Here's the blunt answer: a lot of physician-led startups don't fail because the idea is bad. They fail because the structure is bad. Specifically, they run straight into Corporate Practice of Medicine rules, or CPOM, and only realize it after they've raised money, hired people, signed payer contracts, or launched in the wrong state.
I've seen this movie before. Smart doctor founders build a telehealth platform, DPC model, AI triage tool, or specialty network, then a healthcare lawyer says the sentence nobody wants to hear: "You can't have the company set up that way." Suddenly the cap table is a problem. The employment model is a problem. The revenue model is a problem. Sometimes the whole thing has to be rebuilt.
This article is for the physician who wants to build something real without stepping on a regulatory landmine.
This content is for educational purposes only. It is not financial advice, not legal advice, and not tax advice; figures vary, and you should consult a qualified professional.
What Are Corporate Practice of Medicine (CPOM) Rules?
CPOM is the legal doctrine that says lay entities, meaning non-physicians or non-professional business corporations, can't employ physicians to practice medicine or control medical judgment. That's the core idea. Clean and brutal.
The policy reason is straightforward: medicine is supposed to be directed by physicians, not by investors, operators, software managers, or growth teams trying to hit quarterly targets. The law is trying to protect independent medical judgment and patient trust. And frankly, that concern isn't crazy. If you let non-clinical owners dictate care, bad incentives show up fast.
The doctrine goes back to the late 19th century, when states started drawing a line between professional services and ordinary commerce. Medicine wasn't supposed to be just another retail product. You can disagree with how the rule works today, but the original logic was to stop business owners from turning doctors into employees who answer to sales pressure instead of patients.
What makes CPOM so frustrating is that it's not one national rule. It's a state-by-state patchwork.
A few broad buckets:
- Strict states: California, Texas, New York, and several others take CPOM seriously.
- Moderate states: Some states allow more operational flexibility but still restrict lay control over physician employment or clinical decisions.
- Exception-heavy states: Others carve out exceptions for hospitals, academic systems, or certain practice models.
That variation matters more than most founders realize. A structure that's tolerated in one state may be dead on arrival in another.
For more on employment constraints, see: Why Your Noncompete Can Stall Your Startup Timeline (https://residencyadvisor.com/resources/medical-startups/why-your-noncompete-can-stall-your-startup-timeline-and-what-to-do).
Physicians launching telehealth startups can also benefit from Top 10 Tips for Physicians to Successfully Launch Medical Startups (https://residencyadvisor.com/resources/medical-startups/10-essential-tips-for-physicians-launching-medical-startup).
For startups, the trigger is usually one of these:
- non-physician ownership of the practice entity
- non-physician employment of physicians
- investor or operator control over clinical protocols
- compensation tied too closely to professional fee generation
- technology or workflow design that effectively overrides physician judgment
That last point is where digital health founders get sloppy. They think, "We're just a platform." Maybe. But if your app tells doctors what to do, limits treatment options, routes patients based on revenue priorities, or pressures clinicians to follow business rules over medical judgment, CPOM concerns show up fast.
The practical takeaway: if a non-physician-controlled company is too close to the actual delivery of medical care, CPOM is going to be one of your first real legal problems.
How CPOM Rules Specifically Block Physician-Led Startups
CPOM doesn't just create abstract legal risk. It blocks very specific startup models.
1) Direct employment models
This is the classic mistake.
A founder raises money into a Delaware C-corp, then has that company hire physicians. In many states, that's illegal if non-physicians own or control the entity. It doesn't matter that the founder is a doctor. If the company itself is lay-owned or investor-controlled, you've got a CPOM problem.
2) Telehealth platforms
Telehealth founders hit this wall constantly.
The platform wants to hire doctors directly, standardize care, push scheduling, and scale across states. Fine in theory. Not fine under CPOM in many states. The usual fix is a physician-owned Professional Corporation, or separate PCs in each relevant state, employing the clinicians while the platform company handles technology and operations through an MSO arrangement.
That sounds annoying because it is annoying. But it's how serious telehealth businesses survive.
3) Direct Primary Care models
DPC founders often assume that because they're subscription-based and may avoid insurance billing, CPOM is somehow less relevant. Wrong.
If non-physician investors own the entity delivering care, or if the management company effectively controls the physicians through pricing, staffing, visit rules, panel size, or clinical workflow mandates, you can still have a CPOM issue. DPC does not get a magic exemption from basic ownership and control rules.
4) AI diagnostics and clinical decision support
This area is getting messy fast.
If your startup builds AI that merely supports physicians, that's one thing. If your startup uses algorithms to direct diagnosis, constrain treatment options, or pressure doctors to accept machine-generated recommendations because the company controls throughput, reimbursement, or quality metrics, CPOM starts lurking in the background.
The legal issue isn't "AI is illegal." It's whether lay owners are controlling medical judgment through the product. Different wrapper. Same old problem.
