Why is CPOM due diligence important for healthcare investors?

A CPOM violation discovered post-close can result in voided contracts, loss of medical licenses, regulatory penalties, and in the most serious cases, criminal liability. These outcomes can destroy the entire equity value of an investment. CPOM is not a compliance checkbox — it is a structural risk that needs to be evaluated as seriously as financial or intellectual property diligence in any healthcare deal.

What documents should investors request in CPOM due diligence?

Key documents include: the PC operating agreement; the Management Services Agreement between MSO and PC; physician ownership records; state professional corporation filings; all stock transfer restriction agreements; physician employment or contractor agreements; credentialing records; state medical board license verifications; payor contracts; and any prior legal opinions on the CPOM structure.

Can CPOM problems be remediated after discovery during due diligence?

Often yes, but it depends on the nature and severity of the issue. Structural problems — like an overly broad MSA, a management fee tied to prescription volume, or a prohibited stock transfer restriction agreement — can typically be renegotiated and remediated. Active enforcement actions, loss of physician licensure, or historical billing fraud connected to a CPOM violation are much harder to remediate and may be deal-killers.

CPOM Due Diligence Checklist for Healthcare Investors

CPOM is not a compliance checkbox. It is a structural risk that can void contracts, eliminate revenue streams, and in serious cases, result in enforcement actions that effectively destroy the business being acquired. For healthcare investors evaluating companies with clinical operations, CPOM due diligence needs to be as rigorous as financial diligence — and it needs to happen before term sheets are signed, not after.

This checklist is designed for venture capital and private equity investors evaluating healthcare companies that operate MSO-PC structures. It is also useful for founders preparing their company for a fundraise, who want to audit their own structure before investors do it for them.

Why CPOM Diligence Matters More in 2026

The enforcement environment has changed materially. Between 2024 and 2026, Oregon passed the most restrictive CPOM statute in US history, California codified its existing CPOM prohibitions into statute and extended PE transaction reporting requirements, Massachusetts mandated disclosure of PE-healthcare financial relationships, and regulatory focus across the country has shifted from ownership form to operational control substance.

A structure that passed CPOM diligence in 2022 under the old analytical framework may not pass today. Investors doing healthcare deals in 2026 should apply updated analysis — particularly for companies operating in California, Oregon, Massachusetts, Texas, and New York.

The 20-Point CPOM Due Diligence Checklist

Corporate Structure Documents

PC operating agreement — Does it vest genuine clinical governance authority in the physician owner? Are there provisions that give the MSO or its investors operational voting rights over the PC? Do any provisions conflict with state professional corporation requirements?
Management Services Agreement — Is the MSO's scope of services limited to non-clinical administrative functions? Are management fees structured to avoid fee-splitting (flat fee or services-based rather than volume-linked)? Does the MSA include any clinical control provisions that could constitute a CPOM violation?
Stock Transfer Restriction Agreements — Do any STRAs exist? If so, what triggers them? In Oregon-operating companies, do STRAs comply with SB 951's restricted list of permissible triggers? In other states, could STRA trigger events be read as giving investors constructive ownership of the PC?
MSO operating agreement and cap table — Does any investor or MSO insider also hold majority equity in the PC? (Prohibited in Oregon under SB 951; scrutinized in all CPOM states.)
Historical legal opinions on the CPOM structure — Was a formal CPOM legal opinion ever obtained? If so, who wrote it and when? Does it address the specific states the company operates in? Has the structure changed since the opinion was issued?

Physician Ownership Analysis

Physician license verification — Is the PC owner's medical license active and in good standing in every state the PC operates? Check state medical board databases directly, not just the company's representations.
Disciplinary and malpractice history — Any board actions, consent orders, or practice restrictions? Any OIG exclusions or Medicare/Medicaid sanctions?
PC owner concentration risk — How many other PCs does this physician own? Does the volume of PC ownership relationships make genuine clinical governance implausible?
Succession plan — Is there a documented process for replacing the PC owner if they leave? Is there a secondary physician owner or a network relationship that provides replacement capacity?
Evidence of actual governance — Can the company provide meeting minutes, protocol reviews, or other records showing the physician PC owner exercised genuine clinical oversight? Regulatory analysis increasingly focuses on actual conduct, not just document structure.

