Navigating the Regulatory Gauntlet: Critical Updates for Telehealth, Medspas, and Clinical Practices

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for healthcare businesses is shifting rapidly, with intensified enforcement, new prescribing rules, and evolving corporate practice doctrines. This briefing cuts through the noise, detailing critical updates from the DEA, DOJ, CMS, and state boards that demand immediate attention from telehealth operators, medspas, and clinical practices.

The healthcare regulatory environment is a dynamic and often challenging terrain, particularly for innovative models like telehealth and medspas, and for traditional practices expanding their reach. As the editorial director for TrueEval, our mandate is to provide clarity and actionable intelligence amidst this complexity. This regulatory roundup distills recent critical developments from federal agencies and state boards, offering a strategic overview for founders, operators, and compliance officers.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Intensified Scrutiny in Telehealth, Medspas, and Controlled Substance Prescribing](/blog/compliance-crucible-telehealth-medspa-controlled-substances).

DEA and DOJ Intensify Scrutiny on Telehealth Prescribing

The federal government continues to sharpen its focus on controlled substance prescribing via telehealth, signaling a clear intent to prevent diversion while balancing access to care. This has manifested in both proposed rules and aggressive enforcement actions.

Proposed DEA Rules for Telehealth Controlled Substance Prescribing

The U.S. Drug Enforcement Administration (DEA) has been working to establish a permanent framework for prescribing controlled medications via telehealth, following the expiration of the COVID-19 Public Health Emergency (PHE) flexibilities. While the initial proposed rules were met with significant industry feedback, the DEA issued a supplemental proposed rule indicating that the PHE flexibilities would be extended until November 11, 2023, and for an additional year (until November 11, 2024) for patient-prescriber relationships established during the PHE. This extension provides a temporary reprieve but underscores the eventual return to stricter requirements.

Key Takeaway: For telehealth providers prescribing buprenorphine for opioid use disorder (OUD), or any Schedule II and certain Schedule III-V controlled substances, the future likely mandates an initial in-person medical evaluation or a referral from a practitioner who has conducted one. This marks a fundamental shift from the broad allowances during the PHE. Practices must prepare for a hybrid model, integrating in-person assessments or robust referral networks to maintain compliance post-November 2024. The rules also emphasize the importance of state law compliance, meaning practices must navigate both federal DEA requirements and any additional state-specific regulations for telehealth and controlled substance prescribing.

DOJ's Heightened Enforcement Against Telehealth Controlled Substance Violations

Beyond rulemaking, the Department of Justice (DOJ) has significantly intensified its focus on prosecuting telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This trend highlights that mere technical compliance with emergency waivers (like those related to the Ryan Haight Act during the COVID-19 PHE) is insufficient if the underlying medical practice lacks a legitimate medical purpose or if the platform incentivizes or enables diversion.

Case in Point: While specific recent cases with public dollar amounts are often under seal or part of ongoing investigations, the DOJ's press releases frequently detail indictments and arrests related to alleged healthcare fraud schemes involving telehealth and controlled substances. For example, in July 2023, the DOJ announced charges against dozens of individuals across the country, including medical professionals, for alleged healthcare fraud schemes totaling over $2.8 billion, with a significant portion tied to fraudulent telemedicine and prescription drug diversion. This included schemes involving medically unnecessary prescriptions for controlled substances and other treatments.

Actionable Insight: For telehealth brands, this means a rigorous re-evaluation of patient intake protocols, provider training, and technological safeguards. Every prescription for a controlled substance must be preceded by a comprehensive, individualized medical evaluation that meets federal and state standards, including appropriate physical examinations where necessary. Medspas, dental practices, and chiropractic offices that might consider incorporating controlled substance prescribing into their telehealth offerings (e.g., for pain management) must recognize that the 'legitimate medical purpose' standard is not merely a suggestion; it is a foundational legal requirement. Robust compliance programs, regular audits of prescribing patterns, and clear policies prioritizing patient safety and regulatory adherence over rapid patient acquisition are now non-negotiable. Failure can lead to severe criminal penalties, substantial fines, and exclusion from federal healthcare programs.

Navigating DEA Registration Across State Lines

The complexities of DEA registration for telehealth providers prescribing controlled substances across state lines remain a critical concern. The expiration of PHE waivers has reverted the regulatory environment closer to the pre-PHE rules, primarily governed by the Ryan Haight Act.

Compliance Requirement: Providers must not only be licensed in the state where the patient is located but also hold a DEA registration in that state if they intend to prescribe controlled substances to patients there. This necessitates a robust credentialing and compliance infrastructure to track provider licenses, DEA registrations, and state-specific prescribing rules. For multi-state telehealth operators, this is a significant logistical and compliance challenge, requiring meticulous attention to detail to avoid DEA investigations, license revocation, civil monetary penalties, and even criminal charges.

