Telehealth's Tightening Grip: DEA, DOJ, and State Boards Signal a New Era of Scrutiny

The promise of telehealth – expanded access, efficiency, and innovation – has been a transformative force in healthcare. Yet, as the industry matures and pandemic-era flexibilities recede, a new reality is setting in: heightened scrutiny and rigorous enforcement. Federal agencies like the DEA and DOJ, alongside state medical and professional boards, are signaling a definitive shift towards stricter oversight, particularly concerning controlled substance prescribing and the fundamental structure of healthcare delivery. For telehealth founders, practice owners, and compliance officers, understanding these converging trends isn't just prudent; it's essential for sustainable operations.

For more on this topic, see our analysis: Telehealth Tensions: Navigating DEA Scrutiny, CPOM Landmines, and State Board Enforcement in a Post-PHE World.

DEA and DOJ Unleash a New Wave of Controlled Substance Enforcement

Recent intelligence underscores a critical and escalating focus from federal authorities on controlled substance prescribing via telehealth. The Department of Justice (DOJ) has significantly ramped up its prosecution efforts against telehealth companies and practitioners suspected of illegal prescribing and diversion. This isn't merely about technical non-compliance; it's about systemic failures to uphold the 'legitimate medical purpose' standard that underpins all controlled substance prescriptions.

For more on this topic, see our analysis: Telehealth Tensions: Navigating DEA Scrutiny, CPOM Landmines, and State Board Enforcement in a Post-PHE World.

Key Takeaways from DOJ Enforcement (All States):

• Beyond Waivers: The DOJ's actions highlight that even during the COVID-19 Public Health Emergency (PHE), mere technical compliance with waivers (like those related to the Ryan Haight Act) was insufficient if the underlying medical practice lacked a legitimate medical purpose. This means that platforms facilitating rapid patient acquisition without thorough, individualized medical evaluations are prime targets.
• Systemic Scrutiny: Enforcement is targeting not just individual prescribers but also the telehealth platforms themselves, seeking to dismantle schemes that enable or incentivize diversion. This includes scrutinizing business models that prioritize volume over patient safety and robust clinical protocols.
• Severe Consequences: Penalties are dire, ranging from license revocation, substantial fines, and exclusion from federal healthcare programs to criminal charges and imprisonment for those found to be orchestrating or participating in fraudulent schemes.

Simultaneously, the Drug Enforcement Administration (DEA) is formalizing its post-PHE stance on telehealth prescribing for controlled substances. While the agency has extended some PHE flexibilities for buprenorphine prescribing until November 2024 for existing patient-prescriber relationships, the long-term trajectory is clear: a return to stricter requirements.

DEA's Proposed Rules and Their Impact (All States):

• In-Person Requirement: The proposed rules generally mandate an in-person medical evaluation for initial prescriptions of Schedule II and certain Schedule III-V controlled substances. While buprenorphine for Opioid Use Disorder (OUD) has some specific, albeit temporary, carve-outs, the default will be an initial in-person visit or a referral from a practitioner who has conducted one.
• Multi-State Complexity: For providers operating across state lines, the complexity of DEA registration is amplified. A provider must be licensed in the patient's state AND hold a DEA registration in that state to prescribe controlled substances. This necessitates a sophisticated credentialing and compliance infrastructure.
• Agility is Key: The finalization of DEA's proposed rules is ongoing, requiring practices to remain agile and prepare for various scenarios. Investment in compliance software and specialized legal counsel is no longer optional but a strategic imperative.

Actionable Insight: Telehealth brands and any practice prescribing controlled substances remotely must immediately audit their patient intake, evaluation, and prescribing protocols. Ensure every prescription is backed by a documented, legitimate medical purpose and that providers are appropriately licensed and DEA-registered in the patient's state. Robust internal controls, ongoing provider training, and a culture that prioritizes patient safety over rapid growth are non-negotiable.

Corporate Practice of Medicine: A Persistent Hurdle for Innovation

While federal agencies focus on controlled substances, state boards continue to grapple with the fundamental structure of healthcare delivery, particularly through the lens of the Corporate Practice of Medicine (CPOM) doctrine. This week, we've seen intelligence from Kentucky and Iowa, highlighting the varied but consistently impactful application of CPOM.

