Regulatory reference
Telehealth Compliance Overview Cash-pay, multi-state, async telehealth with products. Current as of October 2026. Orientation only, not legal advice.
General educational information from Camino Strategy Group, LLC, a compliance consulting firm. Not legal advice. Requirements vary by state and change; confirm with qualified healthcare counsel before relying on this material.
Compliance crosswalk Select a category or search any regulation, state variation, risk, or review question. Open a row to see every field.
Structure Corporate practice of medicine (CPOM) Many states bar non-physicians from owning a medical practice or controlling clinical decisions. Usual setup is a physician-owned PC contracting with an MSO. Structure Fee splitting / management fees Limits how the MSO can be paid by the PC. Structure Anti-kickback and self-referral (federal) Federal AKS and Stark apply when federal health care programs are billed. Marketing FTC advertising and health claims Health claims must be truthful and backed by evidence. Testimonials and before-and-after photos must be real and show typical results. Paid endorsements must be disclosed. Marketing FDA claims about compounded drugs Compounded drugs are not FDA approved. Calling them generic or the same as brand drugs is treated as misleading. Marketing Ad platform approval (LegitScript) Google and Meta require LegitScript certification before running telehealth or prescription drug ads. Marketing TCPA and CAN-SPAM (texts, calls, email) Marketing texts and calls need documented prior written consent. Emails need opt-out and sender info. Marketing Affiliates and influencers Paying people for patient referrals can be patient brokering or fee splitting. Licensure State medical licensure Clinicians must be licensed in the state where the patient is located at the time of care. Licensure NP and PA supervision / collaboration States set scope of practice and supervision rules for NPs and PAs. Licensure Malpractice and credentialing Coverage must match every state and service line. Licenses and DEA registrations must be tracked. Async care Provider-patient relationship A valid relationship must exist before prescribing and meet the same standard of care as in person. Async care Telehealth informed consent Patients must consent to telehealth and understand its limits. Async care Identity and location verification Confirms who the patient is and which state they are in. Prescribing DEA / Ryan Haight Act Generally requires an in-person exam before prescribing controlled substances online. Prescribing State controlled substance and PDMP rules States add their own telehealth prescribing limits and PDMP check requirements. Technology / EMR Clinician routing by license and state The EMR should only route a patient to a clinician licensed in the state where the patient is located. Technology / EMR Scope of practice gating Drug and service menus should be limited by clinician type and state. Technology / EMR Collaboration and chart review tracking Many states require documented physician chart review or co-signature for NP or PA care. Technology / EMR Async protocols and auto-approval Async intake can use protocols, but a licensed clinician must make each prescribing decision. Technology / EMR E-prescribing and EPCS Most states require e-prescribing for controlled substances, and some for nearly all prescriptions (e.g., New York). Technology / EMR AI tools in care and messaging States are adding rules on AI in clinical care. Technology / EMR Data location and security HIPAA Security Rule requires a risk analysis, access controls, audit logs, and safeguards like encryption. Technology / EMR Patient access and information blocking Patients have a right to their records, and the Cures Act limits blocking access to electronic health information. Technology / EMR Labs and diagnostics Lab orders need a licensed clinician and a properly licensed lab. Technology / EMR Messaging, escalation, and after-hours Patients need a way to reach a clinician and clear emergency instructions. Technology / EMR Records ownership and portability The PC should own medical records, with the MSO or vendor acting as custodian. Products Compounding (503A vs 503B) 503A pharmacies compound per patient with a prescription. 503B facilities make larger batches under stricter FDA oversight. Products Compounded GLP-1s Shortages for tirzepatide (Dec 2024) and semaglutide (Feb 2025) are over. Copies of approved drugs are not allowed. Products Peptides (BPC-157 etc.) Peptides must be on an allowed list to be compounded. Products Pharmacy licensure and dispensing Pharmacies shipping into a state usually need a nonresident license there. Selling from the practice triggers dispensing rules. Products Supplements and adverse events Supplements follow FDA labeling and FTC claim rules. Serious adverse events should be reported. Pharmacy Pharmacy payments and steering Payments from pharmacies to the practice or MSO for referrals can violate state kickback and fee-splitting laws even with no insurance billed. Payments Subscriptions and auto-renewal Memberships need clear terms, express consent, and easy cancellation. Payments Pricing transparency and Good Faith Estimates Consult, membership, and medication fees should be disclosed separately and accurately. Payments Payment processing and HSA/FSA Telehealth is often classed as high-risk by processors. Privacy HIPAA and BAAs The practice and its vendors handling PHI must follow HIPAA and sign BAAs. Privacy Tracking pixels and analytics Ad pixels on intake, checkout, or portal pages can share health data. Privacy State consumer health data laws Cover health data HIPAA does not, including marketing and website data. Operations Website accessibility (ADA) Sites and intake flows should be accessible. Operations Policies, complaints, and board reporting Written policies, complaint handling, and timely reporting are expected. Operations Clinician compensation How clinicians are paid can create pressure to prescribe. Peptides and compounding A separate substance-level reference based on FDA's 503A category list (updated May 14, 2026) and the July 23–24, 2026 PCAC meeting. Verify before launch; categories change.
