Navigating the Regulatory Gauntlet: DOJ Scrutiny, CPOM Tightening, and Telehealth's Evolving Compliance Imperatives

The healthcare sector, particularly its rapidly expanding digital and aesthetic frontiers, is operating under an increasingly intense regulatory spotlight. Federal and state authorities are not merely observing; they are actively shaping the operational parameters through aggressive enforcement actions, nuanced policy clarifications, and the steadfast application of long-standing doctrines. For telehealth founders, medspa operators, and practice owners, understanding these shifts is not optional—it is fundamental to sustainable growth and risk mitigation.

> For more on this topic, see our analysis: [The Shifting Sands of Healthcare Compliance: Navigating Telehealth Fraud, CPOM, and State-Specific Scrutiny](/blog/telehealth-fraud-cpom-state-scrutiny-roundup).

DOJ Intensifies Scrutiny on Telehealth Fraud and Kickbacks

The Department of Justice (DOJ) continues to signal a clear and unwavering commitment to combating fraud, waste, and abuse within the telehealth ecosystem. This is not a new trend, but rather an intensification of existing efforts, leveraging insights gained from the rapid expansion of virtual care during the public health emergency (PHE). The DOJ's focus extends beyond individual practitioners to the corporate entities that facilitate or incentivize fraudulent schemes.

> For more on this topic, see our analysis: [The Shifting Sands of Healthcare Compliance: Navigating Telehealth Fraud, CPOM, and State-Specific Scrutiny](/blog/telehealth-fraud-cpom-state-scrutiny-roundup).

Key Areas of Enforcement:

• Billing for Services Not Rendered or Medically Unnecessary Services: The DOJ is vigilant against telehealth platforms or providers billing federal healthcare programs (e.g., Medicare, Medicaid) for consultations that never occurred, or for services deemed medically unnecessary. This often involves schemes where patient information is exploited to generate claims for unneeded durable medical equipment (DME), genetic testing, or prescription medications.
• Illegal Kickbacks and Inducements: A significant portion of DOJ actions target violations of the Anti-Kickback Statute (AKS). This includes arrangements where telehealth companies, laboratories, pharmacies, or DME suppliers pay physicians or other providers for referrals or for ordering specific items/services. These kickbacks are frequently disguised as marketing fees, administrative service agreements, or consulting arrangements. The False Claims Act (FCA) is often invoked in conjunction with AKS violations, leading to substantial civil penalties, treble damages, and potential exclusion from federal healthcare programs.
• Lack of Legitimate Patient-Provider Relationship: The DOJ, in concert with state medical boards, scrutinizes situations where prescriptions or services are rendered without a proper, established patient-provider relationship, often through superficial online questionnaires or brief, non-substantive interactions. This is particularly relevant for sexual wellness platforms and DTC weight loss brands where the temptation to streamline patient intake can lead to compliance shortcuts.

Actionable Implications:

• Robust Compliance Programs: Implement and rigorously enforce comprehensive compliance programs that include regular audits of billing practices, referral patterns, and vendor relationships. Ensure all staff, from clinicians to administrative personnel, receive ongoing training on fraud, waste, and abuse prevention.
• Fair Market Value (FMV) for All Arrangements: Any financial relationship with third parties—be it marketing agencies, lead generators, or pharmacies—must be structured at fair market value, commercially reasonable, and not directly or indirectly tied to referrals or the volume/value of business generated.
• Documentation Integrity: Maintain meticulous documentation for every patient encounter, clearly justifying medical necessity, the modality of care, and the establishment of a legitimate patient-provider relationship. This is your primary defense against allegations of false claims.

Corporate Practice of Medicine (CPOM) Continues to Shape Business Structures

The Corporate Practice of Medicine (CPOM) doctrine remains a formidable barrier for non-physician-owned entities seeking to deliver medical services, particularly in states with strict interpretations. Recent intelligence highlights both the enduring strictness in jurisdictions like New York and the nuanced flexibility found elsewhere, such as Nevada.

New York's Unyielding Stance

New York's CPOM is among the nation's most stringent. It unequivocally prohibits corporations from employing physicians or controlling the practice of medicine. This has profound implications for telehealth companies, medspas, and other clinical practices operating within the state.

Key Requirements in NY:

• Physician-Controlled Management Services Organizations (PC-MSOs): For non-physician entities to operate compliantly, they must adopt a PC-MSO model. In this structure, the professional entity (PE) must be physician-owned and physician-controlled, retaining absolute autonomy over all clinical decision-making, patient care, and professional employment. The MSO's role is strictly limited to providing non-clinical administrative and technical services.
• Strict Separation of Clinical and Administrative Functions: The Management Services Agreement (MSA) between the MSO and PE must clearly delineate responsibilities, ensuring the PE maintains ultimate authority. Any perceived MSO influence over clinical matters, physician hiring/firing, or treatment protocols can trigger severe CPOM violations by the New York State Education Department (NYSED) Office of Professional Discipline (OPD) or the Attorney General's Office.
• Fee-Splitting Prohibitions: Financial arrangements must be carefully structured to avoid any appearance of illegal fee-splitting. MSO fees must be fair market value for the services rendered and not tied to patient volume or revenue generation in a way that could be construed as sharing professional fees.

