Navigating the New Regulatory Frontier: DEA Crackdowns, CPOM Scrutiny, and State-Specific Telehealth Compliance

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The healthcare regulatory landscape is shifting dramatically, with intensified enforcement from the DEA, heightened scrutiny of Corporate Practice of Medicine doctrines, and granular state-specific telehealth rules. For telehealth innovators and expanding practices, understanding these converging pressures is no longer optional—it's foundational to sustainable growth.

The past few months have seen a significant acceleration in regulatory activity across the healthcare sector, creating a complex and often challenging environment for businesses. From federal crackdowns on telehealth prescribing to state-level enforcement of archaic corporate practice doctrines, the message is clear: compliance is not a static checkbox, but a dynamic, ongoing strategic imperative. At TrueEval, we continually monitor these shifts, translating regulatory intelligence into actionable insights for our partners. This digest synthesizes recent critical developments, offering a roadmap for navigating this evolving terrain.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Intensified Scrutiny in Telehealth, Medspas, and Controlled Substance Prescribing](/blog/compliance-crucible-telehealth-medspa-controlled-substances).

The Intensifying Federal Scrutiny on Telehealth and Controlled Substances

Perhaps no area has seen more rapid and impactful regulatory evolution than the intersection of telehealth and controlled substance prescribing. The temporary flexibilities granted during the COVID-19 Public Health Emergency (PHE) have largely expired, ushering in a new era of enforcement that demands meticulous adherence to federal and state guidelines.

DEA's Renewed Focus on In-Person Requirements and Legitimate Medical Purpose

Articles 2, 4, 5, and 12 collectively paint a stark picture: the Drug Enforcement Administration (DEA) and the Department of Justice (DOJ) are aggressively targeting telehealth companies and practitioners for violations related to controlled substance prescribing. The core of this scrutiny reverts to the Ryan Haight Act, which generally requires an in-person medical evaluation before a controlled substance can be prescribed via telehealth. While the DEA has issued *proposed* rules (Article 2) that offer some pathways for buprenorphine prescribing for Opioid Use Disorder (OUD) and extended PHE flexibilities for certain established relationships, the overarching trend is towards stricter requirements.

The DOJ's intensified enforcement (Article 4) underscores that mere technical compliance with waivers is insufficient if the underlying medical practice lacks a "legitimate medical purpose." This standard is now being rigorously applied. Companies are being scrutinized for systemic failures, fraudulent schemes, and practices that incentivize or enable drug diversion. This means:

Telehealth brands must re-evaluate patient intake protocols, provider training, and technological safeguards to ensure every controlled substance prescription is preceded by a comprehensive, individualized medical evaluation that meets federal and state standards, including appropriate physical examinations where necessary.
Medspas, dental practices, and chiropractic offices that might consider incorporating controlled substance prescribing (e.g., for pain management) via telehealth will find their scope significantly limited without an initial in-person evaluation. A hybrid model, combining virtual consultations with in-person assessments, is becoming the de facto standard.
Cross-state prescribing (Articles 5, 12) adds another layer of complexity. Providers must be licensed *and* hold a DEA registration in *each state* where the patient is located if they intend to prescribe controlled substances there. This necessitates a robust credentialing and compliance infrastructure to track provider licenses, DEA registrations, and state-specific prescribing rules.

Actionable Insight: Develop robust protocols for documenting initial evaluations, track patient-prescriber relationships established during the PHE, and ensure meticulous record-keeping for all controlled substance prescriptions. Invest in compliance software and legal counsel specializing in telehealth and DEA regulations. The cost of non-compliance—loss of DEA registration, civil penalties, criminal charges, and exclusion from federal healthcare programs—far outweighs the investment in proactive compliance.

The Resurgence of Corporate Practice of Medicine (CPOM) Enforcement

While federal agencies focus on controlled substances, states are increasingly asserting their authority through Corporate Practice of Medicine (CPOM) doctrines. These laws, designed to protect the integrity of the physician-patient relationship from commercial influence, prohibit corporations from employing physicians or controlling medical decision-making. Articles 3, 7, 8, and 11 highlight the critical impact of CPOM, particularly for rapidly expanding telehealth and medspa models.

State-Specific Nuances and "Strict" Enforcement

States like Kentucky (Article 3) and Iowa (Article 7) are cited as examples of jurisdictions with moderate to strict CPOM enforcement. Iowa, in particular, generally prohibits non-licensed entities from employing licensed healthcare professionals or owning medical practices. This presents a significant hurdle for:

Telehealth brands: Direct employment of Iowa-licensed providers by a national telehealth company (if not a professional corporation licensed in Iowa) is likely non-compliant. Instead, models like Management Service Organizations (MSOs) become essential, where the MSO provides administrative services to an independently owned professional practice, meticulously avoiding any influence over clinical decision-making, fee-splitting, or direct employment of clinical staff.
Medspas: Non-physician ownership of a medspa that provides medical services (e.g., injectables, laser treatments) is highly problematic. The medical director must be genuinely engaged, and the entity providing medical services must typically be a professional entity owned by licensed professionals. MSO arrangements must clearly delineate clinical and administrative responsibilities, ensuring the MSO does not dictate pricing or interfere with professional judgment.
DTC Telehealth Weight Loss Brands (Articles 8, 11): These brands, often prescribing GLP-1 agonists, face intense scrutiny. The tension between a scalable, technology-driven business model and CPOM laws is acute. Compensation structures for physicians must be fair market value and not tied to the volume or value of referrals or prescriptions, which could be construed as illegal fee-splitting. Regulators are examining whether corporate entities unduly influence prescribing patterns or patient selection criteria.

