Regulation, risk and the DEA cliff

Proven rule. Every body claim traces to a source. Inferred or single-sourced-shaky claims live in section 4.

Kicker. MEDvidi's controlled-substance business runs on a temporary rule that expires at the end of the day on 31 December 2026 — 135 days after this interview — and as of 18 August 2026 the DEA has published nothing in 2026 to replace it: no fifth extension, no final rule, no new proposal. The only replacement on the table is the January 2025 Special Registration proposal, and as written that proposal would end telemedicine-only Schedule II prescribing outright, because it caps telemedicine Schedule II scripts at under 50% of a prescriber's total Schedule II scripts in a calendar month and requires the prescriber to be physically in the patient's state for every Schedule II prescription. Meanwhile the enforcement question stopped being theoretical: on 7 July 2026 the founder of Done Global was sentenced to 72 months in federal prison for a business model DOJ described in product terms — monthly subscription, auto-refill, half-length initial visits, volume-based clinician pay. Everything else in this Area — state law, the friendly-PC structure, the ad-tech funnel on a HIPAA practice, the ESA letter line, GLP-1 — is second-order next to those two facts, and all of it is a product-design problem, not a legal-department problem.

Source legend

1. What we found

1.1 The statute, in one paragraph, because everything else is a gloss on it

The Controlled Substances Act, as amended by the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, says that a prescription for a controlled substance delivered by means of the internet is valid only if the prescribing practitioner has conducted at least one in-person medical evaluation of that patient — 21 U.S.C. §829(e) [REG-RH]. The escape hatch is the statutory definition of "practice of telemedicine" at §802(54), which lists seven circumstances in which a practitioner may prescribe without ever having examined the patient in person [REG-RH] [REG-FR4]. Two of those seven matter here. Subparagraph (D) covers a public health emergency declared by the Secretary of HHS — that is the hook DEA used in March 2020. Subparagraph (E) covers a practitioner holding a special registration for telemedicine — the regime that has never existed. A third, subparagraph (G), lets the Attorney General and the Secretary jointly designate further circumstances by rule "consistent with effective controls against diversion and otherwise consistent with the public health and safety"; that is the authority under which every temporary extension since May 2023 has been issued [REG-FR4].

One mechanical detail inside that paragraph is worth more to a product organisation than any of the rest of it. DEA states it plainly in the fourth extension: once a practitioner has conducted one in-person evaluation of a patient, the Ryan Haight remote-prescribing rules "no longer apply to that specific practitioner-patient relationship," and the practitioner may then prescribe remotely to that patient indefinitely — regardless of how long ago the in-person visit was or whether it concerned a different complaint [REG-FR4]. In other words, the in-person requirement is a one-time gate per practitioner-patient pair, not a recurring obligation. That single sentence is the seed of every credible mitigation in this Area.

1.2 The timeline, with instruments

Two numbers from that record are worth memorising. The 2023 NPRMs drew 38,369 comments [REG-FR123]; the 2025 Special Registration NPRM drew 6,475 [REG-FR4]. This is a rulemaking with a very loud, very organised constituency, which is the main reason the cliff has been postponed four times.

1.3 What exactly expires on 31 December 2026

The operative regulatory text — 21 CFR 1307.41 and its HHS twin 42 CFR 12.1, as amended by the fourth extension — reads [REG-FR4]:

"(a) This section is in effect until the end of the day December 31, 2026. The authorization granted in paragraph (b) of this section expires at the end of December 31, 2026. (b) During the period May 12, 2023, through December 31, 2026, a Drug Enforcement Administration (DEA)-registered practitioner is authorized to prescribe Schedule II-V controlled substances via telemedicine ... to a patient without having conducted an in-person medical evaluation of the patient if all of the conditions listed in paragraph (c) ... are met."

The four conditions in paragraph (c) are: a legitimate medical purpose in the usual course of professional practice; a communication using an interactive telecommunications system as defined in 42 CFR 410.78(a)(3); a practitioner authorised under their DEA registration for that schedule (or exempt under 21 U.S.C. §822(d)); and compliance with the rest of 21 CFR part 1306 [REG-FR4].

Three consequences follow directly from that text.

First, there is no grandfathering. The authorisation is drafted as a window of time in which prescriptions may be issued, not as a status a patient acquires. The first temporary rule in May 2023 did distinguish between relationships formed before and after 11 November 2023 [REG-FR123]; the second, third and fourth rules collapsed everything into a single expiry date [REG-FR123] [REG-FR4]. So on 1 January 2027, absent new action, a patient who has been treated by a MEDvidi clinician by video since 2024 is in exactly the same position as a brand-new patient: no in-person evaluation has ever occurred, so §829(e) applies again and the next Schedule II prescription is unlawful. MEDvidi's own patient-facing page says the opposite — "The proposed new regulations may affect those who begin their online treatment after December 31, 2026" [WEB]. On the text of the current rule, that statement is unsupported [REASON]. It is also boilerplate: the identical sentence appears in the 2024-12-03 Wayback capture with "December 31, 2024" substituted [ARC].

Second, the modality question is more favourable than it looks. 42 CFR 410.78(a)(3) defines an interactive telecommunications system as two-way real-time audio and video, but it then says the term "may also include two-way, real-time audio-only communication technology for any telehealth service furnished to a patient in their home if the distant site physician or practitioner is technically capable of using" video "but the patient is not capable of, or does not consent to, the use of video technology" [REG-CFR]. Because the DEA rule incorporates that definition by reference rather than writing its own, the plain reading is that an audio-only visit to a patient at home can support a controlled-substance prescription under the temporary rule where the patient cannot or will not use video [REASON]. This is a question for counsel, not for a product manager to decide alone — it is parked in section 4 — but it is worth knowing that MEDvidi's own FAQ requires a video visit for any prescription [WEB], which may be a stricter policy than the rule demands.

Third, the cliff is 135 days away and the signal window has not opened.

Days from this Finding to expiry:
  2026-08-18 -> 2026-12-31
  Aug 13 + Sep 30 + Oct 31 + Nov 30 + Dec 31 = 135 days          [REASON]

Precedent for how late DEA acts:
  Fourth extension submitted to OMB      2025-11-10   [OMB]
  Fourth extension published             2025-12-31   [REG-FR4]
  Fourth extension effective             2026-01-01   [REG-FR4]
  => 51 days from OMB submission to publication;
     21 days from publication to the prior rule's expiry.         [REASON]

Applying that precedent, the earliest reliable public signal of a fifth extension would appear at OMB around early-to-mid November 2026 [REASON]. Anyone who wants to know before then is reading tea leaves. That timing matters for the interview: as of today the honest answer to "will they extend again?" is "the record says they probably will, and the record also says we will not know until roughly seven weeks before the deadline."