Implications for Your Practice:

• Meticulous Structuring: If operating in or expanding to New York, engage experienced healthcare legal counsel to design and implement a truly compliant PC-MSO model. Generic MSO agreements will not suffice.
• Ongoing Vigilance: Regularly audit your operational workflows and contractual agreements to ensure they align with New York's strict CPOM interpretations. The risk of license revocation, civil penalties, and even criminal charges is substantial.

Nevada's Nuanced Approach

In contrast to New York, Nevada's CPOM doctrine is often considered more flexible, allowing for MSO models, especially for telehealth and medspa businesses. However, this flexibility should not be mistaken for permissiveness.

Key Considerations in NV:

• MSO Model Viability: Nevada generally permits MSO structures where a non-physician entity provides administrative services to a physician-owned professional corporation. This is a common strategy for telehealth and medspa businesses.
• Preserving Physician Autonomy: The critical compliance point remains the preservation of physician autonomy. The MSO must not exert control over clinical decision-making, physician employment, or fee-splitting arrangements that could be deemed illegal. The Nevada State Board of Medical Examiners will scrutinize arrangements that appear to dictate patient care or influence medical diagnoses.

Implications for Your Practice:

• Careful Agreement Drafting: Ensure MSO agreements are meticulously drafted to clearly delineate administrative support from clinical autonomy. Explicitly state the PC retains full control over medical judgments, clinical staff, and professional fees.
• Dental and Chiropractic Practices: While under separate boards, similar CPOM principles apply. MSO models for these specialties in Nevada should also prioritize professional independence.

Evolving Telehealth Regulations: State-Specific Nuances and Supervision Requirements

The post-PHE era has cemented telehealth's role in healthcare delivery, but it has also brought a renewed focus on state-specific regulations, particularly concerning patient-provider relationships, prescribing, informed consent, and supervision.

State-Specific Telehealth Prescribing and Patient-Provider Relationships

For sexual wellness platforms and other telehealth providers, the lack of a uniform federal standard for establishing a patient-provider relationship and prescribing controlled substances remains a critical challenge. The DEA's Ryan Haight Act generally requires an in-person evaluation for controlled substances, with specific exceptions. While the DEA has proposed new rules post-PHE, the landscape is dynamic.

Key State Variations:

• Initial In-Person Exams: Many states still require an initial in-person exam to establish a patient-provider relationship, particularly for certain conditions or before prescribing specific medications. This impacts chiropractic telehealth significantly, where hands-on diagnosis is often foundational.
• Synchronous Communication: Requirements vary for audio-only vs. audio-visual communication. Some states mandate video for initial consultations, while others permit audio-only for established patients.
• Controlled Substances: State medical and pharmacy boards often impose additional restrictions beyond federal law, including limits on Schedule II substances, specific documentation, and prohibitions on prescribing certain controlled substances via telehealth without prior in-person visits. The District of Columbia Board of Pharmacy regulations, for instance, emphasize a proper patient-provider relationship for telehealth prescribing, including for compounding.

Implications for Your Practice:

• State-by-State Legal Analysis: Conduct meticulous legal analysis for every jurisdiction where you operate or intend to operate. This includes reviewing medical board rules, pharmacy board regulations, and state statutes related to telemedicine.
• Robust Protocols: Develop clear protocols for patient intake, identity verification, informed consent, and documentation that meet the most stringent requirements across all operating states.
• Provider Licensure: Ensure all prescribing providers are licensed in the patient's state and are fully aware of and compliant with that state's specific telehealth and controlled substance prescribing guidelines.

Supervision and Delegation in Washington State

The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have clarified requirements for physician and advanced registered nurse practitioner (ARNP) supervision and delegation, particularly relevant for telehealth and medspa settings.

Key Directives:

• Ongoing Collaboration: Supervision is not a passive role. It demands a robust, documented process for ongoing collaboration, review of patient charts, and availability for consultation. This is crucial for telehealth brands to ensure remote care quality.
• Competency and Training: For medspas, delegating physicians or collaborating ARNPs must ensure PAs and ARNPs have the necessary training and competency for each procedure, especially for injectables, lasers, or other advanced modalities. Meticulous records of delegation agreements, training, and ongoing supervision are required.
• Clear Delineation of Responsibilities: Any delegated medical functions or collaborative agreements must adhere to WMC and NCQAC guidelines, including clear delineation of responsibilities, established communication pathways, and regular review of patient care.

