Telehealth Compliance in 2025: What Operators Need to Know

The telehealth industry has grown faster than the regulatory frameworks designed to govern it. That gap is closing — and operators who aren't paying attention are going to feel it.

This isn't a scare piece. It's a practical overview of the compliance landscape as it stands today, and what it means for brands operating on telehealth infrastructure.

Compounding pharmacies sit at the center of most telehealth weight management and hormone therapy businesses. The products your patients receive — Semaglutide, Tirzepatide, Testosterone, HRT compounds — are compounded, not manufactured. That distinction matters enormously from a regulatory standpoint.

The FDA's oversight of compounding pharmacies operates under Section 503A and 503B of the Federal Food, Drug, and Cosmetic Act. 503A pharmacies compound for individual patient prescriptions. 503B outsourcing facilities can compound in larger quantities without patient-specific prescriptions.

What this means for operators: The pharmacy network you use must be operating in compliance with the applicable section. If you're running high volume, the distinction between 503A and 503B matters for your supply chain and your legal exposure.

Telehealth prescribing is governed at the state level, and the rules vary significantly. Some states require an in-person visit before a telehealth prescription can be issued. Others have specific requirements around the prescribing of controlled substances via telehealth. A handful have enacted telehealth-specific legislation that creates additional requirements.

The COVID-era waivers that relaxed many of these rules have largely expired or are expiring. Operators who built their businesses on those waivers need to ensure their protocols reflect the current state-by-state requirements — not the emergency-era rules.

What this means for operators: Your provider network needs to be credentialed in every state where you're prescribing. Your protocols need to reflect current state law, not 2020 emergency rules. This is not a set-it-and-forget-it compliance posture.

The FDA's position on compounding GLP-1 medications — specifically Semaglutide and Tirzepatide — has been a moving target. The agency has at various points placed these compounds on shortage lists (which permits compounding) and removed them (which restricts it).

The practical reality: the demand for GLP-1 compounds remains enormous, and the regulatory environment around them is being actively contested. Operators need to be working with compliance counsel who is monitoring this in real time.

What this means for operators: If your business is built on GLP-1 compounds, you need a compliance infrastructure that can adapt quickly. That means attorney-reviewed protocols, real-time regulatory monitoring, and a pharmacy network that operates within the current rules.

Many telehealth operators are running on protocols that were written once and never updated. That's a significant liability.

Clinical protocols govern what conditions can be treated, what medications can be prescribed, what intake information is required, and what follow-up is mandated. When regulations change — and they do — protocols that don't reflect current law expose both the operator and the prescribing providers.

Attorney-reviewed protocols aren't a luxury. They're the baseline for operating a compliant telehealth business.

Compliance in telehealth isn't a document. It's a system. Here's what a real compliance infrastructure includes:

Legal counsel with telehealth specialization. Not a general healthcare attorney. Someone who understands compounding pharmacy law, state prescribing rules, and the FDA's position on specific compounds.

PhD-level clinical oversight. Someone who can evaluate clinical protocols against current evidence and regulatory requirements, and update them when either changes.

Real-time regulatory monitoring. The ability to identify regulatory changes before they affect your operations — not after a complaint or enforcement action.

Documented audit trail. Records that demonstrate your protocols were reviewed, updated, and followed. This is what protects you in an enforcement action.

Compliance isn't a competitive disadvantage. It's a prerequisite for building a business that can scale and, eventually, be acquired.

Buyers and investors doing due diligence on a telehealth brand will look at your compliance posture. A business with attorney-reviewed protocols, documented regulatory monitoring, and a clean compliance history is worth significantly more than one that cut corners.

Build it right from the start. The cost of compliance infrastructure is a fraction of the cost of an enforcement action — or a failed acquisition.

TeleMed Shop provides attorney-reviewed compliance infrastructure as part of both Platform Access and Full White Label arrangements. Our DC-based attorney team and PhD compliance staff monitor regulatory changes in real time so you don't have to.