Revenue Flow Analysis

Management fee structure — What percentage of the PC's revenue flows to the MSO as management fees? Is it flat, services-based, or revenue-linked? If revenue-linked, does the percentage exceed the 15-20% threshold that draws regulatory scrutiny?
Money flow mapping — Trace the movement of every dollar from patient/payor to MSO. Is clinical revenue separated from administrative revenue at the PC level before management fees are assessed? Is there any direct payment from payors to the MSO that bypasses the PC?
Fee-splitting analysis — Does the MSA or any related agreement create an arrangement where the MSO receives compensation tied to physician referrals or clinical volume in a manner that could implicate the Anti-Kickback Statute or state fee-splitting prohibitions?

State-by-State Compliance Mapping

Operating state CPOM matrix — Has the company produced a state-by-state analysis of CPOM requirements for every state where it operates? Does that analysis reflect current law (including Oregon SB 951, California AB 1415/SB 351, and Massachusetts PE reporting requirements)?
Multi-PC structure consistency — If the company operates PCs in multiple states, are each state's PC documents consistent with that state's specific CPOM requirements? A document drafted for California may not satisfy Oregon's SB 951 requirements.
Planned state expansion — Does the company plan to expand into new states in the next 12-18 months? Has CPOM analysis been conducted for those states?

Clinical Operations and Employee Classification

Clinical employee classification — Are all clinical employees (physicians, NPs, PAs) employed by the PC, not the MSO? Employment of clinicians by the MSO rather than the PC is a direct CPOM violation in most states.
Clinical protocol governance — Who developed the clinical protocols? Were they developed and approved by the PC's physician leadership, or by the MSO's medical affairs team? The latter creates functional control concerns.
AI and technology tools in clinical workflows — Does the company use AI for clinical recommendations or patient triage? If so, who owns that AI (MSO or PC), and does the workflow design require genuine physician review or allow passive ratification?

Enforcement History and Marketing Review

Regulatory and enforcement history — Has the company or its PC received any inquiries, investigations, or enforcement actions from state medical boards, the OIG, or CMS? Has any regulatory action been resolved? Is any pending? Review all correspondence with regulatory authorities.

The most dangerous CPOM issues in diligence are not the obvious structural violations — those are visible and usually remediable. The dangerous ones are the operational patterns: physician owners who never review protocols, management fees that quietly scaled with prescription volume, clinical employees classified under the MSO rather than the PC. These require forensic diligence, not just document review.

What to Do When You Find a CPOM Issue

Assess Severity First

Not every CPOM issue is a deal-killer. Structural problems in documents — overbroad MSA provisions, volume-linked fees, undocumented physician governance — are typically remediable through negotiation and document revision. The question is whether you have time in the deal process to remediate them and whether the company's management team is willing to do so.

Distinguish Active Risk from Historical Risk

A company that operated with a non-compliant structure in 2021 and corrected it in 2023 has a different risk profile than a company operating non-compliantly today. Historical CPOM exposure without enforcement action may be manageable — particularly if statutes of limitations apply and the structure has been corrected. Active non-compliance creates ongoing risk that must be fixed before close or priced into the deal.

Build Remediation into the Deal Terms

When CPOM issues are identified but deal interest remains, structure remediation as a closing condition rather than a post-close aspiration. Require specific document revisions, physician governance updates, or structural changes as conditions to closing. This protects the investor and creates accountability for the management team to fix the issue on a defined timeline.

Consider Representations and Warranties Coverage

Reps and warranties insurance underwriters have become more sophisticated about CPOM risk. If the diligence has been thorough and the structure is compliant, coverage for CPOM representations may be available. If the structure has known issues, exclusions will be significant — another reason early remediation before a deal process is far better than discovery during one.