The structure your lawyer built has to show up on the website.
Almost every national GLP-1 and telehealth brand is two companies wearing one name. There is the business you think of as the brand, and there is a medical practice that actually sees patients and writes prescriptions. The law requires them to be separate, and your healthcare counsel sets that separation up long before anyone opens a design file. What gets missed is that the website is where the two companies meet the public, and a site that quietly contradicts the structure is a problem the structure cannot fix on its own.
This is not a guide to forming the entities. That is counsel's work, and nothing here is legal advice. This is about the part we do own: making the storefront, the intake, the disclosures, the payment, and the state logic reflect the structure accurately, so the website tells the same true story as the paperwork.
What the doctrine actually says, and where it is strict.
The corporate practice of medicine doctrine, usually shortened to CPOM, is state law holding that a general business corporation cannot practice medicine or employ physicians to deliver care. The reason is old and simple: the person making a medical decision should answer to a medical board, not to a shareholder. As the Chapman and Cutler primer puts it, in its simplest terms the doctrine prohibits corporations from practicing medicine or employing a physician to provide professional medical services.
Two things make it hard to reason about. First, it is state specific, built from a patchwork of statute, regulation, case law, and attorney general opinions, so there is no single national rule to point at. The same primer counts a majority of states applying some form of the doctrine and roughly nineteen with no explicit statute, and even some of those use fee-splitting or licensure rules to similar effect. Second, enforcement intensity varies widely. California, New York, and Texas are the usual examples of strong states, where medicine can only be delivered through a professional entity owned by someone licensed there.
It is also getting more attention, not less. Health-law firms describe a 2025 to 2026 enforcement wave, and point to California's SB 351, effective January 1, 2026, as codifying and strengthening the state's position and giving its Attorney General new remedies. The practical read for a founder is that the structure, and the website that sits on it, is a worse thing to improvise now than it was two years ago.
The MSO and friendly PC model, in one paragraph.
The structure that answers the doctrine is the MSO and friendly PC model, and it is worth stating plainly because the whole website design follows from it. A professional corporation, the PC, owned by a licensed physician, holds the clinical license, employs or contracts the providers, and bills for care. A management services organization, the MSO, which is usually the company that built the platform and raised the money, provides everything that is not the practice of medicine, the technology, marketing, scheduling, billing operations, and administration, under a long-term management services agreement, and is paid a fee for it. Patients pay the PC for care; the PC pays the MSO for services. The friendly physician who owns the PC is kept aligned with the MSO through a stock transfer restriction agreement. The line the doctrine draws, in Health Law Alliance's framing, is between administrative support and clinical control: the MSO can run the business side, but it cannot direct how a clinician treats a patient.
Reading the structure off the website.
Here is the part that is actually ours. If you open a well-built telehealth site and read it as a regulator would, the structure is legible without being clumsy about it.
- The brand is the service company. The consumer name, the logo, the marketing voice, that is the MSO. It describes the program and sells the experience.
- A professional entity is named as the medical practice. Somewhere the patient will encounter, usually in the terms, the consents, and the clinical pages, the professional corporation is named, often as a given brand's Medical Group, P.C., and it is identified as the party that evaluates patients and prescribes.
- The providers belong to the PC. Licensed clinicians are presented as practicing through the medical group, not as employees of the brand.
- Consents and the notice of privacy practices name the PC. The clinical relationship, and usually the HIPAA covered entity, is the practice, with the MSO frequently sitting as a business associate. Counsel confirms which is which; the site has to match whatever they say.
- Payment is disclosed for what it is. The MSO commonly bills and collects as the PC's agent. Who the merchant of record is should be a settled answer that the checkout, the receipts, and the policies all agree on.
None of that requires turning the homepage into an org chart. It requires that nowhere on the site does the brand appear to be the thing practicing medicine.
Where the marketing storefront ends and the clinical relationship begins.
Every telehealth funnel has a seam, a point where a visitor stops being a shopper on the MSO's storefront and becomes a patient of the PC. Usually it is the start of intake, where the person begins answering clinical questions that a provider will review. Designing that seam deliberately is most of the job.
Before it, the storefront can do ordinary commerce: explain the program, state eligibility and pricing context, set expectations, and ask for the next step. After it, the experience belongs to the clinical side: the evaluation, the provider's determination, and the prescription if one is appropriate. The mistake is letting the storefront reach across the seam, for example by implying a specific medication is already decided, or by letting marketing copy make the clinical call that only a provider is allowed to make after intake. Health-law commentators list marketing that practices medicine among the ways a compliant structure gets undermined in practice.
Fifty states is a UX problem and a licensing problem at once.
A national offer runs straight into the fact that a provider must be licensed where the patient is, and the professional entity has to be registered where a state requires it. That makes the state question the first real gate in the funnel, not an afterthought at checkout.
In practice the site detects or asks for the patient's state early, and routes them toward a provider licensed there. States the network does not yet cover are handled honestly, with a clear message rather than a payment taken for care that cannot be delivered. The footprint the site advertises has to be the footprint the provider network and the entity registrations actually support, which is a detail counsel and the clinical side own and the site has to mirror exactly. One virtual-care guide goes further and suggests writing the underlying agreement to the most stringent state's requirements when the plan is national, so the structure holds everywhere it operates.
The mistakes that make a compliant structure look noncompliant online.
A real, carefully papered structure can still be made to look like a problem by the website in front of it. The recurring ones are worth naming.
- The brand speaks as the doctor. Copy that says we prescribe, we treat, or we decide, where the business, not the provider, is the subject.