1.4 What DEA has done in 2026: nothing, and that is the finding

A complete pull of DEA rules and proposed rules published between 1 January and 12 August 2026 returns 34 documents. Every one is a scheduling action, a List I chemical designation, a quota mechanic, a marijuana action, an EMS registration rule, or a Form 222 technical amendment. None touches telemedicine, Docket DEA-407, or the Special Registration [REG-DEA26]. The special registration NPRM's comment period closed on 18 March 2025 [REG-SR]; seventeen months later there is no final rule, no supplemental proposal, and no withdrawal.

DEA said in December 2025 what it intends to do with the time: "thoroughly consider the presentations made at the Telemedicine Listening Sessions, the Tribal Consultations, the E.O. 12866 meetings, as well as the comments made to the Special Registration for Telemedicine NPRM," and it stated it "intends to hold further virtual consultations with Tribal governments ... and address any concerns raised into the final set of Special Registration for Telemedicine regulations" [REG-FR4]. That is an agency saying, in the flattest available prose, that the Special Registration framework is still the plan.

1.5 The three 2027 scenarios, and what each does to the business

These are reasoned scenarios, not forecasts with a defensible base rate. The probabilities are mine and are labelled as such; the mechanics under each are sourced.

Scenario A — a fifth temporary extension (most likely). DEA has done this four times, the fourth expressly invoking the APA "good cause" exception to skip notice and comment entirely on the reasoning that running a full rulemaking before the deadline is "impracticable and contrary to the public interest" [REG-FR4]. It has an $17.2 million net-present cost-savings figure on the record to justify extension as a deregulatory action under E.O. 14192 [REG-FR4]. Nothing changes for MEDvidi except that the same conversation recurs in December 2027. My estimate: 60-70% [REASON].

Scenario B — a final Special Registration rule, softened but recognisable. The tiering, the platform registration, the nationwide PDMP check and the state registrations survive in some form; the two provisions that would kill telemedicine-only Schedule II prescribing (the same-state rule and the under-50% cap) get relaxed or phased, because 6,475 comments and the hospice/psychiatry lobbies pushed hard on exactly those [REG-SR] [OMB]. In this world MEDvidi has to become a registered entity with per-state registrations, mandatory EPCS and nationwide PDMP checks — an operational and product build of real size, but survivable. My estimate: 20-30%, and note that a final rule would almost certainly come with a compliance runway, since DEA's own stated purpose for the extension is to "allow sufficient time for providers to come into compliance" [REG-FR4] [REASON].

Scenario C — hard reversion. The rule simply lapses. Then, from 1 January 2027, no MEDvidi clinician may prescribe any Schedule II-V controlled substance to any patient they have never examined in person, unless another §802(54) exception applies [REG-RH] [REG-FR4]. Note the scope: this is not an ADHD problem. It is every scheduled item on the menu — the stimulants and the benzodiazepines and the Z-drugs and phentermine and Qsymia (see 1.7). The 2023 NPRM's answer to this was a "qualifying telemedicine referral": an in-person evaluation by another practitioner who then refers, which is the pathway MEDvidi itself built and published in 2023 (see 1.8 and 6). My estimate: 10-15% as an unmanaged lapse [REASON].

1.6 The Special Registration proposal, provision by provision

This is the single document a VP of Product at MEDvidi should have read end to end. It runs from 90 FR 6541 to 90 FR 6598; the load-bearing provisions are these [REG-SR]:

Three registrations, plus a fourth ancillary one. 1. Telemedicine Prescribing Registration — physicians and board-certified mid-level practitioners; Schedules III-V only. 2. Advanced Telemedicine Prescribing Registration — Schedules II-V, but reserved to an enumerated list: psychiatrists; hospice physicians; palliative care physicians; physicians at long-term care facilities; pediatricians; neurologists (excluding pain management); and "mid-level practitioners and physicians from other specialties who are board certified in the treatment of psychiatric or psychological disorders" (or the other listed fields). DEA is explicit that "Mid-level practitioners are ... required to be board-certified under this proposed framework." 3. Telemedicine Platform Registration — Schedules II-V, for a "covered online telemedicine platform" acting as a platform practitioner that dispenses controlled substances. DEA proposes to amend 21 CFR 1300.01 specifically to exclude such platforms from "institutional practitioner," i.e. to give them their own registrant category. 4. State Telemedicine Registration — issued by DEA (not by the states), required for every state in which a patient is treated, contingent on the underlying Special Registration, on a three-year cycle, via a new Form 224S.

The two provisions that decide MEDvidi's ADHD line. Proposed 21 CFR 1306.45(b) and (c), in DEA's own regulatory text:

"(b) A special registration prescription may not be issued for a controlled substance listed in Schedule II unless the individual special registrant is physically located in the same state in which the patient was located at the time of the telemedicine encounter ... (c) The number of special registration prescriptions issued by the individual special registrant in a calendar month for Schedule II controlled substances shall constitute less than 50 percent of the total number of Schedule II prescriptions issued in that calendar month by the individual special registrant in their telemedicine and non-telemedicine practice."

Read (c) arithmetically:

Let T = a prescriber's telemedicine Schedule II scripts in a month
Let N = the same prescriber's NON-telemedicine (in-person) Schedule II scripts

Rule as proposed:  T / (T + N) < 0.50   =>   T < N        [REG-SR]

For a telemedicine-only prescriber, N = 0:
   T / (T + 0) = 100%  > 50%   =>  no compliant volume above zero.

To place 100 telemedicine Schedule II scripts a month, a prescriber must
also write at least 101 in-person Schedule II scripts that month.        [REASON]

DEA's stated rationale is to ensure "a significant portion of these prescriptions are issued following in-person medical evaluations" [REG-SR]. Whatever the intent, the arithmetic is a prohibition on telemedicine-only Schedule II practice, and the (b) same-state rule independently destroys the economics of licence pooling: a clinician licensed in eight states can serve patients in all eight for Schedule III-V, but for Schedule II must be sitting in the patient's state at the time of the visit [REASON].

Prescription mechanics. Special registration prescriptions must be issued via electronic prescribing (EPCS), after verifying the patient's identity, and after a nationwide PDMP check of all 50 states plus any territory with its own PDMP. The nationwide requirement has a three-year delayed effective date; in the interim the prescriber must check the patient's state, the prescriber's state, and any state with a reciprocity agreement with either [REG-SR].

Fees, with arithmetic. $888 per three-year cycle for any of the three Special Registrations; $888 per state for the Platform Practitioner State Telemedicine Registration; $50 per state for a clinician's State Telemedicine Registration [REG-SR].

Illustrative platform-side cost if MEDvidi registers for its current 35 states:
   Telemedicine Platform Registration            1 x $888   =    $888
   Platform State Telemedicine Registrations    35 x $888   = $31,080
                                                             --------
   Total per three-year cycle                                 $31,968
   Annualised                                                 $10,656     [REASON]

Clinician side, illustrative only (headcount unknown):
   35 clinicians x 3 states average x $50        = $5,250 / 3 years       [REASON]

The fees are trivial. The compliance machinery behind them is not: three-year registration cycles, per-state credentials, EPCS everywhere, a nationwide PDMP query in the prescribing flow, and a platform that is itself a DEA registrant subject to revocation or suspension under 21 U.S.C. §824(a) if it obtained the registration on false information or used it improperly [REG-SR].

