Beyond CPOM and Supervision: Why Specialty and Scope of Practice Decide Whether a Practice Holds Up
Most founders launching a clinic put their early energy into two questions: can a non-physician own this, and can a mid-level practice under it. Those are the corporate practice of medicine (CPOM) and supervision questions, and they matter, but they are the floor rather than the ceiling. Clearing them tells you the entity can exist; it does not tell you whether the specific clinical model you are building is legal, defensible, and able to survive a board review or an audit.
That second layer is driven by physician specialty, scope of practice, treatment modality, and facility rules, and it is where structures that look clean on paper quietly fall apart. The details are narrow, they vary by state, and they are extremely specific to what you are actually doing, which is exactly why templated approaches tend to miss them. Below is why this layer exists, how it plays out across three common verticals, and where it most often goes wrong.
The test regulators actually apply
A medical director or collaborating physician is not a generic license you plug into an org chart, because regulators treat a delegation as only as valid as the physician's ability to actually supervise the delegated act. If the physician could not competently perform or oversee the procedure themselves, the delegation is a fiction, and the care provided under it can be recharacterized as unlicensed practice.
So the real question is never whether you have a physician, it is whether this physician's specialty, training, and physical availability match what you are doing, in this state, through this modality. That single test is what varies from one situation to the next, and it is what breaks templated structures that were designed around the entity instead of the medicine.
This is also why "the rule doesn't require it" is a weak place to build. Some states, California among them, do not require a collaborating or supervising physician to hold the same specialty as the practitioner or the services being delivered, and founders often read that silence as permission to pair whichever physician is cheapest or easiest to find. The requirement has not disappeared, though; it has simply moved from a filing box to an enforcement standard. If a complaint or board action arises and the reviewer looks at the collaborative practice agreement and finds a physician who was not actually qualified to supervise that care, both parties get dinged, the physician for inadequate supervision and the practitioner for practicing outside of meaningful oversight. It is the same competence test from above, applied after something has already gone wrong, and it holds for everyone in the chain, because you cannot supervise what you do not understand. "Not legally required" is a planning answer, not a defense, so the defensible move is to match the physician to the care even where the statute is silent.
Delegating down: check what the lower license actually allows
There is a second version of this problem that runs in the opposite direction. To protect margins, practices try to push clinical work down to less expensive staff, using registered nurses in place of prescribers, licensed vocational or practical nurses in place of RNs, and medical assistants in place of nurses. The instinct is understandable, but the mistake is assuming the physician's authority to delegate is the only thing that matters.
Delegation is a two-sided constraint, because a physician can only delegate an act that sits within their own scope and within the legal scope of the person receiving it. The lower license is a hard ceiling, and no job title, private training certificate, or signed protocol can raise it.
Medical assistants are where most of the trouble starts, because they are unlicensed personnel. There is no state-issued medical assistant license, and a "certified medical assistant" credential comes from a private organization rather than a government board, so it authorizes no clinical scope of its own. An MA injecting Botox or filler is one of the most commonly cited scope violations in recent board records, treated as the unlicensed practice of medicine, with criminal exposure for the MA and disciplinary exposure for the supervising prescriber and the practice owner, and neither medical assistants nor estheticians can inject in any state.
Licensed practical and vocational nurse scope is narrower than RN scope and heavily state-specific. Cosmetic injection sits above LPN and LVN scope in nearly every state, and on the IV side their therapy scope is limited and often certification-gated, frequently excluding certain IV push medications and any independent patient assessment. RNs have broader administration scope, but they still cannot diagnose or issue the order themselves, which is where RN roles most often go wrong. An RN can administer under a valid order but cannot perform the good-faith exam or the initial assessment of a new patient, so the second most common injection violation is an RN treating a first-time patient a prescriber never evaluated, since a standing order covers follow-up doses, not the initial assessment.
Underneath all of these is a single misconception, which is that training or certification expands legal scope. It does not. A weekend injectables course, a laser certificate, or a written protocol cannot authorize an act the person's license does not permit, because protocols operate within a scope and cannot enlarge it. And when one of these violations surfaces, usually through a patient complaint, a social media post, or a competitor tip, malpractice coverage often voids for the related claim, and liability runs up the chain to the supervising prescriber and the owner rather than stopping with the person who performed the act.
