The Compliance Crucible: Navigating Telehealth's Evolving Regulatory Landscape & Enforcement Blitz

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-18

The past week has underscored a critical truth for healthcare operators: the telehealth regulatory environment is not just evolving, it's intensifying. From state-specific practice doctrines to federal enforcement actions, understanding this complex web is no longer optional—it's foundational to sustainable growth.

The rapid expansion of telehealth has undeniably revolutionized healthcare access, but it has also ushered in an era of unprecedented regulatory scrutiny. For telehealth founders, brick-and-mortar practice owners expanding nationally, and compliance officers alike, the past week's intelligence paints a clear picture: proactive, granular compliance is the only path forward. Federal agencies like the Department of Justice (DOJ) are sharpening their focus on fraud, while state boards continue to carve out highly specific rules for everything from informed consent to corporate practice of medicine. Ignoring these shifts is not merely risky; it's an existential threat.

> For more on this topic, see our analysis: [The Compliance Crucible: Navigating Telehealth's Evolving Regulatory Landscape Amidst Heightened Enforcement](/blog/telehealth-compliance-crucible-enforcement-trends).

DOJ's Unwavering Gaze: The Intensification of Telehealth Fraud Enforcement

The Department of Justice (DOJ) has made it unequivocally clear: the era of relaxed oversight for telehealth, born out of the COVID-19 Public Health Emergency (PHE), is over. Our recent intelligence highlights the DOJ's intensified enforcement against telehealth fraud and kickback schemes (Intelligence #9). This isn't a new trend, but rather a deepening commitment to prosecuting providers and companies that exploit virtual care for illicit gains. The scope of these investigations is broad, targeting everything from billing for medically unnecessary services to elaborate kickback arrangements disguised as legitimate business transactions.

For telehealth brands, this means every financial relationship—with lead generators, pharmacies, laboratories, or marketing firms—is under a microscope. The Anti-Kickback Statute (AKS) and the False Claims Act (FCA) are powerful tools in the DOJ's arsenal, carrying severe penalties including criminal charges, civil fines, and exclusion from federal healthcare programs. It's not enough to simply avoid overt fraud; arrangements must be structured to fit within AKS safe harbors, ensuring compensation is fair market value, commercially reasonable, and not tied to referrals.

Medspas, dental practices, and chiropractic offices integrating telehealth or engaging in referral networks are equally vulnerable. Consider a medspa offering weight-loss or hormone-therapy via telehealth: if prescriptions are not medically necessary, or if the process is influenced by illegal inducements, it could draw federal attention. The DOJ is particularly adept at uncovering schemes where providers are paid to order unnecessary items or services, even if they claim to be merely fulfilling a telehealth company's directive. This underscores the critical need for robust compliance programs, regular audits, and comprehensive staff training on fraud, waste, and abuse prevention across all service lines.

The Patchwork Persists: State-Specific Telehealth Regulations Demand Hyper-Vigilance

While federal enforcement casts a wide net, the day-to-day operational realities for healthcare businesses are largely dictated by a complex, fragmented web of state-specific regulations. This is particularly true for telehealth, where a lack of federal uniformity means compliance is a state-by-state, often board-by-board, endeavor.

Navigating the Nuances of Patient-Provider Relationships and Controlled Substances

Our analysis on state-specific telehealth regulations for sexual wellness platforms and controlled substance prescribing (Intelligence #1) reveals a critical compliance challenge. There is no uniform federal standard for establishing a patient-provider relationship via telehealth, nor for prescribing controlled substances across state lines. This directly impacts how any telehealth platform, medspa, or practice can operate.

For instance, while the DEA's Ryan Haight Act generally requires an in-person evaluation for controlled substance prescribing via telemedicine (with PHE exceptions), state medical boards often impose additional, stricter requirements. Some states may mandate video for all initial consultations, while others might allow audio-only for established patients. Sexual wellness platforms, which may involve controlled substances for certain conditions, must conduct meticulous state-by-state legal analysis. This includes reviewing medical board rules, pharmacy board regulations, and state statutes to ensure protocols for patient intake, identity verification, and prescribing methods meet the most stringent requirements in every operating jurisdiction. Failure here can lead to allegations of unlawful practice, insurance fraud, or improper prescribing.

Chiropractic Telehealth: Defining the Boundaries of Virtual Care

The evolving landscape of telehealth is also reshaping traditional practices. State chiropractic boards are increasingly defining the scope of telehealth for chiropractors (Intelligence #2), impacting how remote consultations and patient management can be conducted. For telehealth brands offering chiropractic services, or chiropractic offices integrating virtual care, understanding these regulations is paramount. Many states still require an in-person initial visit to establish a legitimate patient-practitioner relationship, limiting fully remote care models. This often necessitates a hybrid approach.