Who counts as a platform. DEA's definition of a "covered online telemedicine platform" excludes hospitals, clinics, insurers, and "local in-person medical practices" — the latter defined as a practice whose offices are all within 100 miles of each other and where less than 50% of controlled-substance prescriptions in any calendar month are issued via telemedicine [REG-SR]. MEDvidi is the paradigm case of what is not excluded.

DEA's motive, on the record. Footnote 27 of the NPRM is a description of Done Global, citing DOJ's June 2024 press release, and it isolates the business model: "The company allegedly provided easy access to controlled substances in exchange for a monthly subscription fee" [REG-SR]. The proposed rule was drafted in the shadow of one specific company's product design.

1.7 Schedule by schedule: which product lines survive which scenario

MEDvidi's navigation lists medications by condition [WEB] [SM]. Classifying them by schedule produces the exposure map.

Distinct medication pages on the menu:  9 + 10 + 4 + 3 + 6 = 32
Scheduled items:  6 CII + 4 benzo CIV + 3 insomnia CIV + 2 phentermine CIV = 15
   => 15/32 = 47% of the medication menu is a controlled substance
   =>  6/32 = 19% is Schedule II, and all six sit in the ADHD line       [REASON]

Programmatic state landing pages on the site:
   ADHD    27
   anxiety  5
   => 27/32 = 84% of state-level SEO inventory points at the line whose
      core drugs are Schedule II.                        [SM] [REASON]

Two federal mechanics shape the visit cadence of that Schedule II line, and they are permanent — they have nothing to do with the 2026 cliff:

• 21 CFR 1306.12(a): "The refilling of a prescription for a controlled substance listed in Schedule II is prohibited." [REG-CFR] Every Schedule II supply requires a new prescription. There is no such thing as a refill.
• 21 CFR 1306.12(b): multiple prescriptions up to a 90-day supply are permitted, if each is for a legitimate medical purpose, each carries written earliest-fill-date instructions, the prescriber concludes there is no undue diversion risk, and state law permits it [REG-CFR]. DEA adds that nothing in the provision encourages seeing patients "only once every 90 days."

That pair is the reason a Schedule II telepsychiatry business is structurally a high-frequency-visit business, and the reason MEDvidi's FAQ says post-dated prescriptions "may be considered for long-term, stable patients who have been regularly monitored" [WEB]. It also means the Schedule II line has a floor on clinician time per dollar that no amount of AI removes.

The 11 August 2026 orexin proposal is a small piece of genuine good news: moving daridorexant (Quviviq), lemborexant and suvorexant from Schedule IV to Schedule V, comments closing 10 September 2026 [REG-DEA26]. Schedule V is the least restricted tier and would sit inside the lower Special Registration tier if that framework ever lands [REASON].

1.8 State law sits on top of federal law, and it explains the map

Federal permission is a ceiling, not a floor: the §802(54) definition itself requires practice "in accordance with applicable Federal and State laws" [REG-RH], and the Special Registration proposal would require compliance with the law of both the prescriber's state and the patient's state [REG-SR].

MEDvidi serves 35 states [WEB]. The complement is therefore 15 states plus the District of Columbia:

Served (35): AZ CA CO CT FL GA ID IL IN KS KY ME MD MA MI MS MO MT NE NV NH NM NY NC ND
             OH OR PA TN TX VT VA WA WI WY
Not served (15 + DC): AL AK AR DE HI IA LA MN NJ OK RI SC SD UT WV + DC
   35 + 15 = 50 states.                                       [WEB] [REASON]

Four of the fifteen absentees have their own statutory or board-level in-person requirement for controlled substances, which would make them unservable regardless of the DEA flexibility [ST-LAW]:

• Arkansas — a physician using telemedicine may not prescribe Schedules II-V absent an in-person exam, or a relationship established through consultation or referral.
• South Carolina — telehealth prescribing of Schedule II and III narcotics permitted only in enumerated circumstances (hospital settings, buprenorphine for OUD in an established relationship, palliative/hospice, board-authorised programmes).
• Alabama — the prescriber must have had at least one in-person encounter with the patient within the preceding 12 months.
• West Virginia — an established telemedicine patient must see an in-person practitioner within 12 months or telemedicine service is no longer available to them.

The remaining eleven plus DC split, on my reading, between more state-law obstacles I did not verify (New Jersey, Louisiana, Delaware and Oklahoma are the usual suspects in this category) and states where licensure and clinician-recruitment economics simply do not repay the effort (Alaska, Hawaii, South Dakota, Rhode Island, DC) [REASON]. Utah is a special case worth noticing: it is absent from the 35 and it is one of the states that regulates mental-health chatbots (see 1.15) [REG-AI-ST].

MEDvidi's own operating rules already reflect the state layer. Its FAQ states that "in most cases, you must be in your state of residence at the time of a visit ... and that provider must be licensed in your state of residence" [WEB], and its refund policy treats "Incorrect Provider Assignment — a patient is scheduled with a provider not licensed in their state" as a full-refund event [LEGAL]. That second item is a tell: the failure mode is common enough to have its own refund clause.

1.9 Corporate structure: the friendly PC, and how Done made it a criminal-law question

MEDvidi's member terms describe the standard management-services architecture explicitly [LEGAL]:

"MEDVidi Health P.C. ('MEDvidi P.C'), a California professional corporation, through its medical director, and MEDvidi Inc. ('MEDvidi'), a Delaware corporation, (collectively, 'MEDvidi Health') have entered a certain management services agreement."

The rest of the structure is on the page too. MEDvidi Inc. provides "management and related services" that are "non-medical ... for example, intake assistance, scheduling assistance, software services, site maintenance, and technological support." "MEDvidi P.C. alone controls and supervises the Medical Services and clinical decisions." Practitioners are "independent contractors of MEDvidi P.C." and "independently insured." MEDvidi Inc. "is a business associate of MEDvidi P.C. as such term is defined under HIPAA." Fees paid to MEDvidi Inc. are declared to be at fair market value and "not based on a percentage of professional fees rendered by MEDvidi P.C. or the volume or value of MEDvidi P.C. services" — the classic anti-fee-splitting recital. The consent-to-telehealth page, last updated 2025-03-17, calls MEDvidi Health, P.C. "a Medical Group" and repeatedly says "the applicable Medical Group," language that anticipates more than one PC [LEGAL]. The Notice of Privacy Practices is issued in the name of the P.C., not the Delaware company [LEGAL]. Corporate address of record for privacy correspondence: 4010 Moorpark Ave., Ste. 114, San Jose, California [LEGAL].

Members also represent and warrant that they "will not submit any claims for reimbursement to any federal program, including but not limited to Medicare or Medicaid" [LEGAL]. That single sentence is doing a lot of work: it is the contractual moat against the entire federal health-care-fraud, Anti-Kickback and False Claims apparatus, which is the apparatus that delivered Done Global's health-care-fraud count [ENF-DONE] [REASON].

