Digital health and telehealth

Digital health companies deliver medical care through software. They usually operate in many states, and their founders usually incorporate a Delaware C-corporation. None of that changes the law. A lay-owned corporation cannot practice medicine in a corporate-practice state, and a clinician practices wherever the patient happens to be. So the venture-backed technology company almost always takes the role of the management services organization in an MSO-PC structure, and a network of state professional entities delivers the care.

​

The Delaware C-corp question

A Delaware C-corp can be owned by anyone. It is the most popular corporate form in the United States, used by about 90% of new startups and more than 60% of the Fortune 500.¹ The C corp may own the platform, the brand, the data infrastructure, and the non-clinical workforce. It may contract to provide management services, and it may be paid a management fee for them. In a CPOM state, it may not employ the physicians, own the medical practice, or direct clinical judgment. The professional entity is always the one delivering healthcare services. Even in Delaware, which has no meaningful CPOM doctrine, a corporation rendering medical services must be a professional service corporation under 8 Del. C. ch. 6, and its shares may be issued only to individuals licensed in the profession. See Delaware and Who can own a professional entity. Wilson Sonsini’s guidance to digital health investors puts the division plainly: because “the MSO does not perform medical services,” it “can be owned by lay investors,” while ordinary corporations cannot employ physicians in CPOM states.²

​

The structure at scale

Three features set the digital health version apart from a regional medical group’s. The first is one professional entity per state, or close to it. Several states require professional services to be rendered through a domestic entity, and every state’s professional corporation act has its own ownership rules. Groups therefore form a PC or PLLC in each state where they treat patients.² See One PC per state. Whether a PC may own another PC, the so-called “lead PC” shortcut, is a state-by-state question. Nevada, for example, limits professional-entity owners to licensed individuals.³ The second is a single physician-owner across many states. A physician licensed in many states, which the interstate compact makes feasible, commonly owns every PC in the network. This is lawful where each state permits it. It is also the pattern that draws the most scrutiny, because an owner of forty practices who has never met a clinician in thirty-five of them looks like a nominee. The mitigations are described in The friendly PC: documented governance duties, fair-market-value pay for them, and a genuine ability to say no to the MSO. The third is that the MSO is the product. In a conventional MSO the management fee buys billing, HR, and real estate. Here it buys the software the clinicians work in, the patient acquisition funnel, and the data. That makes the question of who controls clinical judgment sharper. A protocol embedded in the intake flow is a clinical protocol, and if the technology company’s product team wrote it without the PC’s medical director approving it, the MSO is practicing medicine through code. The clinical carve-out in the MSA has to reach the product. See What an MSO can and can’t do.

​

Licensure follows the patient

The Federation of State Medical Boards’ position, which the boards have adopted, is that “the practice of medicine occurs where the patient is located … A physician must be licensed, or appropriately authorized, by the medical board of the state where the patient is located.”⁴ A platform serving patients in fifty states needs clinicians licensed in fifty states, and the PC in each state employs or contracts with the clinicians licensed there. The compacts shorten the path without changing the rule. Nurse practitioners deliver much of digital health’s care, and they have no operating multistate compact for advanced practice. Each state license is separate, and so is each state’s collaborative-practice or supervision requirement. Budget for it. Prescribing rules are stricter than practice rules in several states. Arkansas provides that a professional relationship “cannot be established only through: an internet questionnaire.” Indiana excludes internet questionnaires from its definition of telehealth unless a relationship is already established. Texas requires a synchronous audiovisual encounter, store-and-forward with clinically relevant data, or a technology meeting the standard of care to establish the relationship.⁶ An asynchronous-only prescribing product has to be mapped state by state.

