The Compliance Crucible: Navigating Telehealth's Evolving Regulatory Landscape Amidst Heightened Enforcement

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

The past week has seen a torrent of critical compliance developments, from intensified DOJ scrutiny on telehealth fraud to state-specific mandates reshaping how virtual care is delivered. This digest cuts through the noise, offering actionable intelligence on CPOM, supervision, informed consent, and billing complexities.

The healthcare regulatory landscape is not merely shifting; it is undergoing a profound transformation, particularly within the dynamic realm of telehealth. For telehealth founders, practice owners, and compliance officers, the past week has underscored a critical truth: proactive, granular compliance is no longer optional – it is the bedrock of sustainable operation. Federal agencies like the Department of Justice (DOJ) are intensifying enforcement, while state boards continue to refine rules on everything from corporate practice of medicine (CPOM) to the minutiae of informed consent and professional supervision. This digest synthesizes these pivotal developments, offering a strategic overview to navigate the compliance crucible.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Q2's Regulatory Onslaught in Telehealth and Specialty Practice](/blog/compliance-crucible-q2-regulatory-onslaught).

DOJ Intensifies Scrutiny: The Unrelenting Fight Against Telehealth Fraud

The Department of Justice (DOJ) has made it unequivocally clear: telehealth fraud and kickback schemes remain a top enforcement priority. Recent actions highlight the federal government's unwavering commitment to safeguarding federal healthcare programs and ensuring the legitimacy of patient care in the rapidly expanding telehealth sector. This isn't a new trend, but rather an escalation of existing efforts, leveraging insights gained from the pandemic-era telehealth boom.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Q2's Regulatory Onslaught in Telehealth and Specialty Practice](/blog/compliance-crucible-q2-regulatory-onslaught).

For telehealth brands, the primary areas of risk include billing for services not rendered, medically unnecessary services, or services provided by unqualified personnel. The DOJ is particularly vigilant about arrangements that incentivize referrals through illegal kickbacks, often disguised as marketing fees, administrative services, or consulting agreements. Any financial relationship with lead generators, laboratories, pharmacies, or other service providers must be meticulously structured to comply with the Anti-Kickback Statute (AKS) and its safe harbors. Failure to do so can result in criminal charges, civil penalties under the False Claims Act (FCA), and exclusion from federal healthcare programs.

Medspas, dental practices, and chiropractic offices that integrate telehealth components or engage in referral relationships are also squarely in the DOJ's crosshairs. Consider a medspa offering weight-loss or hormone-therapy services via telehealth: all prescriptions must be medically necessary, based on a legitimate patient-provider relationship, and not influenced by illegal inducements. Similarly, dental and chiropractic practices referring patients for durable medical equipment (DME), diagnostic tests, or specialty consultations must ensure these referrals are based solely on clinical need, not on financial incentives. The DOJ's enforcement actions often target schemes where providers are paid for ordering unnecessary items or services, even if they claim to be acting on behalf of a telehealth company. This signals a broadened scope of enforcement, moving beyond traditional telehealth-only platforms to encompass any entity leveraging virtual care or referral networks.

The Enduring Challenge of Corporate Practice of Medicine (CPOM)

The Corporate Practice of Medicine (CPOM) doctrine continues to be a formidable barrier for innovative healthcare delivery models, particularly in states with strict interpretations. Our recent intelligence highlights the critical impact of CPOM in jurisdictions like New York and Ohio, as well as its pervasive influence on Direct-to-Consumer (DTC) telehealth weight loss brands across multiple states.

New York's CPOM doctrine is among the nation's strictest, prohibiting corporations from employing physicians or practicing medicine. For telehealth companies operating in NY, this necessitates a meticulous Physician-Controlled Management Services Organization (PC-MSO) structure. The professional entity (PE), owned and controlled by licensed New York physicians, must retain complete clinical autonomy. The MSO's role is strictly limited to providing non-clinical administrative, technical, and management services. Any perceived influence or control by the MSO over clinical aspects can trigger severe penalties from the New York State Education Department (NYSED) Office of Professional Discipline (OPD) or the Office of the Attorney General.

Similarly, Ohio maintains a strict CPOM doctrine, explicitly prohibiting non-licensed entities from employing or controlling the professional judgment of licensed healthcare providers. This means business models relying on direct employment of physicians or advanced practice nurses by a lay corporation are generally impermissible. Medspas in Ohio, for instance, must either be physician-owned or operate under an MSO model where clinical services are provided by a separate, physician-owned professional entity. The MSO provides the facility, equipment, and administrative staff, but the medical director must maintain ultimate authority over all clinical protocols.

