California Healthcare
Compliance Guide

California presents a complex yet highly significant market for healthcare companies. Known for its progressive healthcare policies and robust regulatory oversight, the state demands meticulous attention to compliance. While California has historically been a leader in telehealth adoption, especially post-pandemic, its regulatory environment remains stringent, particularly concerning the Corporate Practice of Medicine (CPOM), prescribing practices, and professional licensure. The state's regulatory bodies, including the Medical Board of California, Board of Pharmacy, and various professional licensing boards, are proactive in enforcement. Recent legislative actions have aimed to solidify telehealth's role in healthcare delivery, expand access, and address issues like payment parity and cross-state licensure. For instance, AB 1304 (2021) codified many pandemic-era telehealth flexibilities, ensuring payment parity for specific services. The general business climate for healthcare operations is competitive, with a strong emphasis on consumer protection and quality of care. Companies expanding into California must navigate a landscape characterized by a strong CPOM doctrine, detailed prescribing regulations, and specific scope of practice limitations for various provider types. Despite these complexities, California's large population and innovative spirit make it an attractive market, provided companies establish a robust compliance infrastructure from the outset. The state continues to grapple with issues like mental health access and opioid prescribing, leading to ongoing legislative and regulatory scrutiny. Companies must be prepared for a dynamic regulatory environment, requiring continuous monitoring of legislative updates and board guidance. The state's commitment to patient safety and ethical practice underpins all regulatory frameworks, making a 'compliance-first' approach not just advisable, but essential for sustainable operations.

California maintains one of the strictest Corporate Practice of Medicine (CPOM) doctrines in the United States, rooted in both statutory law and long-standing legal interpretations. The fundamental principle is that medical corporations must be owned and controlled by licensed physicians. The legal basis for California's CPOM doctrine is primarily found in the Medical Practice Act (Business and Professions Code § 2052, § 2400, and § 2406). Business and Professions Code § 2400 states that 'Corporations and other artificial legal entities have no professional rights, privileges, or powers.' This means that only licensed individuals or professional corporations formed by licensed individuals can practice medicine. Non-physicians are generally prohibited from employing physicians, controlling their clinical judgment, or sharing in professional fees. This prohibition extends to various healthcare entities, including telehealth companies, medspas, dental practices, and wellness clinics, if they are deemed to be practicing medicine or dentistry. For example, a medspa offering medical procedures (e.g., injectables, laser treatments) must be owned by a physician or a professional medical corporation. Non-physicians cannot own the entity that employs the medical professionals providing these services. This strict interpretation means that typical corporate ownership structures common in other industries are not permissible for entities directly providing medical services. The permitted ownership structures are primarily professional corporations (e.g., Medical Corporations, Dental Corporations, Podiatric Corporations, Psychological Corporations) where all shareholders are licensed professionals of the same or compatible professions, as defined by Business and Professions Code § 13401.5. Even in multi-disciplinary practices, strict rules apply regarding the percentage of ownership by different licensed professionals. For instance, a medical corporation may have up to 49% ownership by certain allied health professionals (e.g., psychologists, optometrists, podiatrists, chiropractors, acupuncturists, physician assistants, registered nurses, naturopathic doctors, or physical therapists) as per Business and Professions Code § 13401.5(a)(19), but a majority must still be physicians. Non-physicians cannot own healthcare businesses that directly provide professional medical services. This has significant implications for telehealth companies, which often seek to scale rapidly with non-physician investment. To navigate this, the Professional Corporation-Management Services Organization (PC-MSO) model is almost universally employed. Under this model, a professional corporation (PC) owned by licensed physicians provides the medical services, while a separate, non-professional entity (the MSO) owned by non-physicians provides administrative, non-clinical support services to the PC. The MSO cannot interfere with clinical decision-making, direct physician employment, or share in professional fees. Any arrangement that could be construed as non-physician control over medical judgment or fee-splitting is strictly prohibited and carries significant risks, including license revocation and civil/criminal penalties. The California Attorney General and the Medical Board of California actively enforce these provisions, often through investigations into alleged unlicensed practice of medicine or illegal fee-splitting. Companies must ensure their MSO agreements are carefully structured to avoid any appearance of CPOM violations.

