Virginia Healthcare
Compliance Guide

Virginia presents a nuanced regulatory landscape for healthcare companies, balancing a generally pro-telehealth stance with traditional healthcare oversight principles. The Commonwealth has made significant strides in expanding telehealth access, particularly accelerated by the COVID-19 pandemic, codifying many temporary flexibilities into permanent law. Key regulatory bodies include the Virginia Board of Medicine, Board of Pharmacy, Board of Nursing, and the Department of Health Professions, all of which play a critical role in licensing, scope of practice, and enforcement. Virginia's business climate is generally favorable, but healthcare entities must navigate a well-established Corporate Practice of Medicine (CPOM) doctrine, which restricts the ownership and control of medical practices by non-licensed individuals or entities. Recent legislative actions have focused on refining telehealth reimbursement, expanding the scope of practice for certain advanced practice providers, and addressing mental health access. While the state encourages innovation in healthcare delivery, particularly through technology, it maintains stringent requirements for patient safety, professional licensure, and ethical business practices. Companies looking to operate in Virginia must prioritize robust compliance frameworks, particularly concerning CPOM, provider credentialing, and state-specific telehealth protocols, to ensure sustainable and lawful operations. The state's commitment to expanding access is evident, but this expansion is carefully balanced with a strong regulatory hand, making diligent legal counsel essential.

Virginia maintains a robust Corporate Practice of Medicine (CPOM) doctrine, which prohibits corporations or other business entities from practicing medicine or employing physicians to practice medicine. The legal basis for Virginia's CPOM doctrine is primarily derived from common law principles and reinforced by various statutes that define the practice of medicine and prohibit unlicensed individuals or entities from engaging in it. For instance, Virginia Code § 54.1-2900 defines 'practice of medicine' and 'practice of osteopathic medicine,' and § 54.1-2902 states that no person shall practice medicine without a license. This statutory framework implicitly prohibits non-licensed entities from controlling the professional judgment of licensed practitioners.

The CPOM doctrine in Virginia means that only licensed physicians or professional medical corporations (PC) owned and controlled by licensed physicians can employ other physicians or provide medical services. Non-physicians, including lay corporations or individuals, are generally prohibited from owning or exercising control over medical practices. This extends to dental practices (Corporate Practice of Dentistry) and other licensed healthcare professions, where similar restrictions apply based on their respective licensing statutes.

Permitted Ownership Structures:

• Professional Corporations (PC): Licensed physicians can form a PC to practice medicine. All shareholders, directors, and officers of a medical PC must typically be licensed to practice medicine in Virginia. Virginia Code § 13.1-1111 et seq. governs professional corporations.
• Physician-Owned Entities: A physician, or a group of physicians, can directly own and operate a medical practice.

Specific Restrictions and Impact:

• Non-Physician Ownership: Non-licensed individuals or entities cannot own a medical practice, employ physicians, or dictate medical decision-making. This directly impacts private equity firms, venture capitalists, or lay-owned telehealth companies seeking direct ownership of provider entities.
• Fee-Splitting: Virginia prohibits fee-splitting, where a licensed professional divides fees with an unlicensed person or entity for patient referrals or services. Virginia Code § 54.1-2915(A)(13) considers such conduct as unprofessional and grounds for disciplinary action.
• Telehealth Companies: Telehealth platforms, medspas, dental practices, and wellness clinics must carefully structure their operations to comply with CPOM. The most common compliant structure involves a Management Services Organization (MSO) model. In this model, a lay-owned MSO provides non-clinical administrative and management services (e.g., billing, marketing, IT, real estate) to a physician-owned professional entity (PC). The PC retains sole control over all clinical decisions, physician employment, and patient care. The MSO charges a fair market value fee for its services, avoiding any appearance of fee-splitting or control over clinical practice. This structure is crucial for telehealth companies to operate legally in Virginia without violating CPOM.
• Medspas and Wellness Clinics: These entities, if offering medical services (e.g., injectables, laser treatments, IV therapy), must be owned and operated by a licensed physician or a physician-owned PC. Non-physician owners can only operate the non-medical, 'spa' portion of the business, with the medical services provided by a separate, physician-controlled entity under an MSO arrangement. The physician must maintain direct supervision and control over all medical procedures.

Virginia has a progressive stance on telehealth, with comprehensive laws ensuring its integration into the healthcare system, largely codified from pandemic-era flexibilities. The establishment of a provider-patient relationship via telehealth is explicitly permitted. Virginia Code § 38.2-3418.16 defines 'telehealth services' and mandates that health plans cover these services to the same extent as in-person services, provided they are medically necessary and meet the same standards of care.

