Telehealth Compliance Overview
Cash-pay, multi-state, async telehealth with products and peptides. Current as of October 2026. Orientation only, not legal advice.
General educational information from Camino Strategy Group, LLC, a compliance consulting firm. Not legal advice. Requirements vary by state and change; confirm with qualified healthcare counsel before relying on this material.
Compliance Overview
| Category | Regulation / Rule | Overview | Nuances and State Variation | Risk if Ignored | Questions to Ask |
|---|---|---|---|---|---|
| Structure | Corporate practice of medicine (CPOM) | Many states bar non-physicians from owning a medical practice or controlling clinical decisions. Usual setup is a physician-owned PC contracting with an MSO. | Varies by state. California SB 351 (eff. 1/1/2026) limits PE and investor control. Oregon SB 951 bars MSO owners from holding a majority of the PC (new deals 1/1/2026, existing 1/1/2029). | Void contracts, board discipline, loss of revenue model. | Which of our states enforce CPOM? Does our PC/MSO structure hold up in each one? |
| Structure | Fee splitting / management fees | Limits how the MSO can be paid by the PC. | Percentage-of-revenue fees are risky in some states (e.g., NY, TX, FL). Flat fair market value fees are safer. | Fee arrangement treated as illegal fee splitting. | Is our management fee fixed fair market value or a percentage? Does the MSO have de facto control through stock transfer or succession agreements? |
| Structure | Anti-kickback and self-referral (federal) | Federal AKS and Stark apply when federal health care programs are billed. | Cash-pay only models fall mostly under state laws instead, many of which apply to all payers. | Criminal and civil liability if any federal payer is involved. | Do we touch Medicare, Medicaid, or other federal payers anywhere, including labs? |
| Marketing | FTC advertising and health claims | Health claims must be truthful and backed by evidence. Testimonials and before-and-after photos must be real and show typical results. Paid endorsements must be disclosed. | FTC final order against NextMed (Dec 2025) over fake reviews, hidden costs, and unsupported weight loss claims. | FTC orders, refunds, state AG action. | Can we back up every outcome claim? Are testimonials real, typical, and disclosed if paid? |
| Marketing | FDA claims about compounded drugs | Compounded drugs are not FDA approved. Calling them generic or the same as brand drugs is treated as misleading. | FDA warning letters to telehealth sellers in Sept 2025, March 2026, and June 2026. | Warning letters, platform removal, partner pharmacy fallout. | Does any page say FDA approved, generic, or same active ingredient for a compounded product? |
| Marketing | Ad platform approval (LegitScript) | Google and Meta require LegitScript certification before running telehealth or prescription drug ads. | Certification takes weeks to months and reviews licensing, pharmacy partners, and site content. Payment processors often require it too. | Ad accounts blocked, processor shutdown. | Are we LegitScript certified? Will our pharmacy partners pass review? |
| Marketing | TCPA and CAN-SPAM (texts, calls, email) | Marketing texts and calls need documented prior written consent. Emails need opt-out and sender info. | Opt-outs by any reasonable method must be honored within 10 business days. FCC broader revoke-all rule delayed to Jan 31, 2027. | Class actions with per-message damages. | How do we capture and store consent? How fast do we process opt-outs? |
| Marketing | Affiliates and influencers | Paying people for patient referrals can be patient brokering or fee splitting. | Per-patient or per-prescription payments carry the most risk. Flat fees for content are safer. Some states have patient brokering laws (e.g., FL). | Kickback or brokering exposure, board discipline. | Are affiliate payments flat or tied to sign-ups or prescriptions? |
| Licensure | State medical licensure | Clinicians must be licensed in the state where the patient is located at the time of care. | IMLC speeds physician licensing (Alaska joined 2026) but still issues separate state licenses. Texas requires a full Texas license. | Unlicensed practice, invalid prescriptions, uninsured claims. | Does our license map match where patients actually are, including travelers? |
| Licensure | NP and PA supervision / collaboration | States set scope of practice and supervision rules for NPs and PAs. | Ranges from full practice authority to required collaboration agreements, chart review, and supervising physician ratios. | Scope violations, invalid prescriptions. | Which states need collaboration agreements, chart review, or physician sign-off? |