Why the structure now matters more than it did: DOJ's own description of the Done prosecution says the Health Care Fraud Unit's investigation "reached beyond the individual clinicians writing the prescriptions to examine how corporate decisionmakers controlled its operations," and that the defendants "used a technology platform, management incentives, and clinical protocols that were designed together to corrupt medical decision-making at a national scale" [ENF-DONE]. The friendly-PC wall is a civil and licensing construct. It did not stop a criminal theory built out of platform features, compensation design and protocol documents — i.e. out of artefacts a product organisation owns.

1.10 Enforcement precedent: what actually happened to the peers

Done Global — the case that defines the category. Sequence and outcome, from DOJ's own releases [ENF-DONE] [REG-SR]:

• 13 June 2024: founder/CEO Ruthia He and clinical president Dr. David Brody arrested; DOJ release 24-752 frames it as a "$100M Adderall Distribution and Health Care Fraud Scheme."
• November 2025: both convicted by a jury of one count of conspiracy to distribute controlled substances, four counts of distribution of controlled substances, and one count of conspiracy to commit health care fraud; He also convicted of conspiracy to obstruct justice.
• 7 July 2026: He sentenced to 72 months (six years) in prison plus a $1 million fine; Brody sentenced to 24 months plus a $1 million fine. Northern District of California; DOJ release 26-744; the first sentence announced by the new West Coast Strike Force.
• Scale as charged: over 37 million pills of Adderall (over 40 million pills of stimulants in HSI's phrasing), a $90 million scheme, over $12.3 million paid by Medicare, Medicaid and commercial insurers on false prior authorisations, and over $40 million spent on social media advertising.

The reason this matters to a product leader is that DOJ's list of the unlawful conduct is, almost line for line, a list of product and operating decisions [ENF-DONE]:

1. A "subscription for prescription business model whereby patients paid a monthly fee for prescriptions that were automatically refilled."
2. An "auto-refill" platform feature "to minimize follow-up appointments," with prescribers signing off "based on an automatically generated message that a patient desired a refill."
3. Initial visits "capped at half the length of a typical examination."
4. Clinician compensation of "up to $60,000 per month to clinicians who signed Adderall prescriptions every 30 seconds."
5. Refusing to hire, and firing, clinicians who would not comply.
6. Prohibiting practitioners from discharging patients.
7. Advertising that promised easy access to stimulants, and ads that reframed ordinary inattentiveness — "aging," "a lack of structure due to work-from-home policies" — as ADHD.
8. Ignoring escalations: refills continued "even through involuntary psychiatric holds or after the patients had died"; three mothers testified to warnings the company ignored.
9. False prior authorisations to insurers claiming DSM-5-based diagnosis, urine drug screens and failed non-stimulant trials.
10. Creating a secondary entity, Mindful Mental Wellness, specifically to bypass pharmacy blocks after national chains began refusing Done prescriptions.
11. Obstruction: moving staff to Signal and WhatsApp with disappearing messages, deleting documents, moving operations and money abroad.

Brody personally wrote prescriptions for 394,324 Schedule II stimulant pills to 6,559 patients he had never evaluated, and said "it only [took him] 30 seconds per refill" [ENF-DONE].

Cerebral — the consumer-protection and data half. In April 2024 the FTC announced a proposed order, filed by DOJ in the Southern District of Florida, requiring Cerebral, Inc. to pay "more than $7 million": $5.1 million for consumer refunds plus a $10 million civil penalty suspended after a $2 million payment on inability to pay [ENF-CEREBRAL]. The allegations: sensitive data of nearly 3.2 million consumers disclosed to third parties including LinkedIn, Snapchat and TikTok through tracking tools on the website and apps; violations of ROSCA for failing to disclose material cancellation terms while promising "cancel anytime"; and violations of the Opioid Addiction Recovery Fraud Prevention Act (OARFPA). The order permanently bans Cerebral from using or disclosing health information for most advertising, requires an easy cancellation method, and requires a notice on the website about the allegations. Former CEO Kyle Robertson did not settle [ENF-CEREBRAL].

One allegation in that complaint is a pure product story and belongs on a wall somewhere: when Cerebral "first implemented an easier cancellation button in April 2020, the company removed it after only two weeks at Robertson's direction after seeing cancellations rise" [ENF-CEREBRAL].

The 2026 baseline rate. On 23 June 2026 DOJ and HHS announced the 2026 National Health Care Fraud Takedown: 455 defendants, more than $6.5 billion in alleged false claims, over $182 million in seizures, with 36 defendants including 28 licensed medical professionals charged in controlled-substance diversion matters [ENF-TD26]. Telehealth appears explicitly among the scheme types. The environment is not cooling.

1.11 The ad-tech funnel sitting on top of a HIPAA-covered practice

MEDvidi's marketing site is organised by branded drug and by state: /drugs/xanax/, /services/adhd-treatment/ca/, and 27 ADHD state pages [SM] [WEB]. A URL of that shape is itself a health inference about whoever requested it.

What is actually loaded, as of 2026-08-18 [TECH]: a single Google Tag Manager container (GTM-T7TBQ8C) on both the homepage and the deep state page, plus a Bing UET call on the state page. Inside the container's configuration the tag types present include 7 Bing UET tags (__baut), Google Analytics and GA4 event tags (__gas, __gtes, __gtcs), a Google Ads conversion linker (__gclidw), 8 custom-HTML tags, click/scroll/link triggers, and 39 paused tags. Identifiers visible: GA4 G-BZMEPY2QES and a legacy Universal Analytics UA-183312254-1. A string search of the container for facebook, fbq, tiktok, snapchat, pinterest, linkedin, criteo, hotjar and clarity returns nothing [TECH]. So on the public marketing surface the advertising exposure is Google and Microsoft, not the Meta/TikTok/LinkedIn combination that produced the Cerebral order — and the 39 paused tags say the estate has been actively pruned at some point [REASON].

The legal frame around that:

• HHS OCR's tracking-technologies bulletin (December 2022, revised March 2024) took the position that using such technologies in a way that transmits PHI requires a business associate agreement or a HIPAA authorisation. On 20 June 2024, the Northern District of Texas in American Hospital Association v. Becerra vacated the portion asserting that HIPAA obligations attach where a technology connects an individual's IP address with a visit to an unauthenticated public webpage about specific health conditions or providers. The rest of the bulletin stands and HHS said it was evaluating next steps [REG-OCR].
• The FTC's theory in Cerebral did not depend on HIPAA at all. It ran on Section 5 deception (privacy promises), ROSCA (cancellation) and OARFPA [ENF-CEREBRAL].

Which means: the vacatur relieves some of the HIPAA pressure on the pre-login marketing site, and none of the FTC pressure on what the site promises and what the funnel does [REASON].

