The Five-Minute Call Billed as an Hour: What MSOs and Physician Owners Should Take From a New Telehealth Fraud Case

Bill an hour for a five-minute phone call. Then do it again, for nearly every patient, for three years. That is what federal prosecutors say happened at a Washington, D.C. mental health provider.

If you own a medical practice that works with a management services organization (MSO), or you run the MSO, this case deserves more than a headline. Telehealth fraud usually lives in the gap between the business that runs operations and the practice whose name is on the claims. Whichever side you are on, your biggest risk is often the other side.

A five-minute call, billed as an hour

On November 5, 2026, federal prosecutors in Washington, D.C. unsealed a 10-count indictment against two executives and a community support worker at Quality Healthcare Services, LLC, a provider of mental health rehabilitation services to low-income youth. According to the indictment announcement, the company billed D.C. Medicaid roughly $14 million between January 2022 and February 2025.

The alleged method was simple. Staff were told to bill four units, about one hour, for every telehealth encounter, even calls that lasted only a few minutes. To look less suspicious to regulators, they were allegedly told to record a random session length between 53 and 67 minutes.

Management also allegedly told staff to "make sure to use" all 600 units Medicaid authorized per patient over 180 days, regardless of medical necessity or whether the service happened at all. The government is seeking forfeiture of five luxury vehicles, a Maryland house, and a Cartier watch. These are allegations; the defendants are presumed innocent unless and until proven guilty.

The pattern: unnecessary or phantom services

The D.C. case fits the two oldest templates in healthcare fraud: billing for services that were never provided, and billing for services that were not medically necessary. Telehealth did not invent either one. It made both easier to scale, because no one sees an empty waiting room when the "visit" is a phone call.

The numbers show how central this has become. In June 2026, the Justice Department announced its 2026 National Health Care Fraud Takedown: 455 defendants, including 90 doctors and other licensed professionals, tied to more than $6.5 billion in alleged false claims.

The common thread is that every claim carries a licensed provider's name, and in most telehealth businesses, someone else runs the machine that submits it. That is where the physician owner and the MSO come in.

The friendly PC owner: your name, their billing

If you are the physician owner of a "friendly PC," the claims are going out under your name, even when someone else runs the operation. In California and other corporate practice of medicine states, a management services organization (MSO) often handles marketing, staffing, technology, and billing, while the physician owns the professional corporation that holds the licenses, payer enrollments, and NPI.

That structure is lawful and common, especially in telehealth. But it creates a gap between who controls the money and who carries the liability. The PC is the enrolled provider. The claims are submitted under its Tax ID, and often under the owner's individual NPI as the rendering or supervising provider.

The law does not let you hide in that gap:

• Medicare enrollment and payment. The PC, not the MSO, is the enrolled supplier. Medicare's anti-assignment rules generally bar paying anyone other than the supplier, so an MSO can handle collections only as a billing agent, with payment issued in the PC's name (42 C.F.R. § 424.73). The MSO is compensated through its management fee. The claims history, overpayments, and enrollment risk all stay with the PC. Each clinician who reassigns benefits to the PC is also jointly and severally liable with it for overpayments (42 C.F.R. § 424.80(d)).
• False Claims Act. "Knowingly" includes deliberate ignorance and reckless disregard, not just actual knowledge (31 U.S.C. § 3729(b)(1)). "The MSO handled billing" is not a defense if the red flags were there to see.
• State Medicaid programs. Payment suspensions, overpayment demands, and exclusions attach to the enrolled provider. In California, a Medi-Cal suspension or audit lands on the PC and its owner first, regardless of who designed the billing practices.

In short, a friendly PC owner can face repayment, exclusion, licensing discipline, and in the worst cases criminal exposure, for a scheme they never designed and never profited from.

The MSO: your fee, their charts

Now flip the arrangement around. The MSO runs the business, but it doesn't see patients. Every claim it submits rests on documentation written by clinicians it doesn't control, at least on paper. If those clinicians inflate visit times, copy notes forward, or document services that never happened, the MSO is the one pushing those claims out the door.

Running the operation is not insulation:

• "Causes to be presented." The False Claims Act reaches anyone who causes a false claim to be submitted, not just the provider whose name is on it (31 U.S.C. § 3729(a)(1)). An MSO that designs billing workflows, sets coding defaults, or submits claims can be a defendant, and so can its executives. Look again at who was charged in D.C.: the company's executives.
• A fee paid from bad claims. If the management fee comes out of collections, and collections come from services that weren't provided or weren't necessary, the MSO has been paid with the proceeds. Expect the government to come after that money, and in criminal cases, the cars and the house.
• Fee structures that invite scrutiny. Percentage-of-collections fees are common, but when the MSO also handles marketing or patient acquisition, regulators can view that fee as payment for generating business. That is an Anti-Kickback Statute question prosecutors like to pair with fraud charges.
• A disengaged owner is your problem too. If the physician owner isn't exercising real clinical oversight, the arrangement starts to look like the MSO is practicing medicine. That invites corporate practice challenges that can unravel the whole structure, including the MSO's right to its fee.