| Licensure | Malpractice and credentialing | Coverage must match every state and service line. Licenses and DEA registrations must be tracked. | Many policies exclude compounded drugs, peptides, or certain states. | Uncovered claims. | Does our malpractice cover telehealth, every state, and peptides or compounded drugs? Who tracks renewals and board actions? |
| Async care | Provider-patient relationship | A valid relationship must exist before prescribing and meet the same standard of care as in person. | Most states say a questionnaire alone is not enough. Mississippi and Arkansas reject questionnaire-only. Iowa allows an adaptive interview. Texas allows async with images or records. NJ, DE, and CA allow async if standard of care is met. | Board discipline, invalid prescriptions, pharmacy partner exposure. | State by state, can our async flow establish the relationship or do we need a video or audio visit first? |
| Async care | Telehealth informed consent | Patients must consent to telehealth and understand its limits. | Some states require specific written or verbal consent language and documentation. | Board complaints, weak defense in claims. | Does our consent meet each state's specific requirements? |
| Async care | Identity and location verification | Confirms who the patient is and which state they are in. | Required to apply the right state's rules and licensing. | Prescribing to the wrong person or in an unlicensed state. | How do we verify ID and patient location at each visit and refill? |
| Prescribing | DEA / Ryan Haight Act | Generally requires an in-person exam before prescribing controlled substances online. | Federal flexibilities allow audio-video prescribing through Dec 31, 2026. Async-only is not covered. DEA special registration final rule sent to OIRA Aug 2026, text not public. | DEA action, criminal exposure, care gap on Jan 1, 2027. | Do we prescribe any controlled substances (testosterone, ketamine, stimulants)? What is our plan for Jan 1, 2027? |
| Prescribing | State controlled substance and PDMP rules | States add their own telehealth prescribing limits and PDMP check requirements. | Florida limits Schedule II via telehealth. Texas bars chronic pain treatment with scheduled drugs via telemedicine. | Board discipline even if DEA rules are met. | Which states require PDMP checks before each prescription? Which restrict our drugs via telehealth? |
| Technology / EMR | Clinician routing by license and state | The EMR should only route a patient to a clinician licensed in the state where the patient is located. | Routing should also check DEA registration in that state for controlled substances, NP/PA collaboration requirements, and address or travel changes between visits. | Unlicensed practice, invalid prescriptions. | Does our EMR block assignment to clinicians not licensed in the patient's state? Does it recheck location at each visit and refill? |
| Technology / EMR | Scope of practice gating | Drug and service menus should be limited by clinician type and state. | Some states restrict NP or PA prescribing of Schedule II drugs or require them in the collaborative agreement. Some services may need physician sign-off. | Scope violations, board discipline. | Is our formulary locked by clinician type and state inside the EMR? Who updates it when laws change? |
| Technology / EMR | Collaboration and chart review tracking | Many states require documented physician chart review or co-signature for NP or PA care. | Required percentages, frequency, and meeting rules differ by state and profession. | Failed board audit, invalid collaboration. | Does the EMR track co-signatures and chart review by state and clinician? |
| Technology / EMR | Async protocols and auto-approval | Async intake can use protocols, but a licensed clinician must make each prescribing decision. | Algorithms or non-clinical staff approving or denying prescriptions can be unlicensed practice and a CPOM problem. | Unlicensed practice, CPOM violation, invalid prescriptions. | Does a clinician review every async case before prescribing? Who approved our protocols and when were they last updated? |
| Technology / EMR | E-prescribing and EPCS | Most states require e-prescribing for controlled substances, and some for nearly all prescriptions (e.g., New York). | Controlled substance e-prescribing must use DEA-compliant software with identity proofing and two-factor authentication. | Rejected prescriptions, DEA findings. | Is our e-prescribing platform EPCS certified? Are all prescribers identity proofed? |
