Medical Weight Loss Program Compliance Checklist (2026)

A medical weight loss program compliance checklist should cover the clinical entity, state-by-state licensure, patient-location rules, prescribing workflow, pharmacy pathway, advertising claims, HIPAA safeguards, billing, subscriptions, and scheduled-medication rules. The program should document each item before launch rather than treating a technology platform or clinician questionnaire as the compliance solution.

What should a telehealth weight loss program settle before launch?

The operator should be able to identify who provides care, which clinician makes each clinical decision, where the patient is located, how medication is sourced, what the advertising claims mean, how health data moves through the system, and how every charge is billed. Those decisions create the core of weight loss telehealth compliance.

This is not a single federal approval process. Federal agencies regulate areas such as drug marketing, health claims, privacy, and controlled substances, while state boards and statutes can determine who may practice, prescribe, own or manage a medical practice, and bill for services. Rules vary by state, so a national launch still needs a state matrix.

The 15-point medical weight loss program compliance checklist

Use this checklist as an operating document. Each item should have an owner, supporting policy, and review date.

A founder should have the proposed entity structure, clinical workflow, pharmacy arrangement, and marketing claims reviewed by appropriate healthcare counsel, a qualified clinician, or the relevant state board before relying on the checklist for launch.

1. Who owns the medical practice and clinical decisions?

Start by naming the entity that contracts with clinicians, holds or controls patient records, bills patients or payers, and provides medical services. Then determine whether each target state restricts ownership or control of a medical practice by an unlicensed company.

The business can supply administrative infrastructure, branding, technology, customer support, and other nonclinical functions. It should not turn those functions into control over diagnosis, eligibility, prescribing, follow-up, or medical records. MDLaunchr is one white-label infrastructure option: it can run the business layer under the operator’s brand, while independently licensed clinicians make the clinical decisions. The operator still owns its legal-entity choices, advertising, commercial terms, and state-specific review.

New York illustrates why the entity question cannot be skipped. New York Department of Health guidance describes corporate-practice restrictions that can prevent an unauthorized corporation from providing or arranging professional services unless authorized by law. That does not establish a national rule, but it shows why a national operator needs state-by-state entity analysis.

2. Where is the patient, and is the clinician authorized there?

Capture the patient’s physical location at each encounter and maintain a current license matrix for every physician, nurse practitioner, physician assistant, and other clinical professional involved. A clinician’s location is not the only relevant location; the patient’s location can determine which state’s practice rules apply.

Texas, for example, treats an out-of-state person who performs an act affecting the diagnosis or treatment of a Texas patient as practicing medicine in Texas, subject to Texas regulation. Texas also permits a practitioner-patient relationship to be established through specified telehealth methods when the applicable standard of care and follow-up requirements are met. Those Texas rules do not answer how another state will treat the same workflow.

Washington’s Uniform Telehealth Act requires telehealth services to comply with Washington scope-of-practice, professional, and state and federal requirements. Washington also does not treat email, instant messaging, text messaging, or fax as a substitute for the required telehealth relationship pathway under the cited statute.

Your state matrix should track:

• Permitted clinician types and licenses.
• Medical-director, supervision, delegation, or collaboration rules.
• Telehealth consent and identity requirements.
• Any good-faith examination or in-person-care requirement.
• Prescribing restrictions and follow-up standards.
• Referral and emergency escalation procedures.
• Entity ownership and management restrictions.

For a broader operating model, the telehealth program hub can help an operator frame the platform, clinical, and commercial components separately.

3. Does the intake create a sufficient clinical encounter?

A questionnaire alone should not be treated as the complete clinical evaluation. Build a workflow that gives the licensed clinician enough information to make an independent decision and document it.

At minimum, the operational design should address identity verification, patient location, medical history, medication reconciliation, relevant assessment, contraindication and interaction screening, diagnosis or medical necessity, informed consent, follow-up, and referral to in-person care when virtual care is insufficient.

The record should show who evaluated the patient, what information was considered, what decision was made, and what follow-up or escalation plan applies. Automation may organize information, but it should not silently replace clinician judgment.

4. How should the program classify its medication pathway?

Separate FDA-approved products, off-label prescribing, and pharmacy-compounded products in both clinical operations and marketing review. A program may discuss FDA-approved medications such as semaglutide and tirzepatide, but the label, indication, evidence, and prescribing decision belong to the licensed clinician.

For example, the FDA-approved Zepbound label describes use with a reduced-calorie diet and increased physical activity for adults with obesity, or adults who are overweight with at least one weight-related condition. A program should not convert that labeled indication into a promise about what an individual will experience.

Compounded products require a separate control path. Compounded drugs are not FDA-approved and are not reviewed by FDA for safety, effectiveness, or quality before marketing. Do not call a compounded product FDA-approved, and do not suggest that it is the same as, equivalent to, interchangeable with, or a generic version of an FDA-approved product.

The operator should identify the actual compounder, avoid branding that obscures the source, determine whether the pharmacy operates under a 503A or 503B pathway, and review patient-specific prescription requirements where applicable. The pharmacy relationship should also address labeling, shipping, adverse-event reporting, recalls, and current FDA positions.

FDA stated on April 1, 2026, that 503A compounders generally compound for an individual patient pursuant to a prescription and should not regularly or inordinate amounts compound products that are essentially copies of commercially available drugs. FDA also described restrictions for 503B outsourcing facilities when products are essentially copies unless the approved drug is on the FDA shortage list.

FDA proposed on April 30, 2026, excluding semaglutide, tirzepatide, and liraglutide from the 503B bulk-drug-substances list. That was a proposal with a June 29, 2026, comment deadline; the final status and the shortage status of each relevant presentation must be checked before launch. For deeper operational detail, review the telehealth compounding rules for GLP-1 programs.

