Compliance
How to Set Up a Provider Network for a Telehealth Clinic
The pharmacy fills and the storefront sells, but nothing ships until a licensed clinician says yes. Here is how operators build, credential, and scale that layer.
Quick answer
Setting up a provider network means securing licensed clinicians who can lawfully evaluate and approve orders in every state where your patients are located. Operators either contract 1099 providers directly, partner with a physician-owned MSO-PC to satisfy corporate-practice-of-medicine rules, or use a clinic's existing providers. Each clinician must be credentialed and verified — NPI, active state license, DEA where controlled substances apply, OIG exclusion check, and malpractice coverage — and a provider must approve every single order.
Key takeaways
- A provider must be licensed in the state where the patient is physically located at the time of the visit — not where the clinic or provider sits.
- Corporate-practice-of-medicine rules bar non-clinician-owned companies from owning the practice in many states, which is why the MSO-PC (friendly-PC) structure exists.
- Every clinician must be credentialed against primary sources: NPI via NPPES, active state license, DEA registration where controlled substances apply, OIG exclusion, and malpractice/E&O.
- A licensed provider must review and approve every order — there is no compliant 'auto-approve' path, and standing-order shortcuts do not replace a real clinical decision.
- Some states still require a synchronous audio-video visit before prescribing; asynchronous store-and-forward is not universally accepted.
- Scaling the network is a state-by-state licensure exercise, not a single national credential — the OIG exclusion list alone carries tens of thousands of names.
Setting up a provider network means securing licensed clinicians who can lawfully evaluate and approve orders in every state where your patients are located. Operators either contract 1099 providers directly, partner with a physician-owned MSO-PC to satisfy corporate-practice-of-medicine rules, or use a clinic's existing providers. Each clinician must be credentialed and verified — NPI, active state license, DEA where controlled substances apply, OIG exclusion, and malpractice coverage — and a provider must approve every single order.
The provider layer is the part of a telehealth clinic that most operators underbuild. It is tempting to treat clinicians as a commodity you plug in behind a storefront, but the network is where your legal right to operate actually lives. The pharmacy fills, the storefront sells, and the software routes — but nothing lawfully ships until a licensed human, credentialed and licensed in the right state, makes a clinical decision on the specific patient. This is the plain-spoken version of how to build that layer and keep it defensible.
How Do You Set Up a Provider Network for a Telehealth Clinic?
You build it in three moves: choose an employment model that respects corporate-practice-of-medicine law, secure licensed clinicians in every state where patients are located, and credential each one against primary sources. Then you wire a hard rule into operations — a licensed provider approves every order, with no exceptions and no auto-approve path.
Those four things — model, licensure, credentialing, and the approval gate — are the whole job. Everything else is logistics. Get the model wrong and you can be practicing medicine unlawfully; get licensure wrong and each out-of-state prescription is a violation; get credentialing wrong and you cannot prove a provider was ever qualified; skip the approval gate and you no longer have a clinic, you have an unlawful drug-shipping operation. The rest of this piece takes each in turn.
Employ, Contract, or Partner: Which Provider Model?
The model decision is really a corporate-practice-of-medicine decision. In many states, a company not owned by licensed clinicians cannot own a medical practice, employ physicians to practice medicine, or share professional fees. That constraint drives whether you contract 1099 providers, stand up a friendly-PC, or ride on a clinic's existing providers.
The corporate practice of medicine (CPOM) doctrine exists to keep clinical judgment free of commercial pressure. Its strictness varies widely by state, and the penalties range from unenforceable contracts to fee disgorgement and disciplinary action. This is why the MSO-PC (or "friendly-PC") structure is the industry norm at scale: a physician owns the professional corporation that employs the clinicians and holds the clinical decision, while a management services organization — which the operator owns — provides billing, technology, marketing, and administration under a management services agreement. We walk through the mechanics in how the MSO-PC telehealth structure works.
Here is how the three models compare:
| Model | Clinical control | CPOM compliance | Speed to launch | Cost / complexity |
|---|---|---|---|---|
| 1099 contract providers | You direct workflow; provider keeps clinical judgment | Risky in strict CPOM states; misclassification exposure | Fast — sign and start | Low upfront, higher legal risk |
| MSO-PC (friendly-PC) | Clinical decisions sit inside the physician-owned PC | Built for CPOM states; the standard at scale | Slower — legal setup, MSA, PC formation | Higher upfront, lower ongoing risk |
| BYO / clinic's own providers | Clinic owns the clinical relationship | Clinic already carries the CPOM structure | Fastest if the clinic exists | Lowest — you overlay, they staff |
For an operator overlaying neolife on a clinic that already has providers, the third row is often the pragmatic start: the clinic owns the clinical relationship and the CPOM structure, and you supply the intake, compliance, and fulfillment rail on top. As you take on more of the clinical operation yourself, the MSO-PC becomes the durable answer. None of these models change the two rules that follow — licensure and the approval gate apply the same way regardless of who signs the providers' paychecks.
