TrueEval Regulatory Intelligence Briefing: Navigating the Shifting Sands of Telehealth Compliance, CPOM, and Enforcement

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

The healthcare regulatory landscape is in constant flux, with new enforcement actions and state-level mandates reshaping operational strategies for telehealth, medspas, and traditional practices alike. This briefing cuts through the noise, providing critical insights into recent developments in corporate practice of medicine, DEA scrutiny, and state-specific prescribing rules.

The past week has underscored a critical truth for healthcare executives: compliance is not static, it is a dynamic, ever-evolving discipline. From intensified federal enforcement against telehealth fraud to nuanced state-level directives on supervision and prescribing, the regulatory environment demands constant vigilance. For telehealth founders, multi-state practice owners, and compliance officers, understanding these shifts is not merely about avoiding penalties; it's about building resilient, future-proof healthcare enterprises.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Heightened Enforcement and Evolving Telehealth Mandates](/blog/compliance-crucible-telehealth-mandates).

The Intensifying Scrutiny of Telehealth: DOJ and DEA in Focus

Federal agencies are signaling a clear message: the rapid expansion of telehealth has opened new avenues for fraud and abuse, and they are prepared to act decisively. The Department of Justice (DOJ) continues to aggressively pursue enforcement actions against telehealth fraud and kickback schemes (Intelligence Item 6). This isn't just about egregious billing for services not rendered; it extends to sophisticated arrangements designed to circumvent the Anti-Kickback Statute (AKS). The DOJ is scrutinizing any financial relationships with lead generators, laboratories, pharmacies, or other service providers that could be construed as inducements for referrals. For telehealth brands, this means that marketing agreements, administrative service contracts, and even consulting fees must be meticulously structured to comply with AKS safe harbors. The consequences of non-compliance are severe, ranging from False Claims Act violations and civil monetary penalties to criminal charges and exclusion from federal healthcare programs.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Heightened Enforcement and Evolving Telehealth Mandates](/blog/compliance-crucible-telehealth-mandates).

Simultaneously, the DEA is heightening its scrutiny on online prescribing of controlled substances (Intelligence Item 9). While GLP-1s themselves are not controlled, the DEA's focus on the legitimacy of online prescribing sets a critical precedent. This signals a renewed emphasis on the Ryan Haight Act, requiring practitioners to ensure a legitimate medical purpose and a proper patient-provider relationship, even in virtual care settings. Telehealth platforms prescribing any controlled substances must re-evaluate their protocols to ensure robust patient evaluations, comprehensive medical histories, and appropriate diagnostic testing. The days of relying solely on brief online questionnaires for initial controlled substance prescriptions are rapidly drawing to a close. Practices must demonstrate they are actively preventing diversion and ensuring appropriate therapeutic use.

Actionable Insight: Conduct an immediate audit of all third-party vendor contracts and referral arrangements for AKS compliance. For any controlled substance prescribing, review and strengthen patient evaluation protocols to align with DEA expectations for 'legitimate medical purpose' and 'corresponding responsibility.'

Corporate Practice of Medicine (CPOM): A Persistent and Evolving Challenge

Corporate Practice of Medicine (CPOM) doctrines remain a bedrock of state-level healthcare regulation, and recent intelligence highlights their critical impact, particularly for innovative business models. Ohio's strict CPOM doctrine (Intelligence Item 7) serves as a stark reminder that non-licensed entities cannot employ physicians or control medical practice. This necessitates compliant structures like the Management Services Organization (MSO) model, where a professional medical corporation (PC) or professional limited liability company (PLC) owned by licensed physicians retains full clinical autonomy, while the MSO provides administrative support. Similarly, DTC telehealth weight loss brands face significant compliance challenges in states with strict CPOM doctrines (Intelligence Item 1). The tension between corporate structure and physician independence is a constant battleground, demanding meticulous review of operational models, physician employment agreements, and revenue-sharing mechanisms to avoid illegal fee-splitting and undue corporate influence on clinical decisions.

This isn't just about telehealth. Medspas, dental practices, and chiropractic offices expanding nationally or integrating new service lines must also navigate these waters. A non-physician cannot own a medical practice providing services like injectables or laser treatments in Ohio, for example. The MSO model, when correctly implemented, allows for non-clinical business investment while preserving the professional autonomy and ownership of licensed practitioners. Failure to comply can lead to severe penalties, including license revocation, civil monetary penalties, and even criminal charges.

Actionable Insight: If operating in or expanding to states with strict CPOM (e.g., CA, TX, NY, OH, DE, IL, MI, NJ, PA, SC), engage legal counsel to review your corporate structure, physician contracts, and clinical oversight models. Ensure clear separation of clinical and administrative responsibilities, with licensed professionals retaining ultimate clinical authority.