5. Can the advertising survive an FTC review?

Every material health, safety, efficacy, testimonial, and FDA-status claim needs substantiation before publication. The FTC evaluates the advertisement’s overall net impression, including headlines, imagery, product names, testimonials, and implied claims—not only the fine print.

Create an approval process for landing pages, paid ads, email, SMS, social posts, affiliate copy, influencer content, and before-and-after images. The file should connect each claim to competent and reliable scientific evidence or remove the claim.

High-risk examples include:

• Guaranteed weight loss or a guaranteed amount of weight loss.
• “Lose X pounds in Y days” claims without appropriate substantiation.
• “No diet or exercise required” language.
• Claims that a compounded product is FDA-approved or equivalent to an approved product.
• “Clinically proven,” “doctor-approved,” or “safe” claims without defined support.
• Testimonials that imply unusually strong results without clearly communicating what consumers generally can expect.
• A clinician’s image or title used to imply evidence the program does not possess.

The FTC has stated that “results not typical” by itself may not adequately address an unusually strong testimonial. The med spa weight loss advertising rules provide a related claims-review framework, but the same principle applies to a telehealth operator: the whole advertisement matters.

6. Are privacy, security, and marketing technologies covered?

Determine whether the operation is a HIPAA covered entity, business associate, or both, and inventory every vendor that touches protected health information or sensitive health-related data. Applicable vendors may include the telehealth platform, patient portal, cloud storage, customer support, transcription, AI-scribe, call-recording, analytics, advertising, and payment systems.

The launch file should include:

• Business associate agreements where applicable.
• A documented security risk analysis.
• Role-based access and account termination procedures.
• Multifactor authentication where available.
• Encryption and secure-device standards.
• Backup, retention, deletion, and disaster-recovery policies.
• Breach-response procedures.
• Review of pixels, session replay, cookies, call recording, and SMS.
• Required consent for recordings, communications, and state-specific telehealth uses.

HHS recommends a risk-based privacy and security strategy that addresses identity verification, encryption, secure devices, workforce training, policies, and documented consent. A “HIPAA-compliant platform” label does not by itself prove that the full business workflow is compliant; data flows and vendor behavior still require review.

7. How will the program bill patients and payers?

Choose a cash-pay, insurance-billed, or hybrid model before marketing begins. Then separate clinical fees, program or membership fees, medication charges, laboratory charges, and shipping charges in the commercial and billing workflow.

For insurance billing, verify payer enrollment for each billing clinician and entity, telehealth coverage, audio-only rules, modifiers, place-of-service codes, and documentation requirements. The billed code must match the service actually delivered. Records should capture patient location, clinician location, modality, participants, relevant time, medical decision-making, consent, and follow-up.

Washington Medicaid rules provide one state-specific example: telehealth records may need technology used, patient and provider locations, participants, clinician credentials, time where relevant, and consent for audio-only billing. Washington’s reimbursement conditions also demonstrate why a service can be legally deliverable by audio-only and still require separate reimbursement analysis.

Build audits for duplicate billing, impossible time, services by non-enrolled clinicians, unsupported evaluation-and-management levels, and services bundled into another encounter.

8. Do subscriptions and recurring charges have a separate checklist?

Recurring billing requires clear material terms, express informed consent before charging, and a simple way to stop recurring charges under the Restore Online Shoppers’ Confidence Act. The FTC’s 2024 Negative Option Rule amendments are not currently in force: the Eighth Circuit vacated them on July 8, 2025, and the FTC’s March 11, 2026 advance notice of proposed rulemaking is only a proposal.

That does not eliminate recurring-billing obligations. Keep the subscription price, billing frequency, included services, cancellation process, refund policy, failed-visit policy, and medication-shipping terms visible before payment. Do not describe a canceled or paused membership as a clinical outcome, and do not assume that a state’s consumer rules mirror another state’s.

9. Does the program prescribe controlled substances?

Most commonly marketed GLP-1 weight-management products are not controlled substances, but a broader weight-management program may include other medications. If it does, identify the schedule and check DEA registration, state controlled-substance authority, prescription-monitoring-program obligations, and e-prescribing requirements.

DEA announced on December 31, 2025, that certain telemedicine flexibilities for Schedule II–V controlled medications were extended through December 31, 2026, subject to applicable federal and state requirements. An operator should not treat that temporary federal extension as a nationwide override of state law.

When is a white-label program a fit?

A white-label program can reduce the number of infrastructure decisions an operator makes, but it does not transfer every compliance responsibility. The platform may support branding, technology, administrative workflows, clinician coordination, and program setup. The operator still needs to understand its entity, state footprint, claims, commercial terms, vendors, and customer communications.

MDLaunchr gives healthcare entrepreneurs one way to evaluate that division of responsibility through a branded telehealth infrastructure model. Before choosing any platform, ask which party controls clinical decisions, which entity contracts with clinicians, how records and vendors are handled, which states are supported, and what the operator must approve independently.

Final launch sequence

1. 1Define the business and clinical entities.
2. 2Build the patient-location and clinician-license matrix.
3. 3Obtain state-specific entity and telehealth reviews.
4. 4Document the clinician evaluation, consent, prescribing, follow-up, and escalation workflow.
5. 5Classify every medication pathway and verify the pharmacy arrangement.
6. 6Create the advertising substantiation and approval file.
7. 7Complete the HIPAA, privacy, vendor, and security review.
8. 8Select cash-pay, insurance, or hybrid billing and test documentation.
9. 9Review subscriptions, refunds, cancellations, and recurring charges.
10. 10Audit the full workflow before accepting the first patient.

If the business model is defined and the operator is comparing infrastructure options, see the GLP-1 weight management program to review how a branded program is set up. It is a platform option, not a substitute for state-specific legal review or independent clinical judgment.