Corporate Practice of Medicine (CPOM) Enforcement: A Growing Threat

The Corporate Practice of Medicine (CPOM) doctrine continues to be a significant hurdle for innovative healthcare business models, particularly for telehealth and medspas. Recent intelligence highlights intensified scrutiny in various states.

Iowa's Strict CPOM Doctrine

Iowa maintains a particularly strict CPOM doctrine, generally prohibiting non-licensed entities from employing licensed healthcare professionals, owning medical practices, or exercising control over clinical judgments. This means that traditional corporate structures where a lay entity directly employs physicians, dentists, or advanced practice providers are largely impermissible.

Implications: For telehealth brands seeking to operate in Iowa, direct employment of Iowa-licensed providers by a national telehealth company that is not itself a professional corporation licensed in Iowa is likely non-compliant. Instead, models such as forming an Iowa professional corporation (PC) or professional limited liability company (PLLC) owned by licensed Iowa professionals, which then contracts with the telehealth platform for administrative and technical services, are necessary. Medspas in Iowa face similar scrutiny; the entity providing medical services must typically be a professional entity owned by licensed professionals, and the medical director must genuinely oversee and supervise medical services. Any Management Service Organization (MSO) arrangement must meticulously avoid any influence over clinical decision-making, fee-splitting, or direct employment of clinical staff.

Kentucky's Moderate CPOM Enforcement

Kentucky is considered a moderate enforcement state for CPOM. While the doctrine is generally recognized and enforced, specific statutory exceptions or common practices may allow for certain compliant structures. Nevertheless, the principle remains: non-physician owned management companies (MSOs) can provide administrative support, but they cannot dictate clinical decisions, employ licensed professionals who render medical services, or share professional fees.

Actionable Advice: For telehealth providers and medspas in Kentucky, MSO agreements must clearly delineate the separation of clinical and administrative functions, ensuring the MSO does not exert undue influence over the professional entity. Dental practices and chiropractic offices must also ensure any business arrangements preserve professional independence and adhere to their respective professional practice acts and CPOM principles.

CPOM for DTC Telehealth Weight Loss Brands

The rise of direct-to-consumer (DTC) telehealth weight loss brands, particularly those prescribing GLP-1 agonists, has drawn significant attention from regulators regarding CPOM. States like California, Texas, New York, and Illinois (among others) with strict CPOM doctrines pose significant compliance challenges.

Critical Challenge: The core challenge lies in the tension between a scalable, technology-driven business model and state laws designed to protect the physician-patient relationship from commercial influence. Clinical decisions, prescribing, and patient care protocols must remain solely under the control of licensed medical professionals, not corporate entities or non-clinician management. MSO models are often employed, but the financial relationship between the MSO and the professional entity must be structured at fair market value for administrative services, independent of the volume or value of referrals or medical services. Any arrangement where a non-physician entity directly or indirectly profits from medical services rendered by a physician can be deemed a violation of CPOM.

Warning: Failure to comply with CPOM can lead to severe consequences, including license revocation for physicians, corporate penalties, disgorgement of profits, and even criminal charges in some jurisdictions. Given the increasing scrutiny on DTC telehealth, proactive legal review and robust compliance frameworks are essential.

State Board Scrutiny: Telehealth and Medspa Compliance

State medical and professional boards are actively monitoring and enforcing regulations specific to telehealth and medspa operations, often leading to disciplinary actions.

Michigan Medical Board Enforcement Trends

The Michigan Board of Medicine is actively monitoring and enforcing regulations related to telehealth and medspa operations. Disciplinary actions often stem from issues like unprofessional conduct, scope of practice violations, and inadequate supervision. This signals a critical need for robust compliance frameworks within these sectors.

Specific Concerns: For telehealth brands in Michigan, this means heightened focus on ensuring all practitioners are appropriately licensed in Michigan, that patient-provider relationships are established in accordance with state law (e.g., proper initial evaluations, informed consent), and that prescribing practices strictly adhere to Michigan's Public Health Code (MCL 333.16101 et seq.) and administrative rules (Michigan Administrative Code R 338.2301 et seq.). Medspa operators face unique challenges related to scope of practice and delegation, requiring clear delineation of services and active, on-site supervision by medical directors as required. Misrepresentation of services or provider qualifications is a significant risk area. Dental practices and chiropractic offices expanding into adjunctive services or utilizing telehealth must ensure all services remain within their defined scope of practice.

