---
title: "Telehealth Glossary: MSO, CPOM, 503A, EPCS and More"
description: "Plain-English definitions of the legal, licensing, prescribing, pharmacy and privacy terms a telehealth founder meets, with how Cuvo Health handles each."
canonical: "https://cuvo.co/glossary"
last-updated: "Oct 26, 2026"
---
# The telehealth glossary for brand founders

Launching a telehealth brand means meeting a vocabulary built by state medical boards, the DEA, the FDA, HHS and the FTC. Each entry below defines one term in plain English, cites the rule behind it, and says how Cuvo Health handles it for the brands on its platform.

## Legal structure

- [Anti-Kickback Statute](https://cuvo.co/glossary/anti-kickback-statute): The federal Anti-Kickback Statute, 42 U.S.C. 1320a-7b(b), makes it a felony to knowingly and willfully offer, pay, solicit or receive anything of value to induce or reward referrals of items or services payable in whole or in part by a federal health care program such as Medicare or Medicaid.
- [Corporate practice of medicine (CPOM)](https://cuvo.co/glossary/corporate-practice-of-medicine): The corporate practice of medicine (CPOM) doctrine is a body of state law that bars or limits companies owned by non-physicians from practicing medicine or employing physicians, so that clinical judgment stays with licensed professionals.
- [Fair market value (FMV) in healthcare arrangements](https://cuvo.co/glossary/fair-market-value-healthcare): Fair market value (FMV) in healthcare is the price a service, asset or rental would bring in an arm's-length deal between well-informed parties who are not in a position to send each other business, the benchmark federal fraud and abuse rules apply to payments between referral sources.
- [Fee-splitting laws](https://cuvo.co/glossary/fee-splitting): Fee-splitting laws are state statutes and medical board rules that bar a licensed clinician from sharing professional fees with an unlicensed person, or from paying part of a fee in return for patient referrals, outside the arrangements the law permits.
- [Friendly PC (friendly professional corporation)](https://cuvo.co/glossary/friendly-pc): A friendly PC (friendly professional corporation) is a medical professional corporation owned by a licensed physician that holds the clinical practice, while a management services organization owned by non-physicians runs the business side under a management services agreement.
- [Management services agreement (MSA)](https://cuvo.co/glossary/management-services-agreement): A management services agreement (MSA) is the contract under which a management services organization provides non-clinical services such as billing, technology, staffing and marketing to a medical practice for a stated fee, while the practice keeps control of every clinical decision.
- [Management services organization (MSO)](https://cuvo.co/glossary/management-services-organization): A management services organization (MSO) is a company that runs the non-clinical side of a medical practice, such as billing, technology, marketing and staffing, under a management services agreement, while licensed clinicians own the practice and make every clinical decision.
- [Professional corporation (PC) and PLLC](https://cuvo.co/glossary/professional-corporation): A professional corporation (PC) or professional limited liability company (PLLC) is a business entity that state law allows to practice a licensed profession such as medicine, with ownership limited to people licensed to render that professional service.
- [Stark Law (physician self-referral)](https://cuvo.co/glossary/stark-law): The Stark Law, 42 U.S.C. 1395nn, bars a physician from referring patients for designated health services payable by Medicare to an entity with which the physician or an immediate family member has a financial relationship, unless an exception applies, and bars that entity from billing for them.