So the delegation question has two ends that both have to hold: at the top, whether the physician's specialty matches the work, and at the bottom, whether the delegatee's license actually permits the act. A defensible model clears both, and the pull toward cheaper labor is exactly where the bottom end tends to break.
Aesthetics
Florida is the clearest teaching example, and the precise version of its rule is more instructive than the shorthand. The line people repeat is that a med spa medical director must be a board-certified dermatologist or plastic surgeon, but the more accurate picture is that this specialty requirement bites hardest when the supervising physician is not physically on site, particularly in the satellite or off-site model. When the physician is present while services are delivered, the strict specialty requirement does not apply in the same way, and when they are not present and the location is separate from their primary office, it comes into force.
Florida reinforces the point with physical constraints, allowing a physician to oversee only one satellite aesthetic office beyond their primary practice, requiring satellite locations to sit within roughly 25 miles or a neighboring county with a hard 75-mile ceiling, and requiring the practice to post a schedule showing when the physician is and is not on site.
The consequence for structure is significant, because a purely virtual aesthetics model in Florida is difficult by design when the state contemplates physician physical presence and proximity for delegated device work and treats direct on-site supervision as mandatory for higher-risk procedures. Laser sharpens this further, since in many states laser and IPL are classified as the practice of medicine, which controls who may operate the device and how close the physician must be. California shows how narrow the operator pool can be, because only physicians may use a cosmetic laser or IPL device, with registered nurses and physician assistants able to do so under physician supervision, while licensed vocational nurses, medical assistants, cosmetologists, electrologists, and estheticians cannot under any circumstances, regardless of training. No management agreement makes requirements like these disappear.
Two more aesthetics nuances belong in any planning conversation. The first is the good-faith exam, since most states require an individualized exam and a patient-specific order before injectables rather than a single blanket standing order. The second is specialty functioning as a competence filter rather than a title, because the logic Florida leans on is that facial anatomy, vascular occlusion, filler migration, and laser burns require someone who can actually manage the complication, which is why a family physician, pediatrician, or psychiatrist is treated as unqualified to direct an aesthetic practice even with an unrestricted license.
None of this is theoretical, but the cases worth studying are usually not the obvious bad actors. They are ordinary, well-meaning physicians who agreed to serve as a medical director and got caught by a supervision detail. In one reported example, an OB/GYN with a clean record signed on as medical director of a med spa she did not own, and after a patient she had never even seen disputed a refund and reported the spa, the board investigated, found the arrangement noncompliant, and reprimanded her and reported her to the National Practitioner Data Bank. In December 2025 the Iowa Board of Medicine fined a med spa medical director $10,000, not for any patient harm but because he was reviewing charts remotely and appearing on site only two to three hours a month, when the state required at least four hours a week of in-person supervision and physical presence within sixty miles. Boards now call this the paper or ghost director problem, and the recurring line in the enforcement files is some version of "I never really oversaw the place." The exposure lands on the physician's own license, and staying away does not reduce it, because absence is the violation.
Mental health
This vertical lives and dies on controlled substances, and it carries two independent regulatory layers that people routinely conflate, so you have to clear both the federal layer and the state layer.
At the federal level, the pandemic-era telemedicine flexibilities have been extended again, so a DEA-registered practitioner may currently prescribe Schedule II through V controlled substances by telemedicine without a prior in-person exam, with that flexibility running through December 31, 2026. This is the fourth temporary extension rather than a permanent rule, and the permanent framework, expected to center on a special telemedicine registration, is still unfinalized. Anyone building a telepsychiatry or direct-to-consumer model should treat this clearly, because they are operating on a temporary waiver over the Ryan Haight Act in-person default, and a return to that default, sometimes called the telemedicine cliff, remains a live risk that makes any structure assuming permanence fragile.
The everyday version of this risk is quiet. A clinician leans on the federal flexibility but misses a stricter state in-person requirement, or writes a controlled substance for a patient physically located in a state where the clinician is not licensed, and draws a board action for it. The loud version is the Done Global case, where federal prosecutors brought what they called the first criminal case against digital health executives over controlled substances prescribed through telehealth, and a jury convicted the company's founder and clinical president over a subscription model that pushed Adderall through minimal exams, including into states where the prescriber was not authorized. What makes it instructive even for legitimate operators is that prosecutors used corporate practice of medicine concepts as part of the analysis, which is a reminder that structure and prescribing oversight are where a compliance gap turns into a personal-liability problem.