Category 1 peptides Glutathione Tripeptide Category 1 peptides GHK-Cu (non-injectable only) Copper peptide Category 1 peptides Vasoactive Intestinal Peptide (VIP) Neuropeptide Category 1 peptides Alanyl-L-Glutamine Dipeptide Other Category 1 (common in longevity, hormone, weight programs) NAD+ and NADH Coenzyme Other Category 1 (common in longevity, hormone, weight programs) Enclomiphene Citrate Hormone modulator Other Category 1 (common in longevity, hormone, weight programs) Methylcobalamin (B12) Vitamin Other Category 1 (common in longevity, hormone, weight programs) 7-Keto DHEA, Pregnenolone Hormone precursors Other Category 1 (common in longevity, hormone, weight programs) Acetyl-L-Carnitine, Alpha Lipoic Acid, CoQ10, L-Citrulline, Melatonin Supplement-type substances Recommended by FDA advisory committee, not yet lawful BPC-157 Peptide Recommended by FDA advisory committee, not yet lawful TB-500, KPV, MOTS-c, Semax, Epitalon Peptides Not recommended Emideltide (DSIP) Peptide Scheduled for FDA advisory review by Feb 2027 GHK-Cu (injectable), Melanotan II, LL-37 (Cathelicidin), Dihexa, PEG-MGF Peptides Category 2 (significant safety risks) Kisspeptin-10 Peptide Category 2 (significant safety risks) Ibutamoren (MK-677) GH secretagogue (non-peptide) Category 3 (nominated without adequate support) GHRP-2, GHRP-6, Thymulin, Mechano Growth Factor, Cibinetide (ARA-290) Peptides Not on any FDA category list CJC-1295, Ipamorelin, AOD-9604, Thymosin Alpha-1 Peptides FDA-approved peptide drugs Semaglutide GLP-1 FDA-approved peptide drugs Tirzepatide GLP-1/GIP FDA-approved peptide drugs Liraglutide GLP-1 FDA-approved peptide drugs Tesamorelin, Bremelanotide (PT-141), Oxytocin Peptides FDA-approved peptide drugs Sermorelin GHRH analog Category 1 Under FDA evaluation. 503A pharmacies may compound under FDA's interim policy while the review is pending. Category 2 Raises significant safety risks. Should not be compounded. Category 3 Nominated without enough support. Not covered by the interim policy. 503A Bulks List The final list set by regulation. Advisory committee votes do not add anything to it. Research use only Peptides labeled research use only and sold for human use are unapproved drugs. 503B facilities Can only use substances on the 503B bulks list or the FDA drug shortage list. State pharmacy boards Some states are stricter than FDA. Pharmacies must be licensed in each patient's state. Ask your pharmacy Get the legal basis, Category status, API source, and certificate of analysis in writing for every product. Sources FDA, Bulk Drug Substances Nominated for Use in Compounding Under Section 503A (updated May 14, 2026); FDA PCAC meeting, July 23-24, 2026. General educational information from Camino Strategy Group, LLC, a compliance consulting firm. Not legal advice. Requirements vary by state and change; confirm with qualified healthcare counsel before relying on this material.