California has a robust framework for telehealth, largely codified and expanded by AB 1304 (2021) and AB 457 (2022). A provider-patient relationship can be established via telehealth, provided it meets the same standard of care as an in-person encounter. The Medical Board of California's Telehealth Guidelines (updated 2023) emphasize that a 'good faith prior examination' is required, which can be performed via telehealth. This examination must be sufficient to establish a diagnosis, treatment plan, and ensure the appropriateness of the proposed treatment. The guidelines explicitly state that a questionnaire alone is generally insufficient. All modalities are permitted, including live video (synchronous audio-visual), audio-only (synchronous audio), and asynchronous 'store and forward' technologies. However, the choice of modality must be clinically appropriate for the patient's condition and the services being rendered. For example, audio-only may be acceptable for certain follow-up appointments or mental health counseling, but less so for an initial diagnosis requiring visual inspection. Informed consent requirements are critical. Providers must obtain informed consent from the patient for the use of telehealth, including informing them of the risks, benefits, and alternatives to telehealth, and ensuring the patient understands their right to withdraw consent. This consent should be documented in the patient's medical record. California does not have specific telehealth registration requirements for out-of-state providers; instead, providers must hold a full, unrestricted California license to practice telehealth with California residents. There are no geographic restrictions within California for telehealth services, meaning a provider licensed in California can treat a patient anywhere within the state. However, the provider must be licensed in the state where the patient is located at the time of the service. Out-of-state providers practicing into California without a California license are engaging in the unlicensed practice of medicine, which carries severe penalties. California's payment parity laws, particularly AB 1304, mandate that commercial health plans and Medi-Cal reimburse for telehealth services at the same rate as in-person services for certain categories of care, provided the service is medically necessary and meets the same standard of care. This significantly supports the financial viability of telehealth models in the state. Providers must also comply with all federal and state privacy laws, including HIPAA and the California Confidentiality of Medical Information Act (CMIA) (Civil Code § 56 et seq.).

California's prescribing rules for telehealth largely mirror those for in-person care, with specific considerations for controlled substances. The ability to prescribe controlled substances via telehealth was significantly expanded during the COVID-19 Public Health Emergency (PHE) under federal waivers, which allowed for prescribing without an initial in-person visit. While the federal PHE ended, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 generally requires an in-person medical evaluation or a qualifying telemedicine encounter for prescribing controlled substances. The DEA has proposed new rules for post-PHE prescribing, but as of early 2025, an initial in-person visit or a qualifying telemedicine encounter (where the patient has been seen in-person by any DEA-registered practitioner) is generally required for Schedule II-V controlled substances, unless specific exceptions apply (e.g., a qualifying telemedicine encounter as defined by DEA, or the patient is in an institutional setting). California law, specifically Business and Professions Code § 2242, requires a 'good faith prior examination' for prescribing, which can be done via telehealth. However, for controlled substances, the standard of care is heightened. The Medical Board of California's Telehealth Guidelines state that prescribing controlled substances via telehealth requires a thorough medical evaluation, including a patient history, physical examination (which may be done virtually if clinically appropriate), and review of relevant medical records. PDMP (Prescription Drug Monitoring Program) checking is mandatory in California. Under Health and Safety Code § 11165.1, prescribers are required to consult the California PDMP (CURES 2.0) prior to prescribing Schedule II, III, IV, and V controlled substances to a patient for the first time, and at least once every four months thereafter if the controlled substance remains part of the patient's treatment. This applies equally to telehealth prescribing. There are no specific quantity or refill limitations unique to telehealth prescribing beyond those that apply to in-person prescribing (e.g., 6-month limit for Schedule II prescriptions, specific refill rules for Schedule III-V). However, prescribers must exercise extreme caution and document the medical necessity for all controlled substance prescriptions. Special rules apply to specific drug classes: for GLP-1s, testosterone, and stimulants, the standard of care requires comprehensive evaluation, appropriate diagnostic testing, and ongoing monitoring. For GLP-1s, prescribers must document the medical necessity for weight loss or diabetes management, often requiring lab work and lifestyle counseling. Testosterone prescribing requires careful assessment of hypogonadism, baseline and follow-up lab tests, and monitoring for adverse effects. Stimulant prescribing for ADHD via telehealth is particularly scrutinized; a thorough diagnostic workup, including differential diagnoses and consideration of non-pharmacological treatments, is essential. The Medical Board emphasizes that prescribing controlled substances for chronic pain or psychiatric conditions via telehealth requires a robust patient-provider relationship and careful risk assessment. Prescribers must be diligent in documenting clinical rationale, patient education, and monitoring plans to mitigate risks of diversion or misuse.

