What is the CPOM enforcement shift from ownership to control?

Historically, CPOM enforcement focused on whether a non-physician entity owned a medical practice. Increasingly, regulators ask who functionally controls clinical decision-making — regardless of what ownership documents say. This means a physician-owned PC connected to an investor-controlled MSO can still violate CPOM if the MSO's influence over clinical operations is substantial.

Which states are most actively enforcing CPOM against PE-backed companies in 2026?

California (AB 1415, SB 351), Oregon (SB 951), and Massachusetts (PE reporting law, January 2025) have all enacted new legislation targeting PE involvement in healthcare MSO structures. Texas and New York continue to actively enforce existing CPOM doctrine through their medical boards and attorney general offices.

What management fee percentage triggers CPOM scrutiny?

Management fees consistently exceeding 15-20% of the PC's revenue, particularly when tied to patient volume or prescription counts, have been identified in enforcement analysis as potential fee-splitting. This threshold is not statutory but has emerged from regulatory guidance and litigation patterns.

Private Equity and CPOM: The New Enforcement Era

For most of its history, CPOM enforcement was a binary question: does a non-physician own this medical practice? If yes, fix the structure. If no, move on. The MSO-PC model emerged as a clean answer to that question — physician nominally owns the PC, investor owns the MSO, everyone moves forward.

That era is ending. In 2026, the CPOM question regulators are asking is more sophisticated and harder to answer with a corporate org chart: who functionally controls clinical decision-making in this organization? And in the private equity healthcare world — where investors are motivated to maximize clinical throughput, minimize variance, and drive toward exit — the answer is increasingly uncomfortable.

Three state legislatures passed new laws targeting PE influence in healthcare MSO structures between 2025 and 2026. Bloomberg Law reported that "growing health-care, private equity scrutiny shadows 2026 deals." The PC-MSO model, once considered a de facto safe harbor, is no longer automatically compliant — it needs to be compliant in practice, not just on paper.

The Ownership-to-Control Shift

Traditional CPOM doctrine focused on ownership. If a corporation or non-physician entity owned shares in a medical practice, that was the violation. The MSO-PC workaround was elegant: the physician owns 100% of the PC, the investor owns the MSO, a management services agreement connects them. Ownership was clean. Clinical governance was nominally in physician hands.

The problem is that ownership and control are not the same thing. A physician PC owner who signed a management services agreement giving the MSO control over staffing, scheduling, productivity targets, formulary, and operational protocols may nominally own the PC — but they do not functionally govern it. Regulators caught on, and the enforcement trend has followed.

Today, state medical boards, attorneys general, and healthcare regulators in the most active CPOM states are conducting what practitioners call "substance over form" analysis. They look past the ownership documents to ask: in practice, who decides how this medical practice operates? If the answer is the MSO's management team rather than the physician PC owner, the structure fails — regardless of what the corporate documents say.

The Legislative Response: Three States, Three Approaches

Oregon SB 951 (June 2025)

Oregon's approach targeted two specific mechanisms PE investors use to retain control over physician practices: cross-ownership and stock transfer restriction agreements. SB 951 prohibits MSO insiders from holding majority interests in the contracting PC, and restricts STRAs to a narrow list of triggering events. It is the most structurally explicit CPOM law in the country, and legal commentators at multiple major law firms called it unprecedented.

California AB 1415 and SB 351 (October 2025)

California took a two-pronged approach. SB 351 codified the prohibition on PE interference with physician clinical judgment into statute — specifically calling out patient scheduling, hours worked, and treatment decisions. AB 1415 expanded transaction reporting requirements to capture MSO-level PE deals that previously flew under the regulatory radar. Together, they significantly raised the compliance bar for every PE-backed California health company.

Massachusetts (January 2025)

Massachusetts required corporate healthcare investors to disclose financial transactions with provider entities on an annual — and in some cases quarterly — basis. The disclosure requirement covers ownership structures, financial stability, and contractual affiliations reported to the state's Center for Health Information and Analysis. The intent is transparency: regulators want to understand the full web of financial relationships between investors and providers before problems emerge.