Where Must Your Providers Be Licensed?
A provider must hold an active, unrestricted license in the state where the patient is physically located at the time of the visit. Telemedicine is treated as occurring where the patient is, not where the clinician sits. That single rule is the hardest constraint on scaling a telehealth network, and there is no national workaround.
This means your addressable market is defined by your providers' license map, not by your website's reach. To serve patients in fifteen states, you need clinicians collectively licensed in all fifteen — and if a patient travels, the state at the moment of the encounter is what governs. State medical boards, indexed by the Federation of State Medical Boards, set and enforce these rules, and they differ on telehealth specifics.
The Interstate Medical Licensure Compact helps, but it is frequently misunderstood. The Compact is an expedited pathway for eligible physicians to obtain licenses in participating states faster — not a single license that covers them all. The physician still ends up individually licensed in each state and still answers to each state's board. Building coverage across many states is therefore an ongoing operations function, not a one-time task, which we cover in depth in building a 50-state telehealth prescriber network.
One more jurisdictional wrinkle: modality. Some states permit asynchronous store-and-forward evaluation for certain conditions, while others require a real-time synchronous audio-video visit before a prescription issues — especially for controlled substances or first-time prescribing. Because the requirement follows the patient's state, a multi-state network usually has to support both and gate them by jurisdiction.
How Do You Credential and Verify Each Provider?
Credentialing is the discipline of verifying a clinician's qualifications against primary sources and keeping dated evidence of each check. A self-attested CV is not credentialing. At minimum you verify identity and NPI, state license, DEA where controlled substances apply, OIG exclusion status, and malpractice coverage — each against the authority that issues it.
The non-negotiable checks, with the source of truth for each:
| Credential | What it confirms | Primary source of truth |
|---|---|---|
| NPI | The provider's national provider identifier and identity | NPPES NPI Registry (CMS) |
| State medical license | Active, unrestricted license in each state of practice | The relevant state medical board |
| DEA registration | Authority to prescribe controlled substances (only if applicable) | DEA Diversion Control registration |
| OIG exclusion | Provider is not barred from federal healthcare programs | HHS OIG exclusions / LEIE |
| Malpractice / E&O | Current professional liability coverage | The carrier's certificate of insurance |
A few notes that trip operators up. The NPPES registry is free and public, so there is no excuse for an unverified NPI. DEA registration only matters where you actually handle controlled substances — a non-controlled 503A workflow may not need it, and you should not require what does not apply. The OIG's List of Excluded Individuals and Entities carries tens of thousands of names and updates monthly; screening against it is a standard expectation, and screening should be repeated on a cadence, not just at onboarding. And credentialing is not a one-time event: licenses expire, DEA registrations lapse, and an exclusion can land after you signed the provider. Re-verification on a schedule is part of the job.
The deeper reason all of this matters is provability. If a regulator, a payer, or a plaintiff's attorney asks whether a provider was qualified to approve a given order, "we were pretty sure" is not an answer — a dated record of each primary-source check is. This is the same recordkeeping discipline that runs through the compliance requirements every operator carries, and it sits alongside the platform-level credentials — like how LegitScript telehealth certification works — that regulators and ad platforms expect of a legitimate clinic.
Why Is Provider Approval Non-Negotiable?
Because a licensed clinician's individualized decision on the specific patient is what makes a prescription lawful. Remove it and you do not have a faster clinic — you have an unlawful drug-shipping operation. There is no compliant version of "auto-approve," and standing orders do not substitute for a real clinical judgment on each order.
This is the line operators are most tempted to blur under growth pressure, because the provider review is the slowest step in the funnel. The temptation is to pre-approve, batch-approve, or let a questionnaire "decide." All of those are the same mistake wearing different clothes: they strip the individualized clinical decision the law requires. Software should make the provider's decision faster and better-informed — routing the order, surfacing the intake, flagging interactions, queuing the work — but it must never make the decision. We treat this at length in why provider approval and prescription oversight are non-negotiable.
This is exactly where neolife draws its line. neolife enforces the provider-approval gate directly in the order flow: an order cannot advance to the pharmacy until a credentialed, appropriately licensed provider has approved it, and the approval — who, when, against which intake — is captured in the operator's own system of record. The rail is built so the gate cannot be skipped by accident, by configuration, or by a well-meaning growth hack. Speed comes from removing friction around the decision, never from removing the decision.
How Do You Scale the Network Across States?