California's scope of practice laws are detailed and vary significantly among different mid-level providers. The state does not grant full practice authority to Nurse Practitioners (NPs) across the board, though significant changes have been implemented. Under Assembly Bill (AB) 890 (2020), effective January 1, 2023, NPs meeting specific criteria can transition to practicing without physician supervision in certain settings. These criteria include completing a transition to practice period (3 full-time equivalent years or 4600 hours) and obtaining a '103 NP' designation from the Board of Registered Nursing (BRN). NPs with this designation can perform functions such as ordering, performing, and interpreting diagnostic procedures; certifying disability; and, most significantly, furnishing or ordering controlled substances without physician supervision, within their scope of practice. However, this is limited to specific settings like clinics, hospitals, and medical groups, and does not equate to complete independent practice in all contexts. For Physician Assistants (PAs), collaborative practice agreements are generally required. Under Senate Bill (SB) 697 (2021), PAs now practice under a 'practice agreement' with a physician, replacing the previous 'supervision agreement.' This agreement defines the PA's scope of practice, which is delegated by the supervising physician and must be appropriate to the PA's education, training, and experience. PAs can perform medical services that are within the physician's scope of practice and within the PA's own competence. This includes diagnosing, treating, prescribing (including controlled substances), and ordering diagnostic tests. While the language shifted from 'supervision' to 'practice agreement,' PAs still require a relationship with a physician who is responsible for the overall care of the patient and who must be available for consultation. Delegation rules for Medical Assistants (MAs) in medspas are particularly stringent. MAs can perform only basic administrative and clinical tasks under the direct supervision of a physician, podiatrist, or registered nurse. They cannot perform any procedure that requires independent judgment or a license. This means MAs cannot administer injectables (e.g., Botox, fillers), perform laser treatments, or conduct any procedure that pierces the skin or involves medical decision-making. These procedures must be performed by a licensed physician, NP, or PA (within their scope and under appropriate supervision/agreement). Unlicensed personnel performing such tasks is a significant area of enforcement for the Medical Board. Supervision requirements vary: for NPs with a 103 designation, direct physician supervision is not required for their independent functions. For PAs, the physician must be available for consultation as outlined in the practice agreement, but continuous physical presence is not always necessary. For RNs, their scope is defined by the Nursing Practice Act (Business and Professions Code § 2725) and generally requires physician orders for medical treatments. Any delegation to unlicensed personnel must strictly adhere to the Medical Board's guidelines and the Business and Professions Code, ensuring patient safety and preventing the unlicensed practice of medicine.

