An outsourced good faith exam is only as good as four things behind it: the examiner’s license in your patient’s state, the professional entity that employs the examiner, the patient-specific order that comes out of the exam, and the record you can still reach after the contract ends. The ten questions below test those four things, and each one is tied to a rule.
We should say this plainly: MDside provides good faith exams, so we are a vendor in the market this post describes. The questions are the ones we expect to be asked, and every rule cited is there so you can check the answer without taking our word, or anyone else’s.
Ten questions, and the rule behind each
1. For every state where my patients sit, show me the examiner’s license or registration in that state. North Dakota says it most cleanly: “The practice of medicine is deemed to occur in the state the patient is located” (N.D.C.C. § 43-17-02.3). Texas treats an out-of-state practitioner who performs an act that is part of patient care initiated in Texas as practicing medicine in Texas (Occ. Code § 151.056(a)). Florida and Arizona let out-of-state clinicians register for telehealth, and both bar a registrant from opening an office in the state (Fla. Stat. § 456.47(4); A.R.S. § 36-3606). See how a nationwide provider network works.
2. How is the exam actually performed, and is that enough in my state? Texas recognizes synchronous audiovisual interaction, or store and forward used with “clinically relevant photographic or video images” or the patient’s records (Occ. Code § 111.005(a)(3)). North Dakota says an evaluation “consisting only of a static online questionnaire or an audio conversation does not meet the standard of care.” New Jersey bars a prescription “based solely on the responses provided in an online static questionnaire.” California is the contrast: § 2242(a) allows the exam to be asynchronous, questionnaire included, if the standard of care is met. The detail is in telehealth good faith exam rules.
3. If the examiner is an NP or PA, where is the physician agreement for my state, and how many others does that physician hold? In Texas, prescribing is delegated through a written, signed prescriptive authority agreement, the physician’s combined total “may not exceed seven,” the parties meet at least monthly, and the agreement must reach a board within three business days of a request (Occ. Code § 157.0512). Since September 1, 2025, elective IV therapy delegations count toward that cap (§ 172.051). Georgia requires nurse protocol agreements to be filed with the Board within 30 days of execution (r. 360-32-.03).
4. Which physician-owned professional entity employs or contracts the examiner? California: “Corporations and other artificial legal entities shall have no professional rights, privileges, or powers” (Bus. & Prof. Code § 2400), and the Medical Board lists as prohibited a management company “arranging for, advertising, or providing medical services.” Texas disciplines a physician who “aids or abets the practice of medicine” by an unlicensed entity (Occ. Code § 164.052(a)(17)). The newest authority is Georgia’s. On May 7, 2026 the Composite Medical Board said that using a third-party company “does not change that result where the APRN is paying the third-party company to obtain or furnish the delegating physician.” Background: friendly PC and MSO structure.
5. Is your fee a flat charge for the exam, or does it move with what the patient buys? Florida makes it unlawful for any person to pay or receive a commission or “engage in any split-fee arrangement, in any form whatsoever” to induce patient referrals (Fla. Stat. § 817.505(1)(a)). California bars consideration for referring patients and permits percentage arrangements only where the payment is “commensurate with the value of the services furnished” (Bus. & Prof. Code § 650). New York is stricter still, as we set out in percentage fees and fee splitting.
6. Will you sign a business associate agreement for the platform, and which of your entities is the treating provider? Two HIPAA rules apply at once. A treating provider is not a business associate for disclosures “concerning the treatment of the individual” (45 CFR § 160.103, paragraph (4)(i) of the definition), and HHS confirms no agreement is needed to disclose to a provider for treatment. A company that stores, routes or schedules protected health information on your behalf is a business associate, and that relationship “must be documented through a written contract” (§ 164.502(e)(2)). Our reading: the examiner’s professional entity is the first kind, and the vendor’s platform is the second.