Telehealth can enhance follow-up consultations or lifestyle advice, but it generally cannot replace hands-on diagnostic or therapeutic procedures. This means practices need clear protocols for determining which services are appropriate for telehealth versus in-person visits. Furthermore, HIPAA-compliant technology and meticulous documentation are non-negotiable. For medspas or dental practices referring to chiropractic services, understanding these limitations is crucial to avoid inadvertently contributing to compliance issues.

Informed Consent: The Foundational Pillar of Telehealth Compliance

Beyond the specifics of service delivery, the foundational principle of informed consent takes on new dimensions in the virtual realm. Our intelligence on navigating telehealth informed consent requirements across all 50 states and D.C. (Intelligence #6) underscores that a generic consent form is no longer sufficient. Each jurisdiction may have explicit mandates regarding disclosures, such as the potential for technology failures, data privacy specifics, or the scope and limitations of virtual versus in-person treatment.

Telehealth platforms must integrate dynamic consent workflows that can present state-specific disclosures. Medspas prescribing medications virtually, or dental/chiropractic practices offering virtual assessments, must ensure their consent processes cover the risks and benefits of the specific service, the virtual process itself, and any state-specific prescribing requirements. A comprehensive audit of current consent practices against every state's requirements is vital, including the content, method of obtaining consent, and specific information conveyed to the patient.

Corporate Practice of Medicine (CPOM): A Persistent Hurdle for Innovation

Perhaps one of the most significant and enduring challenges for modern healthcare businesses, particularly those with innovative business models, is the Corporate Practice of Medicine (CPOM) doctrine. This doctrine, varying wildly in strictness from state to state, prohibits corporations and non-licensed individuals from employing physicians or controlling medical practice.

New York's Strict CPOM: The PC-MSO Imperative

New York maintains one of the nation's strictest CPOM doctrines (Intelligence #3). For any telehealth company, medspa, or practice seeking to operate in NY, a Physician-Controlled Management Services Organization (PC-MSO) structure is not merely advisable, it's essential. The core principle is that the professional entity (PE), owned and controlled by licensed New York physicians, must retain complete clinical autonomy. The MSO's role is strictly limited to providing non-clinical administrative, technical, and management services. Any perceived influence by the MSO over clinical aspects can trigger severe violations, leading to investigations by the NYSED or Attorney General.

Compliance in New York demands meticulous attention to contractual agreements, operational workflows, and financial arrangements. The Management Services Agreement (MSA) must clearly delineate responsibilities, ensuring the PE maintains ultimate authority over clinical matters. Fee structures must be fair market value and not tied to patient volume in a way that could be construed as illegal fee-splitting. This is particularly critical for practices involved in weight-loss, hormone-therapy, mental-health, sexual-health, dermatology, and primary-care via telehealth.

Ohio's Strict CPOM: A Blueprint for MSO Structures

Similarly, Ohio maintains a strict Corporate Practice of Medicine doctrine (Intelligence #10), prohibiting non-licensed entities from employing or controlling licensed healthcare providers. This necessitates the adoption of compliant structures like the MSO model for telehealth brands, medspas, dental practices, and chiropractic offices in the state. Under an MSO arrangement, the non-licensed entity provides administrative support to a professional medical corporation (PC) or professional limited liability company (PLC) owned and controlled by licensed Ohio physicians. The MSO cannot dictate clinical decisions or interfere with physician judgment.

For medspas in Ohio, this means that while services like injectables or laser treatments are considered the practice of medicine, the ownership and management structure is paramount. A non-physician cannot own a medical practice that provides these services; thus, medspas must either be physician-owned or operate under an MSO model with a physician-owned professional entity. Failure to comply with Ohio's CPOM can lead to severe civil penalties, injunctions, disgorgement of profits, and even criminal charges.

DTC Telehealth Weight Loss Brands and CPOM

The intersection of CPOM with innovative business models is particularly evident for Direct-to-Consumer (DTC) telehealth weight loss brands (Intelligence #4). These brands face significant compliance challenges due to the inherent tension between their corporate structure and the requirement for physician autonomy. Operational models, physician employment agreements, and revenue-sharing mechanisms must be meticulously reviewed to avoid illegal fee-splitting or corporate control over clinical practice.

If a platform dictates specific weight loss treatments or formularies without independent physician judgment, it risks violating CPOM. Revenue-sharing models tied directly to the volume or type of prescriptions are particularly scrutinized. Medspas, dental practices, and chiropractic offices expanding into telehealth for weight loss or related services must ensure licensed professionals retain ultimate clinical authority and that business arrangements comply with state-specific CPOM and fee-splitting laws. Engaging legal counsel to audit business models and contracts is critical to avoid license revocation, civil penalties, and criminal charges.

Supervision, Delegation, and Pharmacy Regulations: The Operational Details That Matter

Beyond broad doctrines, the specific operational details of supervision, delegation, and pharmacy regulations are crucial for daily compliance.

