What Investors Ask a Telehealth Company in Diligence

Investors in telehealth now diligence regulatory risk before revenue quality. Expect questions in seven areas: clinician licensure by state, prescribing practices and the DEA timeline, the corporate structure, Medicare exposure after 2027, privacy and tracking technology, marketing claims, and vendor and pharmacy relationships. Have a data room that answers each with documents, not narrative, and a memo from counsel on structure. The companies that close fastest found and fixed their own gaps first.

Why has diligence shifted to regulatory risk?

Because the enforcement record changed. The FTC ordered BetterHelp to pay $7.8 million in 2023 over sharing health data for advertising, and announced orders against Cerebral (more than $7 million) and Monument in April 2024. FDA sent warning letters to telehealth companies over compounded GLP-1 marketing in September 2025, March 2026 and June 2026. And on July 7, 2026, Done Global's founder was sentenced to six years in prison, with its clinical president sentenced to two years, according to published reports, after a 2025 jury conviction for distributing stimulants through the company's telehealth model. An investor buying a telehealth company is buying those exposures if they exist.

1. Can every clinician legally treat every patient they see?

Investors will sample encounters and check the clinician's authorization in the patient's state on the date of service.

• Roster of clinicians with every license, compact privilege and telehealth registration, by state, with issue and expiration dates.
• Evidence of how the patient's location is captured at each visit.
• Collaboration and supervision agreements for NPs and PAs where required.
• A report of encounters by patient state and clinician, reconciled to the roster.

2. How do prescriptions get written, and what happens on January 1, 2027?

• Written protocols for each drug class, signed by the medical director.
• Prescribing data by clinician: volume, drug mix, refill patterns.
• For controlled substances: DEA registrations per prescriber per state, the legal basis for each telemedicine prescription, PDMP check records, and the plan for patients seen only by telemedicine when DEA's temporary flexibilities (90 FR 61301) end on December 31, 2026. The special registration final rule has been at OIRA since August 25, 2026 and is not published; a credible plan covers both outcomes. See what changes on January 1, 2027.
• Minimum-interaction rules: whether any prescription is issued on an intake form alone, and in which states that is prohibited. See where questionnaire-only prescribing is prohibited.

3. Who actually owns and controls the practice?

• Org chart of every entity, with ownership.
• Management services agreement, stock transfer restriction or succession agreements, and any loans between the MSO and the professional entities.
• How the management fee is set, and whether any part varies with professional revenue or referrals.
• Counsel's analysis of the corporate practice and fee-splitting rules in each state you serve, including Oregon SB 951 and California SB 351, which was signed October 6, 2025 and limits private equity and hedge fund control over physician practices from January 1, 2026. See the friendly PC and MSO model.

No structure is approved everywhere. Investors expect a state-by-state answer from counsel, not a general assurance.

4. How much revenue depends on Medicare telehealth flexibilities?

The flexibilities extended by the Consolidated Appropriations Act, 2026 run through December 31, 2027, and the in-person requirement for tele-mental health is deferred to January 1, 2028. Investors will model revenue at risk if Congress does not extend them again. Have the analysis ready: Medicare share of revenue, the share delivered to patients at home, the share by audio-only, and the plan if the flexibilities lapse. See planning for the end of Medicare's telehealth flexibilities.

If you bill remote monitoring, expect questions about the CY2027 proposal (91 FR 43842) that would require RPM and RTM clinical staff to be direct employees of the billing practice. Outsourced monitoring models are directly affected.

5. What data leaves the company, and to whom?

• HIPAA security risk analysis, policies, training records and breach log.
• Business associate agreements with every vendor handling PHI.
• An inventory of every pixel, tag and SDK on the website and apps, with what each sends and where. Investors' counsel will run their own scan.
• Analysis of state consumer health data laws for non-HIPAA data, including Washington's My Health My Data Act, which has a private right of action through the state consumer protection act. See Washington's My Health My Data Act.
• Whether the FTC Health Breach Notification Rule applies to any product. See the FTC Health Breach Notification Rule.

6. What do the ads and the website claim?

• A library of current and past ads, landing pages and emails, with substantiation for every outcome claim.
• For compounded drugs: how products are described, who is named as the compounder, and whether any claim implies FDA approval or equivalence to an approved drug. FDA's June 2026 letters cited these practices under sections 502(a) and 502(bb) of the Food, Drug, and Cosmetic Act.
• Subscription terms, cancellation flow and refund data. The FTC's Cerebral order included refunds tied to cancellation practices.

7. Which vendors could break the business?

• Platform, pharmacy, lab and device contracts, with termination rights and change-of-control clauses.
• Any payment from a pharmacy, lab or device vendor to the company, and how it is calculated.
• Pharmacy licensure coverage by state and any FDA or board actions against your compounding partners.

Can state transaction-notice laws delay the closing?

Yes, and they are easy to miss. Several states require advance notice of health care transactions that meet their thresholds:

• Oregon requires notice to the Oregon Health Authority at least 180 days before closing a covered material change transaction (ORS 415.501), and the review can extend beyond that.
• California requires covered health care entities to notify the Office of Health Care Affordability at least 90 days before closing material change transactions that close on or after April 1, 2024.
• Washington requires notice to the Attorney General before material change transactions involving provider organizations, under RCW 19.390.

Other states have their own. Thresholds and definitions differ; deal counsel should check every state where the target or its affiliated practices operate.

How should a company prepare?

• Run the investor's checklist on yourself six months before a raise.
• Reconcile encounters to clinician authorizations and fix any gap you find, with a record of the fix.
• Get a structure memo from counsel for every state.
• Scan your own site for trackers and fix what you find before anyone else scans it.
• Write the DEA and Medicare contingency plans down.

Our 50-State Telehealth Matrix ($2,950 for one service line) and Counsel-Ready Structure Packet ($950) are built to go straight into a data room for counsel's review. See pricing.