Corporate practice of medicine states in 2026: the full list

Statute

Some states wrote the prohibition into the medical practice act or the professional corporation statute.

• California and Texas are the usual examples.
• Statutory states are predictable: the text says who may own a professional entity and who may employ a physician.
• They are also the states most likely to add rules, as Oregon and California did in 2025.

Attorney general opinions and board positions

In other states the statute is silent or vague and the real authority is an attorney general opinion or a medical board position statement.

North Carolina, Michigan and New Jersey lean on these. They can be as strict as a statute but are enforced through licensing discipline rather than courts.

Case law

A third group rests on court decisions, sometimes decades old, holding that a lay corporation cannot practice medicine.

Illinois and Colorado fall here. These carry the most uncertainty because the rule has never been tested against a modern telehealth MSO, so counsel advises conservatively.

Nothing, or almost nothing

A number of states have no general prohibition.

That does not mean anything goes: licensing rules, fee-splitting bans, anti-kickback statutes and, in Florida, the Health Care Clinic Act still apply. It means ownership is not the first thing a regulator looks at.

Strong

A clear prohibition in statute, binding board rule or well-established case law, with active enforcement or recent legislation.

Lay ownership of the professional entity is not an option and management agreements are scrutinized for control.

Moderate

A recognized prohibition with meaningful exceptions, limited enforcement history, or rules that focus on specific arrangements such as fee-splitting rather than ownership as such.

A compliant MSO structure is still expected.

Limited or unsettled

Either a narrow rule, or a doctrine whose status is unclear because the authority is old, implied or never enforced.

Counsel usually recommends the MSO structure anyway because the downside of guessing wrong is a licensing problem for every provider in the state.

None

No general prohibition identified by either guide.

Fee-splitting, kickback and clinic-licensing rules may still apply, and Florida is the clearest case of a state with no CPOM doctrine but a licensing regime that bites non-physician-owned clinics.

What the MSO may do

Build and run the platform, acquire patients, run the storefront, bill as merchant of record, handle non-clinical HR, hold the software contracts, and charge a management fee.

In most states the fee should be fair market value for services rendered rather than a percentage of professional revenue.

What the MSO may not do

Decide who gets prescribed what, set clinical protocols, hire or fire physicians for clinical reasons, own the medical records, or hold a veto over the PC's clinical decisions.

Oregon's SB 951 and California's SB 351 turned this list into enforceable statute in 2025.

Why one structure for all 50 states

The 12 strong states include California, Texas, New York, Illinois and New Jersey.

• Any national brand is in some of them, so the structure has to satisfy them anyway.
• A looser structure in the 14 no-prohibition states saves little and adds entities to maintain.
• Our guide to the model is at /blog/telehealth-compliance-mso-model-guide, and a review of MSO providers is at /blog/telehealth-mso-companies.

Oregon SB 951 (2025, Chapter 295)

Per the Oregon Legislature's measure record, SB 951 prohibits an MSO, and its shareholders, directors, officers, employees and contractors, from owning or controlling, serving as a director or officer of, working for, or managing a professional medical entity the MSO has a management contract with.

• It defines ownership and control, voids certain noncompetition, nondisclosure and nondisparagement agreements with medical professionals, treats violations as unlawful trade practices, and gives professional entities and licensees a right to sue.
• It carried an emergency clause, so it took effect on passage.
• The friendly-physician-as-MSO-employee pattern is exactly what it targets.

California SB 351 (Chapter 409, Statutes of 2025)

Governor Newsom's October 6, 2025 legislative update lists SB 351 (Cabaldon, Health facilities) among the bills signed; it chaptered the same day and took effect January 1, 2026.

The law bars private equity groups and hedge funds from interfering with the clinical decisions of physicians and dentists in practices they invest in, including diagnostic tests, referrals, patient volume and hours, and from controlling hiring and coding and billing. It voids contract terms that permit that conduct or impose noncompete or nondisparagement clauses, and gives the Attorney General authority to seek injunctive relief and fees.

Fee-splitting

Separately from CPOM, many states prohibit a licensee from splitting professional fees with an unlicensed person.

• New York and California have long-standing statutes, and several strong and moderate states treat a percentage-of-revenue management fee as a fee split.
• The practical test is whether the MSO's compensation is a fair market value fee for defined services.
• Flat or cost-plus fees are easier to defend than a revenue percentage.

You own the brand, the customers and the data

The client is merchant of record and owns its patients, records and data with export at any time.

There is no revenue share and no exit or termination fee; the fee is a flat platform fee scoped at onboarding, with 0% medication markup and month-to-month terms after onboarding. That is a services fee, not a share of professional revenue.

Clinical decisions stay with licensed providers

Care is delivered by the Provider Network's 2,400+ board-certified MD, DO, NP and PA providers across all 50 states, credentialed to NCQA standards with monthly OIG and SAM exclusion screening, and covered by occurrence-based malpractice insurance with $1 million per occurrence and $6 million aggregate limits.

OrbitOS keeps a full HIPAA audit trail of every encounter and prescription.

The compliance stack behind the structure

HIPAA compliant with a BAA in every contract, SOC 2 Type II, EPCS with two-factor identity proofing, and a LegitScript-certified pharmacy network.

50+ digital clinics run on the platform. Before signing with any vendor, including us, run the questions in /blog/telehealth-vendor-due-diligence-checklist and ask to see the structure documents.