Camino Strategy Group
Our Blog · Field notes

The rules are your roadmap.
How you operationalize them
is your defense.

Practical writing from Camino on the compliance layer that private practices, telehealth, and digital-health companies actually live inside — from PC/MSO structure to marketing, credentialing, payors, and ongoing oversight.

The big idea

Compliance is growth infrastructure.

The myth: compliance slows you down and gets in the way of building.

The reality: it's the infrastructure that lets you scale. Build it before you grow, not after. It unlocks — in this order — the ability to market, hire, expand states, raise capital, and take on risk.

Same service can be compliant for one practice and a violation for another. Five waypoints set your rulebook: payment model, services, state(s), provider type, and care setting.

Rules by domain

Where practices actually get caught.

The gate that stops you is rarely the thing you were trying to do. It's the layer underneath that got skipped.

Ownership & structure

The PC/MSO line is the whole game.

  • The physician (or 51% majority, where lay minority is allowed) owns the clinical entity. A non-clinician cannot own the PC — that's why the MSO exists.
  • Money flows patient → PC first → fair-market management fee → MSO. Straight-to-MSO reads as a strawman.
  • In strict states (NY, CA), the MSO fee is fixed or cost-plus at FMV — never a % of revenue.
  • Forced share-transfers and MSO-controlled exit terms are exactly what regulators (CA AG, SB 351 / AB 1415) now attack.
Marketing & claims

Marketing is where you get caught.

  • FTC: every claim must be substantiated before it runs. Endorsements need disclosure and typical-result context.
  • No practicing medicine in ads — marketing is a physician-controlled function under CPOM, and that approval has to be documented.
  • FDA scrutiny is highest on compounded GLP-1s, hormones, and off-label promotion. Never imply FDA approval.
  • LegitScript + payment processing still gate paid healthcare ads before you can scale. Get certified first, not after the account gets shut down.
Payors & billing

Cash-pay is not a compliance shortcut.

  • Good Faith Estimates apply to cash-pay patients under the No Surprises Act — build them into intake, don't bolt them on.
  • Insurance-billing practices face clinic-licensure rules (e.g. Florida AHCA) that cash-pay physician-owned practices often avoid.
  • Payor enrollment (Medicaid, Medicare, commercial) is where UPIC, RAC, and MAC audits start — clean credentialing files are the first defense.
  • Refunds and billing-error logs are a monthly cadence item, not an annual cleanup.
Hiring & credentialing

The physician hires and fires the clinicians.

  • Clinical staff decisions belong to the PC / physician owner. The MSO handles administrative staff only — that split has to show in the org chart, not just the MSA.
  • Verify licensure, DEA, board actions, and OIG/SAM exclusions before day one — and re-check monthly.
  • Standing orders, protocols, and scope-of-practice sign-offs are the physician's authority, not HR's.
  • Noncompetes are void in California and restricted in Colorado — templated national agreements will fail an audit.
Ongoing audits & oversight

A recurring cadence is the defense.

  • Monthly: compliance meeting with signed minutes, chart-review log, incident review, license/DEA/OIG checks, refund log.
  • Quarterly: state & federal rule scan, BAA and vendor review, disaster-recovery and breach-response test.
  • Physician engagement gets logged — meetings, decisions, protocols — so oversight can be proven in 10 minutes, not reconstructed in 10 days.
  • Oversight is how you catch a problem before a regulator, a biller, or a patient does.
Mistakes we see most

None of these start as a legal problem.

  • Contracts that don't match operations — the MSA says one thing, the day-to-day says another.
  • A signed consent treated as a defense. Real consent is that the patient actually understood; the signature is just the receipt.
  • Expansion before the structure is ready — new state, new provider, same broken foundation.
  • Marketing claims that can't survive a complaint. Ad accounts get shut down long before a lawyer's letter arrives.
  • "I think so" answers to basic questions — every "not sure" is a gap a system would already have answered.
Same doctrine, different obligations

Four states, four different rulebooks.

CACalifornia

Physician owns 100%; no proximity rule. 2026 watch: SB 351 / AB 1415 and the AG amicus target friendly-PC share-transfer and MSA-termination terms. Noncompetes void.

NYNew York

PC/PLLC 100% physician-owned via NYSED (slow); NPs can't own a medical PC. Strict fee-splitting ban — MSO fees fixed or cost-plus at FMV, never a % of revenue.

