If you're building, running, or backing a telemedicine or digital health company in California, two new state laws now stand between your company and its next deal, and neither one is a formality.
California's Office of Health Care Affordability (OHCA) requires healthcare entities to notify the state at least 90 days before closing a "material change transaction," generally when a party has $25 million or more in California-derived revenue (with a $10 million threshold pulling in smaller counterparties on the other side of that deal). OHCA can't block the transaction outright, but it can open a Cost and Market Impact Review, delay closing by months, and refer the deal to the California Attorney General.
That alone would be worth knowing about. But two new laws that took effect January 1, 2026 make it far more consequential for exactly the kind of company this blog's audience runs or invests in:
- SB 351 codifies California's corporate practice of medicine (CPOM) doctrine into statute, bars private equity firms, hedge funds, and management services organizations (MSOs) from interfering with clinical judgment (staffing, coding, billing, referrals, payor contracting), and voids non-compete and non-disparagement clauses in PE/MSO-physician contracts.
- AB 1415 expands who has to file the 90-day OHCA notice in the first place, pulling MSOs, PE groups, hedge funds, and other controlling entities into scope as "Noticing Entities," not just the traditional provider organizations.
Put together, that's a state that just told every PE-backed or VC-backed telemedicine platform operating an MSO structure in California: your deal timeline just got longer, your clinical control has real legal limits now, and the state will know when you're transacting even if you didn't think of yourself as the kind of company this was aimed at.
This isn't only a California story either. It's one piece of a broader regulatory tightening around exactly this business model — telehealth prescribing, MSO-based practice structures, and PE/VC-backed rollups — moving across multiple states and at the federal level at the same time.
Editorial note: figures and dates below reflect current research as of this writing and should be spot-checked against the primary sources linked at the end before this goes live. Several items are actively moving.
Why This Didn't Come Out of Nowhere
Regulations like this rarely appear overnight. They move from proposed rule to public comment to final rule, and once a draft is out, the core requirement almost never disappears in the final version — the specifics get adjusted, the underlying obligation does not. OHCA's transaction notice framework and California's CPOM legislation both followed exactly that pattern: visible in draft form well before they took effect, and companies that waited for the final version to start preparing gave away most of their runway.
That pattern is why the DEA telemedicine prescribing rule below matters just as much as anything already final. The direction is set. The exact mechanics are still being finalized. Waiting for "final" is not a preparation strategy.
The Next Cliff: DEA Telemedicine Prescribing Flexibilities
Since the COVID-19 public health emergency, DEA has allowed prescribers to issue controlled substance prescriptions via telehealth without the in-person exam otherwise required under the Ryan Haight Act. That flexibility has been kept alive through a series of temporary extensions rather than a permanent rule, and the current extension is set to run through December 31, 2026.
DEA proposed a permanent framework in January 2025 — special registrations for telemedicine — that would let qualifying platforms and prescribers continue prescribing controlled substances via telehealth without an in-person visit, under a formal registration and monitoring structure. It has not been finalized as of this writing.
For any company whose care model depends on telehealth-initiated prescribing — GLP-1s, ADHD medications, buprenorphine, hormone therapies — this is not a rule to wait out. The direction has been consistent through every extension: more structure, more documentation, more registration requirements, not less. Build toward that now, because the extension has been renewed multiple times before and each renewal has come with tighter conditions, not looser ones.
It's Not Just California
At least a dozen states have enacted or are actively advancing their own version of a healthcare transaction notice law, corporate practice of medicine restriction, or both, largely modeled on whichever state moved first:
| State | What changed | Timing |
|---|---|---|
| Massachusetts | Expanded transaction notice requirements and sale-leaseback limits | Enacted January 2025 |
| Washington | Expanded change-of-control reporting and a statewide healthcare entity registry | Effective June 2026 |
| Rhode Island | 60-day pre-closing notice to the state, fines up to $100,000 for failing to notify | Effective January 2026 |
| Indiana | Expanded ownership reporting and AG market-concentration investigation authority | Phased in through January 2026 |
| New York | 30-day pre-transaction notice (including MSO formations); pending bill would add five years of post-closing reporting | In effect, expansion pending |
| Oregon | SB 951 — the most aggressive MSO/CPOM law in the country | First private lawsuit filed April 2026 |
| Pennsylvania, Illinois, North Carolina | Pending bills extending similar oversight; Pennsylvania's would require up to 120 days advance notice | Pending |
Oregon's SB 951 bars MSOs from controlling clinical staffing, coding, billing, or payor contracting, bans dual ownership of the professional corporation and the MSO, and voids non-compete clauses.
The pattern across all of these: state regulators are closing the exact gap that fast-growing, PE-backed and VC-backed care delivery companies have historically operated inside — thin compliance infrastructure relative to how quickly the business scaled.
Why This Hits Startups and Their Investors Hardest
The companies most exposed here are, almost by definition, the ones that have grown fastest. Speed and compliance infrastructure tend to trade off against each other in a company's early years, and an MSO structure or prescribing model built for speed rather than defensibility is exactly what these new laws are targeting.
If you're raising from, or being acquired by, private equity, this shows up directly in diligence. PE diligence teams are increasingly building regulatory exposure checks into their process, specifically because deals have started getting delayed, repriced, or restructured over exactly these issues. A company that walks into diligence with a clean transaction notice history, a defensible MSO structure under SB 351 or the equivalent in its state, and a prescribing model built for the stricter version of the DEA rule is a materially easier deal to close.
What to Actually Do About It
- Get your transaction history and notice process in order now. If a raise, acquisition, or restructuring is anywhere on your roadmap in California or a state with a similar law, build the internal readiness for a formal 90-day (or longer) notice process before you need it.
- Audit your MSO structure for defensibility, not just function. The question regulators and diligence teams are asking is not whether your structure works operationally — it's whether it holds up to scrutiny about who actually controls clinical decisions. SB 351 and Oregon's SB 951 both make that a matter of statute now, not just case law.
- Stress-test your prescribing model against the stricter version of the DEA rule. If your model depends on telehealth-only prescribing for controlled substances, plan for a future with more registration and documentation requirements. That has been the direction of every extension so far.
- Treat draft rules and pending bills as your actual compliance clock. By the time a rule is final, most of your preparation window is gone. Track proposed legislation in your specific categories — MSO structure, transaction notice, telehealth prescribing — the same way you'd track a competitor's roadmap.
- Build a compliance function that scales with growth, not after it. Companies that treat compliance as something to build once they're big enough are the ones that get caught flat-footed by the next rule. Companies that build it in parallel with growth keep closing deals while competitors are stuck in review.
The Takeaway
California's OHCA transaction rule and its 2026 CPOM overlay are not an isolated compliance update. They're a preview of how state and federal regulators are approaching the exact business model — telehealth prescribing, MSO-based practice structures, PE and VC-backed scaling — that grew fastest with the least oversight. Oregon's law is next in that same line, and DEA's telemedicine rule is the federal equivalent. None of this is likely to reverse. The companies that build compliance infrastructure now are the ones that keep growing, keep raising, and keep closing deals while the rest are stuck in review.
Sources
- California OHCA affordability and Cost and Market Impact Review program
- Federal Register (DEA telemedicine extension notices)
- DEA Diversion Control Division
- CMS telehealth policy
- HHS
Several figures above — exact OHCA penalty amounts, the precise DEA controlled-substance schedule scope, and the current status of a few pending state bills — should be confirmed against these primary sources immediately before publication. They are the parts most likely to have shifted since this draft was written.