Telehealth's Tightening Grip: DEA, DOJ, and State Boards Redefine Compliance for 2024 and Beyond

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for telehealth and healthcare businesses is rapidly evolving, with federal and state authorities intensifying scrutiny. From DEA's proposed prescribing rules to DOJ's enforcement actions and strict state CPOM doctrines, understanding these shifts is critical for sustainable operations. This digest cuts through the noise, offering actionable insights for navigating 2024's compliance challenges.

The healthcare industry is experiencing a profound recalibration, with regulatory bodies at both federal and state levels actively shaping the future of care delivery. For telehealth founders, practice owners, and compliance officers, the past week has underscored a critical truth: the era of regulatory ambiguity is over. What remains is a complex, yet navigable, environment demanding meticulous attention to compliance. TrueEval is here to dissect these developments, offering the clarity and strategic foresight you need to thrive.

> For more on this topic, see our analysis: [Telehealth Tensions: Navigating DEA Scrutiny, CPOM Landmines, and State Board Enforcement in a Post-PHE World](/blog/telehealth-tensions-dea-cpom-state-board-enforcement).

Federal Scrutiny Intensifies: DEA and DOJ Lead the Charge

DEA's Evolving Stance on Telehealth Controlled Substance Prescribing

The Drug Enforcement Administration (DEA) continues to be a central player in defining the boundaries of telehealth. Their proposed rules for prescribing controlled medications via telehealth, particularly buprenorphine for opioid use disorder (OUD), represent a significant pivot. While the initial proposals were stringent, the DEA has since offered a temporary reprieve, extending the COVID-19 Public Health Emergency (PHE) flexibilities until November 11, 2023, with an additional year's grace period (until November 11, 2024) for patient-prescriber relationships established during the PHE. This extension provides a crucial, albeit temporary, window for adaptation.

Actionable Insight: For telehealth providers, especially those treating OUD, this means preparing for a future where an initial in-person medical evaluation or a referral from a practitioner who has conducted one will likely be mandatory for new buprenorphine patients. This also applies to Schedule II and other non-buprenorphine Schedule III-V controlled substances. Practices must develop robust protocols to document in-person evaluations, track PHE-established relationships, and ensure meticulous record-keeping. The complexity is amplified for multi-state operations, as providers must hold both a state license and a DEA registration in each state where they prescribe controlled substances to patients. Failure to comply risks severe penalties, including loss of DEA registration and criminal charges.

DOJ's Unrelenting Focus on Telehealth Fraud and Diversion

Complementing the DEA's regulatory efforts, the Department of Justice (DOJ) has significantly increased its enforcement against telehealth companies and practitioners involved in illegal controlled substance prescribing. This isn't merely about technical compliance; it's about the 'legitimate medical purpose' standard. The DOJ is scrutinizing whether telehealth platforms facilitate practices that circumvent this foundational requirement, particularly concerning the Ryan Haight Act.

Actionable Insight: The message is clear: telehealth operations must be designed to deliver high-quality, legitimate medical care, not to serve as a conduit for drug diversion. This demands rigorous re-evaluation of patient intake protocols, comprehensive provider training, and robust technological safeguards. For practices prescribing controlled substances, this means regular audits of prescribing patterns and clear policies that prioritize patient safety and regulatory adherence over rapid patient acquisition. The DOJ's focus on systemic failures and fraudulent schemes necessitates a top-down compliance culture. Even practices not directly prescribing controlled substances should be aware that the overall regulatory climate for telehealth is tightening, potentially impacting ancillary services or referral relationships.

State-Level Roadblocks and Opportunities: CPOM, Scope of Practice, and Telehealth Specifics

Corporate Practice of Medicine (CPOM) Doctrines: A Persistent Hurdle

States like Iowa and Kentucky continue to enforce strict Corporate Practice of Medicine (CPOM) doctrines, posing significant challenges for telehealth and medspa business structures. Iowa, in particular, maintains a stringent CPOM doctrine, generally prohibiting non-licensed entities from employing licensed healthcare professionals or controlling medical decision-making. Kentucky, while perhaps a moderate enforcement state, still requires careful adherence to compliant management service organization (MSO) models.

Actionable Insight: For telehealth brands, medspas, dental practices, and chiropractic offices operating in or expanding to CPOM states, compliant legal structuring is non-negotiable. Direct employment of licensed providers by a national telehealth company that is not itself a professional corporation licensed in the state is likely non-compliant. Instead, businesses must consider forming professional corporations (PCs) or professional limited liability companies (PLLCs) owned by licensed professionals, which then contract with the telehealth platform for administrative services. MSO agreements must meticulously delineate clinical and administrative functions, ensuring the MSO avoids any influence over clinical decisions, fee-splitting, or direct employment of clinical staff. The financial relationship between the MSO and the professional entity must be structured at fair market value, independent of patient volume or prescriptions. This is especially critical for Direct-to-Consumer (DTC) telehealth weight loss brands prescribing medications like GLP-1 agonists, which face heightened scrutiny in CPOM states.