The state layer is separate and can be stricter, and Georgia is a strong illustration. It requires the collaborating physician's specialty to be comparable to the nurse practitioner's, documented in a nurse protocol agreement filed with the board, but the larger trap sits underneath that requirement, because under a Georgia nurse protocol agreement an APRN may not prescribe Schedule I or Schedule II controlled substances at all. That prohibition is absolute and does not depend on the collaborating physician's specialty, so for ADHD stimulant prescribing, which involves Schedule II medications, the prescription has to come from the physician directly, with the only narrow exception being a limited emergency short-supply authorization for experienced APRNs rather than a general prescribing pathway.
Put those together and a nurse-practitioner-led telepsychiatry ADHD model in Georgia is broken at the design stage, because the collaborator must be psychiatry-comparable in specialty and even then the nurse practitioner cannot write the stimulant, which no entity structure repairs.
Two asymmetries are worth naming because they cut the other way. Buprenorphine for opioid use disorder is treated more permissively than controlled substances generally, since the X-waiver has been eliminated and dedicated telemedicine allowances exist, so an OUD model has more room than a stimulant model. Ketamine runs in the opposite direction, because it is a Schedule III substance that is frequently used off-label and is a current enforcement focus, with monitoring and in-person expectations that undercut a light-touch virtual approach.
IV hydration and IV therapy
This is where facility and pharmacy rules appear that have nothing to do with the corporate practice of medicine, and the central one is sterile compounding. Once you admix or reconstitute beyond simple manufacturer directions, you can land in USP 797 territory, which brings environmental controls, beyond-use dating, training, and documentation requirements, and it is why a mobile drip operation run out of a cooler is so often quietly noncompliant.
On top of that, the therapy has to be authorized by someone who can lawfully order it, because a registered nurse cannot independently diagnose a deficiency and self-order the bag; you need a good-faith exam and a prescriber-authorized order, or a properly constructed standing order. Prescription-only ingredients pull in a prescriber, sourcing raises 503A versus 503B pharmacy questions so you cannot simply buy bulk vials and mix, and you may answer to two regulators at once, the medical board and the board of pharmacy, which many owners never plan for.
These are not just paperwork risks. An Iowa IV hydration spa drew board charges tied in part to controlled-substance registration and prescription-documentation requirements, the kind of technical obligations that are easy to miss once a drip menu includes prescription-only or controlled ingredients.
Where this goes wrong
The recurring failure modes all trace back to skipping this layer.
The name-only medical director. A generalist signs on for an aesthetics or psychiatric practice, the board later asks whether real supervision of that specialty actually occurred, concludes that it did not, and the delegated care gets recharacterized, which means the management structure was fine but the clinical oversight was not.
Rejection at submission. Collaborative or protocol agreements get bounced because the physician's specialty does not line up with the delegated acts, which is exactly the comparable-specialty screen that states like Georgia apply at filing.
Audit failure from the federal-state gap. A model relies on a federal telehealth flexibility and overlooks a stricter state in-person or scheduling rule, or overlooks that the flexibility is only temporary.
Template inversion. This is the deepest one, because founders choose an entity structure first and then try to reverse-engineer the physician and the services into it, which is backward.
The order that actually works
Scope the clinical model first, which means defining exactly what services you will provide, through what modality, involving what medications, and in which states. That set of answers determines the physician specialty you need, the supervision modality and any physical-presence requirement, which license levels can legally perform each act, and the facility and pharmacy compliance you have to build, with the entity structure coming only after all of that. Generic MSO and PC templates invert this sequence, which is why they read cleanly and still fail in the room.
The structure is downstream of the medicine, not the other way around, which is why two clinics that look identical on an org chart can carry completely different and non-interchangeable requirements. It is also why the right physician and the right structure are so specific to your own situation that a template is rarely a safe starting point.
References and further reading
The sources below are starting points. The rules change often, so confirm the current version for your state and your specific services before relying on any of them.
