Scaling to 50 States: Your Infrastructure Checklist for Compliant Telehealth Growth

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

Expanding your healthcare practice from a single state to a multi-state or even 50-state operation is an ambitious undertaking. This guide provides a critical infrastructure checklist, focusing on the compliance pillars essential for sustainable, risk-mitigated growth in the complex telehealth landscape.

The promise of telehealth is boundless: expanded patient access, operational efficiency, and unprecedented growth opportunities. Yet, for healthcare entrepreneurs looking to scale beyond their initial state, the path is fraught with regulatory complexities. Moving from a single-state operation to a multi-state or 50-state footprint is not merely an exercise in replication; it demands a sophisticated, compliance-first infrastructure strategy. As the editorial director for TrueEval, I've witnessed firsthand the pitfalls and triumphs of practices navigating this expansion. This article provides a definitive checklist, designed to empower you with the knowledge and actionable steps to achieve compliant, sustainable growth.

> For more on this topic, see our analysis: [Medspa Expansion: Navigating the Regulatory Minefield for Compliant Growth](/blog/medspa-expansion-regulatory-minefield-compliant-growth-compliant-growth-mo2ijtzg).

The Multi-State Mandate: Why Compliance is Your Growth Engine

Many practices begin with a single state, often their home base, where they understand the local regulatory nuances. However, the moment you serve a patient across state lines, you enter a new dimension of compliance. The notion that 'telehealth is just like in-person care' is a dangerous oversimplification. Every state has its own medical board, pharmacy board, dental board, and corporate practice of medicine (CPOM) doctrines, all of which impact how you can operate. Ignoring these can lead to severe penalties, including license revocation, fines, and even criminal charges, effectively derailing your expansion before it truly begins.

Consider the District of Columbia Pharmacy Board Regulations or Connecticut's Pharmacy Board Regulations. These are not just about pharmacies; they dictate how *you*, the provider, must establish a patient-provider relationship for prescribing, handle compounding, and ensure legitimate fulfillment. If your telehealth platform facilitates prescriptions in DC or CT, you are directly impacted. Similarly, Michigan's Medical Board Enforcement Trends highlight a focus on telehealth and medspa compliance, scrutinizing everything from unprofessional conduct to scope of practice violations and inadequate supervision. These state-specific regulations are not exceptions; they are the norm.

Infrastructure Checklist: Building Your Multi-State Compliance Framework

Scaling compliantly requires a robust, adaptable infrastructure built on several key pillars. This isn't a one-time setup; it's an ongoing commitment to regulatory intelligence and operational excellence.

1. Licensure and Credentialing Management: The Foundation of Multi-State Practice

Your providers are your most valuable asset, and their licensure is your most critical compliance point. Each state where you intend to treat patients requires your providers to be licensed in that state. This is non-negotiable.

Centralized Licensure Tracking System: Implement a system to track every provider's license status, expiration dates, and continuing education requirements across all states. This should include automated alerts for renewals.
Interstate Licensure Compacts: Leverage initiatives like the Interstate Medical Licensure Compact (IMLC), Nurse Licensure Compact (NLC), and Psychology Interjurisdictional Compact (PSYPACT) where applicable. While these compacts streamline the process, they still require initial applications and adherence to compact-specific rules.
DEA Registration: For providers prescribing controlled substances, ensure they have active DEA registrations for each state where they practice, if required by state law. The DEA's heightened scrutiny on online prescribing of controlled substances, including their proposed rules for buprenorphine, underscores the critical importance of legitimate medical purpose and patient safety. This means robust protocols for initial evaluations—even as PHE flexibilities extend, prepare for a future where in-person or referred evaluations for controlled substances may be the norm.
Credentialing and Enrollment: Beyond state licensure, providers must be credentialed with commercial payers in each state. This is a lengthy process, often taking 90-120 days per payer per state. Plan for this timeline and consider third-party credentialing services to expedite. For self-pay models, credentialing is less critical, but provider verification remains essential.

Actionable Insight: Begin provider licensure and credentialing processes *well in advance* of your target launch date in a new state. A 6-9 month lead time for full payer enrollment is not uncommon. Budget for licensure fees, which can range from a few hundred to over a thousand dollars per state per provider.

2. Legal Entity Structuring: Navigating Corporate Practice of Medicine (CPOM)

CPOM doctrines vary wildly by state and dictate who can own a medical practice and employ licensed providers. This is perhaps the most complex aspect of multi-state expansion.