Establishment of Provider-Patient Relationship: Virginia law allows for the establishment of a bona fide provider-patient relationship through telehealth. There is no explicit requirement for an initial in-person visit for most services. The standard of care for telehealth services is the same as for in-person services, meaning providers must ensure they have sufficient information to make an informed diagnosis and treatment plan. This generally necessitates a comprehensive history and physical examination, which can often be achieved via synchronous audio-visual technology.

Permitted Modalities: Virginia permits a broad range of telehealth modalities:

• Synchronous Audio-Visual (Video-Conferencing): This is the preferred and most commonly reimbursed modality, allowing for real-time interaction and visual assessment.
• Synchronous Audio-Only (Telephone): While generally permitted, its use for establishing a new patient relationship or for complex diagnoses may be limited by the standard of care. It is more commonly used for follow-up visits or certain mental health services. Reimbursement parity for audio-only services is generally maintained for specific services.
• Asynchronous (Store-and-Forward): This involves the transmission of medical information (e.g., images, pre-recorded video, data) to a provider for review at a later time. It is permitted but typically used for specific specialties like dermatology or ophthalmology, and may not be sufficient for establishing a new patient relationship requiring a comprehensive evaluation.
• Remote Patient Monitoring (RPM): This involves the use of technology to collect health data from patients in one location and electronically transmit that data to a provider in a different location for review. It is permitted and reimbursed under specific conditions.

Telehealth Registration Requirements: Virginia does not impose a separate 'telehealth registration' requirement for providers who are already licensed in the Commonwealth. However, out-of-state providers wishing to offer telehealth services to Virginia patients must be licensed by the appropriate Virginia health regulatory board (e.g., Board of Medicine, Board of Nursing). Virginia participates in the Interstate Medical Licensure Compact (IMLC) and Nurse Licensure Compact (NLC), which facilitate multi-state licensure for eligible physicians and nurses, respectively.

Informed Consent Requirements: Virginia Code § 38.2-3418.16(C) mandates that providers obtain informed consent from the patient (or their legal guardian) before rendering telehealth services. This consent must include, at a minimum, information about the services, the technology used, potential risks and benefits, and patient rights, including confidentiality and data privacy. Providers must document this consent in the patient's medical record.

Geographic Restrictions: There are generally no geographic restrictions within Virginia for telehealth services, meaning a provider licensed in Virginia can provide telehealth services to a patient located anywhere within the Commonwealth. However, providers must ensure they are licensed in the state where the patient is physically located at the time of the service.

Virginia has specific regulations governing the prescribing of controlled substances via telehealth, aligning with federal guidelines while incorporating state-specific nuances. The ability to prescribe controlled substances depends heavily on the establishment of a legitimate provider-patient relationship and adherence to the standard of care.

Schedules Permitted via Telehealth: Generally, all schedules of controlled substances (Schedules II, III, IV, and V) can be prescribed via telehealth, provided a legitimate medical purpose exists and the prescribing is within the scope of the practitioner's license and consistent with the standard of care. However, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (21 U.S.C. § 829(e)) requires an in-person medical evaluation before prescribing controlled substances via the internet, with certain exceptions. The COVID-19 Public Health Emergency (PHE) waiver temporarily lifted this requirement, allowing prescribing of all schedules without an in-person visit. While the federal PHE ended, the DEA has extended certain flexibilities related to the Ryan Haight Act, but the long-term status for new patients remains under review. As of late 2024/early 2025, providers should operate under the assumption that an in-person examination or a qualifying telehealth evaluation (e.g., via synchronous audio-visual technology) that meets the standard of care is required to establish the legitimate medical purpose for prescribing controlled substances, particularly Schedule II medications.

Specific DEA Requirements: Prescribers must hold a valid DEA registration. If prescribing controlled substances via telehealth, the DEA registration must be valid in Virginia. The DEA's temporary flexibilities regarding the Ryan Haight Act have allowed for prescribing of controlled substances without a prior in-person medical evaluation during the PHE and subsequent extensions. However, the DEA is currently finalizing permanent rules, and providers should monitor these developments closely. For Schedule II-V controlled substances, electronic prescribing (EPCS) is generally required in Virginia, as per Virginia Code § 54.1-3408.02.

PDMP Checking Required: Yes, Virginia mandates the use of the Prescription Monitoring Program (PMP). Virginia Code § 54.1-2522 requires prescribers to review a patient's PMP history before prescribing an opioid or benzodiazepine for more than seven consecutive days. This check must be performed for new prescriptions and at least once every 90 days for ongoing prescriptions. This requirement applies equally to telehealth encounters.

