Oregon Healthcare
Compliance Guide

Oregon presents a generally favorable regulatory environment for healthcare companies, particularly those leveraging telehealth, though it maintains a robust regulatory framework to ensure patient safety and quality of care. The state has proactively embraced telehealth, evidenced by its comprehensive statutes ensuring payment parity and broad modality acceptance. Key regulatory bodies include the Oregon Medical Board (OMB), the Oregon Board of Nursing, the Oregon Board of Pharmacy, and the Oregon Health Authority (OHA). The business climate is moderately friendly, with a clear, albeit nuanced, stance on the Corporate Practice of Medicine (CPOM). Recent legislative actions have focused on solidifying telehealth access post-pandemic, expanding provider scopes of practice, and enhancing consumer protections. For instance, Oregon has been at the forefront of codifying telehealth payment parity and defining appropriate standards of care for virtual encounters. Companies expanding into Oregon must navigate specific licensure requirements, understand the nuances of CPOM enforcement, and adhere strictly to prescribing rules, especially for controlled substances. The state's emphasis on patient-centered care and equitable access means that telehealth operations are generally well-supported, provided they meet established clinical and ethical standards. The OHA plays a significant role in public health policy and oversight, while professional licensing boards govern individual practitioners. Overall, Oregon offers a stable and predictable regulatory landscape for compliant healthcare businesses, but thorough due diligence is essential to avoid potential pitfalls related to CPOM, scope of practice, and specific prescribing mandates.

Oregon maintains a nuanced, but generally enforced, Corporate Practice of Medicine (CPOM) doctrine, primarily rooted in statutory law and regulatory interpretation rather than extensive case law. The foundational principle is that medical services must be rendered by licensed professionals, and corporations or unlicensed individuals generally cannot employ physicians to practice medicine or control their clinical judgment. Oregon Revised Statutes (ORS) Chapter 677, governing the Oregon Medical Board, implicitly supports CPOM by defining the practice of medicine and requiring licensure for those who engage in it. While there isn't a single, explicit 'CPOM statute' broadly prohibiting corporate ownership of medical practices, the regulatory framework effectively restricts such arrangements. Specifically, ORS 677.085 outlines acts constituting the practice of medicine, and ORS 677.095 prohibits unlicensed persons from practicing. The Oregon Medical Board has historically interpreted these statutes to mean that entities that employ or contract with physicians and exert control over clinical decision-making or receive a percentage of professional fees may be deemed to be practicing medicine without a license.

Permitted Ownership Structures:

• Professional Corporations (PCs): ORS Chapter 58 allows licensed professionals, including physicians, to form professional corporations. These entities must be owned and controlled by licensed professionals in the same or related fields. For example, a medical PC must be owned by physicians. This is the most common compliant structure for physician-owned practices.
• Physician-Owned Entities: Direct ownership by licensed physicians is permissible.

Restrictions and Non-Physician Ownership: Non-physicians generally cannot own a medical practice that directly employs physicians or controls their clinical judgment. This extends to telehealth companies, medspas, dental practices, and wellness clinics that provide services requiring a medical license. For example, a medspa offering medical procedures (e.g., injectables, laser treatments) must be owned by a licensed physician or a professional corporation of physicians. Similarly, a telehealth company providing medical diagnoses or treatments cannot be owned by an unlicensed entity that employs the treating physicians.

Impact on Telehealth Companies: Telehealth platforms that directly employ or contract with physicians and dictate clinical protocols or share in professional fees face significant CPOM risks. To mitigate this, many telehealth companies adopt a Management Services Organization (MSO) model. The MSO provides administrative and non-clinical services to a physician-owned professional corporation (PC), which is the entity that employs the physicians and delivers clinical care. The MSO cannot interfere with clinical decision-making, and compensation must be structured to avoid illegal fee-splitting or kickbacks.

Impact on Medspas, Dental Practices, and Wellness Clinics: These entities, if providing services that constitute the practice of medicine or dentistry, must adhere to CPOM. For medspas, this means a physician must own the entity providing medical aesthetic services. Dental practices must be owned by licensed dentists (ORS 679.020). Wellness clinics offering medical interventions (e.g., IV therapy, hormone therapy) must also be structured to comply with CPOM, typically through physician ownership or a compliant MSO arrangement with a physician-owned PC. Any structure where an unlicensed individual or entity controls the medical decision-making or profits directly from the professional medical services is highly scrutinized and likely non-compliant. The key is to ensure that clinical autonomy and professional judgment reside solely with the licensed practitioner.

