What an MSO can and can't do

An MSO may provide any non-clinical service a business needs: space, equipment, technology, non-clinical staff, marketing, finance, and billing support. It may not, in states with a corporate practice of medicine doctrine, employ clinicians to practice, own medical records, set clinical protocols, control clinical staffing, direct coding, or take fees that amount to profit-sharing. The line between the columns is where compliance actually happens.

​

The two columns

The prohibited column is not generic. It closely tracks the functions California’s SB 351 enumerates, determining appropriate diagnostic tests, determining referral necessity, being responsible for overall patient care, and setting how many patients a physician sees or how many hours they work, plus a separate bar on management entities participating in billing, coding, equipment selection, and clinical staff oversight.¹ Oregon’s SB 951 reaches MSO control over scheduling, clinician compensation, coding, billing, and payer contract terms.² Legislatures wrote lists because “the MSO shall not interfere with clinical judgment” wasn’t constraining anyone’s behavior.

​

The load-bearing word: support

Notice that billing and payer contracting appear in both columns, distinguished only by support versus control. This is the most operationally important distinction in the whole model, and it is where most real practices sit: Coding is the one people get wrong most often. Assigning a diagnosis or procedure code is an exercise of clinical judgment about what was medically done and why. The MSO can employ certified coders, provide the software, and run the workflow, but the MSA should state that coding responsibility rests with the PC, and clinicians must have genuine authority to reject a coding change. See Run a CPOM self-audit.

​

The gray zone, honestly described

Some questions have no clean answer, and pretending otherwise is worse than admitting it. These are the ones that come up in every real engagement: Scheduling policy. The MSO clearly can operate the schedule. Can it set a policy that appointments are 20 minutes? That looks like an administrative efficiency decision, and it also looks like determining how much time a clinician spends with a patient, which California’s statute names. The defensible version: the PC sets clinical time standards; the MSO implements them and reports on adherence. Collections policy. Can the MSO decide when a patient goes to collections? Mostly administrative, but it affects the patient relationship and, at the margin, access to care. Best practice is PC approval of the policy, MSO execution of it. Clinical protocols in software. If the MSO licenses an EHR with embedded clinical decision support, has the MSO set clinical protocols? Generally no, but if the MSO configures order sets, formularies, or care pathways, the answer gets less clear. Have the PC approve clinical configuration. AI tooling. The sharper modern version of the same question. An MSO-built model that suggests codes a clinician reviews is support; one that assigns them is the MSO determining coding, a function both California’s SB 351 and Oregon’s SB 951 name explicitly. See LLMs, zero data retention, and HIPAA. Marketing. The MSO can market the practice. But website copy saying “our physicians provide expert care” under the MSO’s name edges toward the MSO holding itself out as a provider. Market the practice, using the practice’s name. Recruiting. The MSO can source and screen clinical candidates. The hiring decision must be the PC’s, and it must be real, documented, with the clinician-owner or a clinical leader actually deciding. Quality metrics. The MSO can measure and report. When metrics drive compensation or retention, they start to influence clinical behavior. Keep clinical quality standards owned by the PC. Equipment selection. Purely administrative for furniture; clinical for a laser or an imaging device. California’s SB 351 names equipment selection specifically. Let the PC specify clinical equipment; the MSO procures it.

​

What varies by state

The columns above describe strict-state analysis. In permissive states the prohibited column shrinks substantially, and in a handful of states it barely exists for medicine. But three considerations argue for building to the strict standard anyway:

1. You will expand. Rebuilding governance for state four is harder than building it right at state one.
2. The law is tightening, not loosening. Oregon, California, and Vermont all moved toward restriction in 2025–2026, and pre-existing arrangements are not permanently grandfathered — Oregon’s deadline for them is January 1, 2029.³
3. Diligence applies the strict standard. Acquirers and investors underwrite the worst-case jurisdiction.

​

The five bright lines

If you remember nothing else:

1. The PC employs the clinicians.
2. The PC owns the medical records.
3. The PC controls its own bank account and receipts.
4. The PC makes every clinical decision, including coding.
5. The fee is a price for services, not a claim on profit.

Hold those five and most gray-zone questions resolve themselves.

​

Sources

1. Cal. S.B. 351 (2025), effective January 1, 2026. Summaries: Benesch, California Enacts SB 351; Quarles, California Cracks Down.
2. Or. S.B. 951 (2025 Reg. Sess.). Enrolled bill.
3. Holland & Knight, An Update on the Implementation and Implications of Oregon’s New CPOM Laws (May 2026).