Implications for Your Practice:

• Comprehensive Compliance Programs: Invest in programs that include regular audits of supervision practices, staff training, and robust documentation systems. Merely having a supervising physician on paper is insufficient.
• Risk Mitigation: Non-compliance can lead to disciplinary action against all involved practitioners and significant legal liability for the practice.

Telehealth Informed Consent Across All 50 States and D.C.

Informed consent for telehealth is not a one-size-fits-all proposition. The application of this foundational principle introduces specific considerations that vary significantly by state.

Key State-Specific Requirements:

• Content Nuances: Some states require explicit disclosure of potential technology failures, while others mandate specific language regarding patient data privacy in a telehealth context. The content of the consent form must be tailored to each jurisdiction.
• Method of Obtaining Consent: Requirements vary for written, electronic, or verbal consent (with documentation).
• Scope and Limitations: For medspas and dental practices offering virtual consultations, the consent must address the scope and limitations of the virtual interaction versus any subsequent in-person treatment.

Implications for Your Practice:

• Dynamic Consent Workflows: Integrate systems that can present state-specific disclosures and capture consent in the required format for each jurisdiction.
• Regular Audits: Conduct comprehensive audits of current consent practices against the requirements of every state you serve, given the continuous evolution of regulations post-PHE.

Billing and Coding Compliance: A Perpetual Challenge

Telehealth billing and coding remain complex, demanding meticulous adherence to regulations for both commercial insurance and self-pay patients. Missteps here can trigger audits, recoupments, and severe penalties.

Key Compliance Areas:

• Commercial Insurance: Providers must stay updated on each payer's specific telehealth policies, which vary by plan and state. Accurate use of CPT/HCPCS codes, telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth from a location other than the patient's home, 10 for telehealth in the patient's home) is paramount.
• Self-Pay Models: While seemingly simpler, self-pay models require adherence to price transparency rules, including the No Surprises Act's mandate for good faith estimates for uninsured and self-pay patients. Clear, upfront pricing for all services is essential to avoid consumer complaints and regulatory scrutiny.

Implications for Your Practice:

• Continuous Training: Provide ongoing training for billing staff on evolving payer rules and regulatory mandates.
• Documentation Support: Ensure documentation clearly supports billed services, including medical necessity, modality, and patient consent.
• Price Transparency: For self-pay, ensure clear, upfront pricing and compliance with good faith estimate requirements.

What This Means For Your Practice

The current regulatory environment demands a proactive, sophisticated approach to compliance. The days of generic compliance plans or assuming federal guidelines supersede state-specific rules are over. For telehealth operators, medspa owners, and clinical practices expanding nationally, the following are non-negotiable:

1. Invest in State-Specific Regulatory Intelligence: There is no substitute for understanding the precise requirements of each state where you operate. This applies to CPOM, telehealth prescribing, supervision, informed consent, and billing. Generic approaches are high-risk. 2. Fortify Your Corporate Structure: If you are a non-physician-owned entity delivering medical services, your MSO or PC-MSO structure must be meticulously designed and rigorously maintained to withstand scrutiny, especially in strict CPOM states like New York. 3. Audit Your Financial Arrangements: Every financial relationship, from referral sources to vendor contracts, must be reviewed for compliance with anti-kickback statutes and fee-splitting prohibitions. Fair market value and commercial reasonableness are your watchwords. 4. Strengthen Documentation and Protocols: Comprehensive, accurate, and timely documentation is your first line of defense. Develop clear, enforceable protocols for patient intake, assessment, care delivery, and billing that align with regulatory requirements. 5. Prioritize Ongoing Training: Regular and targeted compliance training for all staff, from clinicians to billing personnel, is crucial to foster a culture of compliance and mitigate individual and organizational risk.

The regulatory landscape is not static; it is a constantly shifting terrain. Engaging expert legal counsel specializing in healthcare regulatory compliance is not merely an expense but a critical investment in your practice's longevity and success. TrueEval is committed to providing the clarity and tools necessary to navigate this complexity, ensuring your operations are not just innovative, but impeccably compliant.

Further Reading

• [The Shifting Sands of Healthcare Compliance: Navigating Telehealth Fraud, CPOM, and State-Specific Scrutiny](/blog/telehealth-fraud-cpom-state-scrutiny-roundup)
• [Navigating the Regulatory Gauntlet: Telehealth, CPOM, and Enforcement in 2024](/blog/telehealth-cpom-enforcement-2024)
• [Navigating the Shifting Sands: Critical Regulatory Updates for Telehealth, Medspas, and Clinical Practices](/blog/regulatory-updates-telehealth-medspas-clinical-practices)
• [The Compliance Crucible: Navigating CPOM, Telehealth Prescribing, and DOJ Scrutiny in a Dynamic Regulatory Landscape](/blog/compliance-crucible-cpom-telehealth-doj)