Oregon has a progressive and comprehensive framework for telehealth, largely codified in ORS 743A.058, which mandates payment parity for telehealth services. The state generally supports the establishment of a provider-patient relationship via telehealth, provided that the standard of care is met.

Establishment of Provider-Patient Relationship: A valid provider-patient relationship can be established through telehealth, including video conferencing. While an initial in-person exam is not explicitly required by statute for all telehealth encounters, the Oregon Medical Board (OMB) and other professional boards emphasize that the standard of care for telehealth services is the same as for in-person services. This means a practitioner must gather sufficient information to make an appropriate diagnosis and treatment plan, which may necessitate a real-time audio-visual encounter. The OMB's 'Guidelines for the Practice of Telemedicine' (Policy 2020-1) reinforces this, stating that a 'meaningful physician-patient relationship' must exist, which typically requires a synchronous audio-visual interaction for initial encounters involving diagnosis and treatment.

Permitted Modalities: Oregon permits a broad range of telehealth modalities:

• Synchronous Audio-Visual (Video): This is the preferred and most widely accepted modality, particularly for establishing new patient relationships and for services requiring visual assessment. It is generally reimbursed at the same rate as in-person services (ORS 743A.058).
• Synchronous Audio-Only (Telephone): Permitted and subject to payment parity under ORS 743A.058, especially when audio-visual technology is unavailable or impractical. However, practitioners must ensure that an audio-only encounter is sufficient to meet the standard of care for the specific service being provided.
• Asynchronous (Store-and-Forward): Allowed for certain services, particularly for transmitting medical images, data, or recorded video for later review. Payment parity also applies to asynchronous services. Practitioners must ensure secure transmission and appropriate documentation.
• Remote Patient Monitoring (RPM): Permitted and reimbursed for collecting and transmitting patient data from remote locations to healthcare providers.

Telehealth Registration Requirements: Oregon does not have a separate telehealth-specific registration or licensure requirement for providers already licensed in Oregon. Providers must hold a valid, active license from their respective Oregon professional licensing board (e.g., Oregon Medical Board, Oregon Board of Nursing) to provide telehealth services to patients located in Oregon. Interstate compacts (e.g., Interstate Medical Licensure Compact, Nurse Licensure Compact) facilitate multi-state practice, but providers must still ensure they are authorized to practice in Oregon.

Informed Consent Requirements: Comprehensive informed consent is mandatory for telehealth services. ORS 743A.058(2)(b) requires that the patient or the patient's legal representative be informed of the 'risks and benefits of telehealth.' This consent should include:

• Confirmation of the patient's identity.
• Verification of the patient's location.
• Information on the technology used and its security measures.
• Potential for technical failures and alternative communication methods.
• Privacy and confidentiality protections.
• The right to refuse telehealth services and opt for in-person care.
• Information on how to access follow-up care. Consent should be documented in the patient's medical record.

Geographic Restrictions: There are no specific geographic restrictions within Oregon for telehealth. Providers licensed in Oregon can provide telehealth services to patients anywhere within the state. However, providers must be physically located in a state where they are licensed to practice when delivering telehealth services to Oregon patients, unless specific interstate compacts or temporary waivers apply.

Oregon's prescribing rules for telehealth largely align with in-person prescribing standards, with specific considerations for controlled substances. The Oregon Medical Board (OMB) and Oregon Board of Pharmacy (OBP) are the primary regulatory bodies.

