Navigating the New Regulatory Gauntlet: CPOM, Telehealth Prescribing, and DOJ Scrutiny in 2024

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

Healthcare businesses face an increasingly complex regulatory environment, with heightened enforcement around Corporate Practice of Medicine, state-specific telehealth prescribing, and aggressive DOJ actions. This roundup details critical updates and provides actionable insights to safeguard your operations in 2024.

The healthcare regulatory landscape is in a perpetual state of flux, demanding constant vigilance from telehealth operators, medspas, and traditional practices alike. As TrueEval's editorial director, I'm here to cut through the noise, providing a clear, authoritative analysis of the most critical compliance developments shaping our industry. This quarter, we're seeing a significant tightening of enforcement, particularly around the Corporate Practice of Medicine (CPOM), state-specific telehealth prescribing rules, and an intensified focus from the Department of Justice (DOJ) on fraud and kickback schemes. Understanding these shifts is not merely about avoiding penalties; it's about building a resilient, compliant, and sustainable healthcare enterprise.

> For more on this topic, see our analysis: [Navigating the Regulatory Gauntlet: CPOM, Telehealth Prescribing, and Enforcement in 2024](/blog/regulatory-gauntlet-cpom-telehealth-prescribing-2024).

The Resurgence of Corporate Practice of Medicine (CPOM) Enforcement

The Corporate Practice of Medicine (CPOM) doctrine, which generally prohibits corporations from employing physicians or controlling medical practice, continues to be a cornerstone of state-level healthcare regulation. While its application varies significantly, recent intelligence indicates a renewed focus, particularly in states with historically strict interpretations. This impacts everything from ownership structures to operational control, challenging the very foundation of many modern healthcare delivery models.

> For more on this topic, see our analysis: [Navigating the Regulatory Gauntlet: CPOM, Telehealth Prescribing, and Enforcement in 2024](/blog/regulatory-gauntlet-cpom-telehealth-prescribing-2024).

New York's Unyielding Stance: The PC-MSO Imperative

New York stands out with one of the nation's most stringent CPOM doctrines. The state's prohibition against corporate entities practicing medicine or employing licensed professionals to deliver clinical services is absolute. For telehealth companies and medspas operating in New York, this means the Physician-Controlled Management Services Organization (PC-MSO) model is not just advisable, but essential. The core principle is that the professional entity (PE) – owned and controlled by licensed New York physicians – must retain complete clinical autonomy over all medical decision-making, patient care, and professional employment. The MSO's role is strictly limited to providing non-clinical administrative, technical, and management services. Any perceived influence or control by the MSO over clinical aspects can trigger severe violations, leading to investigations by the New York State Education Department (NYSED) Office of Professional Discipline (OPD) or the Office of the Attorney General.

Compliance in New York demands meticulous attention to contractual agreements, operational workflows, and financial arrangements. The management services agreement (MSA) between the MSO and PE must clearly delineate responsibilities, ensuring the PE maintains ultimate authority. Fee structures must be fair market value and not tied to patient volume or revenue generation in a way that could be construed as illegal fee-splitting. This is particularly critical for practices involved in weight-loss, hormone-therapy, mental-health, sexual-health, dermatology, and primary-care via telehealth, which are under heightened scrutiny. Non-compliance can result in license revocation, civil monetary penalties, and even criminal charges.

Nevada's Nuance: Flexibility, Not Permissiveness

In contrast to New York, Nevada's CPOM enforcement is often considered more flexible, allowing for management services organization (MSO) models, particularly for telehealth and medspa businesses. However, this flexibility should not be mistaken for permissiveness. While a non-physician-owned MSO can provide administrative services (e.g., billing, marketing, IT) to a physician-owned professional corporation (PC), the critical compliance point is ensuring the MSO does not exert control over clinical decision-making, physician employment, or fee-splitting arrangements. Practices expanding into Nevada must ensure their MSO agreements are meticulously drafted to delineate clear boundaries, explicitly stating the PC retains full control over medical judgments, hiring/firing of clinical staff, and setting professional fees. Any arrangement that appears to dictate patient care or improperly share professional fees could be challenged by the Nevada State Board of Medical Examiners.