| Technology / EMR | AI tools in care and messaging | States are adding rules on AI in clinical care. | California AB 3030 requires a disclaimer when generative AI drafts patient clinical messages unless a clinician reviews them. Texas SB 1188 requires disclosure of AI use in care and practitioner review of AI-generated records. | State enforcement, board complaints. | Where do we use AI in intake, charting, or messaging? Do we disclose it and have clinician review? |
| Technology / EMR | Data location and security | HIPAA Security Rule requires a risk analysis, access controls, audit logs, and safeguards like encryption. | Texas SB 1188 requires electronic records of Texas patients to be stored in the US. Offshore staff or vendors need extra review. | OCR enforcement, breach liability. | Where is our data stored and who can access it, including offshore staff? When was our last security risk analysis? |
| Technology / EMR | Patient access and information blocking | Patients have a right to their records, and the Cures Act limits blocking access to electronic health information. | HIPAA access requests must be met within 30 days. Results and notes generally should be released promptly through the portal. | OCR right of access penalties, information blocking complaints. | How do patients get their records? Do we delay release of results or notes? |
| Technology / EMR | Labs and diagnostics | Lab orders need a licensed clinician and a properly licensed lab. | Some states restrict direct-to-consumer lab testing (e.g., New York). Labs must be CLIA certified and state licensed where required. Abnormal results need a follow-up process. | Unlicensed testing, missed critical results. | Are our labs licensed for every patient state? Who reviews and acts on abnormal results? |
| Technology / EMR | Messaging, escalation, and after-hours | Patients need a way to reach a clinician and clear emergency instructions. | Async models still need response time standards, urgent symptom escalation, and side effect intake. | Patient harm, malpractice, board complaints. | What is our response time standard? How are urgent messages and side effects escalated? |
| Technology / EMR | Records ownership and portability | The PC should own medical records, with the MSO or vendor acting as custodian. | Agreements should cover export on termination and retention periods by state, often longer for minors. | Lost records, CPOM concerns, weak defense in claims. | Who owns records in our PC/MSO and vendor contracts? Can we export them if we switch EMRs? |
| Products | Compounding (503A vs 503B) | 503A pharmacies compound per patient with a prescription. 503B facilities make larger batches under stricter FDA oversight. | Bulk ingredients must be FDA approved components, have a USP monograph, or be on the 503A bulks list. | Unlawful product, FDA action. | Is each product legally compoundable today, and by which type of pharmacy? |
| Products | Compounded GLP-1s | Shortages for tirzepatide (Dec 2024) and semaglutide (Feb 2025) are over. Copies of approved drugs are not allowed. | Patient-specific clinical differences must be documented. FDA proposed (May 2026) excluding GLP-1s from the 503B bulks list, not final. | Warning letters, product line shut down. | Is each GLP-1 prescription documented as clinically different from the approved drug? |
| Products | Peptides (BPC-157 etc.) | Peptides must be on an allowed list to be compounded. | FDA advisory committee (July 2026) recommended adding BPC-157, TB-500, KPV, MOTS-c, Semax, Epitalon. Advisory only until FDA finalizes. Research use only peptides for human use are unapproved drugs. | Unapproved drug sales, FDA and state action. | What is our plan if FDA does not finalize the peptide list? Are we selling anything labeled research use only? |
| Products | Pharmacy licensure and dispensing | Pharmacies shipping into a state usually need a nonresident license there. Selling from the practice triggers dispensing rules. | Practitioner dispensing rules vary widely and some states require a separate permit. | Illegal shipments, dispensing violations. | Is every pharmacy licensed in every patient state? Do we dispense or sell anything directly? |
| Products | Supplements and adverse events | Supplements follow FDA labeling and FTC claim rules. Serious adverse events should be reported. | Disease claims on supplements turn them into unapproved drugs. | FDA and FTC action, safety liability. | Who handles adverse event intake and MedWatch reporting? |
