> ## Documentation Index
> Fetch the complete documentation index at: https://mso.getlemma.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What an MSO can and can't do

> The two-column mental model of permitted and prohibited management company functions, plus an honest account of the gray zone between them.

An **MSO** may provide any non-clinical service a business needs: space, equipment, technology, non-clinical staff, marketing, finance, and billing support. It may not, in states with a corporate practice of medicine doctrine, employ clinicians to practice, own medical records, set clinical protocols, control clinical staffing, direct coding, or take fees that amount to profit-sharing.

The line between the columns is where compliance actually happens.

## The two columns

| ✅ An MSO can                                                              | ❌ An MSO cannot (in CPOM states)                 |
| ------------------------------------------------------------------------- | ------------------------------------------------ |
| Own and provide the premises                                              | Employ clinicians to practice medicine           |
| Own and provide equipment and supplies                                    | Own or control the medical records               |
| Employ non-clinical staff, front desk, billing, admin, finance, marketing | Hire, fire, or discipline clinical staff         |
| License the EHR and technology                                            | Set clinical protocols or standards of care      |
| Provide billing and collection **support**                                | Determine diagnosis or procedure codes           |
| Provide payer contracting **support**                                     | Determine which diagnostic tests are appropriate |
| Provide accounting, HR, legal, and finance functions                      | Determine whether a referral is needed           |
| Market the practice                                                       | Set patient volume quotas or visit lengths       |
| Own the brand and license it to the PC                                    | Set the clinician's working hours                |
| Provide non-clinical training                                             | Be responsible for overall patient care          |
| Negotiate vendor contracts                                                | Control the PC's bank account or receipts        |
| Provide data analytics and reporting                                      | Take a fee that amounts to profit-sharing        |
| Provide compliance program **infrastructure**                             | Hold itself out as providing medical care        |

The prohibited column is not generic. It closely tracks the functions **California's SB 351** enumerates, determining appropriate diagnostic tests, determining referral necessity, being responsible for overall patient care, and setting how many patients a physician sees or how many hours they work, plus a separate bar on management entities participating in billing, coding, equipment selection, and clinical staff oversight.<sup>1</sup> **Oregon's SB 951** reaches MSO control over scheduling, clinician compensation, coding, billing, and payer contract terms.<sup>2</sup>

Legislatures wrote lists because "the MSO shall not interfere with clinical judgment" wasn't constraining anyone's behavior.

## The load-bearing word: *support*

Notice that billing and payer contracting appear in **both** columns, distinguished only by *support* versus *control*.

This is the most operationally important distinction in the whole model, and it is where most real practices sit:

| Function              | ✅ Support                                                                            | ❌ Control                                                            |
| --------------------- | ------------------------------------------------------------------------------------ | -------------------------------------------------------------------- |
| **Billing**           | MSO employs the billers, licenses the system, runs the workflow, reports the metrics | MSO decides what codes get assigned, or overrides clinician coding   |
| **Payer contracting** | MSO analyzes rates, prepares applications, negotiates terms, manages the process     | MSO signs the contracts, or binds the PC without the PC's authority  |
| **Clinical staffing** | MSO recruits candidates, runs HR processes, handles onboarding logistics             | MSO decides who is hired or fired as a clinician                     |
| **Scheduling**        | MSO provides the scheduling system and staff who operate it                          | MSO sets how many patients per hour a clinician must see             |
| **Quality**           | MSO provides data, dashboards, and administrative support for peer review            | MSO sets clinical quality standards or conducts clinical peer review |

**Coding is the one people get wrong most often.** Assigning a diagnosis or procedure code is an exercise of clinical judgment about what was medically done and why. The MSO can employ certified coders, provide the software, and run the workflow, but the MSA should state that coding responsibility rests with the PC, and clinicians must have genuine authority to reject a coding change. See [Run a CPOM self-audit](/guides/compliance/run-a-cpom-self-audit).

## The gray zone, honestly described

Some questions have no clean answer, and pretending otherwise is worse than admitting it. These are the ones that come up in every real engagement:

**Scheduling policy.** The MSO clearly can operate the schedule. Can it set a policy that appointments are 20 minutes? That looks like an administrative efficiency decision, and it also looks like determining how much time a clinician spends with a patient, which California's statute names. The defensible version: the **PC** sets clinical time standards; the MSO implements them and reports on adherence.