DTC Telehealth and Weight Loss: A CPOM Minefield

Direct-to-Consumer (DTC) telehealth weight loss brands face significant compliance challenges across states with strict CPOM doctrines, including California, Texas, New York, and others. The tension between a corporate platform and the requirement for physician autonomy is a major risk factor. Simply contracting with physicians is insufficient; the nature of that contract, the degree of corporate influence on treatment protocols, and how fees are structured are all under scrutiny. For example, if a platform dictates specific weight loss treatments or formularies without independent physician judgment, it could be seen as exercising undue corporate control. Revenue-sharing models tied directly to the volume or type of prescriptions are particularly vulnerable to being construed as illegal fee-splitting or inducements. Medspas and dental practices expanding into telehealth for weight loss or related services must also ensure their licensed professionals retain ultimate clinical authority and that business arrangements comply with state-specific CPOM and fee-splitting laws.

The Evolving Patchwork of Telehealth Prescribing and Informed Consent

The post-PHE era has ushered in a complex, state-specific regulatory environment for telehealth, particularly concerning the establishment of a valid patient-provider relationship, controlled substance prescribing, and informed consent. There is no uniform federal standard, requiring a meticulous, state-by-state approach.

Controlled Substances and Sexual Wellness Platforms

Telehealth platforms specializing in sexual wellness, or any area involving controlled substances, face a particularly challenging landscape. The DEA's Ryan Haight Act generally requires an in-person medical evaluation before prescribing controlled substances via telemedicine, with exceptions for public health emergencies or specific waivers. While the DEA has proposed new rules post-PHE, the landscape remains dynamic. State medical boards often impose their own additional restrictions, including limits on Schedule II substances, specific documentation requirements, and prohibitions on prescribing controlled substances via telehealth without prior in-person visits. This directly impacts how a sexual wellness platform can operate, especially if considering medications that fall under controlled substance classifications. Compliance requires robust state-by-state legal analysis for every jurisdiction, ensuring prescribing providers are licensed in the patient's state and fully aware of its specific guidelines.

Informed Consent: A State-by-State Mandate

Informed consent in telehealth is not a 'one-size-fits-all' proposition. For telehealth brands, medspas, dental practices, and chiropractic offices expanding virtually, a general consent form is insufficient. Practices must tailor their consent processes to meet the explicit mandates of each jurisdiction where they operate and where their patients reside. Some states require explicit disclosure of the potential for technology failures, while others mandate specific language regarding patient data privacy in a telehealth context. The method of obtaining consent (e.g., written, electronic, verbal with documentation), the language used, and the specific information conveyed to the patient all vary. Failure to capture these nuances can lead to regulatory penalties, malpractice claims, and reputational damage. Regular review and updates are critical as state regulations continually evolve.

Washington State's Supervision and Delegation Rules for PAs and ARNPs

The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have clarified requirements for physician and advanced registered nurse practitioner (ARNP) supervision and delegation, particularly relevant for telehealth and medspa services. For telehealth brands, this means more than just a supervising physician on paper; robust, documented processes for ongoing collaboration, chart review, and availability for consultation are required. Medspa businesses are significantly impacted, as the WMC and NCQAC rules dictate that delegating physicians or collaborating ARNPs must ensure the PA or ARNP has the necessary training and competency for each procedure, including understanding complications and emergency protocols. Meticulous records of delegation agreements, training, and ongoing supervision are essential. Non-compliance can lead to disciplinary action against practitioners and the practice, as well as potential legal liability.

District of Columbia Pharmacy Board Regulations

The District of Columbia Board of Pharmacy sets specific regulations governing telehealth prescribing, compounding, and medication fulfillment. For telehealth brands operating in DC, the emphasis on a proper patient-provider relationship, even if established via telehealth, is foundational. Providers must ensure initial patient assessments meet prescribing standards, especially for controlled substances. Medspas and aesthetic practices using telehealth for consultations or prescribing injectables or topical treatments must align their practices with DC's requirements, including comprehensive patient records and verifying prescription legitimacy. For compounding, strict adherence to USP standards and DC compounding regulations is non-negotiable. Any medication fulfillment must occur with DC-licensed entities. Proactive compliance is essential to mitigate risks of regulatory enforcement, fines, and potential loss of licensure.

DOJ Intensifies Enforcement Against Telehealth Fraud and Kickbacks

The Department of Justice (DOJ) continues its aggressive pursuit of enforcement actions against healthcare providers and companies engaged in telehealth fraud, illegal kickbacks, and false claims. This heightened scrutiny underscores the federal government's commitment to safeguarding federal healthcare programs and ensuring legitimate patient care.