7. Who owns the exam record, how long is it kept, and how do I reach it if we part ways? Texas requires providers to “maintain access to medical records for the duration of the required retention period,” at least seven years (22 TAC § 163.2), and says the duty to provide records to a subsequent physician “may not be nullified by contract” (Occ. Code § 159.006(c)). Florida defines the records owner and lets an employment agreement designate the employer (Fla. Stat. § 456.057(1)). A business associate agreement must require return or destruction of the information at termination where feasible (45 CFR § 164.504(e)(2)(ii)(J)).
8. Does a prescriber assess each patient and write a patient-specific order, or do my nurses work from your standing orders? Boards have been direct. Kentucky’s three boards: standing orders do “not satisfy the physician’s legal duties to the patient” (March 28, 2025). Alabama’s medical board said the same in 2022. South Carolina: standing orders “are not client-specific and do not account for the individual health needs of patients.” Mississippi’s medical board calls delegation through such orders “unlawful.” Oklahoma’s nursing board, in 2026: “Standing orders are not an appropriate substitute for the individualized order/prescription and history and physical.” Rhode Island’s health department said it in July 2024, and the 2025 Medical Spas Safety Act now requires an initial assessment and written instructions for each procedure. North Carolina’s nursing board is more permissive, so read your own state.
9. Show me each examiner’s malpractice coverage for telehealth patients in my state, and who files an adverse event report. Florida requires out-of-state registrants to hold coverage that reaches patients outside their home state (§ 456.47(4)(e)) and requires office adverse incident reports “within 15 days” (§ 458.351(3)). Indiana’s 2026 medical spa act requires notice to the board within fifteen days of a serious adverse event, with registration required from January 1, 2027.
10. If the exam supports testosterone or another controlled drug, what is your plan for January 1, 2027? As of September 2026, the DEA and HHS telemedicine flexibilities are “effective January 1, 2026 through December 31, 2026” (90 Fed. Reg. 61301; 21 CFR § 1307.41). Without them, federal law requires a practitioner who has conducted at least one in-person medical evaluation (21 U.S.C. § 829(e)).
How to read the answers
Good answers are documents: a license list by state, a named professional entity, a sample patient-specific order, a records clause, a certificate of insurance. Weak answers are reassurance. Treat “our software company employs the clinicians” or “our standing orders cover that” as the end of the conversation. Our own process for vetting clinicians is in how we credential providers.
What this means for you
Send these ten questions in writing before the demo, and ask for the answers in writing. Check three of them yourself against the sources above: the examiner’s license in your state, the entity on the contract, and the records clause. Do not sign a fee that moves with treatment revenue. Put the January 2027 question to any vendor supporting hormone therapy now. Then read how good faith exams work, so you know what you are buying before you price it.
Related reading
Frequently asked questions
Are outsourced good faith exams legal?
Yes, when the examiner is licensed or registered in the state where the patient is located, is employed or contracted through a lawful professional entity, performs an assessment that meets that state’s standard of care, and issues a patient-specific order. Each of those conditions comes from state law, so the same vendor can be compliant in one state and exposed in another.
Can a good faith exam company be owned by non-physicians?
A lay company may supply software, scheduling and administration. In states with a corporate practice of medicine bar, such as California and Texas, it may not employ physicians to practice medicine or arrange medical services itself. Ask which physician-owned professional entity employs or contracts the examiner. Georgia’s medical board said in May 2026 that a third-party company does not cure a prohibited arrangement.
Do I need a BAA with my good faith exam vendor?
Often, yes, for the platform. Under 45 CFR 160.103 a treating provider is not a business associate for treatment disclosures, so the examining clinician’s professional entity does not need one for the exam itself. A company that stores, schedules or routes protected health information on your behalf is a business associate and needs a written agreement.
Who keeps the good faith exam record if I change vendors?
It depends on the contract and the state. Texas requires access to be maintained for the full retention period and says the duty to provide records to a subsequent physician may not be nullified by contract. Florida lets an agreement designate the records owner. A business associate agreement must address return or destruction at termination. Settle it before you sign.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.