Negative option and cancellation, with current status. MEDvidi's visible commercial model is per-visit — $195 initial, $159 follow-up [WEB] — but its member terms contain recurring-charge language: "BY REGISTERING AS A MEMBER, YOU AGREE TO PAY ANY FEES ASSOCIATED WITH YOUR MEMBERSHIP. THE FEE WILL AUTOMATICALLY BE CHARGED TO YOUR PREFERRED PAYMENT METHOD ... UNTIL YOU CANCEL YOUR REGISTRATION," and, in the same document, "We do not offer refunds" [LEGAL]. The separate Refunds & Fees Policy of 5 May 2025 does offer refunds, and adds a $50 late cancellation/reschedule fee (inside 8 hours), a $100 no-show fee (including failure to log in within 5 minutes), and the rule that "any outstanding No-Show or Late Cancellation/Rescheduling fees must be paid before a new appointment can be scheduled" [LEGAL]. Payment is split: part at booking, the rest "just before the appointment starts" [LEGAL].

The federal rule that would have governed cancellation flows is currently not in force. The FTC's 2024 click-to-cancel amendments (89 FR 90476, 15 November 2024) were undone by federal court decisions, and on 12 February 2026 the FTC published a final action "Revision of the Negative Option Rule, Withdrawal of the CARS Rule, Removal of the Non-Compete Rule To Conform These Rules to Federal Court Decisions" (91 FR 6507), recodifying the older prenotification rule text. On 13 March 2026 it opened an advance notice of proposed rulemaking on new negative-option amendments (91 FR 12318), comments closing 13 April 2026 [ENF-FTC-NEG]. So: no click-to-cancel rule today, a replacement in the pipeline, and ROSCA still fully in force — which is what the FTC actually charged Cerebral under [ENF-CEREBRAL] [REASON].

Legal-surface hygiene, as evidence. medvidi.com/privacy-policy/ serves what is substantially the member terms document, written in terms of "Therapy Services" — a service the same company elsewhere says it does not provide — while /terms-of-use/ and /terms-and-conditions/ are two different documents with different parties and different liability caps [LEGAL]. The HIPAA notice names the entity as "MEDVID HEALTH P.C." [LEGAL]. None of this is an enforcement event on its own. All of it is the kind of drift that turns into an exhibit when something else goes wrong [REASON].

1.12 The pharmacy layer, which is where the regulation is felt daily

MEDvidi has a dedicated /faqs/pharmacy-issues/ page, and it is the most candid document on the site [WEB]. Verbatim admissions:

• "Some pharmacies, large chains and small independents may not accept electronic prescriptions (eRx) from telehealth services due to their specific policies. These policies and the list of pharmacies vary from state to state."
• "MEDvidi's providers cannot increase supply, order, or transfer controlled substances such as Ritalin, Adderall, etc. due to nationwide restrictions and remands."
• "due to the risk of electronic fraud and DEA guidelines, our providers do not send electronic scripts for controlled substances to multiple pharmacies for stock availability."
• "refills can be requested only 25 days after the previous prescription's fill date, and pharmacies usually dispense medication 30 days after the last fill date."
• Refill requests are processed by the Care Team same-day, then "your healthcare provider has to approve the refill and send it to the pharmacy, and this step may take up to 72 hours."
• A pharmacy's refusal to fill is explicitly not a refundable event [LEGAL].

There is a company-side reason to take chain refusal seriously as a category risk rather than a nuisance: DOJ's Done release records that "national pharmacy chains began blocking Done prescriptions due to safety concerns," and that the response — a second corporate entity to route around the blocks — became part of the criminal case [ENF-DONE].

And the supply constraint is still live. From FDA's own shortage database on 2026-08-18 [SUP-FDA]:

generic_name           records   status distribution   most recent update
amphetamine (mixed
  amphetamine salts)      73     all "Current"         2026-08-17
methylphenidate           38     all "Current"         2026-08-17
lisdexamfetamine         100     all "Current"         2026-08-17
semaglutide                3     "To Be Discontinued"  2026-06-04 (Rybelsus 3 mg)
tirzepatide                0     no records            -

Earliest initial posting for the amphetamine shortage: 2022-10-12
2022-10 -> 2026-08 = 46 months on FDA's shortage list.                [SUP-FDA] [REASON]
Dataset sanity check: the same API returns 1,177 "Current" and 10 "Resolved"
records overall, so "Current" here is a live status, not an artefact.  [SUP-FDA]

Caveat on reading that: these records are per-company, per-presentation. "Current" across 11 companies for mixed amphetamine salts means specific NDCs are in shortage, not that no stimulant is obtainable anywhere [SUP-FDA] [REASON]. But a four-year shortage in the exact molecule that anchors 84% of the site's state-level SEO inventory is a structural feature of this business, not weather.

1.13 The ESA letter line: the federal floor moved out from under it in May 2026

MEDvidi sells an ESA letter as a productised flow: a "Full ESA Package" from $195, comprising a 15-minute online consultation, an eligibility assessment, issuance of the letter, 24/7 support for a year and "over-the-phone verifications." The flow is explicitly two visits: "Step 2. Attend a follow-up ESA consultation. This follow-up session takes place 30 days after the initial appointment" [WEB].

That 30-day gate is not an accident. California's AB 468, effective 1 January 2022, requires a 30-day client-provider relationship before ESA documentation may be issued, plus a clinical evaluation and California licensure [REG-ESA]. MEDvidi appears to have adopted the strictest state's rule as its national product spec [REASON] — which, in isolation, is good compliance design.

The problem is the value proposition, not the process. The federal legs of the ESA product have now both been kicked away:

• Air travel went first. The Department of Transportation's 2021 rule removed emotional support animals from the service-animal definition under the Air Carrier Access Act; airlines may treat them as pets [REG-ESA] [REG-HUD].
• Housing went on 22 May 2026, when HUD's Office of Fair Housing and Equal Opportunity, under Assistant Secretary Craig W. Trainor, permanently rescinded its January 2020 assistance-animal notice and adopted the ADA's training standard for animal-related reasonable-accommodation complaints. FHEO will now find reasonable cause "only where the animal has been individually trained to perform work or tasks directly related to the complainant's disability"; requests involving trained assistance animals are "presumptively reasonable," and requests involving untrained ESAs are not. Open cases are to be re-evaluated case by case. The stated impetus was a February 2025 executive order on statute-based enforcement and Henderson v. Five Properties LLC, No. 24-750 (E.D. La., 16 July 2025), which found HUD's prior guidance unpersuasive. Private rights of action under the FHA survive (two-year window), state and local laws are unaffected, and HUD intends notice-and-comment rulemaking to harmonise its regulations with the ADA. The same source records that by 2026 more than 20% of FHEO's caseload involved untrained ESAs [REG-HUD].