​

Rules that expire on dates

Digital health runs on federal flexibilities that have end dates. As of August 2026: The platform-modifier provision deserves attention from every technology-company MSO. From 2027, CMS will be able to identify, claim by claim, which Medicare telehealth services were furnished through a contracted platform. Put that together with OIG’s telemedicine fraud alert and the model becomes visible in the data in a way it never has been. Virtual-only practice locations have their own rule. A practitioner whose only location is home must enroll the home address in PECOS as the practice location. CMS permits flagging it “Home office for administrative/telehealth use only” so the street address is suppressed on Care Compare. Place of service 10 (patient’s home) pays the non-facility rate; POS 02 pays the facility rate.¹⁰

​

The fraud-and-abuse frame

OIG’s July 2022 Special Fraud Alert on “purported telemedicine companies” is the reference document. It lists seven suspect characteristics: patients recruited by telemarketing or advertising for free or low-cost items; practitioners lacking “sufficient contact with or information from the purported patient to meaningfully assess the medical necessity”; compensation “based on the volume of items or services ordered,” possibly disguised as per-record-review pay; serving only federal beneficiaries, or claiming not to while billing them; a single product or product class; and no expectation of follow-up. Those characteristics describe the DME, genetic-testing, and cream schemes behind the annual national takedowns, which charged 324 defendants with $14.6 billion in alleged intended loss in 2025 and 455 defendants with more than $6.5 billion in 2026.¹¹ A legitimate platform shares none of them, and it should be able to show that: real encounters, clinician pay unlinked to what is ordered, a full formulary, and follow-up built in. Paying clinicians for non-encounter work, such as protocol review, asynchronous chart review, and medical direction, is where legitimate platforms most often drift toward the third characteristic. See Draft a medical director agreement.

​

Privacy is a second regulator

Digital health companies have been the FTC’s principal health-privacy targets. GoodRx settled in February 2023 for $1.5 million in the first Health Breach Notification Rule enforcement. BetterHelp settled in 2023 for $7.8 million in consumer refunds and a ban on sharing health data for advertising. Cerebral settled in April 2024 for more than $7 million after data on some 3.2 million people was shared with advertising platforms.¹² The professional entity is a HIPAA covered entity and the MSO is its business associate, and the MSO’s marketing stack is where the FTC cases happened. HHS OCR’s 2022 bulletin on tracking technologies remains in effect except for the portion vacated in American Hospital Association v. Becerra (N.D. Tex. June 20, 2024), which HHS did not appeal.¹³ See HIPAA fundamentals and LLMs and zero data retention.

​

2026: the friendly PC under direct attack

The standard MSO-PC toolkit includes a stock transfer restriction agreement that lets the MSO force the physician-owner to sell to a designated successor. That agreement is now the specific target of state enforcement, and technology companies are the named defendants.

• California. On June 26, 2026 the Attorney General announced a $4.4 million settlement with Carbon Health Technologies, its affiliated professional corporations, and, for $100,000 personally, its co-founder. The complaint alleged a friendly-PC structure in which contracts let the MSO replace physician-owners and the MSO controlled the clinics. The settlement requires restructuring so the MSO cannot control the practices.¹⁴ It followed the AG’s April 2026 amicus brief in Art Center Holdings, Inc. v. WCE CA Art, LLC, which argued that a transfer restriction letting the MSO force divestiture “at any time” means the MSO “effectively owns and controls all aspects of the medical practice,” and the May 2026 Aspen Dental settlement barring the DSO from replacing owners or charging revenue-based fees.¹⁵ SB 351’s enumerated prohibitions apply to any PE- or hedge-fund-involved practice from January 1, 2026. See California.
• Oregon. SB 951 bars MSO owners, officers, and employees from majority ownership of a professional medical entity. It bars de facto MSO control over hiring, compensation, staffing, coding, billing, and payer contracts. It restricts transfer-restriction triggers to a short list (license loss, breach, exclusion, felony indictment, disability, death), and it voids MSO–clinician noncompetes. Telemedicine entities with no physical Oregon location where patients receive clinical services are exempt from the ownership and control-of-equity limits, but not from the rest. New arrangements had to comply by January 1, 2026; pre-existing ones have until January 1, 2029.¹⁶ See Oregon.
• Private enforcement. AAEM Physician Group v. Envision Healthcare (N.D. Cal. No. 22-cv-00421) survived a motion to dismiss on a CPOM theory brought by a competitor. Enforcement is not limited to boards and attorneys general.¹⁷

The lesson for a technology company is not to abandon the structure. The settlements require restructuring, not dissolution. The lesson is to build it so the physician-owner is real: genuinely able to terminate the MSO, not removable at the MSO’s will, paid for governance they actually perform, and in control of the clinical content of the product. See Draft the stock transfer restriction and Run a CPOM self-audit.