You scale by treating licensure and credentialing as a continuous operations function, not a launch checklist. Add states by adding licensed providers for them; add providers by credentialing them against primary sources and re-verifying on a schedule. The gate that a provider approves every order stays fixed no matter how large the panel grows.
Practically, scaling looks like this:
- Map demand to license coverage. Turn on a state only when you have provider capacity licensed there — never let the storefront outrun the license map.
- Use the Compact where it fits. For eligible physicians, the Interstate Medical Licensure Compact shortens the path to new-state licensure, but budget for per-state licensing regardless.
- Automate re-verification. Track license, DEA, and OIG status with expiry dates and recurring OIG screening, so a lapse surfaces before it becomes a violation.
- Keep evidence in your own system of record. Credentialing files, approval logs, and the state-of-patient at each encounter belong in infrastructure you control, not a vendor's black box.
- Keep the modality gate per-state. As you add states, keep enforcing synchronous-vs-asynchronous rules by jurisdiction rather than applying one national policy.
The operators who scale cleanly are the ones who own their data. When your patient records, provider credentials, and approval logs live in a system of record you control, adding a pharmacy or a state is an overlay, not a migration — and every order still carries a provable, licensed-provider decision behind it.
Key Takeaways
- A provider must be licensed where the patient is physically located at the time of the visit — that rule, not your website's reach, defines your market.
- Corporate-practice-of-medicine law drives the model choice; the MSO-PC (friendly-PC) structure is the standard way to comply in strict states.
- Credential every clinician against primary sources — NPPES for NPI, the state board for licensure, DEA where controlled substances apply, OIG for exclusions, and the carrier for malpractice.
- A licensed provider must approve every order; there is no compliant auto-approve, and standing orders do not replace a clinical decision.
- Modality rules vary by state — some require synchronous video, others allow asynchronous intake — so gate by jurisdiction.
- Scaling is a continuous licensure-and-credentialing operation with re-verification on a schedule, not a one-time setup.
neolife enforces the provider-approval gate inside the order flow and keeps credentialing and approval evidence in the operator's own system of record — the licensed-clinician layer, made provable. If you want a fulfillment rail that overlays the pharmacy and storefront you already use while keeping every order behind a real provider decision, talk to us. This post is educational and not legal or medical advice; consult qualified healthcare counsel on corporate-practice-of-medicine, licensure, and credentialing before you operate.
Primary sources
Frequently asked questions
Should I employ providers as 1099 contractors or partner with an MSO-PC?
It depends on your state exposure and how much clinical control you want to keep at arm's length. In corporate-practice-of-medicine states, a non-clinician-owned company generally cannot own the medical practice or employ physicians to practice medicine, so operators use a physician-owned professional corporation (the PC) with a management services organization (the MSO) handling non-clinical operations. Contracting 1099 providers directly is faster and cheaper but carries misclassification and corporate-practice risk in strict states. Many operators start with a small 1099 panel and formalize into an MSO-PC as they scale.
Does a provider need to be licensed in every state where I have patients?
Yes. Telemedicine is generally considered to occur where the patient is located, so a clinician must hold an active, unrestricted license in the state where the patient is physically present at the time of the encounter. This is the single biggest constraint on scaling a telehealth network. The Interstate Medical Licensure Compact speeds multi-state licensure for eligible physicians, but it is an expedited application pathway, not a national license — the provider still ends up licensed in each participating state.
What has to be verified before a provider can approve orders?
At minimum: identity and NPI through the NPPES registry, an active and unrestricted state medical license in each state of practice, a DEA registration where controlled substances are involved, an Office of Inspector General exclusion check to confirm the provider is not barred from federal healthcare programs, and current malpractice or E&O coverage. Credentialing means verifying each of these against its primary source and keeping dated evidence, not trusting a self-attested CV.
Can orders be auto-approved to move faster?
No. A licensed provider must make an individualized clinical decision on every order — that is what makes the prescription lawful. Software can route, queue, pre-populate, and flag, but it cannot substitute a clinician's judgment. 'Auto-approve' or a blanket standing order that ships product without a real provider decision is a compliance and patient-safety failure. neolife enforces the provider-approval gate in the order flow precisely so this line cannot be crossed by accident.
Do I need a live video visit, or is asynchronous intake enough?
It varies by state and drug class. Some states permit asynchronous 'store-and-forward' evaluation for certain conditions; others require a real-time synchronous audio-video visit before a prescription can issue, particularly for controlled substances or first-time prescribing. Because the requirement follows the patient's state, a network operating in many states usually has to support both modalities and gate them by jurisdiction. Confirm the current rule with each state's medical board before you rely on asynchronous intake.
This article is operator education, not medical, legal, or tax advice. Telehealth and pharmacy regulation vary by state and product and change frequently. Verify the specifics for your business with qualified counsel and your pharmacy partner.