| Pharmacy | Pharmacy payments and steering | Payments from pharmacies to the practice or MSO for referrals can violate state kickback and fee-splitting laws even with no insurance billed. | Some states protect patient choice of pharmacy (e.g., VA, NC board guidance). Disclose any ownership ties. | Criminal and civil liability, pharmacy license issues. | Does any money flow from pharmacies to us? Do patients have a real choice of pharmacy? |
| Payments | Subscriptions and auto-renewal | Memberships need clear terms, express consent, and easy cancellation. | Federal click-to-cancel rule vacated July 2025 but FTC still enforces under ROSCA. California ARL (amended July 2025) requires consent proof, annual reminders, online cancel. NYC rule effective Oct 1, 2026. | FTC and AG action, class actions, chargebacks. | Does our checkout and cancel flow meet California ARL and other state laws? |
| Payments | Pricing transparency and Good Faith Estimates | Consult, membership, and medication fees should be disclosed separately and accurately. | No Surprises Act requires Good Faith Estimates for self-pay patients for scheduled services. | Consumer complaints, regulatory action. | Do we issue Good Faith Estimates? Does our refund policy match our ads? |
| Payments | Payment processing and HSA/FSA | Telehealth is often classed as high-risk by processors. | HSA/FSA eligibility claims must be accurate. Medication and membership may be treated differently. | Frozen funds, account termination. | Is our processor approved for telehealth? What can we lawfully say about HSA/FSA? |
| Privacy | HIPAA and BAAs | The practice and its vendors handling PHI must follow HIPAA and sign BAAs. | Applies to EHR, pharmacy, labs, messaging, CRM, and billing vendors. | OCR enforcement, breach costs. | Do we have signed BAAs with every vendor touching PHI? |
| Privacy | Tracking pixels and analytics | Ad pixels on intake, checkout, or portal pages can share health data. | Court vacated part of OCR guidance for public pages (2024) but tracking behind logins is still covered. | OCR action, pixel class actions. | Which pixels run on intake, checkout, and portal pages? |
| Privacy | State consumer health data laws | Cover health data HIPAA does not, including marketing and website data. | Washington My Health My Data, Nevada, Connecticut, CCPA/CPRA. New York bill passed June 2026, pending. | AG action, private lawsuits (WA). | Do we need separate consent to collect or share health data in WA or NV? |
| Operations | Website accessibility (ADA) | Sites and intake flows should be accessible. | WCAG 2.1 AA is the common benchmark. | ADA demand letters and lawsuits. | Is our site and intake flow accessible? |
| Operations | Policies, complaints, and board reporting | Written policies, complaint handling, and timely reporting are expected. | Reporting triggers and timelines vary by state board. | Missed mandatory reports, weak audit position. | How are complaints triaged? When must we report to a board? |
| Operations | Clinician compensation | How clinicians are paid can create pressure to prescribe. | Pay tied to prescription volume or approvals is a red flag for regulators. | Board and enforcement scrutiny. | Is any clinician pay tied to prescriptions or approval rates? |
Peptides and Compounding
Based on FDA's 503A category list (updated May 14, 2026) and the July 23-24, 2026 PCAC meeting. Verify before launch; categories change.
| Group | Substance | Type | FDA Status | Can a 503A Pharmacy Compound It Today? | Notes |
|---|---|---|---|---|---|
| Category 1 peptides | Glutathione | Tripeptide | 503A Category 1 (under evaluation) | Yes, under FDA interim policy | Common in injection and IV menus. Category 1 is temporary and can change. |
| Category 1 peptides | GHK-Cu (non-injectable only) | Copper peptide | Category 1 for non-injectable routes only (re-added May 2026) | Yes, topical or other non-injectable only | Injectable GHK-Cu is not covered. FDA plans advisory committee review by Feb 2027. |
| Category 1 peptides | Vasoactive Intestinal Peptide (VIP) | Neuropeptide | Category 1 | Yes, under FDA interim policy | Often nasal. Confirm pharmacy sterile compounding capability. |
| Category 1 peptides | Alanyl-L-Glutamine | Dipeptide | Category 1 | Yes, under FDA interim policy | Less common in telehealth menus. |
| Other Category 1 (common in longevity, hormone, weight programs) | NAD+ and NADH | Coenzyme | Category 1 | Yes, under FDA interim policy | Popular injectable and IV. Avoid anti-aging or disease treatment claims. |
| Other Category 1 (common in longevity, hormone, weight programs) | Enclomiphene Citrate | Hormone modulator | Category 1 | Yes, under FDA interim policy | Not an FDA-approved drug. Used in male hormone programs; claims must be careful. |
