The Shifting Sands of Healthcare Compliance: Navigating DEA, CPOM, and State Board Scrutiny in Telehealth and Medspas

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for telehealth and medspa operations is undergoing significant transformation, marked by intensified enforcement, new DEA prescribing rules, and persistent Corporate Practice of Medicine challenges. This roundup dissects recent developments from federal agencies and state boards, offering critical insights for healthcare businesses navigating this complex environment.

The healthcare industry, particularly the rapidly evolving sectors of telehealth and medspas, is currently experiencing a period of intense regulatory scrutiny and significant policy shifts. From federal drug enforcement to state-level corporate practice doctrines, the compliance demands on healthcare businesses are escalating. TrueEval's latest regulatory roundup provides a critical analysis of recent enforcement actions, new rules, and guidance documents, offering actionable intelligence for founders, operators, and compliance officers.

> For more on this topic, see our analysis: [Navigating the Regulatory Gauntlet: Critical Updates for Telehealth, Medspas, and Clinical Practices](/blog/regulatory-gauntlet-telehealth-medspas-clinical-practices).

DEA's Tightening Grip: Controlled Substances and Telehealth

The Drug Enforcement Administration (DEA) continues to be a central player in shaping the future of telehealth prescribing, especially for controlled substances. The expiration of COVID-19 Public Health Emergency (PHE) waivers has brought the industry back to a stricter interpretation of the Ryan Haight Act, albeit with temporary reprieves and proposed new rules.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Intensified Scrutiny in Telehealth, Medspas, and Controlled Substance Prescribing](/blog/compliance-crucible-telehealth-medspa-controlled-substances).

Proposed Rules and PHE Flexibilities

Initially, the DEA proposed rules that would largely require an in-person medical evaluation for initial prescriptions of Schedule II and certain Schedule III-V controlled substances, including buprenorphine for opioid use disorder (OUD). However, recognizing the need for a smoother transition, the DEA issued a supplemental proposed rule extending the PHE flexibilities until November 11, 2023, and for an additional year (until November 11, 2024) for patient-prescriber relationships established during the PHE. This means that for existing patients, the ability to prescribe controlled substances via telehealth without an in-person visit continues for a limited time.

Implications for Telehealth Operators: This temporary extension provides a crucial window for telehealth platforms, particularly those in OUD treatment, to adapt their operational models. The eventual return to stricter requirements means that a hybrid model, combining virtual consultations with in-person assessments or referrals, will become the standard for new buprenorphine patients and other controlled substances. Compliance infrastructure must be robust, capable of documenting in-person evaluations, tracking PHE-established relationships, and meticulously record-keeping for all controlled substance prescriptions. Failure to prepare for this shift could result in DEA investigations, loss of registration, and severe penalties.

DOJ's Intensified Enforcement

Complementing the DEA's regulatory efforts, the Department of Justice (DOJ) has significantly intensified its enforcement against telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This trend underscores that mere technical compliance with emergency waivers is insufficient if the underlying medical practice lacks a "legitimate medical purpose" or if the platform facilitates diversion.

Recent DOJ actions highlight that the 'legitimate medical purpose' standard is a foundational legal requirement. For instance, several cases have emerged where telehealth platforms were accused of operating as "pill mills," prioritizing revenue over patient safety and legitimate medical practice. While specific dollar amounts and case names vary, the consistent theme is the prosecution of systemic failures and fraudulent schemes. Penalties can include substantial fines, imprisonment, and exclusion from federal healthcare programs.

Actionable Insight: Telehealth brands, especially those in mental health, pain management, or weight loss, must conduct a rigorous re-evaluation of patient intake protocols, provider training, and technological safeguards. Every prescription for a controlled substance must be preceded by a comprehensive, individualized medical evaluation meeting federal and state standards. This requires top-down compliance cultures, regular audits of prescribing patterns, and clear policies that prioritize patient safety and regulatory adherence over rapid patient acquisition.

