Policy is not workflow
The single most important distinction in this topic is between having a good-faith-exam policy and having a good-faith-exam workflow. A policy is a paragraph in a binder stating that exams happen. A workflow is the actual, repeatable sequence by which every patient is evaluated by an appropriately authorized provider, cleared, and documented before treatment — every time, without exceptions that "everyone knows about." When a regulator examines a practice, they don't grade the policy; they ask to see how a particular patient was actually handled. A practice whose answer is "well, our policy says…" but whose records don't show the exam actually occurred for that patient has a policy and no defense. The workflow, executed and documented patient by patient, is the thing that protects you.
Build it to your state, not to someone else's
Good-faith-exam requirements — who may perform the exam, what it must involve, whether and how telehealth is permitted — are set by state law and vary. This is exactly the area where copying a model that works in another state gets practices in trouble. A telehealth-based exam workflow that's fully compliant in one jurisdiction may be impermissible in another, and telehealth exams specifically are an area of active regulatory attention, with rules that differ and evolve. So the first step in a defensible workflow isn't designing the process — it's confirming, for your state, what the exam must be and who can perform it. Build to your state's actual requirements, with your medical director and counsel, rather than to a template or a competitor's apparent practice.
The elements of defensibility
A defensible good-faith-exam workflow generally needs to demonstrate, for every patient:
- That the exam actually occurred before treatment — not as a formality but as a real evaluation of appropriateness.
- That it was performed by an appropriately authorized provider per your state's rules.
- That it's documented in a way that lets you show, after the fact, that it happened as required.
- That the workflow matches your state's specific requirements, including any telehealth conditions.
The throughline is provability. You're not building a process to feel compliant; you're building one where you can produce, for any patient a regulator names, the evidence that the gate function happened correctly. If you can't show that patient-by-patient, you don't have a defensible workflow regardless of how good your policy reads.
Standing orders and protocols: part of it, not a substitute for it
Standing orders and protocols can be legitimate parts of a compliant structure where your state permits, governing how delegated treatments proceed under appropriate authorization. But they're frequently misunderstood as a way to skip the underlying requirements, and they aren't — they don't eliminate the exam and supervision obligations beneath them. How standing orders may be used, and what they can and can't substitute for, is state-specific and belongs in the structure your medical director and counsel design. Used correctly, they're part of an efficient, compliant workflow; used as a shortcut around the good-faith exam, they're a misunderstanding that creates exposure rather than removing it.
What to do
- Build a workflow, not just a policy — a repeatable, documented sequence ensuring every patient is properly examined and cleared before treatment.
- Confirm your state's specific requirements first — who performs the exam, what it involves, and whether telehealth is permitted — and build to those, not to a template.
- Make it provable patient by patient. Defensibility means being able to show, for any named patient, that the exam happened as required.
- Use standing orders and protocols correctly, as part of a compliant structure, never as a shortcut around the underlying exam and supervision requirements.
The good-faith exam is one of the load-bearing compliance elements of an injecting practice, and it's one where the difference between safe and exposed isn't whether you have a policy — nearly everyone does — but whether you have a workflow that actually happens and can be proven. Build it to your state's real requirements, execute it for every patient, document it so it's provable, and the gate does its job. Leave it as a paragraph in a binder, and you'll discover the policy was never the thing protecting you the day someone asks to see how one specific patient was cleared.