Actionable Insight: For any healthcare business expanding nationally, a state-by-state CPOM analysis is non-negotiable. This includes understanding the specific statutory exceptions, common practices, and enforcement trends in each target state. Robust MSO models, meticulously drafted to ensure physician independence and fair market value arrangements, are critical. Proactive legal counsel experienced in multi-state healthcare regulatory law is essential to structure operations compliantly and avoid severe penalties, including license revocation, corporate dissolution, and criminal charges.

The Granular World of State-Specific Telehealth Regulations

Beyond CPOM and federal controlled substance rules, individual states continue to refine their telehealth regulations, impacting everything from the establishment of a valid patient-provider relationship to the permissible scope of virtual care.

Defining the Telehealth Encounter and Scope of Practice

Articles 1 and 9 highlight state-specific requirements that can significantly alter operational models:

Michigan's Board of Medicine (Article 1) is actively enforcing regulations related to telehealth and medspa operations, with disciplinary actions stemming from issues like unprofessional conduct, scope of practice violations, and inadequate supervision. For telehealth brands, this means ensuring practitioners are appropriately licensed in Michigan, patient-provider relationships are established correctly (e.g., proper initial evaluations, informed consent), and prescribing practices adhere strictly to Michigan's Public Health Code.
The District of Columbia (Article 9) explicitly requires an initial real-time, interactive audio-visual examination to establish a valid provider-patient relationship for prescribing, with limited exceptions. This directly impacts business models relying on asynchronous platforms or audio-only services for initial patient intake or diagnosis.
Chiropractic boards (Article 6) are also issuing guidance on telehealth, defining what services are permissible virtually, requiring patient consent, and specifying documentation standards. The ability to conduct initial consultations or deliver certain therapeutic interventions remotely varies significantly by state, directly impacting telehealth-focused chiropractic brands.

Actionable Insight: One-size-fits-all telehealth policies are a relic of the PHE era. Healthcare businesses must implement state-specific compliance frameworks that account for variations in licensing, scope of practice, patient-provider relationship requirements, and prescribing rules. This requires robust technology platforms that can adapt to these nuances, comprehensive provider training, and continuous monitoring of state board guidance. For medspas, dental practices, and chiropractic offices, ensuring all services remain within the defined scope of practice for their respective licenses, and that any delegated tasks are performed by appropriately trained and supervised personnel, is paramount.

CMS Expansion: Opportunity Amidst Complexity

Amidst these challenges, the Centers for Medicare & Medicaid Services (CMS) continues to expand telehealth services and provider eligibility under Medicare (Article 10). This represents a significant opportunity for many practices, but also introduces its own layer of compliance complexity.

Leveraging Medicare Reimbursement While Ensuring Compliance

CMS's sustained commitment to integrating telehealth into the permanent healthcare landscape means a growing market opportunity. However, it necessitates meticulous attention to:

Billing codes and documentation: Practices must ensure their systems can accurately capture and submit claims for newly eligible services, using correct CPT codes and modifiers.
Originating and distant site rules: Even with some relaxation, understanding these rules is crucial for compliant billing.
Scope of practice: Medspas and chiropractic offices with licensed medical professionals can find new avenues for patient engagement, but their services must strictly align with state licensure and Medicare's specific service definitions for telehealth.

Actionable Insight: Proactively review CMS updates to identify newly reimbursable telehealth services relevant to your practice. Invest in robust billing and documentation systems, and ensure staff are thoroughly trained on Medicare's specific telehealth requirements. While this expansion offers growth potential, it also increases the risk of audits and potential fraud and abuse investigations if compliance is not rigorously maintained.

What This Means For Your Practice

The convergence of these regulatory pressures creates a "compliance crucible" for healthcare businesses. The days of operating under broad, pandemic-era waivers are over. The new reality demands a sophisticated, proactive, and granular approach to compliance.

For Telehealth Founders and Operators: Your business model must be built on a foundation of multi-state regulatory intelligence. Generic MSO agreements or blanket prescribing policies are high-risk. Invest in technology that enforces state-specific rules and robust compliance teams that can navigate the evolving DEA, DOJ, and state board landscapes.
For Brick-and-Mortar Practices Expanding Nationally: Every new state is a new regulatory puzzle. Do not assume your home state's rules apply elsewhere. Conduct thorough CPOM and telehealth analyses for each expansion market, and ensure your clinical and administrative structures are compliant.
For Healthcare Compliance Officers: Your role has never been more critical. Implement dynamic compliance programs that continuously monitor regulatory changes, conduct internal audits, and provide ongoing training. Foster a culture where compliance is integrated into every operational decision.
For Medspa, Dental, Chiropractic, and Wellness Practice Owners: Any service that touches the medical realm, particularly those involving prescriptions or delegation, is under scrutiny. Ensure your medical directors are genuinely engaged, your MSO structures are compliant, and all practitioners operate strictly within their defined scope of practice and state-specific telehealth rules.
For Healthcare Investors and Advisors: Due diligence must now include an even deeper dive into regulatory compliance. Understand the CPOM risks, DEA enforcement trends, and state-specific telehealth nuances of your portfolio companies. Non-compliance can swiftly erode enterprise value and lead to significant legal liabilities.

The regulatory environment is not merely reacting to innovation; it is actively shaping its trajectory. TrueEval stands as your partner in this complex journey, providing the intelligence and infrastructure necessary to build compliant, sustainable, and thriving healthcare enterprises. The future of healthcare is virtual, but its foundation must be undeniably compliant.