Controlled Substances Prescribing via Telehealth:

• Schedules: Oregon generally permits the prescribing of Schedule II-V controlled substances via telehealth, provided a legitimate medical purpose exists and the prescribing practitioner has established a valid provider-patient relationship and conducted an appropriate medical evaluation. This aligns with federal DEA regulations, which, post-PHE, are in a state of flux but currently allow for telehealth prescribing of controlled substances under specific conditions, often requiring an in-person exam or a referral from a practitioner who has conducted one. The Oregon Medical Board's 'Guidelines for the Practice of Telemedicine' (Policy 2020-1) emphasizes that prescribing controlled substances via telemedicine requires careful consideration and adherence to all state and federal laws, including the requirement for an appropriate medical evaluation and a bona fide patient-practitioner relationship.
• DEA Requirements: Practitioners prescribing controlled substances must hold an active DEA registration tied to an Oregon practice address. Federal DEA rules, particularly concerning the Ryan Haight Online Pharmacy Consumer Protection Act, dictate that a controlled substance prescription via telehealth typically requires at least one prior in-person medical evaluation, unless specific exceptions apply (e.g., public health emergency waivers, or if the patient is being seen by a DEA-registered practitioner in another setting). While the DEA has extended certain PHE flexibilities, the long-term rules are still under review. Oregon practitioners must monitor federal DEA updates closely.
• PDMP Checking: Oregon Revised Statutes (ORS) 435.405 mandates that practitioners check the Oregon Prescription Drug Monitoring Program (PDMP) database prior to prescribing Schedule II-IV controlled substances. This check is required for new prescriptions and at least every 90 days for ongoing prescriptions. This requirement applies equally to telehealth encounters. Documentation of the PDMP check must be maintained in the patient's medical record.
• Quantity and Refill Limitations: Oregon law does not impose specific quantity or refill limitations for telehealth prescriptions beyond what applies to in-person prescriptions. However, best clinical practice and the standard of care dictate judicious prescribing, particularly for controlled substances. For opioids, ORS 435.475 imposes specific limits on initial prescriptions for acute pain (e.g., 7-day supply for adults, 5-day for minors, with exceptions for chronic pain or specific conditions).
• Special Rules for Specific Drug Classes:
  • GLP-1s (e.g., Ozempic, Wegovy): While not controlled substances, prescribing GLP-1s for weight loss requires a thorough medical evaluation, diagnosis of obesity or overweight with comorbidities, and a comprehensive treatment plan. Telehealth prescribing is permissible if the standard of care is met, often involving detailed patient history, physical assessment (which may require creative telehealth approaches or referrals), and ongoing monitoring.
  • Testosterone/Hormone Therapy: Prescribing testosterone (a Schedule III controlled substance) or other hormones via telehealth requires a robust diagnostic workup, including lab tests, and careful monitoring for adverse effects. A valid patient-practitioner relationship and adherence to controlled substance prescribing guidelines are paramount.
  • Stimulants (e.g., Adderall, Ritalin): These are Schedule II controlled substances. Prescribing stimulants for ADHD via telehealth is permissible but carries high scrutiny. A comprehensive psychiatric and medical evaluation, often requiring synchronous audio-visual interaction, is essential. Adherence to PDMP checks and careful monitoring for abuse or diversion are critical. The ongoing federal DEA rules regarding the in-person exam waiver for Schedule II substances will significantly impact this area.

In all cases, the prescribing practitioner must ensure that the telehealth encounter is sufficient to meet the standard of care and that the prescription serves a legitimate medical purpose.

Oregon has a progressive approach to the scope of practice for mid-level providers, particularly for Nurse Practitioners (NPs), granting them significant autonomy.

Nurse Practitioners (NPs):

• Full Practice Authority: Yes, Oregon grants full practice authority to Nurse Practitioners. ORS 678.375 and OAR 851-050-0000 et seq. establish that Certified Nurse Practitioners (CNPs) can practice independently without physician supervision or a collaborative practice agreement. They can diagnose, treat, prescribe medications (including controlled substances), and manage patient care within their scope of education and certification.
• Licensure: NPs must be registered nurses (RNs) with advanced education and certification. The Oregon State Board of Nursing (OSBN) regulates NP practice. While NPs have full practice authority, they are expected to consult with or refer patients to other healthcare providers when appropriate, especially for complex cases outside their expertise.

Physician Assistants (PAs):

• Collaborative Practice/Supervision: PAs in Oregon operate under a 'practice agreement' with a supervising physician, as outlined in ORS 677.505 et seq. and OAR 847-050-0000 et seq. While the term 'supervision' is used, Oregon's framework emphasizes a collaborative relationship rather than direct, constant oversight. The practice agreement must define the scope of practice for the PA, the methods of supervision, and the types of medical services the PA is authorized to perform. The supervising physician is responsible for the overall medical care provided by the PA.
• Independence: PAs cannot practice independently in Oregon. Their scope of practice is determined by their education, experience, and the terms of their practice agreement with a supervising physician. They can diagnose, treat, and prescribe (including controlled substances) within this agreement. The Oregon Medical Board oversees PA licensure and practice.