- The medical group is invisible. No professional entity named anywhere, so the site reads as a corporation practicing medicine directly.
- The consents and policies name the wrong party, or name no one, so the document trail does not match the structure.
- The checkout and the clinical relationship disagree about who the patient is paying and who is treating them.
- The advertised states and the states the network can actually serve are not the same, so the funnel sells care it cannot deliver.
Each of these is a site problem, not a structural one, which is the good news: they are fixable in copy, templates, and flow without touching the entities.
A checklist for the website layer.
- Confirm with counsel which entity is the provider of record, which is the merchant and advertiser of record, and which is the HIPAA covered entity, then write those answers down.
- Audit every page for who appears to be practicing medicine. The brand markets; the medical group treats. Fix any copy where the business is the one diagnosing, prescribing, or deciding.
- Name the professional entity and its providers where a patient meets the clinical relationship: terms, consents, the notice of privacy practices, and the clinical pages.
- Design the intake seam on purpose, so the storefront hands off to the clinical evaluation rather than reaching across it.
- Make the state logic a real gate, routing to licensed providers and handling uncovered states honestly.
- Reconcile the site, the LegitScript application, and the merchant account so all three describe the same business.
This is operational and web-architecture guidance, not legal advice, and it does not tell you how to structure your company. The corporate practice of medicine doctrine, the MSO and friendly PC model, the management services agreement, and the fee arrangement are matters for qualified healthcare counsel, and the descriptions here are summaries of published health-law commentary rather than the rules themselves. What ToolBX Media does is the layer on top: building the telehealth and GLP-1 website and the intake and checkout so they reflect the structure counsel designed. The adjacent reviews that read the same site are covered in the web developer's checklist for passing LegitScript the first time and your payment processor scans your site before your first sale, and the tracking that has to stay clean on top of all of it is in HIPAA-compliant attribution for GLP-1 ads. Have counsel review your structure, your pages, and your disclosures before launch.
Common questions
What is the corporate practice of medicine doctrine?
It is a body of state law holding that only licensed physicians, or entities owned by them, may practice medicine, employ physicians to deliver care, or be paid for medical services. The policy behind it, older than telehealth by about a century, is to keep medical decisions accountable to a medical board rather than to shareholders. It is state specific and built from a mix of statute, regulation, case law, and attorney general opinions. A majority of states apply some form of it, and roughly nineteen have no explicit statute, though fee-splitting and licensure rules can create similar limits even there. It is not legal advice to say any of this, and which rules apply to a given business is a question for healthcare counsel.
What is the MSO and friendly PC model?
It is the structure most national telehealth brands run on. A professional corporation, or PC, owned by a licensed physician, holds the clinical license, employs or contracts the providers, and bills for care. A management services organization, or MSO, which is usually the company that raised capital and built the platform, provides the non-clinical work, technology, marketing, billing, scheduling, and administration, under a written management services agreement, and is paid a fee for it. Patients pay the PC for care, and the PC pays the MSO for services. The MSO runs the business and cannot direct how a clinician treats a patient. Counsel forms these entities and writes the agreement; it is not something a website builder sets up.
Whose name goes on a telehealth website, the brand or the medical group?
Both, in their correct roles, and getting this wrong on the page is a common and avoidable problem. The consumer brand is almost always the MSO, and it markets. The medical care is delivered by the professional corporation, often named something like a given brand's Medical Group, P.C. The site should present the brand as the service and marketing company, and clearly disclose the professional entity and its licensed providers as the party that actually evaluates patients and prescribes. A site that reads as though the brand itself practices medicine is describing a structure the doctrine does not allow.
Can the MSO's marketing make treatment claims?
Carefully, and within a real line. Marketing is the MSO's job, but marketing that diagnoses, promises a specific clinical outcome, or tells a visitor which medication they will receive starts to look like the practice of medicine by the business rather than the physician. Health-law commentators list marketing that practices medicine among the structural mistakes that undermine an otherwise compliant arrangement. On the page, that means the storefront can describe the program, eligibility, and process, while the determination of what is appropriate for a given patient belongs to the provider after intake.
How does a fifty state telehealth site handle state licensing?
A provider must be licensed in the state where the patient is located, and the professional entity must be registered where the states require it, so a national offering is both a licensing problem and a user experience problem. Practically, the site detects or asks for the patient's state early, routes them to a provider licensed there, and handles the states the network does not yet cover honestly rather than taking a payment it cannot fulfill. One guide for virtual care companies suggests structuring the underlying agreement to meet the requirements of the most stringent state when the plan is national. The site then has to reflect whatever footprint counsel and the provider network actually support.
Does the MSO and PC structure affect LegitScript and my merchant account?
Yes, because both reviews read your website for a consistent story about who operates the business. If the site, the LegitScript application, and the merchant account describe the brand, the medical group, and who collects payment differently, that inconsistency is itself a finding. Settling which entity is the provider of record, which is the merchant and advertiser of record, and how they are disclosed, and then making every surface agree, is part of the same readiness work as certification and underwriting.
Sources
- Chapman and Cutler LLP, Health Care Regulatory Primer, Management Service Organizations checked 2026-10-07
- Health Law Alliance, Telehealth Companies and the Corporate Practice of Medicine checked 2026-10-07
- Wheel, Guide to the Corporate Practice of Medicine for Virtual Care Companies checked 2026-10-07
- Milbank Memorial Fund, The Corporate Backdoor to Medicine, How MSOs Are Reshaping Physician Practices checked 2026-10-07
Want this costed for your build?
Tell us what you already have and what is not working, and we will come back with the shape of the work and what drives the number.