Iowa's Strict CPOM Doctrine (Iowa):

• No Corporate Control: Iowa maintains a strict CPOM doctrine, generally prohibiting corporations and non-licensed entities from employing physicians or controlling medical decision-making. This means traditional corporate structures where a lay entity directly employs licensed professionals are largely impermissible.
• MSO Nuances: For telehealth and medspa businesses, this necessitates careful structuring, often through Management Service Organization (MSO) models. However, the MSO must meticulously avoid any influence over clinical decision-making, fee-splitting, or direct employment of clinical staff. The professional entity providing medical services must be owned and controlled by licensed Iowa professionals.
• Medspa Scrutiny: Non-physician ownership of medspas providing medical services (e.g., injectables, laser treatments) is highly problematic. The medical director must be genuinely engaged, and the entity providing medical services must be a professional entity owned by licensed professionals.

Kentucky's Moderate CPOM Enforcement (Kentucky):

• Recognized and Enforced: Kentucky also maintains a CPOM doctrine, though it's considered a moderate enforcement state. This means the doctrine is recognized and enforced, but specific statutory exceptions or common practices may allow for certain compliant structures.
• Professional Independence: Similar to Iowa, the core principle is that the entity providing medical services must be professionally owned and controlled. MSOs can provide administrative support, but they cannot dictate clinical decisions or share professional fees.

DTC Telehealth Weight Loss Brands Under the CPOM Microscope (Multi-State):

• GLP-1s and Scrutiny: The rapid growth of direct-to-consumer (DTC) telehealth weight loss brands, particularly those prescribing GLP-1 agonists, has drawn significant CPOM scrutiny across numerous states (e.g., CA, TX, NY, IL, PA, NJ, OH, MI, CO, FL, GA, NC, MD, DE, MO, NV, AZ, WA, OR, MA, CT, RI, KY, TN, LA, AR, OK, KS, NE, IA, MN, WI, IN, VA, WV, NH, VT, ME, MT, ID, WY, ND, SD, NM, UT, AK, HI).
• Physician Independence: The challenge lies in balancing scalable business models with laws designed to protect physician independence. Clinical decisions, prescribing, and patient care must remain solely under the control of licensed medical professionals, not corporate entities.
• Fair Market Value: MSO arrangements must ensure that the financial relationship between the MSO and the professional entity is structured at fair market value for administrative services, independent of patient volume or prescriptions, to avoid illegal fee-splitting.

Actionable Insight: Any healthcare business operating in or expanding to states with CPOM doctrines must engage in a thorough legal review of their corporate structure. Ensure that clinical decision-making, employment of licensed practitioners, and the receipt of professional fees remain within the purview of a professionally owned and controlled entity. MSO agreements must be meticulously drafted to delineate responsibilities and prevent any perception of corporate influence over medical judgment.

State Boards Zero In: Telehealth and Medspa Compliance

Beyond CPOM, state professional boards are actively defining and enforcing specific regulations for telehealth and specialized practices like medspas. This trend highlights the need for granular, state-specific compliance strategies.

Michigan's Focus on Telehealth and Medspa Compliance (Michigan):

• Increased Scrutiny: The Michigan Board of Medicine is actively monitoring and enforcing regulations related to telehealth and medspa operations. Disciplinary actions often stem from unprofessional conduct, scope of practice violations, and inadequate supervision.
• Telehealth Requirements: For telehealth brands, this means strict adherence to Michigan's licensing laws, proper establishment of patient-provider relationships (e.g., initial evaluations, informed consent), and rigorous compliance with prescribing practices, especially for controlled substances.
• Medspa Delegation: Medspa operators face challenges related to scope of practice and delegation. The Board expects clear delineation of services that can only be performed by a physician, those that can be delegated under appropriate supervision, and those outside the scope of non-medical personnel. Active, engaged medical directors providing direct, on-site supervision are critical.

District of Columbia's Telehealth Prescribing Rules (District of Columbia):

• Valid P-P Relationship: DC has specific regulations requiring an initial real-time, interactive audio-visual examination to establish a valid provider-patient relationship for prescribing, with limited exceptions. Asynchronous or audio-only consultations are generally insufficient for initiating a prescribing relationship.
• Equivalent Standard of Care: The standard of care for telehealth must be equivalent to that of in-person care, demanding thorough assessment, comprehensive documentation, and appropriate follow-up.

