Navigating the Regulatory Gauntlet: CPOM, Controlled Substances, and Telehealth's Evolving Landscape

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The healthcare regulatory landscape is in constant flux, presenting both opportunities and formidable challenges for telehealth, medspas, and expanding practices. This digest cuts through the noise, revealing critical trends in Corporate Practice of Medicine, controlled substance prescribing, and state-specific telehealth rules that demand your immediate attention.

The past few weeks have underscored a critical truth in healthcare: regulatory compliance is not a static checkbox, but a dynamic, ever-evolving imperative. For telehealth innovators, medspa operators, and traditional practices expanding their footprint, the stakes have never been higher. Recent intelligence highlights three dominant themes: the enduring, often strict, enforcement of Corporate Practice of Medicine (CPOM) doctrines; the intensified scrutiny on controlled substance prescribing via telehealth; and the nuanced, state-specific requirements for establishing valid provider-patient relationships in a virtual setting. Understanding these trends is not merely about avoiding penalties; it's about building a sustainable, compliant, and defensible healthcare enterprise.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Intensified Scrutiny in Telehealth, Medspas, and Controlled Substance Prescribing](/blog/compliance-crucible-telehealth-medspa-controlled-substances).

The Unyielding Grip of Corporate Practice of Medicine (CPOM)

Across multiple jurisdictions, the Corporate Practice of Medicine doctrine remains a formidable barrier, shaping how healthcare businesses can legally operate. CPOM laws generally prohibit corporations or non-licensed individuals from employing physicians or controlling medical decision-making. This fundamental principle is designed to protect the integrity of the physician-patient relationship from commercial influence, but it creates significant structural complexities for modern healthcare delivery models.

Recent analyses specifically highlight Kentucky and Iowa as states with particularly strong CPOM enforcement. Kentucky is described as a "moderate enforcement state" where the doctrine is recognized and enforced, requiring careful adherence to exceptions and compliant management service organization (MSO) models. Iowa, however, stands out with a "strict" CPOM doctrine, generally prohibiting non-licensed entities from employing licensed healthcare professionals or owning medical practices. This means traditional corporate structures are largely impermissible, pushing businesses towards professional corporations (PCs) or professional limited liability companies (PLLCs) owned by licensed professionals, often supported by meticulously structured MSO agreements.

For telehealth brands, especially those in direct-to-consumer (DTC) segments like weight loss (Articles 6 & 9), CPOM is a critical challenge. The tension between a scalable, technology-driven business model and state laws demanding physician independence is palpable. Any arrangement where a non-physician entity directly or indirectly profits from medical services rendered by a physician can be deemed an illegal fee-splitting violation. This necessitates MSO models where the administrative services are clearly delineated from clinical decision-making, and compensation structures for physicians are at fair market value, independent of patient volume or prescriptions.

Medspas face similar, if not heightened, scrutiny. Services requiring a medical license (e.g., injectables, laser treatments) must be performed under the direct supervision or delegation of a licensed physician, APRN, or PA operating within a compliant professional structure. Non-physician ownership of a medspa providing medical services is highly problematic in strict CPOM states. The medical director must be a genuine clinical leader, not a figurehead, and the entity providing medical services must typically be a professional entity owned by licensed professionals.

Dental practices and chiropractic offices are also subject to their respective professional practice acts and CPOM principles. While some professions have specific statutory allowances for corporate ownership, deviations from traditional professional ownership or attempts by non-licensed entities to control clinical practice can trigger violations. The overarching principle is clear: clinical decisions and the practice of the profession must remain under the control of licensed practitioners.

Intensified Scrutiny on Telehealth Controlled Substance Prescribing

The Department of Justice (DOJ) and the Drug Enforcement Administration (DEA) are sending an unmistakable message: the era of relaxed oversight for telehealth prescribing of controlled substances is over. The expiration of COVID-19 Public Health Emergency (PHE) waivers has reverted the regulatory environment closer to the pre-PHE rules, primarily governed by the Ryan Haight Act.

Articles 2, 3, and 10 highlight the DOJ's intensified enforcement against telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This isn't just about technical compliance; it's about ensuring every prescription for a controlled substance is preceded by a comprehensive, individualized medical evaluation that meets federal and state standards, demonstrating a "legitimate medical purpose." The DOJ is looking for systemic failures and fraudulent schemes, emphasizing that platforms must not facilitate or encourage practices that circumvent this standard.

For telehealth brands involved in mental health, pain management, or weight loss (especially with GLP-1 agonists), the implications are profound. This requires rigorous re-evaluation of patient intake protocols, provider training, and technological safeguards. Robust compliance programs, regular audits of prescribing patterns, and clear policies prioritizing patient safety and regulatory adherence over rapid patient acquisition are non-negotiable. Failure to comply can lead to severe criminal penalties, including imprisonment, substantial fines, and exclusion from federal healthcare programs.