In short, an MSO can lose its revenue, its contracts, and in the worst cases its executives' freedom, because of clinicians it chose not to watch closely.

Both sides end up in the indictment

In case after case, the business people designed the scheme and captured most of the money, while the physician supplied the license and absorbed the consequences. But the business side does not walk away either.

The Done case is the closest to a classic MSO-PC structure: a business entity ran the platform and marketing, and a physician-led P.C. supplied the prescribers. The jury convicted both. According to the Justice Department, the physician personally wrote prescriptions for more than 394,000 stimulant pills for patients he never evaluated (Fierce Healthcare).

For physician owners, the per-order cases show the economics. A physician earning $15 or $20 per signature enabled claims worth hundreds of dollars each to someone else. The license was the most valuable asset in the scheme, and the physician was paid the least for it.

For MSOs, the Done case cuts the other way. The founder ran the business, never wrote a prescription, and received the longest sentence: six years. Running the operation from the business side is not a shield.

"We're cash pay. None of this applies to us."

If your telehealth business never bills Medicare, Medicaid, or insurance, it's tempting to read everything above and shrug. That would be a mistake, for four reasons.

Your patients' insurance still pays for something. Done Global ran on cash. Patients paid a monthly subscription, and Done's revenue came from those fees, not insurance claims. It was still convicted of health care fraud conspiracy, because its prescriptions were filled at pharmacies that billed Medicare, Medicaid, and commercial insurers, which paid more than $14 million (Fierce Healthcare; DOJ). The same is true of lab tests, imaging, and supplies your clinicians order. A cash-pay visit can generate insured claims downstream, and the order that caused them has your clinician's name on it.

Federal fraud law isn't limited to government programs. The federal health care fraud statute covers private insurance plans, not just Medicare (18 U.S.C. § 1347), and the wire fraud statute reaches any scheme that uses the internet to take money by false pretenses, with no insurer required (18 U.S.C. § 1343). A platform that sells a treatment it doesn't deliver, or a result it can't support, is selling over the wire.

Consumer protection agencies are watching subscription telehealth. The FTC has gone after cash-pay telehealth companies for how they price, advertise, and bill. Cerebral agreed to pay about $5.1 million in consumer refunds over allegedly deceptive cancellation practices, along with other relief tied to its handling of patient data (FTC). In December 2025, the FTC finalized an order against GLP-1 weight-loss company NextMed and its two founders personally, over advertised prices that allegedly left out the cost of the drug, labs, and consultations, plus fake reviews and before-and-after photos (FTC). Subscription billing, auto-renewal, and cancellation are exactly where cash-pay businesses live.

State law doesn't care who pays. In California, paying or receiving compensation for patient referrals is prohibited regardless of payer (Bus. & Prof. Code § 650). Prescribing without an appropriate prior examination and medical indication is unprofessional conduct (Bus. & Prof. Code § 2242), which puts the clinician's license at risk no matter how the patient paid. California's automatic renewal law adds its own rules for subscriptions and cancellations (Bus. & Prof. Code § 17600 et seq.). And the corporate practice of medicine doctrine applies with full force: in cash-pay models, it is often the MSO that sets the protocols, the pricing, and the patient funnel, which is exactly the control the doctrine reserves to physicians.

Cash pay changes who the regulators are. It doesn't change whether there are any. For the physician owner, the license and the prescriptions are still yours. For the MSO, the marketing, the subscription terms, and the cancellation flow are usually yours, and those are what consumer protection enforcers look at first.

The AI consult with a one-click physician

A newer version of the same problem is spreading fast in cash-pay telehealth. The patient fills out a questionnaire or chats with an AI tool. The software drafts the assessment and the prescription. A physician sees a queue of AI-generated recommendations and clicks "approve," often in seconds, often hundreds of times a day.

Look again at the table above. Dr. Becerril averaged 26 seconds per review and received 40 months in prison. Clicking "approve" on a recommendation written by software is the same signature, just faster. The law does not care who drafted the order. The physician who approves it is the prescriber, and the prescription has to reflect that physician's own judgment, after an appropriate examination, under the same standard of care that applies to any other visit (Bus. & Prof. Code § 2242). For controlled substances, the Ryan Haight Act adds its own federal requirements for prescribing over the internet, and a chatbot conversation does not satisfy them (21 U.S.C. § 829(e)).

