Banner artwork by Moh Noer / Shutterstock.com
Cheat Sheet:
- Substance beats paperwork. New York's NaphCare settlement shows regulators will look past PC–MSO contracts to who really controls care.
- California is setting the template. Aspen Dental and Carbon Health targeted revenue-linked fees, succession options, and captive financing, and Carbon Health brought the first personal penalty against a founder.
- States are codifying the trend. California's SB 351 and Oregon's SB 951 now limit MSO interference with clinical judgment by statute.
- Audit operations, not just contracts. Check who controls clinical decisions, validate fees, separate reporting lines, and review restraints, disclosures, and financing.
The NaphCare settlement, the Aspen Dental injunction, the Carbon Health settlement, and Oregon’s SB 951 all outline shifts in how state regulators enforce the corporate practice of medicine (CPOM). This article outlines the six things every in-house team should be doing now.
The NaphCare settlement announced on March 26, 2026, by New York Attorney General Letitia James should be required reading for every in-house counsel at a multi-state healthcare company.
NaphCare: the facts
Alabama-based correctional healthcare provider NaphCare will pay $875,000 to the State of New York and be banned for five years from bidding on or contracting for jail health services anywhere in New York. For five more years, NaphCare must obtain written approval from OAG before entering into any such contract. Failure to comply with the agreement will result in a $50,000 fine for each violation. The probe was sparked by three deaths at the Onondaga County Justice Center in Syracuse, where NaphCare was under contract from 2020 to 2022.
The settlement is based on the same legal theory that in-house counsel at virtual-care, behavioral-health, and platform-medicine companies have been hearing about for years: the corporate practice of medicine, or CPOM. The novelty lies in the enforcement: New York disregarded the contracts — the New York PC, the management services agreement, and the on-paper carve-out of clinical work to a state-licensed entity — and turned to the operational reality. Here’s the plain language verdict: An Alabama company provided health care in a New York jail even when the contracts said it couldn’t.
The building’s collapse
The OAG’s findings on the structure are worth a closer look. NaphCare established a New York professional corporation, Proactive Health Care Medicine, PLLC, to hold the clinical contract. The setup was a standard PC–MSO arrangement. Proactive handled clinical services, and NaphCare was nominally responsible for “administrative and managerial” support. In fact, the president of Proactive was the CEO of NaphCare. Both of them had the same address. NaphCare’s chief medical provider was the Proactive medical director. The PC was the property of a named individual, an ophthalmologist with NaphCare. In many instances, the clinicians provided care electronically from Alabama. The documents showed a two-entity structure, but in practice, it was all done by one company.
The problem for in-house counsel doing due diligence on your own MSO-PC arrangements is that some of these features are common in well-meaning structures. Shared addresses are common. So is regular cross-border service. Reporting lines to the platform’s clinical leadership are common. NaphCare has the answer to whether your defense to a CPOM challenge can survive a regulator willing to add those facts together.
Aspen Dental and the other half of the picture – NaphCare is not an isolated incident
In addition, in May 2026, the California Attorney General settled a CPOM action against Aspen Dental Management, Inc., with a $2 million penalty, $300,000 in patient restitution, and a court-appointed compliance monitor for thirty-six months. Aspen did not admit liability, but it agreed to dozens of injunctive provisions that read like a compliance checklist. Practice revenue cannot be linked to management fees. Assignment of premises leases to licensed clinicians. Interest on advances shall not be less than the prime rate or four percent. Any advertising to patients must clearly identify the actual owner of the practice.
Carbon Health: Individual liability
California didn't stop at Aspen. On June 26, 2026, Attorney General Rob Bonta announced that he had settled with Carbon Health Technologies, Inc., and twelve associated professional corporations. For the first time in this wave of enforcement, an individual, co-founder and former CEO Eren Bali, was penalized personally.