Navigating Across State Lines

The complexity of DEA registration is further amplified for providers prescribing controlled substances across state lines. Post-PHE, providers must generally be licensed in the state where the patient is located and hold a DEA registration in that state if they intend to prescribe controlled substances. This necessitates a robust credentialing and compliance infrastructure to track provider licenses, DEA registrations, and state-specific prescribing rules. For multi-state telehealth operators, this is not a trivial undertaking and requires significant investment in compliance resources.

Corporate Practice of Medicine (CPOM): A Persistent Hurdle

State-level Corporate Practice of Medicine (CPOM) doctrines continue to pose significant structural challenges for telehealth and medspa businesses, particularly in states with strict interpretations. These laws generally prohibit corporations and non-licensed entities from employing physicians or controlling medical decision-making, aiming to protect professional independence and patient care from commercial influence.

Iowa and Kentucky: Strict Enforcement

Iowa maintains a strict CPOM doctrine, making it highly problematic for non-physician owned entities to directly employ licensed healthcare professionals or own medical practices. This means that traditional corporate structures where a lay entity directly employs physicians, dentists, or advanced practice providers are largely impermissible. Similarly, Kentucky is considered a moderate enforcement state, where the CPOM doctrine is generally recognized and enforced, requiring careful adherence to exceptions and compliant management service organization (MSO) models.

Implications for Telehealth and Medspas:

Telehealth Brands: Direct employment of Iowa or Kentucky-licensed providers by a national telehealth company (if not itself a professional corporation licensed in that state) is likely non-compliant. Instead, models such as forming a state-specific professional corporation (PC) or professional limited liability company (PLLC) owned by licensed professionals, which then contracts with the telehealth platform for administrative services, are often required. The MSO agreement must meticulously avoid any influence over clinical decision-making, fee-splitting, or direct employment of clinical staff.
Medspas: Non-physician ownership of a medspa offering medical services (e.g., injectables, laser treatments) is highly problematic. The medical director must be genuinely engaged, and the entity providing medical services must typically be a professional entity owned by licensed professionals. Any MSO arrangement must clearly delineate clinical and administrative responsibilities, ensuring the MSO does not dictate pricing for medical services or interfere with professional judgment.
DTC Telehealth Weight Loss Brands: These brands, often prescribing GLP-1 agonists, face particular scrutiny. The financial relationship between the MSO and the professional entity must be structured at fair market value for administrative services, independent of patient volume or prescriptions. Any arrangement where a non-physician entity directly or indirectly profits from medical services rendered by a physician can be deemed a violation of CPOM. States like California, Texas, New York, and Illinois are particularly active in this area.

Actionable Insight: For any healthcare business operating in or expanding into CPOM states, proactive legal counsel is essential. Structuring operations to ensure that clinical decision-making, employment of licensed practitioners, and the receipt of professional fees remain within the purview of a professionally owned and controlled entity is paramount. Non-compliance can lead to license revocation, corporate dissolution, significant fines, and even criminal charges for illegal practice of medicine.

State Board Scrutiny: Telehealth and Scope of Practice

State boards are increasingly active in defining the parameters of telehealth and ensuring compliance within specific professional scopes of practice. This is particularly evident in states like Michigan and the District of Columbia.

Michigan's Focus on Telehealth and Medspas

The Michigan Board of Medicine is actively monitoring and enforcing regulations related to telehealth and medspa operations. Disciplinary actions often stem from issues like unprofessional conduct, scope of practice violations, and inadequate supervision. For telehealth brands, this means ensuring all practitioners are appropriately licensed in Michigan, that patient-provider relationships are established in accordance with state law (e.g., proper initial evaluations, informed consent), and that prescribing practices strictly adhere to Michigan's Public Health Code (MCL 333.16101 et seq.).

Medspa operators in Michigan face unique challenges related to scope of practice and delegation. The Board expects clear delineation of services that can only be performed by a physician, those that can be delegated to nurses or physician assistants under appropriate supervision, and those that fall outside the scope of practice for non-medical personnel. Medical directors must be actively engaged and providing direct, on-site supervision as required.

District of Columbia: Establishing Valid Provider-Patient Relationships

The District of Columbia has specific regulations governing the establishment of a valid provider-patient relationship via telehealth, which is a prerequisite for prescribing. The DC Board of Medicine's regulations explicitly require an initial real-time, interactive audio-visual examination to establish this relationship, with limited exceptions. This means asynchronous modalities or audio-only consultations are generally insufficient for initiating a prescribing relationship, particularly for new patients or new conditions.