Quantity or Refill Limitations: Virginia has specific limitations on opioid prescriptions. For acute pain, the initial prescription for an opioid is generally limited to a seven-day supply for adults and a seven-day supply for minors (Virginia Code § 54.1-3408.01). There are exceptions for chronic pain, cancer treatment, palliative care, or substance abuse treatment. Refills are generally permitted within the standard of care, but the PMP must be consulted regularly for ongoing prescriptions of controlled substances.

Special Rules for Specific Drug Classes:

• GLP-1s (e.g., Ozempic, Wegovy): While not controlled substances, prescribing GLP-1s via telehealth requires a thorough medical evaluation, including a comprehensive history, physical examination (which can be done via video), and appropriate lab work to assess suitability, rule out contraindications, and monitor for side effects. Prescribing must be for a legitimate medical purpose (e.g., type 2 diabetes, chronic weight management with comorbidities) and adhere to FDA-approved indications or accepted medical practice.
• Testosterone (Controlled Substance, Schedule III): Prescribing testosterone via telehealth requires strict adherence to the DEA's rules for controlled substances. A thorough evaluation, including lab tests to confirm hypogonadism, is essential. The PMP must be checked.
• Stimulants (Controlled Substance, Schedule II): Prescribing stimulants (e.g., Adderall, Ritalin) for ADHD via telehealth is particularly scrutinized due to their Schedule II classification. While permitted under the current federal flexibilities, a comprehensive psychiatric evaluation, often requiring multiple sessions, and ongoing monitoring are crucial. The PMP must be checked before each prescription. Providers must be exceptionally diligent in documenting medical necessity and monitoring for diversion or abuse.

Virginia's scope of practice for advanced practice providers (APPs) like Nurse Practitioners (NPs) and Physician Assistants (PAs) has evolved, granting significant autonomy while maintaining certain collaborative requirements. Understanding these distinctions is crucial for healthcare businesses.

Nurse Practitioners (NPs): Virginia grants full practice authority to Nurse Practitioners who meet specific criteria. Virginia Code § 54.1-2957 and 18VAC90-30-85 outline the requirements. NPs who have completed at least five years of full-time clinical experience as an NP and have entered into a practice agreement with a patient care team physician, or who have completed 1,000 hours of clinical experience and 15 graduate credit hours in pharmacology, are eligible for autonomous practice. This means they can practice independently without a written practice agreement with a physician. However, even with autonomous practice, NPs are expected to consult and collaborate with physicians and other healthcare providers as appropriate for patient care. Autonomous NPs can diagnose, treat, prescribe (including controlled substances), and manage patients within their specialty and competence without direct physician supervision. For NPs who do not meet the autonomous practice criteria, a 'practice agreement' with a patient care team physician is required, outlining the scope of practice and collaboration protocols.

Physician Assistants (PAs): Physician Assistants in Virginia practice under the supervision of a licensed physician, as outlined in Virginia Code § 54.1-2952 and 18VAC85-50-10 et seq. PAs must have a 'supervising physician' who is responsible for the PA's actions. The supervision does not necessarily require the physician to be physically present but must be sufficient to ensure patient safety and quality of care. The supervising physician must enter into a 'practice agreement' with the PA, which specifies the services the PA is authorized to perform, the methods of supervision, and the protocols for referral and consultation. PAs can diagnose, treat, and prescribe medications, including controlled substances, within the scope of their practice agreement and under the supervision of their physician. The practice agreement must be submitted to the Board of Medicine.

Delegation Rules for Medical Assistants (MAs) in Medspas: Medical Assistants in Virginia operate under the direct supervision of a physician, NP, or PA. Their scope of practice is generally limited to administrative and clinical tasks that do not require independent medical judgment. In medspas, MAs can perform tasks such as taking vital signs, preparing patients for procedures, and assisting with procedures. However, they cannot independently perform medical procedures such as injectables (e.g., Botox, dermal fillers), laser treatments, or IV therapy. These procedures must be performed by a licensed physician, NP, or PA, or delegated to a qualified licensed individual (e.g., RN) under appropriate supervision. Delegation of medical tasks to MAs is strictly governed by the supervising practitioner's license and the Board of Medicine's regulations, ensuring patient safety and preventing the unauthorized practice of medicine.

Supervision Requirements: Supervision requirements vary by profession. For PAs, a formal practice agreement and ongoing oversight by a supervising physician are mandatory. For NPs, supervision requirements depend on whether they have achieved autonomous practice. For delegated tasks to MAs or other unlicensed personnel, direct, on-site supervision by a licensed practitioner is often required for procedures involving significant risk or requiring medical judgment.