## Licensure and providers

- [CAQH ProView](https://cuvo.co/glossary/caqh-proview): CAQH ProView, now called the CAQH Provider Data Portal, is a free online profile where clinicians enter and attest to their professional data once and authorize health plans to use it for credentialing, enrollment and provider directories.
- [Collaborative practice agreement](https://cuvo.co/glossary/collaborative-practice-agreement): A collaborative practice agreement is a written agreement, required by some states, between a physician and a nurse practitioner or physician assistant that sets out the care the clinician provides and how the physician is available for consultation.
- [Full practice authority (nurse practitioners)](https://cuvo.co/glossary/full-practice-authority): Full practice authority means state law lets nurse practitioners evaluate patients, diagnose, order and interpret tests, and start and manage treatment, including prescribing, under the exclusive licensure authority of the state board of nursing.
- [Interstate Medical Licensure Compact (IMLC)](https://cuvo.co/glossary/interstate-medical-licensure-compact): The Interstate Medical Licensure Compact (IMLC) is an agreement among member states that gives qualified physicians a voluntary, expedited path to licensure in several states, with each member state still issuing its own full license.
- [National Provider Identifier (NPI)](https://cuvo.co/glossary/national-provider-identifier): The National Provider Identifier (NPI) is the 10-digit identifier HIPAA's administrative simplification rules adopt for health care providers. It identifies a provider in standard transactions and carries no information about the provider in the number itself.
- [Nurse Licensure Compact (NLC)](https://cuvo.co/glossary/nurse-licensure-compact): The Nurse Licensure Compact (NLC) lets a registered nurse or a licensed practical or vocational nurse hold one multistate license, issued by the home state, that authorizes practice in person or by telehealth in the other compact states.
- [OIG exclusion list (LEIE) and sanction screening](https://cuvo.co/glossary/oig-exclusion-list): The OIG exclusion list, formally the List of Excluded Individuals/Entities (LEIE), names the people and companies the HHS Office of Inspector General has excluded from federal health care programs. Sanction screening is the routine check of clinicians against it and similar lists.
- [Primary source verification](https://cuvo.co/glossary/primary-source-verification): Primary source verification is the practice of confirming a clinician's credentials, such as a license, education, board certification or registration, directly with the body that issued them rather than relying on copies or the clinician's own statements.
- [Provider credentialing](https://cuvo.co/glossary/provider-credentialing): Provider credentialing is the process of collecting and verifying a clinician's qualifications, including license, education, training, board certification, registrations and malpractice and sanction history, before the clinician treats patients, then repeating it on a set cycle.
- [Originating site and distant site (telehealth)](https://cuvo.co/glossary/telehealth-originating-site): In telehealth, the originating site is where the patient is located when a service is delivered, and the distant site is where the treating clinician is located. State licensure follows the originating site: the clinician must be authorized to practice in the patient's state.

## Prescribing

- [Asynchronous telehealth (store and forward)](https://cuvo.co/glossary/asynchronous-telehealth): Asynchronous telehealth, also called store and forward, is care in which a patient's medical information, such as an intake questionnaire, photos or lab results, is sent to a licensed provider who reviews it later, without the two meeting in real time.
- [Controlled substance schedules](https://cuvo.co/glossary/controlled-substance-schedules): Controlled substance schedules are the five categories, Schedule I through V, into which the Controlled Substances Act sorts regulated drugs by potential for abuse, accepted medical use and dependence risk, with Schedule I the most restricted.
- [DEA registration for telehealth prescribers](https://cuvo.co/glossary/dea-registration): A DEA registration is the federal authorization a practitioner must hold to prescribe controlled substances, issued under the Controlled Substances Act for a state where the practitioner is authorized to prescribe and renewed every three years.
- [DEA special registration for telemedicine](https://cuvo.co/glossary/dea-special-registration-telemedicine): DEA special registration for telemedicine is a registration the Controlled Substances Act lets the DEA issue so a practitioner can prescribe controlled substances by telemedicine without a prior in-person evaluation; as of October 26, 2026, its final rule had not been published.
- [E-prescribing](https://cuvo.co/glossary/e-prescribing): E-prescribing is the electronic transmission of a prescription and related information between a prescriber and a pharmacy, usually as NCPDP SCRIPT standard messages carried by an e-prescribing network, in place of paper, fax or a phone call.
- [Electronic prescribing of controlled substances (EPCS)](https://cuvo.co/glossary/epcs): Electronic prescribing of controlled substances (EPCS) is the sending of a Schedule II through V prescription from a prescriber to a pharmacy electronically, using software and two-factor credentials that meet the DEA's requirements in 21 CFR Part 1311.
- [Good faith exam](https://cuvo.co/glossary/good-faith-exam): A good faith exam is the medical evaluation a licensed prescriber performs before a patient receives a prescription treatment, such as an injectable at a med spa, to confirm there is a medical indication and that the treatment is appropriate.
- [Prescription drug monitoring program (PDMP)](https://cuvo.co/glossary/prescription-drug-monitoring-program): A prescription drug monitoring program (PDMP) is a state electronic database of dispensed controlled substance prescriptions, which authorized prescribers and pharmacists use to review a patient's controlled substance history before prescribing or dispensing.
- [Standing orders](https://cuvo.co/glossary/standing-orders): A standing order is a written protocol, approved by a physician or other authorized prescriber, that lets nurses or other trained staff carry out a defined intervention for patients who meet set criteria, without a new patient-specific order each time.
- [Synchronous telehealth](https://cuvo.co/glossary/synchronous-telehealth): Synchronous telehealth is care delivered in real time, with the patient and a licensed provider at different locations communicating live, usually by two-way audio and video and in limited cases by audio only.

