Checklist

Healthcare Operations Checklist

A practical checklist for scoping telehealth and in-person healthcare operations; verify current requirements with primary sources and qualified counsel.

Last checked October 25, 2026

A practical checklist for scoping a telehealth or in-person healthcare program before launch, grouped in the order the work usually happens. Each item is a question to answer for every state you will serve. Federal items cite their primary source; state items point to the state guides.

1. Entity and CPOM structure

List the states where patients will be located; each one's rules apply.
Check each state's CPOM position (state-by-state CPOM table).
Choose the structure: physician-owned PC with an MSO, or a contracted medical group.
Put the management services agreement in writing and keep clinical decisions with clinicians.
Review fee arrangements with counsel for state fee-splitting rules and, where federal health program business is involved, the Anti-Kickback Statute.

2. Licensure

Every clinician is licensed in the state where each patient is located during the encounter.
Track license numbers, expirations and board actions for every clinician, and verify at hire and at renewal.
Use compact licenses where they help (Nurse Licensure Compact; the Interstate Medical Licensure Compact for physicians), and confirm each state's participation.
Facility, clinic or pharmacy licenses where the state requires them for your service.

3. Medical director and supervision

A named medical director where the state or service requires one (medical directors by state).
Collaborative, supervisory or delegation agreements for NPs and PAs in states that require them (CPA template).
Chart review on a fixed schedule, with findings recorded and acted on.

4. Clinical protocols and standing orders

Written protocols for each service: eligibility, contraindications, treatment ranges, monitoring, escalation.
Standing orders signed by the responsible prescriber where state rules allow them, with an expiry.
Version control: who approved each protocol and when, and a review date.

6. Prescribing and controlled substances

DEA registration in each state where the clinician prescribes controlled substances to patients located there, unless an exception applies (21 CFR § 1301.12).
State controlled-substance registration where the state requires its own, and prescription monitoring program (PDMP) checks where mandated.
Federal telemedicine rule: the Ryan Haight Act generally requires an in-person evaluation before prescribing controlled substances by telemedicine. DEA and HHS have extended the temporary telemedicine flexibilities through December 31, 2026: a DEA-registered practitioner may prescribe Schedule II to V medications through an audio-video telemedicine encounter without a prior in-person evaluation, if the prescription is for a legitimate medical purpose in the usual course of practice and meets the other conditions of the rule, including applicable state law. Audio-only encounters are covered only for certain FDA-approved Schedule III to V narcotic medications for opioid use disorder.
Plan for January 1, 2027: the extension is temporary. Watch DEA for a permanent rule or a further extension before that date.
Electronic prescribing where the state mandates it, and a pharmacy that will fill out-of-state prescriptions.

7. HIPAA, BAAs and tracking

A business associate agreement with every vendor that handles protected health information: EHR, telehealth video, labs, pharmacy, billing, messaging, cloud hosting.
Security risk analysis, written policies, and workforce training; keep HIPAA documentation for six years from creation or last effective date (45 CFR § 164.316).
Review analytics pixels and tracking on patient-facing pages against HHS guidance on online tracking technologies.

8. Pharmacy and compounding

Pharmacy partners licensed (or non-resident licensed) in each patient's state.
For compounded products: know whether the pharmacy is a 503A pharmacy or a 503B outsourcing facility, and the limits that apply (see the GLP-1 guide).
Never market a compounded drug as a generic or the same as an FDA-approved product.

9. Advertising and certification

Claims are truthful and supported by competent and reliable scientific evidence (FTC Health Products Compliance Guidance).
No promise of a prescription or approval before an exam.
Healthcare certification such as LegitScript's where your ad platforms or payment processors require it; it takes weeks, so start early.
State advertising rules for licensees (names, credentials, before-and-after images, testimonials).

10. Adverse events and complaints

A written path for patients to report a problem, with clinician escalation and a response time.
Internal incident log and root-cause review.
Report serious adverse events and product problems to FDA through MedWatch; follow any state reporting rules.

11. Records and retention

Medical record retention per each state's rule (often longer for minors); HIPAA's six-year rule covers policies and documentation, not the medical record itself.
Records stay with, or are accessible to, the clinical entity if a vendor or MSO relationship ends.
Patient access requests handled within the HIPAA timelines.

Frequently asked questions

Are the DEA telemedicine flexibilities still in effect?

Yes, through December 31, 2026, under the fourth temporary extension DEA and HHS issued on December 31, 2025, subject to its conditions and to state law. Check DEA for any newer rule before relying on it after that date.

Do I need LegitScript certification?

Only if a platform you use requires it. Major ad platforms and payment processors require or recognize healthcare certification for telehealth and pharmacy advertisers; check each platform's current policy.

How long do I keep medical records?

Medical record retention is set by state law and varies, often with longer periods for minors. HIPAA's six-year retention rule applies to required policies and documentation.

Sources

Last checked October 25, 2026. General information, not legal or medical advice. Laws, board rules and agency policies change and vary by state, service and license type. Confirm current requirements against the primary sources listed here and with qualified counsel licensed in your state before you rely on them.

Next steps

Readiness worksheet Telehealth compliance service State compliance guides

Want help applying this to your program?

Leave your email and the TrueEval team will see your request. If we haven't heard from you before, we'll send a short note with a link to book a call. We don't email a copy of this guide: it's all on this page, and your browser can print or save it as a PDF.