The corporate defendants will pay $4.4 million in civil penalties, and Bali will pay $100,000 in her individual capacity. The proposed judgment permanently enjoins Carbon Health from the corporate practice of medicine under Business and Professions Code sections 2052(a) and 146(a), with the AG proceeding through its UCL and false advertising authority under sections 17203 and 17535.
The AG targeted three structural features:
- Management agreements that provided the MSO with complete control over advertising, payor negotiations, choice of medical equipment, and hiring, firing, and compensation of licensed professionals;
- Any ownership interest the MSO had in a PC, including an assignable option — backed by a security interest in the PC’s shares — that gave the MSO the unilateral right to cause the practice’s stock to be transferred to a physician selected by the MSO; and
- Revolving credit arrangements that required the PCs to borrow exclusively from the MSO at above-market rates.
The financing prohibition has an explicit carve-out: the MSO may take a first-priority lien on certain PC assets subject to the same restrictions as conventional lenders. The difference lies between regular secured lending on market terms and the use of financing as a tool of control.
The judgment separately enjoins the consumer-facing conduct alleged in the complaint — automatic card charging without clear disclosure, billing HMO patients beyond permitted cost-sharing, and advertising that misrepresented in-network status — a reminder that the AG paired its corporate-practice theory with consumer-protection and billing enforcement in a single action.
Carbon Health will need to undergo a restructuring so that the management company has neither ownership interests nor control of the affiliated practices; the settlement is still subject to the approval of the Los Angeles Superior Court and, given the Chapter 11 filing by Carbon Health, by the U.S. Bankruptcy Court for the Southern District of Texas.
Carbon Health pushes the doctrine both ways at once. It transforms the succession option, long lauded as a neutral continuity mechanism, into a positive signal of corporate ownership. And it adds personal liability to a founder. Put the posture into perspective: the judgment is a stipulated settlement entered into without any admission of liability, subject to court approval and reached in the shadow of Carbon Health’s bankruptcy. It does not make PC–MSO structures illegal or decide anything. It’s a sign of enforcement — but the clearest yet.
The three cases — plus new legislation
NaphCare, Aspen Dental, and Carbon Health all emphasize substance over form. Carbon Health is the third action in a coordinated sequence in California. In an amicus brief filed March 30, 2026, in Art Center Holdings, Inc. v. WCE CA Art, LLC, the AG argued that an MSO’s contractual right to replace a PC’s physician-owner may violate CPOM even if the right is never exercised, because mere retention of the right creates an impermissible division of loyalties. (The California Medical Association filed a companion brief arguing for a fact-based, totality-of-the-circumstances approach rather than a categorical rule; the appeal is pending, and no court has yet adopted the AG’s position.)
When properly done, the MSO/PC structure is a valid legal structure, but no longer a defendable paper artifact wrapped around the same operational control. And California is codifying the trend: Effective January 1, 2026, Senate Bill 351 prohibits private-equity- and hedge-fund-backed MSOs from interfering with clinical judgment, voids offending contract terms, and empowers the AG to seek injunctive relief and fees. California enforcement theories often serve as templates for other states. Multi-state platforms should assume this framework travels.
Senate Bill 951 — Oregon
Oregon has now institutionalized this trend. In 2025, Senate Bill 951 was enacted to provide statutory standards for differentiating administrative support from clinical autonomy in MSO-PC arrangements. The bar is set so high that some virtual-care platforms have pulled out of the Oregon market altogether, rather than reconfigure to meet it. Whether other states follow Oregon's drafting or California's enforcement lead, the days when in-house counsel could rely on a well-drafted MSA as the centerpiece of CPOM compliance are over.
Six step action plan:
1. Paperwork pressure test vs. substance
Take a tour of the operational reality of all MSA and PC governance documents. Who pays the doctor? Who decides the staffing ratios, the clinical protocols, the scheduling rules? Who has quality? If the answer from the contract is different than the answer from operations, document the gap and fix operations, not the contract. Regulators will read them both.
