This is not legal advice. Foundry PC is not a law firm.

The phrase regulators and plaintiffs' lawyers use is "de facto control." It means: regardless of what the documents say, the MSO is actually running the medical practice. Oregon's new law is explicitly built around it. California's Attorney General has argued it. Texas and New York boards investigate it.

Here are the ten habits we see most often in companies whose paperwork is fine and whose operations are not.

1. Clinicians on the MSO's payroll

The single most common problem. If the people delivering care are W-2 employees of the MSO in a CPOM state, the MSO is practicing medicine. Fix: move clinical employment to the PC. It's administratively painful and it's non-negotiable.

2. Ops team makes clinical hiring and firing decisions

The MSO can recruit, screen, and recommend. The PC's physician owner or medical director must make the decision and sign the offer. If your head of operations is approving NP hires without physician involvement, that's control.

3. The MSO sets clinical protocols

Standing orders, prescribing guidelines, visit templates, escalation rules. These are clinical policies and belong to the PC. The MSO can draft and support; the physician approves and owns.

4. The MSO decides what gets coded and billed

Coding is a clinical judgment about what service was rendered. Billing operations can be outsourced to the MSO, but decisions about coding levels, medical necessity documentation, and claim disputes should route through the PC. California's AG named this specifically.

5. The MSO negotiates and signs payer contracts alone

Payer contracts are with the PC. The MSO can support the negotiation, but the PC signs, and the physician should be involved in terms that affect clinical practice (prior authorization workflows, network requirements, quality measures).

6. Physician owner has never attended a governance meeting

If the physician's involvement consists of signing documents once, there's no independent governance. Monthly or quarterly governance meetings with minutes are the minimum, and they should show the physician making decisions.

7. The MSO controls the PC's bank account exclusively

The MSO can administer the account under the MSA, but the physician owner should have signing authority and visibility. A PC whose owner cannot access its money is a shell.

8. Marketing that positions the company as the provider

"Our doctors," "we treat," "our clinical team." If the company's marketing describes the MSO as delivering care, regulators will take it at its word. The PC delivers care; the company provides the platform. Copy should reflect that, including disclaimers where states require them.

9. Physician owner compensation tied to revenue

Covered in an earlier post, but it belongs on this list. A physician whose pay rises with MSO revenue isn't an independent owner.

10. Investor or MSO representatives on the PC's board

Board seats, officer roles, or voting rights held by MSO or investor personnel in the PC. Oregon prohibits ownership and governance overlap. New York's pending S8442 targets it directly. Even where not prohibited, it's the clearest possible evidence of control.

The audit exercise

Once a year, have someone who didn't build the structure sit with the MSA and the physician owner agreement and then interview three people: your head of operations, your medical director, and a clinician. Ask each one who makes clinical staffing decisions, who sets protocols, and who they'd escalate a coding dispute to. If the answers don't match the documents, you've found your de facto control problem, and you've found it before a regulator did.

Why this matters more in 2026

For most of the last decade, enforcement was rare and complaint-driven. That's changing. Oregon's law creates a private right of action. California's AG can now seek injunctions directly. Transaction-review laws in eight-plus states mean regulators see MSO relationships at formation. And plaintiffs' lawyers have started using CPOM violations as leverage in payer disputes and employment litigation. The structure that was "fine as long as nobody looked" now has more people looking.

How Foundry PC handles it

Foundry's ongoing engagement includes an annual operational review against this list, governance meeting cadence with the physician owner, and updates to the document suite as states change. We'd rather find habit number two in a review than in a board investigation.

Book a 20-minute call if you'd like us to run the audit exercise with your team.