Five MSO-PC Structures That Now Fail Regulatory Analysis

Based on the legislative trends and enforcement patterns, these five structural configurations carry meaningful CPOM risk in 2026:

1. MSO Insiders Holding Majority PC Equity

Prohibited outright in Oregon under SB 951. In other states, it is a strong indicator of functional control that undermines the separation the MSO-PC model is supposed to create. If the same people who manage the MSO also own the PC, the structural separation is cosmetic.

2. Management Fees Tied to Clinical Output

Revenue-percentage management fees that move with prescription volume, patient count, or clinical throughput are the most consistent CPOM risk signal across states. When the MSO makes more money when more prescriptions are written, the financial incentive structure mirrors prohibited fee-splitting. Flat-fee or services-based arrangements are significantly less vulnerable.

3. Physician Productivity Metrics Controlled by the MSO

If the MSO's employment or contractor agreements set RVU targets, visit quotas, or prescription volume goals for the PC's physicians — and if the PC physician owner has no practical ability to override those metrics — the MSO is directing clinical throughput. That is a functional control problem regardless of the ownership structure.

4. STRAs With Broad Investor-Favorable Triggers

Stock Transfer Restriction Agreements that can be triggered by investor exit events, business disagreements, or non-clinical performance conditions give investors a veto over who can own the PC — which is economic ownership without legal ownership. Oregon prohibits most STRAs. Other states treat broad STRAs as an indicator of disguised corporate ownership.

5. MSO-Controlled Clinical Protocol Development

When clinical protocols — prescribing criteria, treatment algorithms, patient eligibility rules — are developed by MSO employees (medical affairs, product teams) and handed to the PC to administer without meaningful physician input, the MSO is directing medical practice. The physicians become execution agents rather than independent practitioners.

What PE-Backed Health Companies Should Do Now

Audit Your Management Services Agreement

Pull your current MSA and read it through a substance-over-form lens. List every provision that gives the MSO authority over something that could be characterized as clinical — scheduling, staffing, protocols, quality metrics, formulary. For each one, ask: could a regulator read this as the MSO directing medical care? If yes, revise it.

Build Genuine Physician Governance

Physician PC owners need real authority that they actually exercise. That means clinical advisory committees with genuine decision-making power, PC board meetings where clinical governance is documented, and protocols that originate with physician leadership and are periodically reviewed and updated by physician leadership. Governance on paper that does not match governance in practice is increasingly a liability.

Restructure Fee Arrangements

Transition to management fees that reflect the actual cost of administrative services rather than a percentage of clinical revenue. If the fee must be revenue-linked, ensure it is tied to the value of MSO services delivered, not to clinical performance metrics.

Conduct Multi-State Compliance Mapping

If you operate in Oregon, California, or Massachusetts — or plan to — you need a state-specific analysis of whether your current structure meets the 2025-2026 statutory requirements in those states. Multi-state health companies cannot apply a single MSO-PC template and assume it works everywhere. Each state's requirements need to be mapped against your actual operational structure.

The PC-MSO model is not going away. What is going away is the ability to use that model as a formalistic shield while investors retain practical operational control. Compliance now requires genuine structural separation — not just compliant-looking documents.

The Due Diligence Implication

For PE funds currently holding healthcare platform companies, the new enforcement environment has a direct M&A implication. Potential acquirers — strategic buyers, public companies, and even other PE funds — are conducting more rigorous CPOM diligence than they did two to three years ago. A structure that passed diligence in 2022 may not pass in 2026 under the same analysis framework.

Pre-exit compliance remediation is significantly easier before a sale process begins than during one. If your fund's portfolio includes healthcare platform companies with MSO-PC structures that were built under the old enforcement paradigm, now is the time to audit and remediate — while you control the timeline and the narrative.