DEA registration across state lines is another critical hurdle (Articles 3 & 10). The Ryan Haight Act generally requires an initial in-person medical evaluation before prescribing controlled substances via telehealth. While the DEA has proposed new rules for a permanent framework, the current environment demands that providers be licensed and DEA-registered in *each state* where their patients receive controlled substances, unless a specific exception (like a referral from an in-person practitioner) applies. This complicates business models relying on centralized provider networks serving patients nationwide. Businesses must invest in robust credentialing, geo-location verification, and compliance infrastructure to track provider licenses, DEA registrations, and state-specific prescribing rules.

The Evolving Landscape of Telehealth: Establishing Valid Relationships and Expanding Access

Beyond CPOM and controlled substances, the general regulatory framework for telehealth continues to evolve, presenting both opportunities and specific compliance requirements, particularly around establishing valid provider-patient relationships.

State-specific requirements for establishing a valid provider-patient relationship are crucial. The District of Columbia (Article 7) provides a clear example: an initial real-time, interactive audio-visual examination is explicitly required to establish this relationship, a prerequisite for prescribing. This impacts business models relying on asynchronous modalities or audio-only consultations for initial patient intake or diagnosis. The standard of care for telehealth must be equivalent to in-person care, demanding thorough assessment, comprehensive documentation, and appropriate follow-up.

For chiropractic practices (Article 4), state boards are increasingly issuing guidance on telehealth, defining permissible services, requiring patient consent, and specifying documentation standards. The ability to conduct initial consultations, establish a patient-provider relationship, and deliver certain therapeutic interventions remotely varies significantly by state. Practices must meticulously review their state's chiropractic board rules, especially regarding the definition of a 'physical examination' and whether it can be adapted for telehealth.

On a more positive note, CMS continues to expand telehealth services and provider eligibility under Medicare (Article 8). This reflects a sustained commitment to integrating telehealth into the permanent healthcare landscape. For telehealth brands, this means a growing market opportunity as more services become reimbursable, but it also necessitates meticulous attention to billing codes, documentation requirements, and compliance with originating and distant site rules. Medspas and chiropractic offices with licensed medical professionals may find new avenues for patient engagement and follow-up care, provided their services strictly align with state licensure and Medicare's specific service definitions.

What This Means For Your Practice

The convergence of these regulatory trends paints a clear picture: proactive, comprehensive compliance is no longer optional; it is foundational for growth and sustainability.

Review Your Legal Structure (CPOM): If you operate in or plan to expand to states like Iowa or Kentucky, or if you are a DTC telehealth brand, immediately review your corporate structure. Ensure your MSO agreements are robust, clearly delineate clinical and administrative functions, and prevent any perception of corporate control over medical decision-making or illegal fee-splitting. Physician independence must be unequivocally maintained.
Fortify Controlled Substance Protocols: For any practice prescribing controlled substances via telehealth, a complete overhaul of protocols may be necessary. This includes rigorous patient intake, comprehensive medical evaluations, robust provider training, and meticulous documentation. Ensure your providers are licensed and DEA-registered in *every state* where they prescribe controlled substances, or that a valid exception to the Ryan Haight Act's in-person requirement is met. Stay agile and prepared for the final DEA rules.
Master State-Specific Telehealth Rules: Do not assume a one-size-fits-all approach to telehealth. Understand the specific requirements for establishing a valid provider-patient relationship in each state you operate, especially regarding initial encounters and prescribing. For allied health professionals like chiropractors, closely monitor state board guidance.
Leverage CMS Expansion, But With Caution: While CMS expansion offers opportunities, ensure your billing, coding, and documentation practices align precisely with Medicare's evolving requirements. Compliance with HIPAA, patient consent, and technology standards remains paramount.
Invest in Compliance Infrastructure: This includes robust compliance software, ongoing staff training, and regular audits of your operations. Engage experienced legal counsel specializing in healthcare regulatory law and telehealth to navigate this complex terrain.

The regulatory environment for healthcare is dynamic and unforgiving. By proactively addressing these critical areas, your practice can not only mitigate significant risks but also position itself for compliant, sustainable growth in an increasingly virtual and interconnected healthcare ecosystem. TrueEval is committed to providing the intelligence and tools necessary to navigate this complexity with confidence.

Navigating the Regulatory Gauntlet: CPOM, Controlled Substances, and Telehealth's Evolving Landscape

The Unyielding Grip of Corporate Practice of Medicine (CPOM)

Intensified Scrutiny on Telehealth Controlled Substance Prescribing

The Evolving Landscape of Telehealth: Establishing Valid Relationships and Expanding Access

What This Means For Your Practice

Further Reading