5) Staffing and locum tenens
Agencies and placement models have their own danger zone:
- controlling physician schedules too aggressively
- setting compensation in ways that look like fee-splitting
- influencing patient assignments based on revenue
- acting like the real employer while pretending not to be
I've seen founders assume they can solve CPOM with the phrase "independent contractor." No. Labels don't save bad structures. Regulators look at who actually controls the work.
The ugly consequences of getting this wrong:
- contracts that are void or voidable
- payer enrollment problems
- medical board scrutiny
- allegations of unlicensed practice
- fee-splitting claims
- financing and acquisition headaches later
That last one matters. Bad structures don't just create legal risk; they wreck exits. Diligence teams hate discovering your growth model was technically noncompliant for three years.
Navigating the Legal Maze: Strategies for Compliant Innovation
Here's the good news: CPOM doesn't mean "don't build." It means "build correctly."
The most common compliant structure is the MSO-PC model.
The basic structure
- Professional Corporation (PC): owned by physician(s), holds the clinical side, employs physicians, and controls medical decisions.
- Management Services Organization (MSO): owned by non-physicians and/or investors, provides non-clinical services like billing, marketing, IT, recruiting, scheduling support, analytics, and office operations.
That separation is the whole game.
What the PC must control
The PC should control:
- hiring and firing of clinicians
- supervision of medical staff
- diagnosis and treatment decisions
- clinical protocols
- patient records access rules
- quality-of-care standards
- physician compensation for professional services, subject to applicable law
If the MSO is really making those calls, your "compliant structure" is just a costume.
What the MSO can do
The MSO can usually handle:
- branding and non-clinical marketing
- tech platform development
- revenue cycle support
- office leasing and equipment
- staffing for non-clinical personnel
- bookkeeping and HR administration
- analytics and operational dashboards
This is how venture-backed digital health companies usually thread the needle. Investors buy into the MSO. Physicians own the PC. Everyone signs detailed contracts. Everyone pretends they love the complexity. Welcome to healthcare.
Fee-splitting is the next trap
Even if you solve CPOM structurally, you can still create a fee-splitting problem if the MSO is paid in a way that improperly ties its compensation to professional medical revenue.
The safest approach is usually:
- compensation based on fair market value
- clearly defined administrative services
- documented methodology
- no stealth control over medical income streams
A pure percentage-of-revenue model can be a problem in some states. Sometimes it's workable with careful structuring. Sometimes it's dumb and risky. Don't assume your startup lawyer from a generic tech firm understands the difference. You need healthcare counsel.
Independent contractor models
Some founders try using independent contractors instead of employee physicians. That can reduce CPOM exposure in certain situations, but only if the facts support real independence.
Ask yourself:
- Who controls the physician's schedule?
- Who sets the clinical rules?
- Who decides what patients are seen and how?
- Who controls charting standards?
- Who can terminate the relationship, and for what?
If the startup controls everything but calls the doctor a contractor, that's fake independence. Regulators aren't that gullible.
Joint ventures and PPMC models
There are also more advanced structures:
- physician-owned PC leasing space and services from an MSO
- hospital or health-system joint venture
- physician practice management company, or PPMC, model
- state-specific "friendly PC" structures where legally permitted and carefully documented
These can work. They can also blow up if they're too aggressive, especially when control rights are buried in financing documents, IP licenses, restrictive covenants, or management agreements.
That's the part founders miss. CPOM analysis doesn't stop at the org chart. Lawyers will read:
- equity documents
- board control provisions
- veto rights
- service agreements
- employment agreements
- IP ownership
- compensation models
If your investor can't directly own the practice but can effectively choke it through contracts, that still looks bad.
My practical rule
If a non-physician can force a clinical result, discipline a physician for independent judgment, or capture medical revenue by controlling the doctor, the structure is wrong. Fix it before launch, not during enforcement.
State-by-State Differences: Why One Size Doesn't Fit All
This is where founders get overconfident. They hear one company did something in Florida and assume they can copy-paste it into California. Absolutely not.
Broadly:
- Strict CPOM states: California, Texas, New York, Illinois, Colorado
- More moderate states: Ohio, Florida, Pennsylvania, Washington, Massachusetts
- Exception-driven states: some allow special rules for hospitals, academic systems, or legacy arrangements
The pattern in strict states is simple: physician ownership and physician control matter. A lot. In moderate states, there may be more room for operational flexibility, but lay entities still usually can't cross the line into employing physicians to practice medicine or directing care.
Cross-state telehealth makes this worse. If you provide care to patients in a strict CPOM state, you often need a compliant entity in that state, even if your company is headquartered somewhere more relaxed. Your Delaware paperwork won't save you from California medicine law.
Use charts like this as a rough strategic map, not legal gospel. The actual answer depends on statutes, attorney general opinions, medical board positions, and case law. Which is lawyer territory, not founder guesswork.