Set that against what MEDvidi's ESA page still says today [WEB]: "Housing. With an ESA letter, you can bypass pet restrictions in housing units and not be subject to hefty pet fees"; "No pet fees. Many public places and accommodations that charge fees for pets will often waive this cost for an ESA"; "Legal protection. An ESA letter provides legal recognition, ensuring your right to live with your emotional support animal"; and "ESA letters fully compliant with federal laws and regulations." Those are unqualified statements about a federal entitlement whose federal enforcement backstop was withdrawn 88 days before this Finding [REASON]. Marketing copy that promises an outcome the issuing agency has stopped enforcing is the textbook shape of a Section 5 deception claim and of state UDAP exposure [REASON].

1.14 GLP-1: MEDvidi is on the safe side of the compounding line, and pays for it

MEDvidi's weight-loss line lists branded products — Zepbound, Wegovy, Mounjaro, Ozempic, Rybelsus, Saxenda, Xenical — plus phentermine and Qsymia, and a feature called "Insurance coverage assistance." There is no mention of compounded semaglutide or tirzepatide anywhere on the page [WEB]. MEDvidi is a prescriber, not a dispenser: "MEDvidi Health is not a pharmacy" [LEGAL], and the patient buys the drug at retail.

That is the legally durable position in 2026. The shortage-based exemption that permitted mass compounding of these molecules is gone: FDA's shortage database shows no current tirzepatide shortage and no current semaglutide shortage [SUP-FDA], and FDA is separately running a proceeding on which bulk substances outsourcing facilities have a "clinical need" to compound (91 FR 23431, 1 May 2026; comment period extended by 91 FR 38719, 26 June 2026) [REG-GLP1]. Secondary trade reporting says FDA has proposed to exclude semaglutide, tirzepatide and liraglutide from the 503B bulks list outright and has signalled enforcement against "essentially copies," misleading advertising and interstate shipping volumes; I have not verified those specifics against the primary notice and they are parked [REG-GLP1].

The cost of being on the safe side is that MEDvidi's weight-loss funnel monetises only the consultation while the patient absorbs branded drug prices, which is a materially worse conversion story than the compounded-GLP-1 competitors had in 2024-2025 [REASON].

One overlay deserves emphasis. "Insurance coverage assistance" and prior-authorisation support [WEB] are precisely the surfaces on which Done's executives were convicted: DOJ's health-care fraud count rested on "false and fraudulent prior authorization requests to insurers, which claimed that Done followed the DSM-5 in diagnosing ADHD, utilized urine drug screens, and falsely claimed that non-stimulants had previously been tried without success" [ENF-DONE]. A company that does not bill insurance for its own visits, but does help patients obtain drug coverage, is nonetheless generating representations to payers. Whoever owns that flow owns criminal-exposure-grade content [REASON].

1.15 AI-specific regulation, which is now a real layer and lands squarely on both tracks

MEDvidi already publishes an AI-User Disclosures page covering two distinct things [LEGAL]:

1. Ambient intelligence (the AI Scribe): AI that "listens" to the visit and drafts the note. The consent says, in terms, "You will not know the ambient intelligence tool is being used; you will not interact with it."
2. AI Agents over SMS, authenticated portal chat, public website chat and voice — collecting identifiers, communication content, "call audio recordings and call transcripts," network activity, geolocation, health information, and "inferences drawn from the above information to create a profile," with disclosure to service providers "bound by Business Associate Agreements."

That is a wide surface, and there are now state statutes pointed at it:

• California AB 3030, effective 1 January 2025, requires health facilities, clinics, physician offices and group practices that use generative AI to communicate clinical information to patients to include a disclaimer that the message was AI-generated and clear instructions for reaching a human clinician — at the start of written messages, displayed throughout continuous chat and video interactions, and spoken at the start and end of audio interactions. Communications read and reviewed by a licensed provider are exempt, and non-clinical content such as scheduling and billing is out of scope [REG-AI-CA].
• California SB 243, chaptered 13 October 2025, regulates "companion chatbots": AI disclosure where a reasonable person would be misled, a mandatory published protocol to prevent production of suicidal-ideation or self-harm content with referral to crisis services, extra duties for known minors, annual reporting to the Office of Suicide Prevention beginning 1 July 2027, and a private right of action for anyone injured by non-compliance. Its definition excludes "a bot that is used only for customer service, a business' operational purposes, productivity and analysis ... internal research, or technical assistance" [REG-AI-CA].
• Illinois (HB 1806, the "WOPR Act," signed August 2025) and Nevada (AB 406, June 2025) go further: Illinois prohibits providing, advertising or offering therapy or psychotherapy unless delivered by a licensed professional, enforced by IDFPR with penalties up to $10,000 per violation; Nevada bars AI from providing mental or behavioural health care or claiming it can, permitting AI for administrative functions with independent human review, with penalties up to $15,000. Utah HB 452 (March 2025) takes the disclosure-and-safeguards route rather than a ban [REG-AI-ST].

Mapping that onto MEDvidi's footprint: California, Illinois and Nevada are all among the 35 served states; Utah is not [WEB] [REASON]. The AI Receptionist as described in the posting — "owns internal support processes" [JD] — most likely fits SB 243's customer-service/operational exclusion as long as it stays there; the moment a patient-facing agent discusses symptoms, the exclusion is arguable at best and Illinois's and Nevada's prohibitions come into view [REASON]. AB 3030's exemption for provider-reviewed communications is the cleanest available design lever: human-in-the-loop review removes the disclaimer duty [REG-AI-CA] [REASON].

Two more items for completeness. The FTC published a proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems on 7 July 2026 (91 FR 41638, comments closed 31 July 2026, Matter No. P264200), applying Section 5's deception prohibition to companies that market AI systems; its actual concern is ideological steering of AI outputs rather than health AI, but the framing — that consumers reasonably expect AI systems to aim at truthful, accurate output, and that representations about AI are Section 5 representations — travels [REG-FTC-AI] [REASON]. And note what the Done case did to a specific artefact class: DOJ treated Done's "clinical protocols" as one of the three instruments of the offence, alongside the platform and the incentive structure [ENF-DONE]. MEDvidi ships Chart Review AI that highlights deviations from clinical protocols [JD]. That system's outputs are, by construction, a contemporaneous written record of where clinicians departed from protocol — exculpatory if the protocol is good and the deviations are closed, and a gift to a prosecutor if they are not [REASON].

1.16 Risk register, ranked by probability x impact within four quarters

Probability and impact are my judgement [REASON]; the instrument column is sourced.

2. Capability / object table

3. Reconciliation notes

Reconciliation note — grandfathering. MEDvidi's own /patient-phe-update/ page says the coming regulations "may affect those who begin their online treatment after December 31, 2026" [WEB]. The regulatory text of 21 CFR 1307.41(b) as amended authorises prescribing only "during the period May 12, 2023, through December 31, 2026" and states the authorisation "expires at the end of December 31, 2026," with no carve-out for pre-existing telemedicine relationships [REG-FR4]. Resolved in favour of the rule text. The company's framing is additionally undermined by [ARC]: the identical sentence appears in the 2024-12-03 capture with the 2024 date, so it is template copy rather than a considered legal position. The narrow sense in which it could be right — that the first temporary rule (88 FR 30037) distinguished relationships formed on or before 2023-11-11 — was superseded by the second rule [REG-FR123].