​

Medicare, and the ACCESS model

For most of digital health’s history, Medicare was an afterthought; commercial and cash-pay populations were the market. The CMS Innovation Center’s ACCESS Model, which began July 5, 2026, changes that with per-beneficiary outcome-adjusted payments for technology-enabled chronic care. Its eligibility rules are a compact statement of everything above. The participant must be a Part B-enrolled TIN eligible to bill under the Physician Fee Schedule, with a Medicare-enrolled physician medical director, and every treating clinician must be enrolled, reassigned to that TIN, and licensed where the patient is. For a platform in a CPOM state, the participant is the professional entity. See NPI, enrollment, and licensure, the ACCESS reference, and Get a health technology company into Medicare Part B for ACCESS.

​

Sources

1. Carta, Delaware still accounts for 90% of new startup incorporations; Delaware Division of Corporations, About the Division (Fortune 500 share).
2. Wilson Sonsini, The Corporate Practice of Medicine: Essential Guidance for Digital Health Companies and Investors (Mar. 28, 2025); Epstein Becker Green, Corporate Practice of Medicine: The Unseen Hurdle in Telehealth (Feb. 6, 2013).
3. Nev. Rev. Stat. ch. 89 (professional entities). Verify PC-owns-PC permissibility in each state.
4. Federation of State Medical Boards, Report of the Workgroup on Telemedicine (Apr. 2022); FSMB, Telemedicine Policies: Board-by-Board Overview.
5. Interstate Medical Licensure Compact Commission, imlcc.com; member count as of July 2026 from secondary reporting; verify on the Commission’s map. Nurse Licensure Compact: nursecompact.com. PSYPACT: psypact.gov.
6. Ark. Code § 17-80-402; Ind. Code § 25-1-9.5-6; Tex. Occ. Code § 111.005. Center for Connected Health Policy, Online prescribing (state summaries).
7. Consolidated Appropriations Act, 2026, Pub. L. 119-75, § 6209 (Feb. 3, 2026), amending 42 U.S.C. § 1395m(m). Enrolled text; CMS, Telehealth FAQ (updated Feb. 26, 2026).
8. DEA and HHS, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, 90 Fed. Reg. 61301 (Dec. 31, 2025); Special Registrations for Telemedicine, 90 Fed. Reg. 6541 (Jan. 17, 2025) (proposed). Holland & Knight, DEA and HHS Extend Telemedicine Prescribing Flexibilities Through 2026 (Jan. 2026).
9. CMS, CY 2026 Physician Fee Schedule final rule (Nov. 5, 2025); 42 C.F.R. § 410.32(b)(3)(ii).
10. CMS Telehealth FAQ (Feb. 26, 2026), Q15; Alliance for Connected Care, Provider location.
11. HHS OIG, Special Fraud Alert: Purported Telemedicine Companies (July 20, 2022); CMS, National Health Care Fraud Takedown results in 324 defendants charged (June 30, 2025); HHS OIG, 2026 National Health Care Fraud Takedown (June 23, 2026).
12. FTC, GoodRx (Feb. 1, 2023); BetterHelp (July 2023); Cerebral (Apr. 15, 2024).
13. HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (Dec. 1, 2022, rev. Mar. 18, 2024); American Hospital Association v. Becerra, No. 4:23-cv-01110 (N.D. Tex. June 20, 2024); Quarles, HHS Tracking Technology Guidance Vacated.
14. California Attorney General, Settlement with Carbon Health (June 26, 2026).
15. California Attorney General, Amicus brief, Art Center Holdings (Apr. 1, 2026); Hooper Lundy, California Attorney General Blasts Share Transfer Restriction Agreements (Apr. 22, 2026); California Attorney General, Aspen Dental settlement (May 7, 2026).
16. Or. S.B. 951 and H.B. 3410 (2025). Nixon Peabody, Oregon SB 951 explained (July 11, 2025); Foley & Lardner, Oregon’s New CPOM Restrictions: Five Takeaways for Digital Health (June 17, 2025).
17. Nossaman, A Friendly Reminder: Friendly PC Arrangements are Subject to Scrutiny (June 20, 2022), discussing AAEM Physician Group v. Envision Healthcare, No. 22-cv-00421 (N.D. Cal.).