For DTC telehealth weight loss brands, CPOM compliance is paramount to operational legality. The tension between the corporate structure of a DTC platform and the requirement for physician autonomy demands careful structuring. Brands must meticulously review their operational models, physician employment agreements, and revenue-sharing mechanisms to ensure they do not inadvertently violate CPOM prohibitions on corporate control over clinical practice or fee-splitting. If a platform dictates specific weight loss treatments without independent physician judgment, it could be seen as exercising undue corporate control. Revenue-sharing models tied directly to the volume or type of prescriptions could be construed as illegal fee-splitting or inducements.

Actionable Insight: For any business expanding into a new state, or launching a new service line, a thorough CPOM analysis is non-negotiable. This involves understanding the nuances of state law, the specific requirements for MSO structures, and ensuring that all contractual agreements and operational workflows clearly delineate clinical and administrative responsibilities, preserving physician independence.

State-Specific Telehealth Regulations: A Patchwork of Complexity

The vision of seamless, interstate telehealth remains largely aspirational. Our recent intelligence underscores the persistent reality of state-specific regulations governing everything from the establishment of patient-provider relationships to the prescribing of controlled substances and the scope of practice for various professionals.

Sexual Wellness Platforms and Controlled Substances

Telehealth platforms specializing in sexual wellness face a particularly complex patchwork. The lack of a uniform federal standard for establishing a patient-provider relationship via telehealth, and for prescribing controlled substances across state lines, creates significant compliance hurdles. While the DEA has proposed new rules post-PHE, the landscape remains dynamic. State medical boards often have their own interpretations and additional restrictions on top of federal law, which can include limits on Schedule II substances, specific documentation requirements, and prohibitions on prescribing controlled substances for certain conditions via telehealth without prior in-person visits. This directly impacts how a sexual wellness platform can operate, especially if it considers prescribing medications that fall under controlled substance classifications.

Compliance strategies must include robust state-by-state legal analysis for every jurisdiction, reviewing medical board rules, pharmacy board regulations, and state statutes related to telemedicine. Developing clear protocols for patient intake, identity verification, informed consent, and documentation that meet the most stringent requirements across all operating states is critical.

Chiropractic Telehealth: Defining the Virtual Scope

State chiropractic boards are increasingly defining the scope of telehealth for chiropractors, impacting how remote consultations and patient management can be conducted. Many states require an in-person initial visit to establish a legitimate patient-practitioner relationship, which can limit the ability to offer fully remote chiropractic care from the outset. This often necessitates a hybrid model. While telehealth can enhance patient convenience for follow-up consultations and progress checks, it generally cannot replace hands-on diagnostic or therapeutic procedures. This means practices need clear protocols for determining which services are appropriate for telehealth versus in-person visits. For states like Texas, Florida, and California, understanding these specific board rules is paramount.

Washington State: Supervision and Delegation for PAs and NPs

The Washington State Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have established specific requirements for physician and advanced registered nurse practitioner (ARNP) supervision and delegation, particularly relevant for telehealth and medspa services. This means that merely having a supervising physician or collaborating ARNP on paper is insufficient. The regulations demand a robust, documented process for ongoing collaboration, review of patient charts, and availability for consultation. This is critical for ensuring that remote care delivery maintains the same quality and safety standards as in-person care. Medspas are particularly impacted, as the WMC and NCQAC rules dictate that delegating physicians or collaborating ARNPs must ensure the PA or ARNP has the necessary training and competency for each procedure, with meticulous records of delegation agreements, training, and ongoing supervision.

District of Columbia Pharmacy Board Regulations

The District of Columbia Board of Pharmacy sets specific regulations governing telehealth prescribing, compounding, and medication fulfillment. For telehealth brands operating in DC, understanding the nuances of these regulations is critical. The emphasis on a proper patient-provider relationship, which can be established via telehealth, is foundational. However, providers must ensure their initial patient assessments meet the standards for prescribing, particularly for controlled substances. Medspas and other aesthetic practices prescribing medications must ensure their practices align with DC's requirements, including maintaining comprehensive patient records and verifying the legitimacy of prescriptions. For practices involved in compounding, strict adherence to USP standards and DC compounding regulations is non-negotiable.