Chiropractic Telehealth Regulations Evolve (Multi-State):

• State-Specific Scope: State chiropractic boards are issuing guidance on telehealth, defining what services are permissible (e.g., initial consultations, follow-up visits, remote patient management). The ability to conduct initial consultations and establish a patient-provider relationship remotely varies significantly by state (e.g., AL, AK, AZ, AR, CA, CO, CT, DE, FL, GA, HI, ID, IL, IN, IA, KS, KY, LA, ME, MD, MA, MI, MN, MS, MO, MT, NE, NV, NH, NJ, NM, NY, NC, ND, OH, OK, OR, PA, RI, SC, SD, TN, TX, UT, VT, VA, WA, WV, WI, WY, DC).
• Documentation and Consent: Regulations often require explicit patient consent and specify documentation standards for virtual encounters.

Actionable Insight: Practices must conduct state-specific regulatory deep dives for every jurisdiction in which they operate. This includes reviewing licensing board rules, administrative codes, and professional practice acts. For medspas, ensure medical directors are actively engaged and that all delegated tasks are within scope and appropriately supervised. For telehealth, verify that platforms and protocols meet state-specific requirements for establishing patient-provider relationships and prescribing.

CMS Expands Telehealth, But Compliance Remains Key

Amidst the tightening regulatory environment, the Centers for Medicare & Medicaid Services (CMS) continues its commitment to integrating telehealth into the permanent healthcare landscape. This expansion offers opportunities but also demands meticulous compliance.

CMS Telehealth Expansion (National):

• Growing Reimbursement: CMS is expanding the list of services eligible for Medicare reimbursement when furnished via telehealth and broadening provider eligibility. This presents a growing market opportunity for telehealth brands.
• Billing and Documentation: While opportunities grow, so does the need for meticulous attention to billing codes, documentation requirements, and compliance with originating and distant site rules. Systems must accurately capture and submit claims for newly eligible services.
• Scope of Practice: Medspas and chiropractic offices with licensed medical professionals may find new avenues, but their scope of practice must strictly align with state licensure and Medicare's specific service definitions.

Actionable Insight: Stay current with CMS updates on eligible CPT codes and associated modifiers. Ensure your billing and documentation systems are robust and compliant with Medicare's evolving requirements. Invest in ongoing staff training to capitalize on these expansions while mitigating the risk of claim denials, audits, and potential fraud and abuse investigations.

What This Means For Your Practice

The overarching theme from this week's compliance intelligence is clear: the era of regulatory leniency for telehealth and innovative care models is over. The industry is entering a phase of mature, rigorous oversight. For healthcare executives, this translates into several critical imperatives:

1. Proactive Compliance Audits: Conduct comprehensive internal audits of all telehealth operations, controlled substance prescribing protocols, and corporate structures. This includes reviewing provider licensing, DEA registrations, patient intake processes, and MSO agreements against federal and state-specific regulations.
2. Robust Compliance Infrastructure: Invest in technology and personnel dedicated to compliance. This means sophisticated credentialing systems, secure and compliant telehealth platforms, continuous monitoring of regulatory changes, and robust documentation practices.
3. State-Specific Granularity: Recognize that compliance is not a one-size-fits-all endeavor. Develop and implement state-specific policies and procedures for every jurisdiction in which you operate, particularly concerning CPOM, scope of practice, and telehealth prescribing.
4. Engaged Medical Leadership: Ensure that medical directors and clinical leaders are not just figureheads but are actively involved in setting clinical protocols, supervising staff, and upholding the standard of care. This is especially critical for medspas and telehealth platforms.
5. Legal Counsel as a Strategic Partner: Engage experienced healthcare legal counsel early and often. Their expertise in navigating complex federal and state regulations, particularly around CPOM and controlled substance prescribing, is invaluable for mitigating risk and ensuring sustainable growth.

The regulatory environment is not static; it is a dynamic force shaping the future of healthcare. By embracing a proactive, data-driven, and meticulously compliant approach, your practice can not only navigate these challenges but also solidify its position as a trusted leader in the evolving healthcare landscape.

---

Further Reading

• Telehealth Tensions: Navigating DEA Scrutiny, CPOM Landmines, and State Board Enforcement in a Post-PHE World
• Medspa Expansion: Navigating the Regulatory Minefield for Compliant Growth
• Michigan's Regulatory Gauntlet: Navigating Telehealth, Medspas, and CPOM in the Wolverine State
• GLP-1 Telehealth: Navigating the Regulatory Minefield of Rapid Growth