Reconciliation note — Cerebral's number. Secondary coverage variously reports $7 million and $15 million. The FTC's own release says "more than $7 million," itemised as $5.1 million for refunds plus a $10 million civil penalty suspended after a $2 million payment [ENF-CEREBRAL]. Resolved in favour of the FTC release; the $15 million figure appears to conflate the unsuspended and suspended components. Cash actually payable: about $7.1 million.

Reconciliation note — refunds. The member terms say "We do not offer refunds" [LEGAL] while the Refunds & Fees Policy of 2025-05-05 sets out six full-refund conditions [LEGAL]. Resolved in favour of the Refunds & Fees Policy as the later, more specific and patient-facing instrument — but the contradiction is itself the finding: a plaintiff or regulator gets to choose which document to read from.

Reconciliation note — insurance. MEDvidi states plainly that it does not accept insurance [WEB], yet the member terms contain a full insurance-billing authorisation and benefits-responsibility clause [LEGAL]. Resolved in favour of the public statement for present operations; the terms language reads as unedited template text. Worth confirming with the company, because "we will submit claims and bill Medical Services to your insurer on your behalf" is not a sentence a cash-pay practice should leave lying around [REASON].

Reconciliation note — Schedule II grandfather via one in-person visit. DEA says an in-person evaluation permanently removes a practitioner-patient pair from the Ryan Haight remote-prescribing rules [REG-FR4]. That is federal law only. State rules such as Alabama's and West Virginia's 12-month in-person requirements would still bite [ST-LAW], and the Special Registration proposal, if finalised, imposes its own conditions on special-registration prescriptions [REG-SR]. Resolved: the one-visit cure is real but not universal.

Reconciliation note — audio-only. The DEA temporary rule requires an "interactive telecommunications system referred to in 42 CFR 410.78(a)(3)" [REG-FR4]; that CFR provision includes an audio-only carve-out for patients at home who cannot or will not use video [REG-CFR]. I have found no DEA statement resolving whether it accepts that carve-out for general Schedule II-V telemedicine prescribing, as opposed to the specific audio-only allowances for buprenorphine. Not resolved; parked as a question for counsel.

Reconciliation note — 2026 takedown numbers. The 455-defendant / $6.5 billion figures for the 2026 National Health Care Fraud Takedown come from law-firm and trade summaries, not from a DOJ or HHS-OIG page I retrieved this pass. Treated as directional context, not as a load- bearing number.

4. Open Questions / Parked

1. Will there be a fifth extension, and when will we know? Unknowable today. The only observable early signal is an OMB submission; the fourth extension's was 2025-11-10, 51 days before publication [OMB] [REG-FR4]. What would settle it: monitoring reginfo.gov for RIN 1117-AB40 / 1117-AB78 activity and the Federal Register's DEA docket weekly from October 2026. Note reginfo.gov blocked automated access from this session.
2. Is a final Special Registration rule under OMB review right now? Not established. reginfo.gov would answer it directly and could not be fetched here.
3. Does DEA accept the 42 CFR 410.78(a)(3) audio-only carve-out for Schedule II-V telemedicine prescribing? Parked (see reconciliation note). Would be settled by DEA's telemedicine FAQ on deadiversion.usdoj.gov, which blocked automated fetching, or by counsel's memo.
4. Does MEDvidi operate one professional corporation or several? The consent page says "the applicable Medical Group" and names only MEDvidi Health, P.C., a California PC [LEGAL]. Multi-state DTC practices commonly stand up additional PCs. Would be settled by California and other Secretary of State entity searches and by the prescriber-of-record entity name on patient prescriptions.
5. Who employs or contracts the clinicians, and how are they paid? Terms say independent contractors of the P.C. [LEGAL]. Compensation structure is the single most important unknown in this Area given Done's "up to $60,000 per month ... every 30 seconds" finding [ENF-DONE]. Only the company can answer.
6. Which of the other eleven unserved states are blocked by law versus economics? Four confirmed (AR, SC, AL, WV) [ST-LAW]. NJ, LA, DE, OK, IA, MN, RI, UT and DC unverified; AK, HI, SD plausibly economic. Would be settled by a state-by-state statute and board-rule review.
7. What do the pixels do behind the login wall? Only the pre-login marketing surface was inspected [TECH]. The Personal Portal was not accessed and must not be. Would be settled internally by a tag inventory on authenticated pages.
8. Are there active state AG, DEA administrative, or FTC matters involving MEDvidi? Nothing found in this pass, and nothing was searched under the company name in enforcement databases. Absence of evidence only.
9. Illinois HB 1806 and Nevada AB 406 in their enacted text. Sourced here only to law-firm and trade summaries [REG-AI-ST]; Illinois's legislature site blocked automated access. Public act text would settle scope and exemptions — which matters, because "therapy or psychotherapy" may or may not reach a medication-management practice.
10. FDA's actual proposal on GLP-1s and the 503B bulks list. The Federal Register notices are confirmed [REG-GLP1]; the specific proposal to exclude semaglutide, tirzepatide and liraglutide comes from secondary sources. Would be settled by reading 91 FR 23431 in full.
11. Whether MEDvidi's clinicians would qualify for the proposed Advanced registration. The proposal requires mid-level practitioners to be board certified in the relevant field [REG-SR]. MEDvidi lists PMHNPs, NPs and PAs [WEB]; PMHNP certification would plausibly qualify, a generalist NP would not. Would be settled by the credential mix, which A5 may have.
12. The Special Registration proposal's compliance runway. Not specified in what I read; DEA has repeatedly said extensions exist to give providers time to comply [REG-FR4]. Would be settled by the final rule's DATES section, when it exists.

5. What this does NOT cover

• Clinical merit. Whether stimulant treatment via telemedicine is good medicine is out of scope by the Inquiry's own cut.
• Insurance, coding and reimbursement law. MEDvidi is cash-pay and disclaims federal programme claims [WEB] [LEGAL], so Stark, the Anti-Kickback Statute, the False Claims Act and Medicare telehealth policy are treated only as the thing the structure is designed to avoid. The September-2025 Medicare telehealth lapse appears only as evidence DEA itself cited [REG-FR4].
• Buprenorphine and opioid use disorder. The 2025 buprenorphine final rule and 42 CFR part 8 are noted for completeness only; nothing on MEDvidi's public menu is a narcotic treatment for OUD [WEB].
• Non-US law. Members must reside in the US or its territories [LEGAL].
• Employment and contractor classification law for the clinician network, beyond quoting what the terms say.
• Privacy law state by state. CCPA/CPRA, Washington's My Health My Data Act, and the other consumer health-data statutes are a real and separate exposure surface for a HIPAA-adjacent marketing funnel; not worked here.
• Anything behind authentication. No account was created, no login attempted, no host enumerated. Portal behaviour, intake questionnaire logic and the admin application are unexamined by design.
• Securities, tax and corporate-finance consequences of the structure.
• Individual clinicians. No named-person research beyond the two convicted Done executives, whose facts are matters of public record in a federal criminal case.