Navigating Virginia's Corporate Practice of Medicine (CPOM) doctrine is paramount when structuring healthcare businesses. The Professional Corporation (PC) - Management Services Organization (MSO) model is the most widely accepted and compliant structure for lay-owned entities seeking to partner with licensed healthcare professionals.

PC-MSO Structures:

• When Needed: This structure is essential whenever a non-licensed individual or entity (e.g., private equity, a technology company, or a lay entrepreneur) wishes to invest in, manage, or provide services to a medical, dental, or other licensed healthcare practice. It allows the lay entity to handle the business aspects while ensuring clinical control remains with licensed professionals.
• How it Works:
  1. Professional Corporation (PC): The clinical services (e.g., medical diagnoses, treatments, prescribing) are provided by a PC, which is solely owned by licensed Virginia physicians (or other licensed professionals for their respective fields). This PC employs the licensed providers and holds all necessary clinical licenses and permits.
  2. Management Services Organization (MSO): A separate, lay-owned entity (the MSO) enters into a Management Services Agreement (MSA) with the PC. The MSO provides all non-clinical, administrative, and management services to the PC, such as billing, coding, marketing, IT, human resources (for non-clinical staff), real estate, equipment leasing, and other back-office support.

Fee-Splitting Rules: Virginia strictly prohibits fee-splitting, as outlined in Virginia Code § 54.1-2915(A)(13). This means a licensed professional cannot divide fees for professional services with an unlicensed person or entity, nor can they pay or receive payment for patient referrals. In an MSO arrangement, the MSO must charge the PC a fair market value (FMV) fee for its services. This fee should be fixed or based on legitimate costs and not tied directly to a percentage of the PC's professional fees or revenue, as that could be construed as illegal fee-splitting. The compensation structure must be commercially reasonable and documented.

Management Services Agreement (MSA) Requirements:

• The MSA must clearly delineate the services provided by the MSO and the fees charged.
• The fees must be at FMV and not contingent on the volume or value of referrals or professional services.
• The MSA must explicitly state that the PC retains sole and absolute control over all clinical decisions, patient care, hiring/firing of clinical staff, and professional judgment.
• The MSO cannot interfere with the PC's professional judgment or patient care decisions.
• The term of the agreement, termination clauses, and intellectual property rights should be clearly defined.

Professional Corporation Requirements:

• Virginia Code § 13.1-1111 et seq. governs professional corporations. All shareholders, directors, and officers of a medical PC must be licensed to practice medicine in Virginia. Similarly, for dental PCs, all owners must be licensed dentists, and so forth.
• The corporate name must include 'Professional Corporation,' 'P.C.,' 'PC,' 'Professional Association,' 'P.A.,' or 'PA.'

Structuring Ownership for Compliance:

• Physician Ownership: Ensure the PC is genuinely owned and controlled by licensed physicians. Avoid nominee ownership arrangements.
• Clear Separation: Maintain a clear operational and financial separation between the MSO and PC. While they may share common business goals, their legal and operational roles must be distinct.
• Documentation: All agreements (MSA, lease agreements, equipment leases) must be meticulously drafted and reflect FMV terms. Regular audits of these arrangements are advisable to ensure ongoing compliance. This structure allows for investment and efficient management while upholding the integrity of the medical profession and complying with Virginia's CPOM laws.

Virginia's regulatory landscape is dynamic, with ongoing legislative and board activities shaping healthcare delivery. As of 2025-2026, several key developments are relevant for healthcare companies:

Legislative Actions (2024-2026):

• Telehealth Reimbursement Parity: While Virginia already has robust telehealth parity laws (Virginia Code § 38.2-3418.16), there's ongoing discussion and potential fine-tuning of reimbursement for specific services, particularly for audio-only encounters, to ensure long-term sustainability and equitable access. Expect continued legislative efforts to clarify and expand specific covered services and modalities.
• Scope of Practice Expansion: There's a continuous push to expand the scope of practice for various allied health professionals. While NPs have achieved significant autonomy, legislation may continue to address PAs and other licensed professionals, potentially reducing supervisory requirements or expanding prescriptive authority in certain areas. For example, recent legislative sessions have seen bills proposing greater independence for PAs or allowing pharmacists to administer a broader range of immunizations or prescribe certain medications under collaborative practice agreements.
• Mental Health Access: Given the national mental health crisis, Virginia continues to explore legislative avenues to improve access to mental health services, including further integration of telehealth for behavioral health and potential funding mechanisms for underserved areas. This may include specific waivers or grants for telehealth providers focusing on mental health.