Regulators are now saying this out loud:

• California. AB 1979, signed in 2026, requires health facilities, clinics, and physician offices to take reasonable steps to ensure that licensed providers keep exercising independent professional judgment whenever AI clinical decision support informs patient care (AB 1979; Chief Healthcare Executive). A separate law, AB 489, targets AI tools that present themselves as licensed healthcare professionals (AB 489).
• Pennsylvania. In May 2026, the State Board of Medicine sued the company behind Character.AI, alleging that a chatbot claiming to be a psychiatrist was engaged in the unlawful practice of medicine under the state's Medical Practice Act (Route Fifty).
• Utah. Even Utah's pilot letting an AI system handle prescription renewals, among the most permissive programs in the country, requires a licensed physician to review and approve every AI-generated renewal before it goes to the pharmacy, and is limited to existing prescriptions for specific chronic conditions (GovInfoSecurity).

The common theme is that human review only counts if it is real. Review that is nominal, rushed, or unable to change the outcome is unlikely to protect anyone.

For the physician owner, every click is a prescription under your license, and the platform's logs will show how long each review took and how often you said no. An approval rate near 100% at a few seconds per patient is evidence that no medical judgment was exercised. It is also exactly the kind of data prosecutors and medical boards now ask for.

For the MSO, the AI tool is usually yours: you licensed it, configured it, and decided how the approval queue works. If the software is effectively making the clinical decision and the physician is only clicking through, the business is practicing medicine, which is the core problem under the corporate practice of medicine doctrine. Depending on what the tool does, it may also raise FDA medical device questions.

A defensible AI workflow looks different: the physician can easily modify or reject any recommendation, the system tracks review time and override rates, patients are told when AI is involved, and anything outside defined parameters goes to a real visit.

Red flags

Most of these schemes leave visible fingerprints long before the subpoena arrives. Treat any of the following as a reason to ask hard questions.

For the physician owner

• You can't see the claims. The MSO controls the clearinghouse, the payer portals, and the remittances, and reports to you only in summary form or not at all.
• You don't control the bank account. Payer deposits land in an account the MSO controls, or a deposit account control agreement sweeps everything out before you can review it.
• Billing looks too uniform. Every visit is billed at the same level, every session runs about an hour, or patients consistently hit the maximum authorized units. That is exactly what the D.C. indictment describes.
• Pay is tied to volume. You or your clinicians are paid per order, per prescription, or per signature, or the MSO fee rises with collections in a way that rewards utilization.
• Patients arrive pre-packaged. Patients come from marketers or lead generators, charts arrive pre-populated, and your clinicians are expected to sign in seconds.
• Clinical judgment is overridden. Clinicians are discouraged from declining treatment, discharging patients, or changing a protocol the business side designed.
• You don't know who is practicing under your PC. You did not credential or interview the providers billing under your Tax ID, and you don't know which states they are licensed in.
• You approve what a machine wrote. An AI tool drafts the assessment and prescription, and your clinicians approve nearly all of them in seconds.
• Regulatory mail doesn't reach you. Records requests, audit letters, or payer inquiries are handled by the MSO without your involvement.

For the MSO

• Documentation that never changes. Notes are copied from visit to visit, session times are suspiciously consistent, and assessments read like templates.
• Collections outpace volume. Revenue per patient climbs without a matching change in services, patient mix, or payers.
• Clinicians resist review. Providers push back on documentation requests, refuse coding audits, or insist on codes their notes don't support.
• Certain clinicians draw payer attention. Records requests, prepayment reviews, or denials cluster around the same few providers.
• Credentials you can't confirm. Clinicians are treating patients in states where you can't verify their licenses, or their payer enrollments have lapsed.
• Marketing is driving the medicine. Patients come in through partners whose pitch is a product or a prescription rather than an evaluation.
• AI recommendations are never overruled. Physicians almost never modify or reject what your software recommends, and the system doesn't track how long they spend reviewing.
• The owner is a name on paper. The physician owner never reviews charts, never signs off on protocols, and is hard to reach when a clinical question comes up.

None of these proves fraud on its own. Each one is a gap between what the paperwork says and what is actually happening, and that gap is where liability lives.

How to protect yourself

The best protection is built into the management services agreement before the first claim goes out. Fixing it after an audit letter arrives is far more expensive.