Real-World Examples: Physician-Led Startups That Overcame CPOM
Here's what workable models actually look like.
Example 1: Multi-state telemedicine platform
A telemedicine company wanted to operate in eight states, including California and Texas. The VC money went into a central MSO that owned the software, brand, call center functions, recruiting support, and billing infrastructure. Each state had a physician-owned PC or affiliated professional entity employing licensed local physicians.
Why it worked:
- local physician entity employed the doctors
- local entity controlled care delivery
- MSO handled tech and operations
- agreements were built to preserve physician clinical authority
Was it administratively messy? Yes. Was it compliant enough to scale and raise capital? Also yes.
Example 2: Direct Primary Care chain
A DPC group wanted subscriptions, multiple locations, and outside capital. They didn't put investors into the practice entity. Instead:
- physicians formed the PC
- a separate company handled management and certain non-clinical assets
- office space and services were leased on documented terms
- non-MD investors came in as minority investors on the business side, not the clinical side
That distinction matters. A lot of DPC founders get cute with "we're not billing insurance, so normal rules don't apply." Bad instinct. This group didn't do that. They respected the line and kept growing.
Example 3: AI clinical decision support startup
This company built software for specialty practices. It did not hire doctors to deliver care. It licensed software to physician-owned practices and health systems. The physicians decided whether to use the recommendations and retained final authority over diagnosis and treatment.
Why that was smart:
- no direct employment of physicians by the startup
- no claim that software replaced medical judgment
- commercial relationship stayed vendor-to-practice
- product positioned as support, not control
That last point is huge for AI founders. If your pitch deck says "we replace doctor decision-making," your regulatory lawyer is already tired.
Common lessons
Every compliant success story tends to share the same moves:
- separate medical and business entities
- preserve physician control over clinical decisions
- document arm's-length relationships
- avoid sloppy compensation structures
- plan for state-specific expansion before launch, not after
This isn't glamorous work. It doesn't make the demo prettier. But it's the difference between a real company and a compliance mess wearing scrubs.
What to Do Now: A Step-by-Step Action Plan for Physician Entrepreneurs
If you're building now, here's the practical playbook.
1) Hire a healthcare attorney early
Not your friend from big law who does SaaS deals. Not your cousin who closed a restaurant acquisition. A real healthcare regulatory attorney with CPOM experience in your target states.
Do this before you raise money if possible. Fixing the cap table after the fact is expensive and embarrassing.
2) Map every state where you'll operate
Look at:
- where patients will be located
- where physicians will be licensed
- where the practice entity will be formed
- where marketing and intake occur
- where professional services are deemed delivered
For telehealth, the patient's state matters. Founders forget this constantly.
3) Choose the right structure
Usually this means one of:
- PC + MSO
- state-by-state affiliated PCs
- hospital or health-system joint venture
- carefully designed contractor model, if allowed and factually supportable
Most physician startups with outside capital end up in some MSO-PC variation. That's not because lawyers are boring. It's because the model works.
4) Draft the right agreements
At minimum, expect to need:
- management services agreement
- physician employment agreements
- independent contractor agreements, if used
- IP licensing documents
- governance documents
- space/equipment lease arrangements
- compensation methodology support
And yes, the details matter. "We'll keep medical decisions with the doctors" means nothing if the contract quietly gives the MSO veto rights over staffing, scheduling, or protocols.
5) Build compliance into operations
Don't stop at formation documents. You need operational discipline.
Track and document:
- fair market value support for MSO fees
- separation of clinical and business authority
- meeting minutes and governance decisions
- physician supervision structures
- quality oversight by the PC
- state-specific licensure and registration status
I've seen companies with pretty legal documents and terrible actual practices. That doesn't hold up.
6) Join the adults in the room
If you care about long-term reform, get involved with:
- state medical societies
- specialty associations
- digital health trade groups
- physician entrepreneur networks
CPOM reform won't happen because startup Twitter is annoyed. It happens when organized groups push for narrow, workable changes.
The Future: Will CPOM Rules Evolve?
Yes, but slowly. Painfully slowly.
There's real pressure for reform:
- physician shortages
- consumer demand for digital access
- value-based care models
- integrated care delivery needs
- AI-enabled workflow changes
Some states have already loosened parts of the system, especially around telehealth and DPC-adjacent models. COVID-era waivers also showed that regulators can be flexible when they want to be. But don't expect a federal rescue. Broad federal preemption is unlikely.
Organized medicine still defends CPOM for one central reason: physician autonomy. And honestly, they're not wrong to worry. If you repeal CPOM carelessly, you don't get freedom; you get financiers micromanaging medicine.
My prediction: incremental exceptions, not wholesale repeal. Smart founders won't wait for the law to become convenient. They'll build within the current framework and be ready to adapt as states loosen specific models.
If you're serious about launching, don't let CPOM scare you off. Let it force you to be disciplined. Good founders do hard things early. This is one of them.
