When a GLP-1 telehealth company prescribes you a compounded injectable, ships it across state lines, charges your credit card monthly, and then quietly becomes unreachable when you report side effects — who do you call?
The honest answer: it depends. And in many cases, nobody has clear jurisdiction over the entire transaction. That's the accountability gap — and it's the single biggest structural problem in GLP-1 telehealth right now.
The four-layer regulatory stack
A GLP-1 telehealth transaction touches at least four regulatory domains. Each has a different enforcer, different standards, and different timelines. None of them see the whole picture.
Layer 1: The FDA — drugs, not doctors
The FDA regulates the drug product, not the clinical decision to prescribe it. For compounded GLP-1 medications, the FDA's authority is especially narrow. Under Section 503A of the Federal Food, Drug, and Cosmetic Act, traditional compounding pharmacies operate primarily under state oversight. The FDA can intervene when a pharmacy steps outside its lane — compounding copies of commercially available drugs (which semaglutide and tirzepatide are), or making false claims in marketing materials.
That's exactly what the 85+ warning letters issued since September 2025 targeted: misleading marketing, not clinical care. If your prescriber rubber-stamps 400 intake forms a day without reading them, the FDA has no opinion. That's not their department.
Layer 2: State medical boards — clinicians, not companies
State medical boards license and discipline individual clinicians — physicians, nurse practitioners, physician assistants. If the NP who signed your prescription committed malpractice, the medical board in the state where you reside is the oversight body. Not the state where the NP is physically sitting. Not the state where the company is incorporated.
Here's the gap: medical boards regulate humans, not corporations. When a telehealth company builds an intake funnel that makes it functionally impossible for the reviewing NP to spend more than 90 seconds on each case, the system creates the negligence, but the individual bears the regulatory risk. The company is invisible to the medical board.
Layer 3: State pharmacy boards — the compounding lab
The pharmacy that compounds your semaglutide is regulated by its home state's Board of Pharmacy and — if it ships across state lines — the boards in receiving states that require nonresident pharmacy licenses. Potency, sterility, labeling, and dispensing practices are their domain.
This layer has actually produced the most consequential enforcement actions in 2024-2026. Multiple state pharmacy boards have revoked or suspended licenses of 503A pharmacies compounding GLP-1 products after finding potency failures, sterility violations, and labeling deficiencies. But these actions happen after thousands of patients have already received potentially substandard product.
Layer 4: The FTC and state AGs — marketing and consumer protection
The Federal Trade Commission and state attorneys general enforce truth-in-advertising and consumer protection laws. When a platform runs ads claiming "FDA-approved GLP-1 for $99/month" for a compounded product, that's an FTC matter. When a subscription makes cancellation deliberately difficult, that's a state consumer protection issue, especially post-FTC Click-to-Cancel rule (effective May 2025).
This layer is the most responsive to individual complaints — but also the slowest to produce systemic change. An AG investigation typically takes 12-24 months to produce a consent decree.
Where the gaps are widest
Three specific scenarios demonstrate where accountability breaks down completely.
Gap 1: The multi-state shell game
Company incorporated in Delaware. Medical director licensed in Texas. NPs credentialed through a staffing agency in Florida. Pharmacy compounding in Arizona. Patient in Ohio. When something goes wrong, five different regulatory jurisdictions are technically involved, and the patient has to figure out which one to contact. Most give up.
Gap 2: The MSO shield
Most GLP-1 telehealth companies are Management Services Organizations — they handle the technology, marketing, billing, and customer service. The actual medical practice is technically a separate, clinician-owned entity. This corporate structure exists in a legal gray zone: the MSO can't practice medicine, so it's not regulated as a medical practice. But it controls every aspect of the patient experience except the prescription signature. We've covered this structure in depth in our MSO explainer, but the accountability implication is simple: the entity you're paying is not the entity your medical board can discipline.
Gap 3: The adverse event reporting void
When a patient on brand-name Wegovy experiences a serious adverse event, the prescriber and pharmacy have established MedWatch reporting pathways. When a patient on compounded semaglutide from a 503A pharmacy experiences the same event, the reporting chain is murkier. The telehealth platform has no legal obligation to report adverse events to the FDA (it's not a drug manufacturer). The compounding pharmacy's obligation depends on whether it classifies itself as a manufacturer. The prescribing NP should report, but may never learn about the event if the patient reports it only to the platform's customer support chatbot.
The result: adverse events from compounded GLP-1 products are systematically undercounted in FDA databases.
What's changing in 2026
The Yale secret shopper study published in July 2026 — which found 45 of 49 tested platforms failed basic prescribing standards — has accelerated three regulatory responses:
Congressional attention. The Senate HELP Committee held hearings in July 2026 specifically on GLP-1 telehealth oversight. Bipartisan support exists for requiring telehealth platforms to register with state medical boards as entities, not just through their individual clinicians. This would close the MSO shield gap.
State-level action. California, New York, and Ohio have introduced or advanced bills requiring telehealth platforms that prescribe controlled or compounded medications to maintain nonresident clinic licenses and designate a compliance officer. California's version, if passed, would give the Medical Board direct authority over the platform entity.
Voluntary industry standards. LegitScript expanded its healthcare merchant certification to include a telehealth-specific module in April 2026. While voluntary, platforms that hold this certification have agreed to periodic audits of their prescribing practices, pharmacy relationships, and adverse event protocols.
What you can do right now
Until the regulatory structure catches up, the enforcement burden falls on you — the patient — to verify the basics that should be verified for you. Here's the minimum:
Identify the prescribing clinician by name and NPI. Look them up on the CMS NPI Registry. Verify they hold an active license in your state via your state's medical board lookup tool.
Identify the compounding pharmacy by name. If the platform won't tell you, that's disqualifying. Once you know the name, check it against the NABP database and your state pharmacy board's license verification tool.
Check the FDA's warning letter database. Search for the platform name, the pharmacy name, and the parent company name. Warning letters don't mean shut down — they mean the FDA found a violation and put the company on notice.
Ask about adverse event reporting. "If I have a bad reaction, what is your protocol for reporting it to the FDA via MedWatch?" Any answer that doesn't include the word MedWatch is an answer that doesn't include FDA reporting.
Who to contact if something goes wrong
If you believe you've been harmed by a GLP-1 telehealth platform, here are the actual enforcement bodies, in order of likely responsiveness:
Your state attorney general's consumer protection division. Every state AG has an online complaint form. This is typically the fastest path to getting a company's attention, especially for billing and cancellation disputes.
Your state medical board. File a complaint against the individual prescriber. This triggers an investigation process that the clinician must respond to. Even if the platform is the systemic problem, the clinician-level complaint is the mechanism that exists.
The state pharmacy board where the compounding pharmacy is located. If you received a product with potency, sterility, or labeling concerns, this is the right body. Provide lot numbers from your vial label if you have them.
The FDA's MedWatch system. Report adverse events from compounded products directly. The more patients report, the better the FDA's data on compounded GLP-1 safety — which ultimately drives enforcement priorities.
The FTC. For false advertising, deceptive billing, or difficulty canceling a subscription. The FTC's complaint database drives enforcement priorities; individual complaints rarely produce individual outcomes, but pattern data does.
The accountability gap is closing. But right now, the patients who protect themselves best are the ones who know which door to knock on when something goes wrong. We've given you the map. Use it.