State-Specific CPOM Analysis: Before entering a new state, conduct a thorough legal analysis of its CPOM laws. States like Ohio have strict CPOM, often necessitating a Management Services Organization (MSO) model where a non-clinical entity provides administrative services to a physician-owned professional corporation. Kentucky also maintains a CPOM doctrine, requiring careful structuring.
Management Services Organization (MSO) Model: This is the most common compliant structure for multi-state telehealth. The MSO (your corporate entity) provides non-clinical services (tech, marketing, billing, HR) to separate, physician-owned professional entities in each state. The key is that the MSO cannot control clinical decision-making, set professional fees, or employ licensed practitioners who deliver medical services.
Professional Entities: Establish separate professional corporations or professional limited liability companies (PLLCs) in each state where CPOM applies, owned by licensed providers. These entities hold the professional licenses and employ the clinical staff.
Clear Contractual Separation: MSO agreements must meticulously define the separation of clinical and administrative functions, ensuring the professional entity retains full autonomy over medical practice. This is critical for avoiding DOJ enforcement actions against telehealth fraud and kickback schemes, which often scrutinize financial arrangements that could be construed as inducing referrals or controlling medical judgment.

Actionable Insight: Engage experienced healthcare legal counsel early in your expansion planning. They will help you establish the correct legal entities and MSO agreements for each target state, minimizing CPOM risk. Expect legal fees to be a significant upfront investment, potentially ranging from $10,000 to $50,000+ per state for complex MSO setups.

3. Regulatory Intelligence & Policy Management: Staying Ahead of the Curve

The regulatory landscape for telehealth is dynamic. What's compliant today may not be tomorrow. A robust system for monitoring and adapting to changes is essential.

Dedicated Regulatory Monitoring: Implement a system (internal or external) to track changes in state medical board rules, pharmacy board regulations, dental board guidelines, and federal policies (e.g., DEA, CMS). This includes monitoring proposed rules, like the DEA's proposed new telehealth prescribing rules for buprenorphine, which signal future shifts.
State-Specific Policy Playbooks: Develop comprehensive internal policy playbooks for each state of operation. These playbooks should cover: licensure requirements, scope of practice for all provider types, supervision requirements (e.g., for dental hygienists in teledentistry), prescribing rules (especially for controlled substances), informed consent, privacy, and billing guidelines.
Continuous Staff Training: Regularly train all clinical and administrative staff on state-specific policies and any regulatory updates. This includes nuanced topics like the establishment of a proper patient-provider relationship for telehealth prescribing, as emphasized by DC and CT Pharmacy Boards.
Compliance Officer/Team: Designate a compliance officer or team responsible for overseeing regulatory adherence, conducting internal audits, and managing policy updates. For larger operations, this is a full-time role.

Actionable Insight: Budget for ongoing regulatory intelligence services or allocate internal resources. Consider subscription services that provide real-time updates on telehealth regulations. Regular compliance audits (quarterly or semi-annually) are crucial to identify gaps before they become liabilities.

4. Billing and Coding Compliance: Protecting Your Revenue Stream

Revenue optimization is inextricably linked to billing and coding compliance. Missteps here can lead to significant financial losses and regulatory penalties.

Payer-Specific Policies: As highlighted by Navigating Telehealth Billing and Coding Compliance, commercial insurance policies vary widely by plan and state. Your billing system must be capable of adapting to these nuances, including acceptable modalities (audio-only vs. audio-visual), eligible services, and specific CPT/HCPCS codes and modifiers (e.g., -95, -GT, -GQ, -G0).
Place of Service (POS) Codes: Ensure correct application of POS codes (e.g., 02 for telehealth from a location other than the patient's home, 10 for telehealth in the patient's home). Incorrect POS codes are a common reason for claim denials.
Documentation Standards: Robust documentation is paramount. Records must clearly support medical necessity, the modality used, and patient consent. This is your primary defense in an audit.
Self-Pay Transparency: For self-pay models, adhere to price transparency requirements, including providing good faith estimates under the No Surprises Act. Clear, upfront pricing prevents consumer complaints and regulatory scrutiny from state attorneys general.
Fraud, Waste, and Abuse (FWA) Prevention: Implement strong internal controls to prevent FWA. The DOJ's intensified enforcement against telehealth fraud and kickback schemes makes it clear that billing for services not rendered, medically unnecessary services, or illegal inducements are high-risk areas. All financial relationships with third parties (e.g., lead generators, labs, pharmacies) must comply with Anti-Kickback Statute (AKS) and Stark Law safe harbors.