6. What this means for a VP of Product

The cliff is a product deadline, not a legal one, and it has already been shipped once. The most useful thing in this entire Area is a 2023 Wayback capture of MEDvidi's own site. In May 2023, when the flexibility looked like it would lapse on 11 November 2023, the company published a fully-formed continuity product: get an in-person appointment with a primary care physician, obtain a qualifying telemedicine referral, send it to us before the deadline; new patients after 10 November 2023 get 30 days only; Schedule II requires the referral for even the initial 30-day script [ARC]. Then the extensions came and it was quietly deleted. So the question in the CEO conversation is not "what would you do about the DEA cliff" — it is "you already built this once and threw it away; my plan is to rebuild it as a permanent capability rather than a fire drill, and to make the referral graph an asset." Rebuilt properly, the referral/in-person-gate flow is not a compliance cost. It is a durable moat: DEA's own rule says one in-person evaluation permanently exempts that practitioner-patient pair from the remote-prescribing rules [REG-FR4], so every patient converted through that flow becomes an annuity that survives every future cliff. A company with 100,000 patients holding valid in-person evaluations is regulation-proof in a way no competitor with a pure-video cohort is [REASON].

The tradeoff to name out loud: friction now versus a cohort you can keep. Every step in that flow — asking a patient to see a PCP, upload a referral, verify identity harder, accept a 90-day-with-fill-dates prescription instead of a monthly touch — costs conversion today. That is the honest cost, and it should be quantified rather than waved at. The counter-argument is that MEDvidi's Schedule II revenue is not a normal revenue line; it is a line with a stated expiry date on the government's own website, and every quarter it runs unhedged is a quarter of enterprise value that a diligence process will discount to near zero. I would spend Q4 2026 conversion deliberately, on the smallest cohort that proves the mechanism — highest-LTV established Schedule II patients in the five biggest states — and hold the rest behind a feature flag until the November OMB signal [OMB] [REASON].

Do not build to the Special Registration proposal, but do build the parts that are true in every scenario. As written, the proposal is unbuildable-around: the under-50% Schedule II cap mathematically forbids telemedicine-only Schedule II practice, and the same-state rule forbids licence pooling for Schedule II [REG-SR]. If that text is finalised unchanged, no product decision saves the ADHD line and the company's answer has to be corporate — a hybrid in-person partner network, or an exit from Schedule II. But three requirements in that proposal are directionally certain to appear in any final regime, and MEDvidi should already be excellent at all three: electronic prescribing for every controlled substance, verified patient identity, and PDMP checks across the patient's state, the prescriber's state and reciprocity states, with a path to all 50 [REG-SR]. MEDvidi already does a PDMP verification before it confirms the appointment and already requires a photo ID [WEB]. That is a genuine head start, and it is worth saying so in the room. Make the PDMP call an instrumented product step with latency, coverage and hit-rate metrics rather than a Care Team chore, and the same work becomes both a compliance asset and a clinical-safety asset.

The Done sentencing changes what "move fast" is allowed to mean inside this company. Read DOJ's press release as a product-review checklist, because that is what it is: subscription for prescription, auto-refill that minimises follow-ups, initial visits capped at half a normal examination, clinician pay up to $60,000 a month for signing scripts every 30 seconds, a ban on clinicians discharging patients, and ad creative that converts ordinary inattentiveness into an ADHD self-diagnosis [ENF-DONE]. MEDvidi's public design is materially better on the two biggest items — visits are per-visit-priced rather than subscription [WEB], and urgent refills without a visit are explicitly excluded for controlled substances [WEB] — and those two facts are worth stating precisely, because they are the difference between this company and the one whose founder is in prison. But the check a new VP of Product owes the CEO in week two is the uncomfortable version: pull the actual comp structure for clinicians, the actual median initial visit duration versus the scheduled 30 minutes, the actual refill approval time-on-task, the actual discharge rate, and the paid-search and paid-social creative library. If any of those five metrics looks like Done's, it is a board-level issue regardless of what the terms of service say. And note the second-order lesson: Done's obstruction count came from moving to Signal and turning on disappearing messages [ENF-DONE]. Retention policy for product and clinical channels is now a product-adjacent decision.

The ESA line needs a decision this quarter, and the decision is probably "shrink it honestly." On 22 May 2026 HUD stopped enforcing the thing MEDvidi's ESA page sells [REG-HUD], and the page still promises that a letter lets you "bypass pet restrictions" and "not be subject to hefty pet fees," and that it ensures "your right to live with your emotional support animal" [WEB]. Private FHA suits and state laws still exist, so the letter is not worthless — but the copy is now a deception exposure and, worse, a refund-and-chargeback engine once patients discover their landlord can say no. The product answer is not to kill the line reflexively; it is to requalify it — accurate claims, a state-by-state entitlement view since state law is where the remaining protection lives, and an honest expectation set at the point of sale. It is also worth noticing that the ESA flow's 30-day two-visit structure [WEB] is already the shape of the relationship-building flow the DEA cliff will require. The same mechanism, aimed at a different problem.

The AI tracks have a regulatory perimeter now, and it is drawable. The AI Scribe is the safest of the three shipped features: ambient documentation with consent obtained, and California's AB 3030 exempts communications a licensed provider reads and reviews [REG-AI-CA] [LEGAL]. The AI Receptionist is safe while it stays operational — SB 243's exclusion covers bots used only for customer service and business operations [REG-AI-CA] — and becomes a live legal question the moment it engages with symptoms, because Illinois and Nevada now prohibit AI from delivering mental or behavioural health care and both are among the 35 served states [REG-AI-ST]. So the AI Clinic Track's roadmap needs a bright line drawn in the product itself, enforced by state-level feature flags, with the crisis-detection and human- handoff protocol built before it is required rather than after. Chart Review AI deserves special attention: it produces a written record of protocol deviations, and DOJ named "clinical protocols" as one of the three instruments of the Done offence [ENF-DONE] [JD]. Built well — deviations triaged, closed and auditable — it is the single best evidence a company can have that its clinical governance is real. Built as a dashboard nobody actions, it is a prosecutor's exhibit list. That is the sharpest argument I have for putting real product investment into the boring closed-loop half of that feature.

What I would ask the CEO, in this order. How are clinicians compensated, exactly, and does any component vary with prescription volume? What is our real distribution of initial-visit duration against the 30 minutes we sell? Do we have a signed legal position on what happens to existing patients on 1 January 2027, and does it match what our own website tells them? Who owns the referral/in-person-gate build, and is it in the Q4 plan or the "if it happens" pile? And last: of the 15 states we do not serve, how many are blocked by law rather than by clinician supply — because that number tells me whether the growth path is licensure operations or regulatory strategy, and those are different teams.