2. Check your fees
Percent-of-revenue management fees have been used by the industry for the last 20 years. In fact, California law does allow for a percentage-of-revenue fee, but only if it’s fair market value and not payment for referrals. Regulators now consider as evidence of a non-clinical party’s interest in clinical volume fees, which are at the MSO’s discretion, fees that are tied to the profitability of the PC, and incentive compensation that incentivizes clinical staff to sell products or services. If the MSO fee is tied to the PC’s top line, get an arm’s-length valuation opinion to justify it or rework the fee. In either case, the important thing is to be proactive about how you approach revenue attribution.
3. Outline the reporting structure
NaphCare’s medical director reported directly to the platform’s chief medical officer. Just that alone did wonders for the OAG. The trick is to separate the clinical reporting lines. Ask whether any platform employee is essentially directing a clinician’s decisions. Define the boundary in writing and train staff to respect it.
4. Watch out for clinician restraints
The regulator’s red zone now includes non-compete restrictions on a clinician’s geographic scope and limits on post-departure communication with patients. Aspen Dental was forced to stop using and enforcing them. The carve-out preserves anti-solicitation language — actively steering patients to a competitor — but not broad restraints.
5. Walk the patient journey
The Aspen injunction requires signage and advertising disclosures that make clear that the brand is used by independent practices that own and control clinical care. Walk your homepage or your sites through a regulator’s eyes. What care does your platform say it delivers for your brand? When in the patient consent flow, do you tell patients which entity is actually treating them?
6. Review intercompany financing and option agreement
Carbon Health treated the assignable succession option, the security interest in the PC’s shares, and exclusive above-market MSO financing as evidence of corporate ownership. Take inventory of your assignable options, stock transfer restrictions, and continuity agreements. Restrict replacement triggers to genuine events — license revocation, gross negligence, death or disability — and empower the PC’s board or independent physicians to select successors, rather than unilateral platform designation. On the financing side, separate normal secured lending on market terms (which the carve-out explicitly preserves for Carbon Health) from captive arrangements that require the PC to borrow only from the platform at above-market rates.
What regulators really believe
That’s why the six-step plan above is more important than a redrafted MSA: state attorneys general are becoming more vocal about what they want to see in an investigation. The NaphCare record is telling. The OAG asked for org charts, email distribution lists, clinical reporting structures, real estate documents, payroll and benefits records, the identity of the person who actually hired and fired clinicians, and the location from which clinical guidance came. The MSA is none of those documents. Everyone confirms or denies the version of who runs the practice in the MSA. In-house counsel preparing for a potential CPOM inquiry should assume their own files will be read in the same light. The remediation that works is the one that takes those underlying records and aligns them to the contractual story before the first person asks for them.
Help from outside experts
CPOM is a patchwork of statutes, regulations, case law, and AG enforcement priorities across 33 states, differing not only in content but also in the intensity of enforcement. Active: California, New York, Texas, North Carolina, and now Oregon. Other states aren’t. The compliance posture that keeps you safe in one state may be insufficient in the next. An in-house team can handle the inventory, cadence, and remediation responsibility, but the outside specialists are worth it for the state-by-state legal mapping, FMV opinions on management fees, and the structural redesign of platform/PC relationships. Many healthcare-specific firms do exactly this work, advising healthcare platforms.
Choose your enforcement event. Don’t wait for it to choose you.
NaphCare denied all responsibility. Aspen Dental would not take responsibility. Carbon Health admitted no wrongdoing. None of these companies is an exception. Sooner or later this year, an in-house counsel will receive another CPOM settlement on their desk — and Carbon Health proved there’s always another. The team that spent its time on the six items above can read the next headline with a clear conscience.
Disclaimer: The information in any resource in this website should not be construed as legal advice or as a legal opinion on specific facts, and should not be considered representing the views of its authors, its authors’ employers, its sponsors, and/or ACC. These resources are not intended as a definitive statement on the subject addressed. Rather, they are intended to serve as a tool providing practical guidance and references for the busy in-house practitioner and other readers.