Navigating California's strict Corporate Practice of Medicine (CPOM) doctrine necessitates specific business structuring, with the Professional Corporation-Management Services Organization (PC-MSO) model being the predominant compliant framework. This model is essential when non-physician investors or entities wish to participate in the financial aspects of a healthcare business. The PC-MSO structure involves two distinct legal entities: 1. A Professional Corporation (PC): This entity is solely owned by California-licensed physicians (or other licensed professionals, subject to specific multi-disciplinary rules under Business and Professions Code § 13401.5). The PC employs the physicians and other licensed clinical staff, holds the necessary medical licenses, and directly provides all professional medical services to patients. It bills for and collects professional fees. 2. A Management Services Organization (MSO): This entity can be owned by non-physicians or investors. It provides all non-clinical, administrative, and management services to the PC under a comprehensive Management Services Agreement (MSA). These services typically include billing, scheduling, marketing, IT, human resources, real estate, equipment leasing, and other back-office support. Fee-splitting rules are critical in California. Business and Professions Code § 650 prohibits the payment or receipt of consideration for the referral of patients. Furthermore, Business and Professions Code § 2282 prohibits physicians from aiding or abetting the unlicensed practice of medicine, which includes arrangements where non-physicians control clinical judgment or share in professional fees. The MSO cannot receive a percentage of the PC's professional fees directly tied to patient volume or revenue, as this could be construed as illegal fee-splitting or an inducement for referrals. Instead, the MSO's compensation from the PC must be a fair market value (FMV) fixed fee, or a fee based on expenses plus a reasonable profit margin, for the specific services rendered. This compensation must be independent of the volume or value of patient referrals or services. Management services agreements (MSAs) must be meticulously drafted to ensure compliance. Key requirements include: clearly defining the MSO's services as purely administrative and non-clinical; explicitly stating that the PC retains sole control over all clinical decisions, physician employment, and patient care; establishing FMV compensation for the MSO; and prohibiting any MSO involvement in physician hiring/firing related to clinical competence, or setting clinical protocols. Professional corporations in California must register with the Secretary of State and comply with specific naming conventions (e.g., 'Medical Corporation,' 'Dental Corporation'). All shareholders, officers, and directors (except for the assistant secretary and assistant treasurer) must be licensed professionals in the relevant field. The ownership structure for compliance hinges on maintaining a clear separation between clinical control (PC) and administrative support (MSO). Any attempt by the MSO to exert control over medical judgment, dictate treatment plans, or share in professional fees risks violating CPOM and fee-splitting prohibitions, leading to severe penalties including license revocation, civil fines, and criminal prosecution. Therefore, careful legal counsel is paramount in establishing and maintaining such structures.

California's regulatory landscape for healthcare is continuously evolving, with several key developments and pending legislation impacting telehealth, CPOM, and prescribing practices in 2024-2026. One significant area of focus continues to be the permanent integration of telehealth post-PHE. While AB 1304 (2021) codified many flexibilities, discussions persist regarding payment parity for audio-only services and the long-term sustainability of various telehealth models. The California Department of Managed Health Care (DMHC) and the Department of Health Care Services (DHCS) are actively refining regulations related to telehealth coverage and reimbursement for commercial plans and Medi-Cal, respectively. The Medical Board of California regularly updates its Telehealth Guidelines, with the latest revisions in 2023 emphasizing the need for robust patient evaluation and informed consent, particularly for prescribing controlled substances or high-risk medications. Enforcement actions continue to target providers engaging in 'pill mill' practices via telehealth or those operating without proper licensure. On the CPOM front, while no major legislative overhaul is anticipated, the Medical Board remains vigilant in prosecuting cases involving unlicensed practice of medicine and illegal fee-splitting. Recent enforcement actions have focused on medspas and wellness clinics operating under non-compliant ownership structures, underscoring the need for strict adherence to the PC-MSO model. There's an ongoing legislative push to expand scope of practice for various allied health professionals. While AB 890 (2020) granted some independent practice authority to NPs, further bills are often introduced to expand this or to address other professions. For example, there are ongoing discussions regarding the scope of practice for pharmacists and naturopathic doctors. Regarding controlled substance prescribing, California is closely monitoring federal DEA actions concerning the Ryan Haight Act's 'in-person exam' requirement for telehealth prescribing post-PHE. While the DEA has issued temporary rules, the finalization of new regulations could significantly impact telehealth models that rely on prescribing controlled substances without an initial in-person visit. California's CURES 2.0 PDMP system continues to be enhanced, with increased integration efforts and data analytics to combat opioid misuse. There are no immediate updates regarding California's participation in interstate licensure compacts like the Interstate Medical Licensure Compact (IMLC) or the Nurse Licensure Compact (NLC). California has historically been hesitant to join these compacts, maintaining its own licensing standards. Any movement towards compact participation would require significant legislative action. Companies should monitor bills introduced in the California Legislature (e.g., via the California Legislative Information website) and public meeting agendas of the Medical Board of California and other licensing boards for the most current regulatory changes.