Enforcement actions and reported cases
Iowa Board of Medicine, disciplinary action against a Waukee med spa medical director, December 2025. The physician agreed to a warning and a $10,000 civil penalty after the board found he was on site only two to three hours a month and reviewing charts remotely, short of the state's in-person supervision and proximity requirements. No patient harm was alleged. Reporting: https://iowacapitaldispatch.com/briefs/licensing-board-levies-10000-fine-on-medical-director-of-waukee-spa/. The underlying standard is Iowa Administrative Code rule 653-13.8.
Iowa Board of Pharmacy and Board of Nursing actions involving the medical director of an Iowa IV hydration spa, 2025 through 2026. Charges included failing to maintain a separate controlled-substance registration for the business and prescription-documentation lapses, illustrating the pharmacy and registration overlay that IV therapy operations often overlook. Reporting: https://www.kcrg.com/2026/05/18/former-medical-director-iowa-health-spa-faces-more-sanctions/.
Done Global (United States v. He and Brody), Northern District of California. The severe end of the same failures, and the Department of Justice's first criminal prosecution of digital health executives for controlled substances prescribed through telehealth. It is instructive for legitimate operators because prosecutors relied on corporate practice of medicine concepts in the analysis. Analysis of the structure and MSO exposure: https://www.ropesgray.com/en/insights/alerts/2026/01/dojs-done-global-telehealth-prosecution-signals-expanded-criminal-risk.
Primary regulatory sources
Osteopathic Medical Board of California, Licensee FAQs, Cosmetic Treatments and Medical Assistants sections. Sets out who may operate lasers and IPL devices, who may inject Botox, and the limits of medical assistant scope, including that medical assistants may not start or work with IV lines. https://www.ombc.ca.gov/faqs/licensee.shtml. See also California Business and Professions Code sections 2052, 2069 through 2071, 2400, and 2725.
Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, Federal Register, published December 31, 2025. Extends telemedicine prescribing of Schedule II through V controlled substances without a prior in-person exam through December 31, 2026. https://www.federalregister.gov/documents/2025/12/31/2025-24123/fourth-temporary-extension-of-covid-19-telemedicine-flexibilities-for-prescription-of-controlled. Joint HHS and DEA announcement: https://www.hhs.gov/press-room/dea-telemedicine-extension-2026.html.
Ryan Haight Online Pharmacy Consumer Protection Act of 2008, and the DEA proposed rule Special Registrations for Telemedicine and Limited State Telemedicine Registrations, 90 FR 6541, January 17, 2025. The statutory in-person default and the still-unfinalized permanent pathway.
Georgia Rules and Regulations, Chapter 410-11, Regulation of Advanced Practice Registered Nurses, together with Georgia's nurse protocol agreement statute. Covers the comparable-specialty requirement and the prohibition on APRN prescribing of Schedule I and Schedule II controlled substances under a nurse protocol agreement. https://rules.sos.ga.gov/gac/410-11.
Florida Statutes section 458.347 on physician assistant supervision and section 464.0123 on APRN autonomous practice registration, together with the Florida Administrative Code Rule 64B8 provisions governing cosmetic laser and electrolysis procedures. These are the primary authorities behind Florida's med spa supervision and satellite-office rules.
USP General Chapter 797, Pharmaceutical Compounding, Sterile Preparations, U.S. Pharmacopeia. The standard governing sterile compounding relevant to IV therapy.
Further reading and analysis
The Aesthetic Guide, "Must-Know Physician Liability Issues With Med Spas," featuring health care attorney Renee E. Coover. Includes the OB/GYN medical director who lost her license after agreeing to direct a med spa she did not own. https://www.theaestheticguide.com/legal-compliance/must-know-physician-liability-issues-with-med-spas.
Black Law, "The Absentee Medical Director: What Florida Law Actually Requires." A useful corrective to the common shorthand that a Florida med spa medical director must be a board-certified dermatologist or plastic surgeon, and a clear explanation of why the name-only arrangement raises a physician's exposure rather than lowering it. https://www.blacklawpa.com/insights/florida-medical-director-medspa-2026.
Alliance for Connected Care, DEA prescribing of controlled substances resource. An ongoing tracker of the telemedicine flexibilities and the permanent-rule process. https://connectwithcare.org/dea-prescribing-of-controlled-substances/.
This article is general information for founders and clinicians building healthcare operations. It is not legal advice, and the rules referenced here change, sometimes quickly. Confirm current requirements for your specific services, states, and structure before you build.
Building foundations that scale | caminostrategygroup.com