Peptide Clinic Compliance

Practice Structure: Corporate Practice of Medicine and MSO Compliance

Why Structure Matters for Peptide Clinics

Corporate practice of medicine (CPOM) laws exist in most states to ensure that medical decisions remain in the hands of licensed physicians, not corporations or non-clinical business owners. For peptide clinics, CPOM compliance is a primary enforcement trigger because regulators are specifically examining whether non-physician owners or management companies are driving clinical decisions about which peptides to prescribe, how to dose them, and where to source them.

The MSO-PC Model

Most peptide clinics with non-physician investors use a Management Services Organization (MSO) structure. The model separates the practice into two entities: a Professional Corporation (PC) or Professional Limited Liability Company (PLLC) owned by the licensed physician, and an MSO that handles non-clinical business functions such as marketing, billing, HR, and facility management.

When properly structured, this model complies with CPOM laws by ensuring that the physician retains full control over all clinical decisions while the MSO handles administrative operations. The entity structuring must be carefully designed to maintain this separation in both documentation and daily operations.

The 2026 Compliance Standard

The most significant trend in 2026 enforcement is the collapse of the “paper MSO.” Regulators are no longer satisfied with management agreements that say the physician is in charge if the actual bank statements, emails, hiring logs, and operational records tell a different story.

A defensible MSO structure for a peptide clinic requires that the physician owner holds 100% equity in the professional entity, all procurement decisions for pharmaceutical products remain under the physician’s direct control, clinical protocols and formulary decisions are documented as originating from the physician’s independent medical judgment, the MSO does not use sweep accounts that automatically transfer patient payments into the MSO’s account, and the physician has ultimate authority over the practice’s funds and is the one to authorize payment of clinical staff and purchase of medical supplies.

If your current structure does not meet these standards, it needs to be restructured before a regulator examines it. The cost of restructuring proactively is a fraction of the cost of defending a CPOM enforcement action, and your asset protection strategy should account for the personal liability exposure that arises when a structure fails under scrutiny.

Informed Consent and Patient Documentation

What Informed Consent Must Include

Informed consent for peptide therapy must go well beyond a standard treatment consent form. The compounded, non-FDA-approved nature of peptide therapies creates additional disclosure obligations that, if not met, expose the provider to both regulatory discipline and malpractice liability.

A compliant informed consent for peptide therapy must include the peptide name, source (compounding pharmacy name and license number), lot number, route of administration, and dosage. It must clearly state that the peptide is not FDA-approved for any indication and has not completed human clinical trials. The consent must describe expected benefits, known risks (including allergic reactions, infection at the injection site, and unknown long-term effects), alternative therapies that were considered, and the documented medical indication supporting the prescription.

The consent must be written, signed by the patient, and maintained in the medical record. It should be refreshed whenever the treatment protocol changes, when the regulatory status of the peptide changes, or at regular intervals (at least annually for ongoing therapy). Verbal discussions and checkbox-only forms do not survive board investigations.

Ongoing Documentation Requirements

Beyond informed consent, peptide clinic compliance requires comprehensive documentation of the entire treatment lifecycle. Every patient receiving peptide therapy should have a documented medical indication with supporting clinical rationale, baseline and follow-up lab work as clinically appropriate, treatment response monitoring with documented outcomes, and adverse event reporting documentation.

This documentation serves two purposes. It supports the clinical standard of care for the patient, and it provides the evidentiary record that your practice will need if a medical board investigation or malpractice claim arises.

HIPAA and Data Privacy Compliance

Peptide clinics handle sensitive patient health information that requires full HIPAA compliance. This is an area where many smaller clinics and concierge practices fall short.

What Qualifies as Protected Health Information

Dose logs with patient names, lab results, wellbeing scores, injection site records, before-and-after photos, and treatment protocols are all protected health information (PHI). Any digital channel that touches patient PHI requires HIPAA-compliant infrastructure.

Common HIPAA Failures in Peptide Clinics

Many peptide clinics communicate with patients through standard consumer messaging apps such as SMS, WhatsApp, or Instagram DMs. These platforms do not meet HIPAA requirements unless the provider has executed a Business Associate Agreement (BAA) with the platform and the platform offers HIPAA-compliant configurations.

Patient management software, electronic health records, scheduling systems, and payment processors must all be HIPAA-compliant. Your privacy policy must accurately reflect how patient data is collected, stored, shared, and protected.

For clinics that operate telehealth or virtual consultation programs for peptide therapy, the telehealth platform must also meet HIPAA requirements. Many of the consumer video conferencing tools that clinics adopted during the pandemic do not satisfy the technical safeguard requirements under the HIPAA Security Rule.