Washington State: Clarifying Supervision for PAs and NPs

In Washington State, the Medical Commission (WMC) and Nursing Care Quality Assurance Commission (NCQAC) have clarified supervision and delegation requirements for PAs and NPs (Intelligence #5), particularly relevant for telehealth and medspa settings. This means that merely having a supervising physician or collaborating ARNP on paper is insufficient. Regulations demand a robust, documented process for ongoing collaboration, chart review, and availability for consultation. Telehealth brands must implement systems to facilitate this effectively, including secure communication channels and clear protocols for escalation.

Medspas are significantly impacted, as the WMC and NCQAC rules dictate that delegating physicians or collaborating ARNPs must ensure PAs or ARNPs have the necessary training and competency for each procedure, including understanding complications and emergency protocols. Meticulous records of delegation agreements, training, and ongoing supervision are required. For dental and chiropractic practices employing PAs or ARNPs, understanding these requirements is paramount to ensure all delegated medical functions adhere to WMC and NCQAC guidelines, with the supervising practitioner retaining ultimate responsibility.

District of Columbia Pharmacy Board Regulations

Finally, the District of Columbia Board of Pharmacy sets specific regulations governing telehealth prescribing, compounding, and medication fulfillment (Intelligence #7). For telehealth brands operating in D.C., understanding these nuances is critical. The emphasis on a proper patient-provider relationship, even if established via telehealth, is foundational. Providers must ensure initial patient assessments meet prescribing standards, especially for controlled substances. Medspas prescribing medications via telehealth must ensure their practices align with D.C.'s requirements, including comprehensive patient records and verifying prescription legitimacy.

For practices involved in compounding, strict adherence to USP standards and D.C. compounding regulations is non-negotiable. Any medication fulfillment must occur with D.C.-licensed entities. Robust internal policies, staff training, and secure electronic prescribing are essential to mitigate risks of regulatory enforcement, fines, and potential loss of licensure.

Telehealth Billing and Coding: The Financial Lifeline Under Scrutiny

Even with impeccable clinical and structural compliance, financial compliance remains a critical area of risk. Our intelligence on telehealth billing and coding compliance for commercial insurance and self-pay models (Intelligence #8) highlights that missteps can lead to claim denials, recoupments, audits, and severe penalties, including False Claims Act violations.

For commercial insurance, providers must stay updated on each payer's specific telehealth policies, which vary widely by plan and state. Accurate use of CPT/HCPCS codes, telehealth modifiers (e.g., -95, -GT, -GQ, -G0), and place of service (POS) codes (e.g., 02 for telehealth provided from a location other than the patient's home, 10 for telehealth provided in the patient's home) is paramount. Documentation must clearly support the billed services, including medical necessity, modality, and patient consent.

Self-pay models, while seemingly simpler, introduce challenges around price transparency and consumer protection. The No Surprises Act mandates good faith estimates for uninsured and self-pay patients. Telehealth businesses must provide clear, upfront pricing for all services, avoiding deceptive marketing practices. Implementing robust internal controls, staff training, and regular audits are essential, especially for practices operating across state lines where state-specific regulations for both insurance and self-pay can vary significantly.

What This Means For Your Practice

The current regulatory environment demands a proactive, comprehensive, and granular approach to compliance. The days of one-size-fits-all solutions are long gone. For telehealth founders, expanding practice owners, and compliance officers, these developments underscore several critical imperatives:

State-Specific Legal Counsel: Invest in legal expertise that specializes in healthcare regulatory compliance across all jurisdictions where you operate or plan to operate. Generic advice is insufficient.
Robust Compliance Programs: Implement and continuously update internal compliance programs that cover fraud, waste, and abuse, CPOM, state-specific telehealth rules, and billing/coding. This includes regular audits and mandatory staff training.
Meticulous Documentation: Ensure all patient encounters, consent processes, supervision agreements, and financial arrangements are thoroughly documented and meet the highest standards of each relevant jurisdiction.
Technology for Compliance: Leverage technology to manage state-specific consent forms, track evolving regulations, and ensure secure, HIPAA-compliant communication and record-keeping.
Vetting Third-Party Partners: Conduct stringent due diligence on all third-party vendors, from marketing agencies to pharmacies, to ensure their practices align with federal and state anti-kickback and fraud statutes.
CPOM Structuring: If operating in strict CPOM states like New York or Ohio, ensure your business model is built on a genuinely compliant MSO or PC-MSO structure, preserving the clinical autonomy of licensed professionals.

The regulatory landscape for telehealth is a dynamic and challenging environment. However, with strategic planning, diligent execution, and a commitment to compliance, healthcare businesses can not only mitigate risk but also build a foundation for sustainable, ethical growth in this transformative sector. TrueEval remains committed to providing the intelligence and tools necessary to navigate this complexity with confidence.