Key Risk Areas and Enforcement Targets

For telehealth brands, the primary risk areas include billing for services not rendered, medically unnecessary services, or services provided by unqualified personnel. The DOJ is particularly vigilant about arrangements that incentivize referrals through illegal kickbacks, often disguised as marketing fees, administrative services, or or consulting agreements. Any financial relationship with lead generators, laboratories, pharmacies, or other service providers must be meticulously structured to comply with the Anti-Kickback Statute (AKS) and its safe harbors. Failure to do so can result in criminal charges, civil penalties under the False Claims Act (FCA), and exclusion from federal healthcare programs.

Medspas, dental practices, and chiropractic offices that integrate telehealth or engage in referral relationships are also under the microscope. For example, a medspa offering weight-loss or hormone-therapy services via telehealth must ensure all prescriptions are medically necessary, based on a legitimate patient-provider relationship, and not influenced by illegal inducements. Similarly, dental and chiropractic practices referring patients for durable medical equipment (DME), diagnostic tests, or specialty consultations must ensure these referrals are based solely on clinical need, not on financial incentives. The DOJ's enforcement actions often target schemes where providers are paid for ordering unnecessary items or services, even if they claim to be acting on behalf of a telehealth company.

Billing and Coding Compliance: A Critical Shield

Beyond direct fraud, the DOJ's focus often extends to improper billing and coding. For all healthcare businesses leveraging virtual care, billing and coding compliance is a critical risk management function. Providers must stay updated on each payer's specific telehealth policies, which vary widely by plan and state. This includes understanding covered services, acceptable modalities (audio-only vs. audio-visual), eligible providers, and any state-specific parity laws. Accurate use of CPT/HCPCS codes, telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth provided from a location other than the patient's home, 10 for telehealth provided in the patient's home) is paramount. Failure to apply these correctly will result in claim rejections and potential audit triggers, which can escalate to federal scrutiny if patterns of abuse are identified. Documentation must clearly support the billed services, including medical necessity, modality, and patient consent.

What This Means For Your Practice

The regulatory environment is not just evolving; it's actively scrutinizing and enforcing. For telehealth founders and operators, brick-and-mortar practice owners expanding nationally, healthcare compliance officers, and medspa, dental, chiropractic, and wellness practice owners, the message is clear: proactive, granular compliance is non-negotiable.

1. Re-evaluate Your Corporate Structure: If you operate in states with strict CPOM doctrines like New York, or even nuanced ones like Nevada, a thorough review of your MSO/PC agreements, ownership structures, and operational control mechanisms is imperative. Ensure genuine physician autonomy in clinical decision-making. 2. Audit Telehealth Prescribing Protocols: For any service involving medication, particularly controlled substances or specialized treatments (e.g., sexual wellness, weight loss), conduct a state-by-state audit of your patient-provider relationship establishment, prescribing guidelines, and pharmacy fulfillment processes. The DC Board of Pharmacy's detailed regulations serve as a reminder of the specificity required. 3. Strengthen Informed Consent Procedures: Move beyond generic consent forms. Implement dynamic, state-specific informed consent processes that address the unique requirements of each jurisdiction where you serve patients. This is a foundational element of ethical and legal telehealth practice. 4. Bolster Supervision and Delegation: For practices utilizing PAs or ARNPs, especially in medspa or telehealth settings, ensure your supervision and delegation agreements and practices meet state-specific requirements, such as those clarified by Washington State. Documentation of ongoing collaboration, training, and competency is critical. 5. Fortify Anti-Fraud and Kickback Compliance: Implement robust internal controls, conduct regular audits, and provide ongoing training to staff on fraud, waste, and abuse prevention. Scrutinize all financial relationships with third-party vendors, lead generators, and referral sources to ensure compliance with AKS and FCA. Ensure all compensation arrangements are fair market value and commercially reasonable. 6. Refine Billing and Coding: Invest in expertise and technology to ensure accurate CPT/HCPCS coding, appropriate modifiers, and correct place of service indicators for all telehealth services. For self-pay models, ensure transparent pricing and compliance with consumer protection laws like the No Surprises Act.

Looking Ahead

The trend towards more granular, state-specific regulation, coupled with aggressive federal enforcement, will only intensify. The onus is on healthcare businesses to not only keep pace but to anticipate these changes. TrueEval remains committed to providing the intelligence and infrastructure necessary to navigate this complex terrain. Your ability to adapt quickly and strategically to these regulatory shifts will define your success and resilience in the evolving healthcare market. Don't wait for an enforcement action to prompt compliance; make it a core, continuous function of your business strategy.