| Other Category 1 (common in longevity, hormone, weight programs) | Methylcobalamin (B12) | Vitamin | Category 1 | Yes, under FDA interim policy | Common add-on in weight loss programs. |
| Other Category 1 (common in longevity, hormone, weight programs) | 7-Keto DHEA, Pregnenolone | Hormone precursors | Category 1 | Yes, under FDA interim policy | Hormone-related; clinical oversight and labs expected. |
| Other Category 1 (common in longevity, hormone, weight programs) | Acetyl-L-Carnitine, Alpha Lipoic Acid, CoQ10, L-Citrulline, Melatonin | Supplement-type substances | Category 1 | Yes, under FDA interim policy | Often bundled in injections. Same claim rules apply. |
| Recommended by FDA advisory committee, not yet lawful | BPC-157 | Peptide | Not on any list. PCAC recommended adding to 503A Bulks List (July 2026); FDA staff recommended against. | No | Advisory vote only. Needs FDA decision and rulemaking, which can take a year or more. |
| Recommended by FDA advisory committee, not yet lawful | TB-500, KPV, MOTS-c, Semax, Epitalon | Peptides | Same as BPC-157. PCAC recommended July 2026. | No | Same as above. Do not offer until FDA finalizes. |
| Not recommended | Emideltide (DSIP) | Peptide | PCAC voted not to recommend (July 2026) | No | |
| Scheduled for FDA advisory review by Feb 2027 | GHK-Cu (injectable), Melanotan II, LL-37 (Cathelicidin), Dihexa, PEG-MGF | Peptides | Not on any list. Nominations withdrawn from Category 2 in 2026; review pending. | No | Removal from Category 2 did not make these compoundable. |
| Category 2 (significant safety risks) | Kisspeptin-10 | Peptide | 503A Category 2 | No | FDA identified significant safety risks. |
| Category 2 (significant safety risks) | Ibutamoren (MK-677) | GH secretagogue (non-peptide) | 503A Category 2 | No | Often sold as research use only. Not for human use. |
| Category 3 (nominated without adequate support) | GHRP-2, GHRP-6, Thymulin, Mechano Growth Factor, Cibinetide (ARA-290) | Peptides | 503A Category 3 | No | Category 3 substances are not covered by the interim policy. |
| Not on any FDA category list | CJC-1295, Ipamorelin, AOD-9604, Thymosin Alpha-1 | Peptides | Not on Category 1, 2, or 3 (FDA list updated May 14, 2026) | No lawful bulk pathway identified | No USP monograph or approved drug component. Still widely marketed; high enforcement risk. Confirm with pharmacy counsel. |
| FDA-approved peptide drugs | Semaglutide | GLP-1 | Approved (Ozempic, Wegovy). Shortage resolved Feb 2025. | Only for documented patient-specific clinical difference; no copies | Warning letters 2025 to 2026. FDA proposed (May 2026) excluding GLP-1s from the 503B bulks list. |
| FDA-approved peptide drugs | Tirzepatide | GLP-1/GIP | Approved (Mounjaro, Zepbound). Shortage resolved Dec 2024. | Only for documented patient-specific clinical difference; no copies | Same as semaglutide. |
| FDA-approved peptide drugs | Liraglutide | GLP-1 | Approved; generics available | Copies restricted | Included in the May 2026 503B proposal. |
| FDA-approved peptide drugs | Tesamorelin, Bremelanotide (PT-141), Oxytocin | Peptides | Approved drugs (Egrifta, Vyleesi, Pitocin) | Possible as component of an approved drug; no copies | Compounded versions must differ for a patient-specific reason. |
| FDA-approved peptide drugs | Sermorelin | GHRH analog | Previously approved (Geref), withdrawn for non-safety reasons | Widely compounded; confirm legal basis | Ask the pharmacy for its legal basis and API source in writing. |
| Category 1 | Under FDA evaluation. 503A pharmacies may compound under FDA's interim policy while the review is pending. | ||||
| Category 2 | Raises significant safety risks. Should not be compounded. | ||||
| Category 3 | Nominated without enough support. Not covered by the interim policy. | ||||
| 503A Bulks List | The final list set by regulation. Advisory committee votes do not add anything to it. | ||||
| Research use only | Peptides labeled research use only and sold for human use are unapproved drugs. | ||||
| 503B facilities | Can only use substances on the 503B bulks list or the FDA drug shortage list. | ||||
| State pharmacy boards | Some states are stricter than FDA. Pharmacies must be licensed in each patient's state. | ||||
| Ask your pharmacy | Get the legal basis, Category status, API source, and certificate of analysis in writing for every product. | ||||
| Sources | FDA, Bulk Drug Substances Nominated for Use in Compounding Under Section 503A (updated May 14, 2026); FDA PCAC meeting, July 23-24, 2026. |