State Board Enforcement: Michigan and DC Set the Tone

State boards are actively monitoring and enforcing regulations specific to emerging healthcare models. The Michigan Board of Medicine, for instance, is increasing its scrutiny of telehealth and medspa operations, with disciplinary actions often stemming from unprofessional conduct, scope of practice violations, and inadequate supervision. This signals a critical need for robust compliance frameworks, ensuring practitioners are appropriately licensed, patient-provider relationships are established correctly, and prescribing practices adhere to state laws.

Similarly, the District of Columbia has specific regulations for establishing a valid provider-patient relationship via telehealth, requiring an initial real-time, interactive audio-visual examination for prescribing. This directly impacts business models relying on asynchronous or audio-only platforms for initial patient intake.

Actionable Insight: Healthcare businesses must regularly review their operational policies and procedures against state-specific public health codes and administrative rules. For medspas, clear delineation of services, active medical director engagement, and appropriate supervision are paramount. For all telehealth providers, ensuring technology platforms support robust real-time audio-visual interactions and that clinical protocols integrate these requirements is essential. The standard of care for telehealth must be equivalent to in-person care, demanding thorough assessment, documentation, and follow-up. Proactive internal audits and comprehensive staff training are critical to mitigate enforcement risks.

Chiropractic Telehealth: Navigating State-Specific Nuances

State chiropractic boards are also issuing guidance on telehealth, defining permissible services, consent requirements, and documentation standards. This impacts how chiropractors can integrate virtual care, from initial consultations to remote patient management.

Actionable Insight: Chiropractic practices must meticulously review their state's board rules regarding the definition of a 'physical examination' and its adaptability for telehealth. Telehealth platforms supporting chiropractic care must align technology and workflows with these regulations, including secure patient portals and robust documentation. While some aspects of remote patient management (RPM) may be less restrictive, all services must remain within the scope of practice and adhere to privacy and security standards. Non-compliance can lead to disciplinary actions, including fines and license suspension.

CMS Expansion: A Glimmer of Opportunity Amidst Scrutiny

Amidst the tightening regulatory environment, the Centers for Medicare & Medicaid Services (CMS) continues to expand telehealth services and provider eligibility under Medicare. This reflects a sustained commitment to integrating telehealth into the permanent healthcare landscape, moving beyond pandemic-era flexibilities.

Actionable Insight: This ongoing expansion presents a growing market opportunity for telehealth brands, medspas, and even chiropractic offices (if medical professionals are on staff and services align with Medicare criteria). However, it necessitates meticulous attention to billing codes, documentation requirements, and compliance with originating and distant site rules. Practices must ensure systems can accurately capture and submit claims for newly eligible services, utilizing correct CPT codes and modifiers. While direct dental procedures are unlikely to be telehealth-eligible, pre-operative consultations or post-operative checks could leverage telehealth if they meet Medicare's strict criteria. Robust compliance infrastructure and ongoing staff training are crucial to capitalize on these expansions while mitigating fraud and abuse risks.

What This Means For Your Practice

The current regulatory climate is not merely a series of isolated events; it represents a fundamental shift towards greater accountability and stricter enforcement in telehealth and digital health. For telehealth founders and operators, this means prioritizing robust compliance infrastructure, investing in legal counsel specializing in multi-state and federal regulations, and fostering a culture of compliance from the ground up. Your business model must be legally defensible, not just commercially viable.

For brick-and-mortar practice owners expanding nationally, understanding each state's unique nuances – from CPOM to specific telehealth prescribing rules – is paramount. A one-size-fits-all approach is a recipe for regulatory disaster. Similarly, medspa, dental, and chiropractic practice owners must ensure that any expansion into telehealth or adjunctive services strictly adheres to their professional scope of practice and state board regulations.

Healthcare compliance officers are now more critical than ever. Your role is to translate these complex regulatory developments into actionable policies and procedures, ensuring ongoing monitoring and auditing. For healthcare investors and advisors, due diligence must extend beyond market potential to include a thorough assessment of regulatory risk and compliance maturity. The cost of non-compliance, as evidenced by recent DOJ actions, can be catastrophic.

Looking ahead, expect continued refinement of federal and state telehealth regulations. The temporary extensions for DEA prescribing flexibilities will eventually expire, and states will continue to clarify their positions on CPOM and scope of practice. Proactive engagement with these evolving requirements, rather than reactive responses, will be the hallmark of successful and sustainable healthcare businesses in the coming years. TrueEval remains your indispensable partner in navigating this complex, yet opportunity-rich, landscape.