Actionable Insight: Businesses operating in DC must ensure their technology platforms support robust real-time audio-visual interactions and that their clinical protocols integrate these requirements. The standard of care for telehealth must be equivalent to that of in-person care, requiring thorough assessment, comprehensive documentation, and appropriate follow-up. Failure to meet these standards can lead to disciplinary action, including license suspension or revocation.

Chiropractic Telehealth Regulations

State chiropractic boards nationwide are issuing guidance and regulations on the use of telehealth for chiropractic care. The ability to conduct initial consultations, establish a patient-provider relationship, and deliver certain therapeutic interventions remotely varies significantly by state. Practices must meticulously review their state's chiropractic board rules to ensure compliance, particularly regarding the definition of a 'physical examination' and whether it can be deferred or adapted for telehealth.

Actionable Insight: Telehealth platforms supporting chiropractic care must ensure their technology and workflows align with these state regulations, including secure patient portals for consent, robust documentation capabilities for virtual encounters, and mechanisms for verifying patient identity and location. Proactive compliance is essential to leverage telehealth's benefits while mitigating risks of disciplinary actions.

CMS Expansion: Opportunities and Compliance Nuances

The Centers for Medicare & Medicaid Services (CMS) continues to expand the list of services eligible for Medicare reimbursement when furnished via telehealth, along with broadening the types of providers who can deliver these services. These updates reflect a sustained commitment to integrating telehealth into the permanent healthcare landscape, moving beyond pandemic-era flexibilities.

Implications for Healthcare Businesses: This expansion presents significant opportunities for telehealth brands, medspas, and even chiropractic offices that incorporate medical services. More services becoming reimbursable can increase patient access and revenue streams. However, it necessitates meticulous attention to billing codes, documentation requirements, and compliance with originating and distant site rules. Practices must ensure their systems can accurately capture and submit claims for these newly eligible services, using appropriate CPT codes and modifiers (e.g., 95 for synchronous telehealth, GT for asynchronous).

Actionable Insight: Stay current with the specific CPT codes added to the Medicare telehealth services list. Ensure your services align precisely with these definitions and adhere to the evolving rules regarding patient consent, technology requirements (HIPAA-compliant platforms), and state-specific licensure for providers delivering care across state lines. Investing in robust compliance infrastructure and ongoing staff training is critical to capitalize on these expansions while mitigating risk of claim denials, audits, and potential fraud and abuse investigations.

What This Means For Your Practice

The current regulatory environment demands a proactive and sophisticated approach to compliance. For telehealth operators, medspas, and clinical practices expanding nationally, the message is clear:

1. DEA Compliance is Non-Negotiable: Prepare for the eventual return to stricter in-person requirements for controlled substance prescribing. Implement robust systems for tracking patient-prescriber relationships, documenting evaluations, and ensuring legitimate medical purpose. The DOJ's increased enforcement means the stakes are higher than ever. 2. CPOM Requires Structural Vigilance: Understand the specific CPOM doctrines in every state where you operate or plan to expand. Engage experienced legal counsel to structure your business models (e.g., MSOs) to ensure professional independence, avoid fee-splitting, and prevent corporate control over clinical decisions. This is particularly critical for high-growth sectors like DTC weight loss. 3. State Boards are Active: Regularly review and align your operational policies and procedures with specific state board regulations for your profession and service lines. Pay close attention to requirements for establishing patient-provider relationships, scope of practice, supervision, and documentation standards, especially in states like Michigan and the District of Columbia. 4. Leverage CMS Expansions Wisely: While CMS is expanding telehealth opportunities, compliance with billing codes, documentation, and technical requirements remains paramount. Ensure your billing and clinical teams are fully trained on the latest Medicare telehealth rules to avoid denials and audits.

Navigating these complex and evolving regulatory landscapes requires continuous monitoring, robust internal controls, and a commitment to a culture of compliance. TrueEval remains your definitive partner in understanding these shifts and transforming regulatory challenges into sustainable operational strategies.