Key Takeaway: The variability across states necessitates a dynamic, state-by-state compliance framework. Generic policies are insufficient; granular legal analysis and adaptable operational protocols are essential for mitigating risk and ensuring legitimate patient care.

Foundational Pillars: Informed Consent and Billing Compliance

Beyond the complexities of CPOM and state-specific practice rules, two foundational pillars of healthcare compliance – informed consent and billing accuracy – continue to evolve, demanding meticulous attention in the telehealth context.

Navigating Telehealth Informed Consent Requirements

Informed consent is a foundational principle in healthcare, and its application to telehealth introduces specific considerations that vary significantly by state. There is no single federal standard governing all aspects. For telehealth brands, medspas, dental practices, chiropractic offices, and other healthcare businesses expanding virtually, this necessitates a meticulous, state-by-state approach to compliance. Simply having a general consent form is insufficient; practices must tailor their consent processes to meet the explicit mandates of each jurisdiction where they operate and where their patients reside.

For example, some states require explicit disclosure of the potential for technology failures, while others may mandate specific language regarding patient data privacy in a telehealth context. Failure to capture these nuances can lead to regulatory penalties, malpractice claims, and reputational damage. It's crucial to regularly review and update consent forms and processes, as state regulations are continually evolving, especially in response to post-PHE permanent telehealth policies.

Telehealth Billing and Coding Compliance

Telehealth providers must meticulously adhere to complex billing and coding regulations for both commercial insurance and self-pay patients. Missteps can lead to claim denials, recoupments, audits, and severe penalties, including False Claims Act violations.

For Commercial Insurance, providers must stay updated on each payer's specific telehealth policies, which vary widely by plan and state. This includes understanding covered services, acceptable modalities (audio-only vs. audio-visual), eligible providers, and any state-specific parity laws. Accurate use of CPT/HCPCS codes, telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth provided from a location other than the patient's home, 10 for telehealth provided in the patient's home) is paramount. Documentation must clearly support the billed services, including medical necessity and modality used.

Self-Pay Models, while seemingly simpler, introduce their own set of compliance challenges, primarily around price transparency and consumer protection. The No Surprises Act mandates good faith estimates for uninsured and self-pay patients. Telehealth businesses must provide clear, upfront pricing for all services, including any potential ancillary fees. Avoiding deceptive marketing practices and ensuring services are delivered as advertised is crucial to prevent consumer complaints and regulatory scrutiny.

Crucial Step: Conduct a comprehensive audit of current consent and billing practices against the requirements of every state served. Investing in robust compliance technology that can manage and track state-specific forms and documentation is increasingly essential.

What This Means For Your Practice

The regulatory intelligence from the past week paints a clear picture: compliance is an ongoing, dynamic process, not a one-time checklist. For telehealth founders, practice owners, and compliance officers, the implications are significant:

Invest in State-Specific Legal Counsel: Generic legal advice is insufficient. Engage counsel specializing in healthcare regulatory compliance for each state where you operate or plan to expand. This is particularly vital for CPOM, controlled substance prescribing, and professional supervision.
Audit Your Business Model Regularly: Proactively review your operational structures, contractual agreements (especially with MSOs, PEs, and third-party vendors), and financial arrangements against current federal and state regulations. This includes scrutinizing referral relationships for AKS compliance.
Strengthen Internal Compliance Programs: Implement robust internal controls, conduct regular staff training on fraud, waste, and abuse prevention, and ensure clear policies and procedures for telehealth documentation, billing, and patient financial counseling. This is your first line of defense against enforcement actions.
Prioritize Granular Documentation: Whether it's informed consent, supervision agreements, or billing records, meticulous and accurate documentation is your best protection. Ensure your systems can capture state-specific requirements and support the medical necessity of all services rendered.
Embrace Compliance Technology: Leverage technology solutions that can track evolving state regulations, manage dynamic consent workflows, and ensure accurate billing and coding across multiple jurisdictions. This is key to scaling compliantly.

Looking Ahead

The trajectory of healthcare compliance points towards continued federal enforcement against fraud and a persistent, albeit evolving, fragmentation of state-level regulations. We anticipate further refinement of telehealth prescribing rules post-PHE, particularly concerning controlled substances, and ongoing scrutiny of business models that blur the lines of professional autonomy. The era of 'move fast and break things' in healthcare is over; the future belongs to those who build with compliance as their core architectural principle. TrueEval remains committed to providing the insights and tools necessary to navigate this complex terrain, ensuring your practice not only survives but thrives in a rigorously regulated environment.