine. If a business controls clinical decisions, or a medical director only signs what operations hands them, the arrangement can be challenged in states with a strict doctrine. In California and New York that goes to the structure of the business itself.

Fraud and abuse. Where a practice bills federal health care programs, the False Claims Act applies to false claims, and the Anti-Kickback Statute applies to payments for referrals. Medical director compensation should reflect the work actually done.

Controlled substances. The Ryan Haight Act provision, 21 U.S.C. 829(e), bars dispensing a controlled substance by means of the internet without a "valid prescription," which by default requires at least one in-person medical evaluation. DEA and HHS have extended the telemedicine flexibilities that relax this through December 31, 2026 (90 FR 61301). A medical director overseeing controlled-substance prescribing by telehealth needs a plan for what happens after that date.

Board action. Medical and nursing boards can discipline a medical director and the clinicians they oversee for failures of supervision and for unprofessional conduct.

Credentialing your medical director

Vet the medical director at least as carefully as any clinician you bring on.

1. Primary source verification. Verify education, training, board certification and each license with the issuing body, not from copies the candidate supplies.
2. State board checks. Look up every license on each state board's website and note any discipline, restrictions or public complaints.
3. NPDB. If your organization is registered and eligible to query the National Practitioner Data Bank, query it. If not, ask the physician for a self-query report.
4. OIG exclusion check. Search the OIG List of Excluded Individuals and Entities. Excluded individuals receive no federal health care program payment for items or services they furnish, order or prescribe, and OIG says "Anyone who hires an individual or entity on the LEIE may be subject to civil monetary penalties." Recheck on a regular schedule, not just at hiring.
5. DEA registration. If the program involves controlled substances, confirm the registrations the arrangement needs.
6. Malpractice coverage. Confirm the policy covers the medical director role and the services and states involved.
7. References. Speak with prior employers or practices about how the physician supervised others.
8. Conflicts of interest. Get a written disclosure of financial interests in pharmacies, suppliers or referral sources.

Apply the same checks, adapted, to every nurse practitioner, physician assistant and nurse working under the program.

Documenting active oversight

Regulators, payers and plaintiffs look at the records to decide whether oversight was real. Keep:

• Chart review logs: date, reviewer, charts reviewed, findings and follow-up.
• Protocol approvals: every protocol dated and signed or attested by the medical director, with a revision history.
• Supervision and collaboration meetings: date, attendees, topics and decisions. In Texas, the monthly prescriptive authority meetings must be documented.
• Training records: what was taught, to whom and when.
• Incident and complaint review: the medical director's review, the corrective action, and evidence it was carried out.

What to do now

1. Review your medical director agreement. It should define clinical authority, duties, time commitment and compensation for actual work.
2. Check each state's supervision rules for every type of clinician you use.
3. Credential the medical director using the checklist above, and repeat the checks on a schedule.
4. Make oversight visible in the record. If it is not documented, assume a regulator will treat it as not done.

Prescribing happens only when clinically appropriate and permitted by the law of the patient's state.

Scope your program with TrueEval

TrueEval is a licensed medical group and physician network that provides medical directors and clinical oversight in all 50 states plus DC. When your front end is live and scope is decided, onboarding takes 3 to 7 days; otherwise allow up to 60 days. Scope your program with us.