Board Actions and Enforcement:

• Telehealth Standard of Care: The Virginia Board of Medicine and other health regulatory boards continue to issue guidance and enforce the standard of care for telehealth services. Expect increased scrutiny on initial evaluations, documentation, and the appropriate use of technology, particularly for controlled substance prescribing and complex conditions. Enforcement actions are likely to target providers who fail to establish a legitimate provider-patient relationship or prescribe without adequate assessment.
• CPOM Enforcement: The Board of Medicine remains vigilant regarding violations of the Corporate Practice of Medicine. Companies operating with non-compliant MSO structures or engaging in illegal fee-splitting are at risk of investigation and disciplinary action against the licensed professionals involved. There's a continued focus on ensuring clinical autonomy of physicians.

Compact Participation Updates:

• Interstate Medical Licensure Compact (IMLC): Virginia is a member of the IMLC, facilitating expedited licensure for eligible physicians. This remains a stable pathway for out-of-state physicians to practice in Virginia via telehealth. No significant changes are anticipated, but ongoing operational refinements may occur.
• Nurse Licensure Compact (NLC): Virginia is also a member of the NLC, allowing nurses with a multi-state license from a compact state to practice in Virginia. This significantly streamlines cross-state nursing practice, including telehealth. The NLC's stability and broad adoption continue to support telehealth expansion.
• Psychology Interjurisdictional Compact (PSYPACT): Virginia is a PSYPACT member, which allows licensed psychologists in PSYPACT states to practice telepsychology and conduct temporary in-person psychology in other PSYPACT states. This is a critical development for mental health telehealth providers.

Entering the Virginia healthcare market, especially with a telehealth component, requires meticulous planning and adherence to state-specific regulations. Here's actionable guidance for companies:

Step-by-Step Compliance Checklist:

1. CPOM Compliance: Immediately engage legal counsel to structure your entity. If lay-owned, implement a robust PC-MSO model from day one. Ensure the Management Services Agreement (MSA) is fair market value and clearly delineates clinical and administrative responsibilities.
2. Provider Licensure: All healthcare professionals (physicians, NPs, PAs, etc.) must be licensed by their respective Virginia health regulatory board. Utilize compacts (IMLC, NLC, PSYPACT) where applicable for expedited licensure. Verify and maintain current licenses.
3. Telehealth Protocols: Develop comprehensive telehealth policies and procedures covering patient intake, informed consent (documented!), modality use, emergency protocols, and data security (HIPAA compliance is non-negotiable).
4. Prescribing Compliance: Implement strict protocols for controlled substance prescribing, including mandatory PMP checks (Virginia Code § 54.1-2522) and adherence to quantity limits. Ensure your providers understand the Ryan Haight Act implications and any federal/state waivers.
5. Scope of Practice: Clearly define and enforce the scope of practice for all providers, especially NPs and PAs, based on Virginia law and their individual qualifications. Ensure appropriate supervision/collaboration agreements are in place and filed with boards if required.
6. Documentation: Maintain thorough and accurate medical records for all telehealth encounters, mirroring the standards for in-person care.
7. Billing & Reimbursement: Understand Virginia's telehealth parity laws (Virginia Code § 38.2-3418.16) and specific payer requirements. Ensure your billing practices comply with anti-kickback statutes and fraud, waste, and abuse laws.

Common Pitfalls to Avoid:

• Ignoring CPOM: Attempting to directly employ physicians or exercise clinical control as a lay entity is a direct violation and will lead to severe penalties.
• Inadequate Informed Consent: Failing to obtain and document proper informed consent for telehealth services can lead to disciplinary action and liability.
• Prescribing Without Legitimate Relationship: Prescribing controlled substances or other medications without a thorough evaluation that establishes a legitimate provider-patient relationship and medical necessity.
• Lack of State Licensure: Assuming federal DEA registration or out-of-state licensure is sufficient for practicing in Virginia via telehealth.
• Fee-Splitting: Structuring MSO fees as a percentage of professional fees or revenue, rather than fair market value for services rendered.

Timeline Expectations for Licensing and Setup:

• Entity Formation (MSO/PC): 2-4 weeks.
• Provider Licensure: 2-6 months (can be faster with compacts, but allow buffer).
• DEA Registration (if applicable): 2-4 weeks after state licensure.
• Payer Enrollment: 3-6 months (can be lengthy, plan accordingly).
• Policy & Procedure Development: Ongoing, but initial drafts should be ready before launch.

Proactive legal and compliance counsel is not merely a recommendation but a necessity for successful and compliant operations in Virginia.