Other Mid-Level Providers:

• Certified Registered Nurse Anesthetists (CRNAs): CRNAs in Oregon also have a high degree of autonomy. ORS 678.210 allows CRNAs to practice without direct physician supervision for anesthesia services, provided they meet certain criteria and practice within the scope of their certification.
• Clinical Nurse Specialists (CNSs): CNSs in Oregon practice within their specialty and are regulated by the OSBN. Their scope typically involves advanced assessment, diagnosis, and treatment within their area of expertise, often in a consultative or educational role, but generally without independent prescriptive authority unless they are also certified as NPs.

Delegation Rules for Medical Assistants (MAs) in Medspas: Delegation to Medical Assistants (MAs) in medspas or other clinical settings is strictly governed by the Oregon Medical Board (OAR 847-010-0060 et seq.). MAs can perform delegated tasks that are within their training and competence, under the direct supervision of a licensed physician, PA, or NP.

• Direct Supervision: For medical aesthetic procedures (e.g., injectables, advanced laser treatments), direct supervision is often required, meaning the supervising practitioner must be physically present in the facility and immediately available to provide assistance and direction.
• Prohibited Acts: MAs cannot perform acts that require independent medical judgment or that are outside the scope of their training or the delegating practitioner's license. This includes diagnosis, prescribing, or performing invasive procedures without appropriate direct supervision. For example, an MA cannot independently administer Botox or dermal fillers. These procedures must be performed by or directly supervised by a licensed physician, PA, or NP. Medspas must ensure clear protocols, adequate training, and proper supervision to comply with these delegation rules, which are critical for patient safety and avoiding unlicensed practice charges.

Navigating business structures in Oregon requires careful attention to the Corporate Practice of Medicine (CPOM) doctrine and fee-splitting prohibitions. The most common compliant structure for healthcare companies, especially those involving non-physician ownership or significant capital investment, is the Management Services Organization (MSO) model.

PC-MSO Structures:

• When Needed: An MSO structure is essential when non-licensed individuals or entities (e.g., private equity, tech companies, lay investors) wish to own or control the business operations of a medical practice. Since CPOM generally prohibits non-physician ownership of medical practices, the MSO provides the administrative and non-clinical support, while the clinical services are rendered by a physician-owned Professional Corporation (PC).
• How it Works:
  1. Professional Corporation (PC): This entity is owned solely by licensed physicians (or other licensed professionals, depending on the service, e.g., dentists for a dental practice). The PC employs or contracts with all clinical staff (physicians, NPs, PAs, MAs) and is solely responsible for all clinical decision-making, patient care, and medical record keeping. It holds all necessary clinical licenses and permits.
  2. Management Services Organization (MSO): This entity is owned by the non-licensed investors. The MSO enters into a Management Services Agreement (MSA) with the PC. Under the MSA, the MSO provides all non-clinical services, such as billing, scheduling, marketing, IT, human resources, facilities management, equipment, and other administrative support. The MSO charges the PC a fair market value (FMV) fee for these services.

Fee-Splitting Rules: Oregon has strict prohibitions against fee-splitting and kickbacks, primarily under ORS 677.190(1)(g) (unprofessional conduct for physicians) and ORS 442.700 et seq. (Oregon Patient Referral Law). These laws generally prohibit licensed practitioners from dividing professional fees with unlicensed persons or entities, or from receiving remuneration for patient referrals.

• MSA Compliance: The MSO fee must be structured as a fixed fee or a percentage of gross revenue that is not tied to the volume or value of referrals or clinical services. It must represent fair market value for the administrative services provided. Any arrangement where the MSO's compensation is directly linked to the professional fees generated by the PC's clinical services, or where the MSO effectively controls the PC's clinical judgment, risks being deemed illegal fee-splitting or an impermissible corporate practice of medicine.