## Pharmacy and compounding

- [503A compounding pharmacy](https://cuvo.co/glossary/503a-pharmacy): A 503A compounding pharmacy is a state-licensed pharmacy that compounds drugs for identified individual patients on valid prescriptions under section 503A of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 353a), overseen day to day by its state board of pharmacy.
- [503B outsourcing facility](https://cuvo.co/glossary/503b-outsourcing-facility): A 503B outsourcing facility is a compounder of sterile drugs at one location that has registered with FDA under section 503B of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 353b), follows current good manufacturing practice and may compound with or without patient-specific prescriptions.
- [Beyond-use date (BUD)](https://cuvo.co/glossary/beyond-use-date): A beyond-use date (BUD) is the date or time after which a compounded preparation may not be stored, transported or started on a patient, counted from when it was compounded. It is set by the compounder and differs from the expiration date a manufacturer sets for an FDA-approved drug.
- [FDA bulk drug substance categories (Category 1, 2, 3)](https://cuvo.co/glossary/bulk-drug-substance-categories): FDA's bulk drug substance categories sort the ingredients nominated for its 503A and 503B bulks lists while FDA evaluates them: Category 1 may be used under FDA's interim policy, Category 2 raises significant safety risks, and Category 3 was nominated without enough support.
- [Compounded medication](https://cuvo.co/glossary/compounded-medication): A compounded medication is a drug that a licensed pharmacist, a licensed physician or an outsourcing facility prepares by combining, mixing or altering ingredients to meet a patient's needs. It is not FDA-approved, so FDA does not review its safety, effectiveness or quality before it is marketed.
- [FDA drug shortage list](https://cuvo.co/glossary/fda-drug-shortage-list): The FDA drug shortage list is the public, up-to-date list of drugs FDA has determined to be in shortage in the United States, kept under section 506E of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 356e) and published as FDA's Drug Shortages Database.
- [Nonresident pharmacy license](https://cuvo.co/glossary/nonresident-pharmacy-license): A nonresident pharmacy license is the license, permit or registration a state requires of a pharmacy located outside its borders before that pharmacy ships, mails or delivers prescription drugs to the state's residents, held in addition to the pharmacy's home-state license.
- [Cold chain shipping for medications](https://cuvo.co/glossary/pharmacy-cold-chain): Cold chain shipping for medications is the unbroken temperature-controlled path that keeps a refrigerated drug within its labeled storage range, usually 2 to 8 degrees C, from the dispensing pharmacy to the patient's door, using insulated packaging, coolant and timed transit.
- [Research use only (RUO) products](https://cuvo.co/glossary/research-use-only): Research use only (RUO) is a label saying a product is for laboratory research, not use in people; federal rules define it for in vitro diagnostics in 21 CFR 809.10(c). For drugs it is no legal shield: FDA judges a product by intended use, so an RUO product sold for human use is a drug.