What the physician owner should insist on

1. Direct, unfiltered access to billing data. The PC should have its own log-in to the clearinghouse and payer portals, plus the right to pull claim-level reports at any time without going through the MSO.
2. Independent audit rights. The PC should be able to engage its own coder or auditor, at least annually, with the MSO required to cooperate and to fix what the audit finds.
3. Control of the money. Payer deposits should go to a PC-owned account. If the MSO is paid through a sweep, the PC should keep the right to stop it if compliance concerns arise.
4. A fixed, fair-market-value fee. Avoid management fees and clinician pay that rise with orders, prescriptions, or units billed. The OIG has flagged volume-based pay in telehealth arrangements as a warning sign (OIG Special Fraud Alert).
5. Clinical autonomy in writing. The agreement should state that all clinical decisions, including whether to treat, prescribe, or discharge, belong to the PC and its clinicians.
6. Credentialing approval. No clinician should bill under the PC's Tax ID unless the PC has approved and credentialed them.
7. Immediate notice of regulatory contact. The MSO should be required to forward any audit, subpoena, records request, or payer inquiry to the PC within days.
8. A real exit. The PC should be able to terminate for compliance concerns, keep its patient records, and unwind the arrangement in an orderly way.

What the MSO should insist on

1. Documentation standards with teeth. The PC should commit that its clinicians will complete timely notes that support every service billed, and that unsupported services will not be submitted.
2. The right to audit clinicians and hold claims. The MSO should be able to review documentation and coding, and to hold or correct claims that the records don't support, without being accused of interfering with clinical judgment.
3. Representations on every clinician. The PC should represent that each clinician is licensed where they practice, properly enrolled, and not excluded, and should notify the MSO immediately of any change.
4. A physician owner who actually oversees. Spell out the owner's duties: approving protocols, reviewing charts, supervising clinicians, and being reachable. An engaged owner protects the MSO as much as the PC.
5. A fee that survives scrutiny. Set the fee at fair market value for the services actually provided, and be especially careful with percentage-based fees if the MSO also markets or acquires patients.
6. Mutual notice. Audits, complaints, and payer inquiries should flow both ways, so neither side is surprised.
7. A path forward if the PC won't fix problems. Include termination rights and, where state law allows, a succession or stock transfer restriction agreement so a noncompliant owner can be replaced without shutting down patient care.

The two lists fit together. Almost everything that protects the physician owner also protects the MSO. An agreement that gives both sides real visibility is the cheapest insurance either one can buy.

If you find a problem

Act on it. Preserve the records, figure out which claims are affected, and get counsel involved before you confront the other side, so the investigation is privileged and the evidence stays intact.

If the review turns up an overpayment, the clock is running. Federal law generally requires an identified Medicare or Medicaid overpayment to be reported and returned within 60 days (42 U.S.C. § 1320a-7k(d)), with some room for a timely, good-faith investigation (42 C.F.R. § 401.305). Holding onto a known overpayment can turn a billing error into a False Claims Act case, for whichever side knew about it.

The bottom line

The MSO-PC model is a legitimate way to build a compliant practice, and most physician owners and MSOs are not fraudsters. But the D.C. indictment, the Done Global convictions, and the per-order telemedicine cases share one lesson: when a scheme runs through this structure, enforcement agencies charge the license and the business together.

At Eliav Legal, we represent physicians, professional corporations, MSOs, and pharmacies in structuring management arrangements, reviewing existing agreements for gaps, and responding to Medicare and Medi-Cal audits, overpayment demands, and investigations. Whether you own the PC or run the MSO, if you aren't sure what is being billed and how, contact us for a confidential review.

This article is for general informational purposes and is not legal advice. Requirements vary by state, payer, and arrangement. The D.C. case involves allegations, and the defendants are presumed innocent unless proven guilty.

Sources

• U.S. Attorney's Office, D.C.: Quality Healthcare Services indictment (Nov. 5, 2026)
• DOJ: 2026 National Health Care Fraud Takedown (June 2026)
• DOJ: Done Global indictment
• Fierce Healthcare: Done Global indicted
• Fierce Healthcare: Done founder sentenced
• Telehealth.org: Done Global sentencing
• Becker's: Becerril sentencing
• Becker's: Powell sentencing
• California AB 1979 (2026), health care services: artificial intelligence
• California AB 489 (2025), AI and health care professional titles
• Chief Healthcare Executive: California AI health care laws
• Route Fifty: Pennsylvania sues Character.AI developer
• GovInfoSecurity: Utah AI prescription renewal pilot
• FTC: Cerebral order
• FTC: NextMed final order
• HHS-OIG Special Fraud Alert on telemedicine arrangements (July 20, 2022)
• 18 U.S.C. § 1343, wire fraud
• 18 U.S.C. § 1347, health care fraud
• 21 U.S.C. § 829, Ryan Haight Act internet prescribing requirements
• 31 U.S.C. § 3729, False Claims Act
• 42 U.S.C. § 1320a-7k(d), reporting and returning overpayments
• 42 C.F.R. § 401.305, Medicare overpayment requirements
• 42 C.F.R. § 424.73, prohibition of assignment
• 42 C.F.R. § 424.80, reassignment
• Cal. Bus. & Prof. Code § 650
• Cal. Bus. & Prof. Code § 2242
• Cal. Bus. & Prof. Code § 17600 et seq., automatic renewal law