FLFlorida

No formal CPOM statute, but not a free pass. Clinic license required if the practice isn't wholly physician-owned and bills insurance (unlicensed is a felony).

COColorado

Physician-owned PC (PAs may be a minority). Lay directors/officers allowed with no shares and no authority over medical judgment. DORA active; noncompetes restricted.

See all 50 states
A self-assessment

Could you prove it?

Answer honestly, in your head. Anywhere the answer is "I think so" or "I'd have to dig" — that is the gap.
"I think so" = no. Every "not sure" is a place a system would already have the answer.

  • Could you prove physician oversight in 10 minutes?
  • Do your contracts match your day-to-day operations?
  • Do you have documentation showing chart review and clinical engagement?
  • Could your marketing claims survive a complaint?
  • Are your consents current for each service and state?
  • Do you know which vendors need BAAs?
  • Do you have a recurring compliance meeting cadence?
From the blog

Further reading.

Retatrutide and Compounding: What the Regulations Say and the Enforcement Records are Showing
Phoebe Gutierrez

Retatrutide and Compounding: What the Regulations Say and the Enforcement Records are Showing

An educational overview of the regulatory and enforcement landscape around retatrutide — what the FDA warning letters, state pharmacy records, and testing data actually show.

Read
The Carbon Health CPOM Settlement: What It Means for Telemedicine and Digital Health using friendly PC/MSO model
Phoebe Gutierrez

The Carbon Health CPOM Settlement: What It Means for Telemedicine and Digital Health using friendly PC/MSO model

California's $4.5 million settlement with Carbon Health is the first time the Attorney General has forced a company to tear down and rebuild a friendly-PC structure. Here's what telemedicine founders need to know.

Read
Restricted Transfer Agreements in MSO/PC Structures: What They Do, Why California Is Different, and Why the AG Just Sent a Warning Shot
Phoebe Gutierrez

Restricted Transfer Agreements in MSO/PC Structures: What They Do, Why California Is Different, and Why the AG Just Sent a Warning Shot

California's Attorney General is targeting restricted transfer agreements in MSO/PC structures. Here's what the warning means and how to fix your contracts.

Read
How to Get GLP-1 Coverage on Medicare in 2026: A Provider's Guide to the New Bridge Program
Phoebe Gutierrez

How to Get GLP-1 Coverage on Medicare in 2026: A Provider's Guide to the New Bridge Program

A provider's guide to Medicare's new GLP-1 bridge program in 2026 — eligibility, prior auth, and what to expect from coverage expansion.

Read
Telehealth Provider Misclassification: What the Cioppettini v. Mochi Medical Lawsuit Means for 1099 Clinician Contracts
Phoebe Gutierrez

Telehealth Provider Misclassification: What the Cioppettini v. Mochi Medical Lawsuit Means for 1099 Clinician Contracts

The Cioppettini lawsuit targets 1099 clinician misclassification in telehealth. Here's what the case means for your contracts and compliance posture.

Read
Medvi and Zealthy: What Every Telehealth Founder Needs to Learn From Compliance Investigations in 2026
Phoebe Gutierrez

Medvi and Zealthy: What Every Telehealth Founder Needs to Learn From Compliance Investigations in 2026

The Medvi and Zealthy investigations are a roadmap of what regulators are looking for in 2026. Here's what telehealth founders should learn.

Read
How to Start a Medical Practice in 2026: A Complete Guide
Camino Strategy Group

How to Start a Medical Practice in 2026: A Complete Guide

Complete guide to starting a medical practice in 2026.

Read
What Is a UPIC Audit? Everything Private Practice Owners Should Know
Camino Strategy Group

What Is a UPIC Audit? Everything Private Practice Owners Should Know

A guide to UPIC audits for private practice owners.

Read
The Final Step Most Miss: Mandatory Board Submissions for NP and PA Collaborative Agreements
Camino Strategy Group

The Final Step Most Miss: Mandatory Board Submissions for NP and PA Collaborative Agreements

Mandatory board submissions for NP and PA collaborative agreements.

Read
Building a Team for a Start-Up: Healthcare Edition
Camino Strategy Group

Building a Team for a Start-Up: Healthcare Edition

How to build a team for a healthcare start-up.

Read
Start with the review

The operational compliance review is the map.
Let's draw yours.

Get the CPOM checklist