## Privacy and security

- [Business associate agreement (BAA)](https://cuvo.co/glossary/business-associate-agreement): A business associate agreement (BAA) is the written contract HIPAA requires before a covered entity lets a vendor create, receive, maintain or transmit protected health information on its behalf, setting how the vendor may use, safeguard and return it.
- [Consumer health data (Washington My Health My Data Act)](https://cuvo.co/glossary/consumer-health-data): Under Washington's My Health My Data Act (RCW 19.373), consumer health data is personal information linked or reasonably linkable to a consumer that identifies their past, present or future physical or mental health status; HIPAA-protected data is exempt.
- [Covered entity (HIPAA)](https://cuvo.co/glossary/covered-entity): Under HIPAA, a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction, such as a claim or an eligibility inquiry (45 CFR 160.103).
- [Designated record set](https://cuvo.co/glossary/designated-record-set): A designated record set is the group of records a HIPAA covered entity keeps about individuals, including a provider's medical and billing records and any records used to make decisions about them; it is what a patient may inspect and copy (45 CFR 164.501).
- [FTC Health Breach Notification Rule](https://cuvo.co/glossary/ftc-health-breach-notification-rule): The FTC Health Breach Notification Rule (16 CFR Part 318) requires vendors of personal health records and related entities that HIPAA does not cover to notify consumers, the FTC and sometimes the media after a breach of identifiable health information.
- [HIPAA right of access](https://cuvo.co/glossary/hipaa-right-of-access): The HIPAA right of access is a patient's right to inspect and get a copy of their protected health information in a covered entity's designated record set, which the covered entity must act on within 30 days, with one 30-day extension (45 CFR 164.524).
- [Protected health information (PHI)](https://cuvo.co/glossary/protected-health-information): Protected health information (PHI) is individually identifiable information about a person's health, care or payment for care that HIPAA protects when a covered entity or its business associate holds or transmits it, in any form or medium.
- [SOC 2 Type II](https://cuvo.co/glossary/soc-2-type-ii): SOC 2 Type II is an independent CPA's report, under AICPA standards, on whether a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy were suitably designed and operated effectively over a period.

## Advertising and consumer protection

- [LegitScript certification](https://cuvo.co/glossary/legitscript-certification): LegitScript certification is a third-party review of a healthcare merchant's licensing, legal history, practices and advertising; Google requires it of US telemedicine advertisers, and Meta of online pharmacies and telehealth providers.
- [Restore Online Shoppers' Confidence Act (ROSCA)](https://cuvo.co/glossary/restore-online-shoppers-confidence-act): The Restore Online Shoppers' Confidence Act (ROSCA), 15 U.S.C. 8401 to 8405, bars charging consumers online through a negative option feature, such as an auto-renewing subscription, unless the seller discloses all material terms, gets express informed consent and offers a simple way to stop.

## Platform and operations

- [Merchant of record (telehealth)](https://cuvo.co/glossary/merchant-of-record): A merchant of record is the business that sells to the customer in its own name and takes the card payment through its own merchant account, so its name appears on the card statement and it answers for refunds and chargebacks.
- [Revenue share (telehealth platforms)](https://cuvo.co/glossary/telehealth-platform-revenue-share): Revenue share is a pricing model in which a telehealth platform is paid a percentage of the revenue a brand's patients generate, in place of or alongside fixed platform and per-visit fees, so the platform's take grows with the brand's sales.
- [White label pharmacy](https://cuvo.co/glossary/white-label-pharmacy): A white label pharmacy is a licensed pharmacy that fills and ships prescriptions for a telehealth brand's program, so the patient experiences one branded service while the pharmacy dispenses under its own licenses and its own name on the prescription label.

Canonical page: https://cuvo.co/glossary