Management Services Agreement (MSA) Requirements: An MSA is the cornerstone of the PC-MSO model. Key requirements include:

• Clear Delineation of Services: The MSA must clearly define the administrative services provided by the MSO and explicitly state that the PC retains sole control over all clinical decisions.
• Fair Market Value (FMV): The compensation paid by the PC to the MSO must be consistent with FMV for the services rendered. This often requires independent valuation.
• Term and Termination: Standard contract provisions regarding term, termination clauses, and dispute resolution.
• No Clinical Control: The MSA must explicitly state that the MSO has no authority or influence over the PC's medical judgment, hiring/firing of clinical staff, or patient care protocols.
• Compliance with Stark Law/Anti-Kickback Statute: While state-specific, the MSA should also be structured to avoid violating federal anti-kickback statutes if federal healthcare programs are involved.

Professional Corporation Requirements:

• ORS Chapter 58: Governs professional corporations in Oregon. A PC must be organized for the sole purpose of rendering professional services.
• Ownership: All shareholders, directors, and officers who render professional services must be licensed in the same profession (or related professions if permitted by the licensing board).
• Name: The corporate name must include words like 'Professional Corporation' or an abbreviation like 'P.C.'
• Licensure: The PC itself does not hold a medical license, but its licensed professional owners and employees do. The PC registers with the Oregon Secretary of State.

Structuring Ownership for Compliance:

• Physician-Owned PC: The medical practice (the PC) must be owned by licensed physicians. For telehealth, this means the entity employing the physicians delivering care to Oregon patients must be physician-owned.
• MSO for Non-Clinical Support: The MSO, owned by non-licensed individuals/entities, provides the necessary infrastructure and administrative services. The financial relationship between the MSO and PC must be transparent, at FMV, and not tied to clinical outcomes or referrals.
• Avoid Indirect Control: The MSO should not exert indirect control over the PC's clinical operations through excessive financial leverage, oppressive contract terms, or by dictating clinical policies. The PC must maintain genuine clinical autonomy.

Failure to properly structure these relationships can lead to severe penalties, including license revocation, fines, and civil or criminal charges for the unlicensed practice of medicine or illegal fee-splitting.

Oregon's regulatory landscape for healthcare, particularly telehealth, continues to evolve, with recent legislative efforts and board actions shaping the compliance environment.

2024-2026 Legislative Outlook:

• Telehealth Permanency: Following the COVID-19 Public Health Emergency (PHE), Oregon has largely made its telehealth flexibilities permanent. While ORS 743A.058 ensures payment parity, ongoing legislative discussions may focus on refining definitions, ensuring equitable access for underserved populations, and addressing specific technology requirements. There's a continued push to solidify comprehensive telehealth coverage across all payer types and service lines.
• Interstate Compacts: Oregon is a member of the Interstate Medical Licensure Compact (IMLC), facilitating multi-state physician licensure. It is also a member of the Nurse Licensure Compact (NLC). Expect continued efforts to streamline interstate practice for other professions, potentially including the Physical Therapy Compact or the Psychology Interjurisdictional Compact (PSYPACT), which would further impact telehealth delivery. Bills related to compact adoption are frequently introduced.
• Behavioral Health Integration: There is a strong legislative focus on expanding access to behavioral health services, including through telehealth. Expect bills that may further clarify or expand the scope of practice for behavioral health professionals via telehealth and ensure adequate reimbursement.
• Prescribing Controlled Substances: As federal DEA rules for telehealth prescribing of controlled substances solidify post-PHE, Oregon may introduce legislation or regulatory changes to align state law with federal mandates, particularly regarding the 'in-person exam' requirement for initial prescriptions of Schedule II substances. Practitioners should closely monitor DEA guidance and any subsequent state legislative responses.

Recent Board Actions/Enforcement Cases:

• Oregon Medical Board (OMB): The OMB continues to prioritize patient safety and professional conduct. Recent enforcement actions often involve issues such as unprofessional conduct, inadequate documentation, prescribing outside the scope of practice, and inappropriate prescribing of controlled substances. Telehealth providers are held to the same standard of care as in-person providers, and violations related to establishing a proper patient-provider relationship or failing to meet the standard of care in a virtual setting have led to disciplinary actions. The OMB regularly updates its 'Guidelines for the Practice of Telemedicine' (Policy 2020-1) to reflect current best practices and address emerging issues.
• Corporate Practice of Medicine (CPOM): While less frequent than individual practitioner discipline, the OMB and other boards remain vigilant regarding CPOM violations. Cases often arise from complaints about unlicensed entities controlling medical judgment or engaging in illegal fee-splitting. While no major recent landmark cases have drastically altered the CPOM landscape, the boards continue to enforce existing statutes and regulations through cease-and-desist orders or referrals for investigation when non-compliant structures are identified.
• License Compact Participation: Oregon's participation in the IMLC and NLC means that disciplinary actions taken in one compact state can impact a licensee's ability to practice in Oregon, and vice versa. Regulatory boards are actively engaged in information sharing and mutual recognition of disciplinary actions across compact states.

Entering the Oregon healthcare market requires a methodical approach to ensure compliance from the outset. Here's actionable guidance for healthcare companies:

Step-by-Step Compliance Checklist:

1. Entity Formation & CPOM Review: If non-physician owned, establish an Oregon Professional Corporation (PC) owned by licensed Oregon physicians for clinical services. Simultaneously, form a separate Management Services Organization (MSO) for administrative support. Ensure the MSA between the PC and MSO is at Fair Market Value and explicitly protects the PC's clinical autonomy.
2. Professional Licensure: All clinical providers (physicians, NPs, PAs, etc.) must hold active, unrestricted Oregon licenses. For physicians, leverage the Interstate Medical Licensure Compact if applicable. For nurses, utilize the Nurse Licensure Compact. Initiate licensing applications early, as processing times can vary.
3. Telehealth Protocols: Develop and implement robust telehealth policies and procedures. These must cover: patient identification, informed consent (documenting risks/benefits of telehealth), privacy/security (HIPAA compliance), emergency protocols (how to handle emergencies for patients at remote locations), technology requirements, and documentation standards. Ensure the standard of care for telehealth mirrors in-person care.
4. Prescribing Compliance:
   • Controlled Substances: If prescribing controlled substances, ensure all providers have active Oregon DEA registrations. Implement strict protocols for PDMP checks (required for Schedule II-IV substances every 90 days). Monitor federal DEA guidance on telehealth prescribing of controlled substances closely.
   • Non-Controlled Substances: Ensure a valid patient-provider relationship is established and an appropriate medical evaluation is conducted for all prescriptions.
5. Scope of Practice Adherence: Clearly define the roles and responsibilities of all clinical staff based on their Oregon scope of practice. For PAs, ensure a compliant practice agreement with a supervising physician. For NPs, understand their full practice authority. For delegated tasks (e.g., MAs in medspas), ensure direct supervision where required by the Oregon Medical Board.
6. Billing & Reimbursement: Understand Oregon's payment parity laws (ORS 743A.058) for telehealth. Ensure billing practices comply with state and federal regulations, including anti-kickback and fee-splitting prohibitions.
7. Data Privacy & Security: Implement comprehensive HIPAA-compliant data security measures. Oregon law may also have additional data breach notification requirements.

Common Pitfalls to Avoid:

• Ignoring CPOM: Assuming a national MSO model will automatically comply with Oregon's CPOM. Oregon's enforcement is active; ensure the PC is truly physician-owned and clinically autonomous.
• Inadequate Patient Evaluation: Prescribing or treating without a sufficient telehealth evaluation to meet the standard of care, particularly for initial encounters or controlled substances.
• Lack of Informed Consent: Failing to obtain and document comprehensive informed consent for telehealth services.
• Non-Compliance with PDMP: Overlooking the mandatory Oregon PDMP checks for controlled substances.
• Improper Delegation: Allowing unlicensed personnel (e.g., MAs) to perform procedures outside their scope or without proper supervision, especially in medspas.
• Illegal Fee-Splitting: Structuring MSO fees as a percentage of professional fees or in a way that implies control over clinical judgment.

Timeline Expectations:

• Entity Formation (PC/MSO): 2-4 weeks (Oregon Secretary of State).
• Provider Licensure: 2-6 months (Oregon Medical Board, OSBN) depending on the profession and completeness of application. IMLC/NLC can expedite this for eligible providers.
• DEA Registration: 4-8 weeks after state licensure.
• Credentialing & Contracting: 3-6 months with payers.
• Overall Setup: Expect 6-12 months for full operational readiness, including legal review, policy development, and staffing.