US Telehealth Risk Landscape: Regulatory,
Financial, and Operational Threats

The legal foundation for remote prescribing of controlled substances — stimulants for ADHD, buprenorphine for opioid use disorder, benzodiazepines — is a temporary DEA waiver first issued during COVID-19 and extended four times since. The fourth extension (Federal Register 2025-24123, published December 31, 2025) runs through December 31, 2026[Federal Register]. After that date, without a permanent rule, practitioners would legally revert to the Ryan Haight Act requirement of an in-person evaluation before any controlled substance can be prescribed via telemedicine.

The DEA released a proposed Special Registrations rule in January 2025 that would create three new registration categories: a standard Telemedicine Prescribing Registration for Schedule III–V substances, an Advanced registration for specialists handling Schedule II–V, and — most significantly — a Telemedicine Platform Registration for direct-to-consumer businesses that advertise controlled substances, tie to pharmacies, or maintain their own prescribing guidelines[Bradley]. This last category would apply directly to companies like Cerebral, Done Global, and Hims & Hers. No finalization date has been confirmed.

The enforcement history makes the stakes concrete. Cerebral reached a $3.75M DOJ settlement in 2024 and Done Global a $19.75M settlement in 2024, both for alleged improper ADHD stimulant prescribing without in-person evaluations. The proposed platform registration would institutionalise compliance requirements that neither company met. Investors should treat December 31, 2026 as a hard operational deadline: if no permanent rule is finalized by then, every controlled-substance prescribing workflow in direct-to-consumer telehealth must either secure in-person evaluation infrastructure or halt.

CMS finalized the CY 2026 Medicare Physician Fee Schedule on November 4, 2025, effective January 1, 2026[CMS]. The headline figure — a 3.85% overall physician reimbursement increase, the first after five consecutive years of cuts — was driven by a statutory 2.50% one-year boost and budget neutrality adjustments. For telehealth specifically, the originating site facility fee (HCPCS Q3014) was set at 80% of the lesser of actual charge or $31.85 for CY 2026[CMS PFS Rule]. CMS also permanently removed frequency limits on nursing home and hospital telehealth visits — a meaningful win for providers — and added group behavioral counseling for obesity and multiple-family group psychotherapy to the reimbursable telehealth services list.

The structural problem sits past 2026. RHC and FQHC non-behavioral health telehealth extensions, hospital outpatient remote billing for therapy, diabetes self-management, and nutrition therapy all run only through December 31, 2027[Sidley]. If Congress does not act, home-based telehealth services revert to pre-pandemic geographic restrictions from January 1, 2028. A 2025 study found that during a 17-day government shutdown, fee-for-service telemedicine visits fell 24% nationally — and more than 40% in some states[PMC]. That is the directional signal for what a structural reimbursement rollback looks like. For telehealth companies where home-based and behavioral health visits are the core volume, the 2028 cliff is an existential planning question, not a background policy consideration.

The Medicaid dimension compounds this. McKinsey analysis shows Medicaid segment EBITDA across the healthcare industry fell from $14 billion in 2023 to $3 billion in 2024, driven by adverse selection following the end of the public health emergency and lagging rate adjustments[McKinsey]. That trajectory is projected to turn negative in 2025–2026 as enrollment declines and uncompensated care grows. Telehealth companies whose patient populations skew toward Medicaid — including Amazon Clinic, Cerebral, and Ro — face the double pressure of falling covered volumes and rate uncertainty.

Deloitte recorded 127 telehealth-specific breach incidents in 2025 — a 40% year-on-year increase — with an average remediation cost of $12.4M per breach[Deloitte]. That figure covers direct remediation costs only. Statista tracked a 22% user churn rate following breach disclosures in telehealth platforms[Statista]. For a platform with one million active users paying $50 per month, a 22% churn event is a $132M annualised revenue loss — before litigation, regulatory fines, or reputational discount on future customer acquisition costs.

The attack surface is not the telehealth platforms themselves — it is their supply chains. KPMG found that 65% of 2025 telehealth incidents originated from third-party flaws, including Software Bill of Materials non-compliance[KPMG]. The Change Healthcare disruption — the ALPHV/BlackCat ransomware attack on Optum's claims processing infrastructure — halted approximately 70% of telehealth claims processing for two weeks and caused an estimated $872M in direct losses, with Optum Virtual Care reporting an 18% revenue decline in Q1 2025[UnitedHealth 10-Q]. That is the cost of a single third-party failure. Telehealth platforms with three to ten major vendor dependencies — EHR systems, SMS authentication providers, cloud infrastructure, pharmacy networks — carry compound exposure from each.

FTC enforcement under the Health Breach Notification Rule (HBNR) has accelerated alongside the breach rate. Twelve telehealth HBNR cases were filed in 2025, up from four in 2024, with average fines of $6.8M[FTC]. A proposed FTC rulemaking (Docket R-911002, March 2026) would require stricter third-party vendor audits as a condition of compliance[FTC NPRM]. For investors, this means cybersecurity is no longer separable from governance and regulatory exposure: a breach now triggers simultaneous remediation costs, user churn, FTC fines, and potential class action settlements.

The most commercially significant enforcement risk in US telehealth right now is not ADHD stimulants — it is GLP-1 weight-loss prescribing. Telehealth platforms built a high-revenue business model on prescribing and, in some cases, compounding semaglutide and tirzepatide during the branded drug shortage. Hims & Hers marketed compounded GLP-1 products in a manner that the FDA concluded implied equivalence with FDA-approved clinical trial comparators[JAMA Health Forum]. The US Health Department referred Hims & Hers to the Department of Justice for potential violations of the Federal Food, Drug and Cosmetic Act. No settlement amount has been disclosed and the enforcement timeline is open.