State-Specific Nuances: Supervision, Informed Consent, and Pharmacy Regulations

While federal enforcement grabs headlines, state-specific regulations often dictate the day-to-day operational realities for healthcare businesses. The sheer diversity of these rules creates a complex compliance mosaic:

Supervision and Delegation: The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have clarified specific requirements for PA and NP supervision and delegation (Intelligence Item 2). This means robust, documented processes for ongoing collaboration, chart review, and availability for consultation are essential, particularly for telehealth and medspa services. For medspas, this extends to ensuring PAs/NPs have documented training and competency for each procedure, including emergency protocols. Similarly, teledentistry demands a meticulous review of state supervision requirements for dental hygienists and assistants (Intelligence Item 8), which vary widely and impact permissible levels of remote oversight.

Informed Consent: Navigating telehealth informed consent requirements across all 50 states and D.C. is a critical, often overlooked, compliance area (Intelligence Item 3). There is no single federal standard. Telehealth platforms must integrate dynamic consent workflows that present state-specific disclosures, covering everything from technology failure risks to patient data privacy. Medspas, dental practices, and chiropractic offices offering virtual consultations must tailor their consent processes to meet explicit mandates of each jurisdiction, ensuring the method of obtaining consent (e.g., written, electronic, verbal with documentation) and the specific information conveyed are compliant.

Pharmacy Regulations: The District of Columbia Pharmacy Board (Intelligence Item 4) and the Connecticut Pharmacy Board (Intelligence Item 10) have issued specific regulations governing telehealth prescribing, compounding, and fulfillment. These rules emphasize the need for a proper patient-provider relationship, adherence to prescription requirements, and strict compliance with compounding standards (e.g., USP standards). For practices prescribing compounded medications, ensuring partnership with state-licensed pharmacies that adhere to these stringent guidelines is non-negotiable. Any deviation can lead to prescription rejection, regulatory scrutiny, and potential disciplinary action.

Actionable Insight: Implement a robust regulatory intelligence program to track state-specific changes in supervision, informed consent, and pharmacy regulations. Develop dynamic consent workflows and internal protocols that adapt to the specific requirements of each state where you operate and where your patients reside. Vet all partner pharmacies for state licensure and compliance with compounding standards.

Billing and Coding: The Foundation of Financial Compliance

Beyond clinical and structural compliance, the financial integrity of your practice hinges on meticulous billing and coding. Navigating telehealth billing and coding compliance for commercial insurance and self-pay models is a critical impact area (Intelligence Item 5). Missteps here can lead to claim denials, recoupments, audits, and severe penalties, including False Claims Act violations.

For commercial insurance, providers must stay updated on each payer's specific telehealth policies, which vary widely. This includes understanding covered services, acceptable modalities (audio-only vs. audio-visual), eligible providers, and state-specific parity laws. Accurate use of CPT/HCPCS codes, telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth from a location other than the patient's home, 10 for telehealth in the patient's home) is paramount. Documentation must clearly support the billed services, including medical necessity, modality, and patient consent.

Self-pay models, while seemingly simpler, introduce challenges around price transparency and consumer protection. The No Surprises Act mandates good faith estimates for uninsured and self-pay patients. Telehealth businesses must provide clear, upfront pricing for all services and avoid deceptive marketing practices to prevent consumer complaints and regulatory scrutiny.

Actionable Insight: Invest in continuous training for billing staff on payer-specific telehealth policies and coding updates. Implement robust internal controls and regular audits of telehealth documentation, billing, and patient financial counseling processes. Ensure compliance with price transparency requirements, including the provision of good faith estimates.

What This Means For Your Practice

The regulatory environment is not merely a hurdle; it's a strategic imperative. The trends are clear: increased federal enforcement, persistent state-level CPOM challenges, and granular state-specific rules for telehealth operations. For telehealth founders, multi-state practice owners, and compliance officers, a proactive, comprehensive approach is non-negotiable.

1. Invest in Regulatory Intelligence: Establish dedicated resources or partnerships to continuously monitor federal and state regulatory changes. This is not a one-time task but an ongoing commitment. 2. Audit Your Operations: Conduct regular, independent audits of your corporate structure, physician contracts, prescribing practices (especially for controlled substances), informed consent processes, and billing procedures against current federal and state regulations. 3. Strengthen Compliance Programs: Develop and implement robust internal policies, procedures, and training programs for all staff and providers. Ensure that your compliance program is not just a document but an ingrained part of your organizational culture. 4. Engage Expert Counsel: Partner with legal counsel specializing in healthcare regulatory compliance. Their expertise is invaluable in navigating complex issues like CPOM, AKS, and state-specific licensing and practice act interpretations.

The future of healthcare delivery is undeniably digital and increasingly national. However, the path to sustainable growth is paved with meticulous compliance. By embracing these insights and taking decisive action, your practice can not only mitigate risk but also solidify its position as a trusted and compliant leader in the evolving healthcare landscape.