California Medical Director Requirements & Compliance Rules (2025 Guide)

1. Entity & Ownership Structure

• California prohibits the corporate practice of medicine — non-physician entities cannot hold or control a medical practice. 
• Physicians must render clinical services through a professional medical corporation (PC). 
• The MSO may provide business, administrative, or support services (e.g. billing, HR, marketing), but must not direct or influence medical decisions, clinical protocols, or charting. 
• The agreement (Management Services Agreement) must explicitly preserve clinical autonomy, avoid fee-splitting or revenue-sharing tied to medical services, and delineate boundaries of control. Read at Holt Law

2. Medical Director Credentials & Responsibilities

Each facility shall have a Medical Director who shall be a physician and shall be responsible for standards, coordination, monitoring and evaluation, and planning for improvement of medical care in the facility.

The Medical Director shall:

• Ensure that the facility admits only those patients for whom it can provide adequate care and that the facility complies with sections 97520.1, 97520.3 and 97520.5.
• Act as a liaison between the medical staff, the Administrator, and the Governing Body.
• Be responsible for reviewing, evaluating and approving patient care policies and procedures.
• Act as a consultant to the Director of Nursing in matters relating to patient care.
• Be responsible for reviewing employees’ health examination reports.

3. Delegation & Prescriptive Authority

Nurse Practitioners (NPs):

• Operate under standardized procedures unless granted independent authority.
• Require a furnishing number to prescribe or furnish drugs.
• Under AB 890 (BPC §§2837.103–.104), qualified NPs can practice independently after meeting transition-to-practice requirements and registering with the BRN.
• Must hold a DEA registration and check CURES before prescribing controlled substances.

Physician Assistants (PAs):

• Must have a practice agreement per SB 697 (2019) outlining supervision, communication, and delegated prescribing.
• DEA registration and CURES use required for controlled substances.
• Modernized rules allow flexible supervision ratios.

4. Quality Assurance (QA) & Oversight Documentation

• Maintain written proof of active physician oversight, including signed attestations, QA committee reports, and supervisory protocols.
• Conduct routine chart reviews (commonly 5–10% of encounters) to monitor quality of care, documentation standards, and adherence to clinical protocols.
• Hold regular QA meetings, with documented agendas, minutes, and follow-up actions, to address findings, complaints, and performance metrics.
• Track and document all complaints, incident reports, investigations, and resolutions in accordance with California’s patient safety and reporting obligations.
• Retain QA and oversight files for at least seven (7) years after the last date of service, or longer for minors and specialized records.

5. Telehealth Compliance

California’s BPC §2290.5 requires telehealth care to meet the same standard as in-person visits.

• Obtain and document telehealth informed consent.
• Use HIPAA-compliant, encrypted systems.
• Providers must be licensed in California to treat California patients.
• Electronic prescribing required under BPC §688, except in limited cases.
  
  

6. Controlled Substances (CURES Compliance)

All DEA-registered prescribers must enroll in and consult CURES (California’s PDMP).

• Query CURES before prescribing any Schedule II–IV controlled drug.
• Recheck at least every four months for ongoing therapy.
• Document each CURES query in the patient record.
• Registration with CURES is mandatory.

7. Pharmacy & Compounding (GLP-1s, Hormones, Injectables)

Compounding and dispensing require strict compliance with federal and state standards.

• 503A/503B:
  • 503A pharmacies compound per patient prescription.
  • 503B outsourcing facilities compound in bulk under FDA registration.
• Source only from FDA-registered suppliers.
• Follow USP <797> standards for sterile compounding.
• Avoid misleading advertising (no “FDA-approved” claims).
• Physician dispensing allowed only with compliant labeling and recordkeeping.

8. Marketing & Advertising Guardrails

• Medical advertising is regulated under California Business & Professions Code (BPC) §§ 651–652, which prohibit untruthful or misleading medical advertising.
• Ads (print, digital, broadcast) must be truthful, factual, and not misleading. Claims must be substantiated.
• You may only claim “board-certified” if the board is recognized by ABMS, AOA, or approved by the Medical Board of California.
• Avoid deceptive before/after photos, exaggerated claims, or unverified patient testimonials.
• Retain copies of advertisements (drafts, final versions, media buys) for at least two years.
• Online marketing must also comply with HIPAA and FTC standards — particularly rules on patient privacy, use of protected health information (PHI), truth in advertising, and prevention of deceptive practices.

9. Documentation & Audit Readiness

Auditors look for written proof of compliance, not verbal claims. Maintain organized files for:

• Entity formation and ownership records.
• MSO management agreement.
• Licenses, DEA, and CURES registration.
• NP/PA agreements and protocols.
• QA meeting logs and chart reviews.
• Advertising approvals and consent templates.