Entering the California healthcare market requires a highly structured and compliance-focused approach. Here's actionable guidance:

1. Establish a Compliant Business Structure Immediately: Do not attempt to operate without a fully compliant Professional Corporation-Management Services Organization (PC-MSO) model if non-physician ownership or investment is involved. Engage experienced California healthcare counsel to draft your Management Services Agreement (MSA) and professional corporation formation documents. Ensure the MSA's compensation structure is fair market value and not tied to patient volume or revenue.

2. Physician Licensure and Professional Corporation: Ensure all physicians providing services to California patients hold a current, unrestricted California medical license. The professional corporation must be properly registered with the California Secretary of State and the Medical Board of California.

3. Telehealth Protocol Development: Develop comprehensive telehealth protocols that adhere to Medical Board of California guidelines. This includes explicit informed consent processes for telehealth, robust patient evaluation procedures (ensuring a 'good faith prior examination'), and clear documentation standards. Train all providers on these protocols.

4. Controlled Substance Prescribing Policy: Implement a strict policy for controlled substance prescribing via telehealth. This policy must include mandatory CURES 2.0 checks, documentation of medical necessity, clear follow-up plans, and adherence to federal Ryan Haight Act requirements (including any DEA waivers or new rules). For high-risk medications (GLP-1s, stimulants, testosterone), ensure protocols require appropriate diagnostic workup, lab monitoring, and patient education.

5. Scope of Practice Verification: For every provider type (NP, PA, RN, MA), meticulously verify their California scope of practice. Ensure NPs with independent practice (103 NP) meet all requirements. For PAs, ensure a valid practice agreement is in place. Crucially, do not allow Medical Assistants or other unlicensed personnel to perform medical procedures in medspas or clinics.

6. Privacy and Security: Implement robust HIPAA and CMIA-compliant privacy and security policies. This includes secure telehealth platforms, data encryption, business associate agreements, and regular staff training.

7. Payment Parity and Billing: Understand California's payment parity laws (AB 1304) and ensure billing practices align with state and federal regulations for telehealth services. Verify payer-specific requirements.

8. Continuous Monitoring: California's regulatory environment is dynamic. Subscribe to updates from the Medical Board of California, Board of Pharmacy, and monitor legislative activity. Regular compliance audits are essential.

Common Pitfalls to Avoid:

• Non-physician ownership or control of the clinical entity.
• Fee-splitting arrangements (e.g., MSO compensation tied to patient revenue).
• Inadequate patient evaluation before prescribing, especially controlled substances.
• Unlicensed personnel performing medical procedures.
• Failure to obtain proper informed consent for telehealth.
• Operating without a California license.

Timeline Expectations:

• Professional Corporation Formation: 2-4 weeks (Secretary of State filing, Medical Board registration).
• Physician Licensure: If not already licensed, 3-6 months (can be longer).
• MSO Formation: 1-2 weeks.
• MSA Drafting/Negotiation: 4-8 weeks (requires careful legal review).
• Credentialing/Payer Enrollment: 3-6 months per payer.

Expect a minimum of 3-6 months for full operational readiness, assuming all licenses are in place and legal structures are finalized. This process requires significant upfront legal and operational investment.