Actionable Insight: Invest in a billing system and staff training that specifically addresses multi-state telehealth billing complexities. Consider outsourcing billing to a specialized vendor with expertise in telehealth. Conduct regular billing audits to identify and correct errors proactively.

5. Technology and Data Security: The Backbone of Virtual Care

Your technology infrastructure must be secure, scalable, and compliant with privacy regulations across all states.

HIPAA Compliance: Ensure all platforms, from your EHR/EMR to communication tools, are fully HIPAA-compliant. This includes robust data encryption, access controls, and business associate agreements (BAAs) with all third-party vendors.
State-Specific Privacy Laws: Be aware of state laws that may impose stricter privacy requirements than HIPAA (e.g., California's CCPA/CPRA, New York's SHIELD Act). Your privacy policies and data handling practices must accommodate the most stringent applicable state laws.
Secure Telehealth Platform: Utilize a telehealth platform that meets federal and state security standards for audio-visual and audio-only consultations. Ensure reliable connectivity and features for identity verification.
Electronic Prescribing (e-Prescribing): Implement an e-prescribing system that integrates with your EHR and complies with state and federal regulations for all medications, including controlled substances. This is especially critical given the scrutiny from the DEA and state pharmacy boards.
Data Residency and Storage: Understand where your patient data is stored and ensure it complies with any state-specific data residency requirements.

Actionable Insight: Conduct regular security audits and penetration testing of your telehealth platform and IT infrastructure. Develop a robust incident response plan for data breaches. Prioritize vendors with strong security certifications and proven track records in healthcare.

6. Pharmacy and Lab Partnerships: Vetting Your Ecosystem

Your external partners are an extension of your practice and must also be compliant.

Licensed Partners: Ensure all pharmacies, compounding facilities, and laboratories you partner with are appropriately licensed in *every state* where your patients reside. The DC and CT Pharmacy Board Regulations specifically highlight the need for pharmacies fulfilling prescriptions to be licensed in their respective states and adhere to compounding standards.
Compounding Compliance: If your practice (e.g., a medspa) utilizes compounded medications, verify that your partner pharmacies adhere to USP standards and all state-specific compounding regulations. Non-compliant compounding can lead to severe patient safety issues and regulatory action against both the pharmacy and the prescribing provider.
Anti-Kickback and Stark Law Compliance: All financial arrangements with pharmacies, labs, and other referral sources must be structured to comply with federal Anti-Kickback Statute and Stark Law, as well as state equivalents. Avoid any arrangements that could be perceived as inducements for referrals, a key focus of DOJ enforcement.
Due Diligence: Conduct thorough due diligence on all potential partners, including reviewing their licenses, compliance policies, and any history of regulatory actions.

Actionable Insight: Develop a standardized vendor vetting process that includes legal review of all contracts and compliance questionnaires. Regularly audit your partners for ongoing compliance.

What This Means For Your Practice: A Phased Approach to Growth

Scaling to 50 states is a marathon, not a sprint. Attempting to launch everywhere simultaneously without the proper infrastructure is a recipe for disaster. Instead, adopt a phased, strategic approach:

1. Pilot States: Start with a few strategically chosen states. Prioritize states with favorable regulatory environments (e.g., less strict CPOM, clear telehealth laws) or high patient demand. 2. Build and Refine: Use these pilot states to build out your core compliance infrastructure, refine your MSO model, optimize your billing processes, and perfect your provider credentialing workflows. Document everything. 3. Iterate and Expand: Once your processes are proven in the pilot states, iterate and expand to new states in manageable clusters. Each new state will require a legal review, policy updates, and provider licensure, but your core infrastructure will be in place. 4. Ongoing Monitoring: Maintain continuous regulatory monitoring and adapt your policies and procedures as laws evolve. This is particularly crucial as federal flexibilities from the Public Health Emergency (PHE) sunset and new rules, like those proposed by the DEA, take effect.

For medspas, dental practices, and chiropractic offices, remember that while your core services may differ, the underlying principles of multi-state compliance (licensure, CPOM, billing, data security, anti-kickback) apply universally. The Michigan Medical Board Enforcement Trends serve as a stark reminder that state boards are actively scrutinizing all forms of healthcare delivery, including aesthetic services and adjunctive care via telehealth.

Building a 50-state telehealth operation is an immense undertaking, but with a meticulous, compliance-first approach to infrastructure, it is achievable. TrueEval is committed to providing the tools and insights you need to navigate this complex landscape, ensuring your growth is not just rapid, but also resilient and fully compliant. Your proactive investment in a robust compliance infrastructure today will safeguard your practice's future and unlock its full potential for national impact.