**Collections policy.** Can the MSO decide when a patient goes to collections? Mostly administrative, but it affects the patient relationship and, at the margin, access to care. Best practice is PC approval of the policy, MSO execution of it.

**Clinical protocols in software.** If the MSO licenses an EHR with embedded clinical decision support, has the MSO set clinical protocols? Generally no, but if the MSO configures order sets, formularies, or care pathways, the answer gets less clear. Have the PC approve clinical configuration.

**AI tooling.** The sharper modern version of the same question. An MSO-built model that *suggests* codes a clinician reviews is support; one that *assigns* them is the MSO determining coding, a function both California's SB 351 and Oregon's SB 951 name explicitly. See [LLMs, zero data retention, and HIPAA](/concepts/compliance/llms-and-zero-data-retention).

**Marketing.** The MSO can market the practice. But website copy saying "our physicians provide expert care" under the MSO's name edges toward the MSO holding itself out as a provider. Market **the practice**, using the practice's name.

**Recruiting.** The MSO can source and screen clinical candidates. The **hiring decision** must be the PC's, and it must be real, documented, with the clinician-owner or a clinical leader actually deciding.

**Quality metrics.** The MSO can measure and report. When metrics drive compensation or retention, they start to influence clinical behavior. Keep clinical quality standards owned by the PC.

**Equipment selection.** Purely administrative for furniture; clinical for a laser or an imaging device. California's SB 351 names equipment selection specifically. Let the PC specify clinical equipment; the MSO procures it.

<Tip>
  The reliable test in every gray case: **who decides, and who merely implements?** An MSO that provides options, data, and execution while the PC decides is on solid ground. An MSO that decides and informs the PC is not, regardless of what the MSA says.
</Tip>

## What varies by state

The columns above describe strict-state analysis. In permissive states the prohibited column shrinks substantially, and in a handful of states it barely exists for medicine.

But three considerations argue for building to the strict standard anyway:

1. **You will expand.** Rebuilding governance for state four is harder than building it right at state one.
2. **The law is tightening, not loosening.** Oregon, California, and Vermont all moved toward restriction in 2025–2026, and pre-existing arrangements are not permanently grandfathered — Oregon's deadline for them is January 1, 2029.<sup>3</sup>
3. **Diligence applies the strict standard.** Acquirers and investors underwrite the worst-case jurisdiction.

## The five bright lines

If you remember nothing else:

1. **The PC employs the clinicians.**
2. **The PC owns the medical records.**
3. **The PC controls its own bank account and receipts.**
4. **The PC makes every clinical decision, including coding.**
5. **The fee is a price for services, not a claim on profit.**

Hold those five and most gray-zone questions resolve themselves.

## Sources

1. Cal. S.B. 351 (2025), effective January 1, 2026. Summaries: Benesch, [California Enacts SB 351](https://www.beneschlaw.com/insight/california-enacts-sb-351-new-restrictions-on-private-equity-and-hedge-fund-involvement-in-physician-and-dental-practices/); Quarles, [California Cracks Down](https://www.quarles.com/newsroom/publications/california-cracks-down-new-laws-governing-the-corporate-practice-of-medicine-and-pe-deals).
2. Or. S.B. 951 (2025 Reg. Sess.). [Enrolled bill](https://olis.oregonlegislature.gov/liz/2025r1/Downloads/MeasureDocument/SB951).
3. Holland & Knight, [An Update on the Implementation and Implications of Oregon's New CPOM Laws](https://www.hklaw.com/en/insights/publications/2026/05/an-update-on-the-implementation-and-implications-of-oregons) (May 2026).


## Related topics

- [Run a CPOM self-audit](/guides/compliance/run-a-cpom-self-audit.md)
- [Draft the management services agreement (MSA)](/guides/agreements/draft-a-management-services-agreement.md)
- [The corporate practice of medicine doctrine](/concepts/model/cpom.md)
- [The friendly PC, explained](/concepts/model/the-friendly-pc.md)
- [Fee-splitting rules, explained](/concepts/model/fee-splitting.md)
- [MSA clause anatomy](/reference/legal/msa-clause-anatomy.md)
- [California — CPOM & MSO reference](/reference/legal/states/california.md)