District of Columbia Telehealth Prescribing Requirements

The District of Columbia has specific regulations governing the establishment of a valid provider-patient relationship via telehealth, which is a prerequisite for prescribing. The DC Board of Medicine's regulations explicitly require an initial real-time, interactive audio-visual examination to establish this relationship, with limited exceptions. This means that asynchronous modalities or audio-only consultations are generally insufficient for initiating a prescribing relationship, particularly for new patients or new conditions.

Operational Impact: This requirement directly impacts business models that rely heavily on asynchronous platforms or audio-only services for initial patient intake or diagnosis. Businesses must ensure their technology platforms support robust real-time audio-visual interactions and that their clinical protocols integrate these requirements. The standard of care for telehealth must be equivalent to that of in-person care, requiring thorough assessment, comprehensive documentation, and appropriate follow-up.

Telehealth for Chiropractic Care: State Board Regulations

Across the nation, state chiropractic boards are increasingly issuing guidance and regulations on the use of telehealth for chiropractic care. The ability to conduct initial consultations, establish a patient-provider relationship, and deliver certain therapeutic interventions remotely varies significantly by state. Practices must meticulously review their state's chiropractic board rules to ensure compliance, particularly regarding the definition of a 'physical examination' and whether it can be deferred or adapted for telehealth.

Key Compliance Areas: This directly impacts the scope of services that can be offered virtually, influencing business models for telehealth-focused chiropractic brands. Telehealth platforms and providers supporting chiropractic care must ensure their technology and workflows align with these state regulations, including secure patient portals for consent, robust documentation capabilities for virtual encounters, and mechanisms for verifying patient identity and location. Non-compliance can lead to disciplinary actions, including fines, license suspension, or revocation.

CMS Expands Telehealth Services and Provider Eligibility

The Centers for Medicare & Medicaid Services (CMS) has continued to expand the list of services eligible for Medicare reimbursement when furnished via telehealth, along with broadening the types of providers who can deliver these services. These updates reflect a sustained commitment to integrating telehealth into the permanent healthcare landscape, moving beyond pandemic-era flexibilities.

Opportunity and Challenge: For telehealth brands, this means a growing market opportunity as more services become reimbursable, potentially increasing patient access and revenue streams. However, it also necessitates meticulous attention to billing codes, documentation requirements, and compliance with originating and distant site rules. Medspas and chiropractic offices that incorporate medical services or have licensed medical professionals on staff may find new avenues for patient engagement and follow-up care through telehealth. However, the scope of practice for these providers must strictly align with state licensure and Medicare's specific service definitions for telehealth.

Compliance Imperative: Businesses must stay current with the specific CPT codes added to the Medicare telehealth services list, understand any associated modifiers (e.g., 95 for synchronous telehealth, GT for asynchronous), and adhere to the evolving rules regarding patient consent, technology requirements (HIPAA-compliant platforms), and state-specific licensure for providers delivering care across state lines. Failure to comply can result in claim denials, audits, and potential fraud and abuse investigations.

What This Means For Your Practice

The current regulatory climate demands a proactive and sophisticated approach to compliance. For telehealth operators, medspas, and clinical practices expanding nationally or leveraging virtual care, these developments underscore several critical imperatives:

Robust Compliance Infrastructure: Invest in systems and processes that can track multi-state licensing, DEA registrations, and state-specific telehealth and prescribing rules. This includes comprehensive credentialing, privileging, and ongoing monitoring.
CPOM Vigilance: Regularly review your business structure, MSO agreements, and provider contracts to ensure strict adherence to state-specific Corporate Practice of Medicine doctrines. Avoid any arrangements that could be construed as non-licensed entities controlling clinical decision-making or engaging in illegal fee-splitting.
Prescribing Protocol Audits: For any practice prescribing controlled substances, conduct regular internal audits of prescribing patterns, patient intake, and documentation to ensure adherence to federal DEA rules (including the evolving Ryan Haight Act requirements) and state regulations. The DOJ's enforcement actions demonstrate that 'legitimate medical purpose' is paramount.
Continuous Regulatory Monitoring: The landscape is constantly shifting. Designate internal resources or partner with external experts to continuously monitor updates from the DEA, DOJ, CMS, and relevant state medical and professional boards. This includes Federal Register entries, state legislative changes, and new agency guidance documents.
Provider Training and Education: Ensure all clinical staff are thoroughly trained on evolving telehealth regulations, scope of practice limitations, and compliance requirements specific to their roles and the states in which they practice. Ignorance of the law is not a defense.

By embracing these principles, healthcare businesses can not only mitigate significant legal and financial risks but also build a foundation for sustainable growth and continued innovation in a highly regulated industry. TrueEval remains committed to providing the intelligence and tools necessary to navigate this complex environment successfully.