The structural legal risk extends beyond Hims & Hers. Platforms including Ro and others operating under Corporate Practice of Medicine (CPOM) exemptions — where licensed physicians nominally own medical groups while the platform provides management services — face ongoing scrutiny over whether platforms exert excessive influence over clinical decisions[JAMA Health Forum]. No specific CPOM case names or state attorney general actions are confirmed in available sources, but the legal theory is active and the enforcement infrastructure exists in every state where CPOM prohibitions apply.

The earlier ADHD enforcement actions set the financial template. Cerebral paid $3.75M to settle DOJ allegations of improper stimulant prescribing without in-person evaluations; Done Global paid $19.75M in a 2024 settlement. Those are precedent-setting amounts — not deterrents. For GLP-1 enforcement, which involves marketing claims to a much larger consumer audience and compounding practices that bypass FDA drug approval, the scale of potential liability is substantially higher. Investors in platforms with significant GLP-1 revenue should treat the Hims DOJ referral as a sector-level signal, not a company-specific idiosyncratic risk.

McKinsey data shows US healthcare provider EBITDA as a share of national health expenditure fell from 11.2% in 2019 to 8.9% in 2024, with a further decline projected to 8.7% by 2027[McKinsey]. Provider EBITDA is growing at roughly 1% a year — well below the inflation rate for clinical labour and technology costs. For telehealth companies, this is the macro backdrop against which every other risk operates: the industry is not generating the margins that would fund compliance upgrades, cybersecurity investment, or geographic expansion.

The Medicaid segment is in sharper distress. Medicaid EBITDA across the sector fell from $14 billion in 2023 to $3 billion in 2024 and is projected to turn negative in 2025–2026[McKinsey]. The mechanism is adverse selection following the end of the COVID-19 public health emergency: sicker patients remained enrolled while healthier members disenrolled during Medicaid redeterminations, raising per-member costs without corresponding rate adjustments. Nine to ten million Medicaid members were lost through this process, shrinking the covered patient pool for Medicaid-reliant telehealth services.

Private digital health funding tightened sharply after 2022, and the recovery has been slow. Rising interest rates raised the cost of capital for growth-stage telehealth businesses that had not yet reached profitability. No Tier 1 figures for 2025 private round volumes or valuation multiples are available in the research — this gap is flagged explicitly and limits confidence in any specific funding figure. What is confirmed: the macro environment that supported $29 billion in annual digital health investment in 2021 does not exist in 2026, and public market telehealth valuations have compressed in line with the broader growth-to-profitability re-rating.

Colorado's Artificial Intelligence Act (SB 24-205) mandates AI governance for high-risk systems that influence access to healthcare[Black Book]. This directly affects telehealth platforms' triage algorithms, patient-matching systems, and clinical decision-support tools. Connecticut SB 1295, effective 2026, tightens consumer data profiling rules and strengthens minor protections — applying to patient-engagement tools, risk-stratification engines, and marketing analytics platforms operating across state lines[Black Book]. Neither law has produced dated enforcement actions yet, but both are in force. Multi-state telehealth platforms face the compliance cost of divergent state AI and data frameworks with no federal pre-emption in sight.

Texas HB 1052, effective January 1, 2026, requires health benefit plans to cover telemedicine services when either the originating or distant site is outside Texas, provided the patient resides in Texas and the provider holds an in-state physical office[Black Book]. This forces claims processing and network configuration changes across payers and providers serving Texas-resident patients — a state with 30 million people and one of the largest Medicaid populations in the country. The administrative burden is confirmed; the revenue impact is not yet quantified in available sources.

The GLP-1 market dynamic deserves separate attention. Branded semaglutide and tirzepatide carry annual costs of $8,000 to $10,000 per user[McKinsey]. During the FDA-declared shortage, compounded versions were legally permissible — which is the business model Hims & Hers, Ro, and others built. The FDA has signaled that the shortage designation for semaglutide is ending, which closes the legal window for compounding. When compounding becomes impermissible, platforms dependent on GLP-1 revenue must either pivot to branded drug prescribing (lower margin, no dispensary revenue) or absorb the revenue loss. This transition is happening now, not in 2027.

The DEA Special Registrations rule is the single most important regulatory event to track. If the rule is finalized before the December 31, 2026 deadline, the industry gets a permanent framework — burdensome for some, but predictable. If no rule is finalized and no fifth extension is issued, the Ryan Haight Act reverts fully on January 1, 2027, and every controlled-substance prescribing workflow without in-person infrastructure is immediately non-compliant. The interval between now and year-end 2026 is the window in which DEA rulemaking signals matter most. Watch the Federal Register for a finalized rule or a fifth extension proposal.

On reimbursement, the key signal is Congressional action on the 2027 telehealth cliff. The question is not whether legislators want to extend telehealth coverage — they do, repeatedly — but whether they do so permanently or via another short-term continuation. A temporary extension kicks the risk forward. A permanent extension removes it. Watch for telehealth-specific provisions in any major healthcare or budget legislation introduced before mid-2027.

For individual companies: Hims & Hers' next earnings call is the clearest company-specific signal. If management discloses a revenue decline in GLP-1 categories or references the DOJ referral in risk factors without quantification, the enforcement is moving. Teladoc's guidance on membership and per-member revenue is the best proxy for overall telehealth demand normalization. If guidance is revised downward in consecutive quarters, it signals the post-pandemic demand floor has not been found.