EHR for Weight Loss Clinics: The Requirements Checklist

The pages that ranked for “EHR for weight loss clinic” when we checked on October 1, 2026 were a single vendor’s setup checklist and a listicle of seven products, and neither cited a regulation. That leaves a nurse practitioner or physician opening a cash-pay GLP-1 practice with a feature wish list and no way to tell which features exist because a rule requires them. Several of those rules now carry hard numbers: FDA says it does not currently intend to act against a compounder that fills four or fewer prescriptions of an essentially-a-copy compounded product in a calendar month, the DEA’s telemedicine flexibilities for controlled substances run through December 31, 2026, and Florida’s obesity-drug rule requires re-evaluation at least once every 3 months.

This guide writes the requirements list from the compliance stack instead. Each requirement is tied to the rule that creates it, and each section ends with a question to ask in the vendor demo. It covers what the ranking pages skip: FDCA 503A documentation for compounded prescriptions, EPCS for phentermine (the federal Part D mandate sets a 70 percent electronic threshold), DEA dispensing records, lot and expiration tracking, membership auto-renewal law, HSA and letter-of-medical-necessity documentation, the HIPAA covered-entity test, and the TCPA limit of one message per day and three per week on exempt patient texts.

It is vendor-free on purpose. You leave with a demo script, not a ranking, and nothing here is legal or tax advice. Where the post touches IRS or HIPAA material, it states what the documentation has to contain or separate. Current as of October 2026.

What does weight loss clinic software actually have to do?

Eight rule sets drive the requirements. The table maps each to the capability it forces and the question that exposes whether a vendor has it.

The sections below take these one at a time.

What documentation does a compounded GLP-1 prescription require?

Section 503A exempts a compounded drug from new-drug approval, adequate-directions labeling, and cGMP only when the drug “is compounded for an identified individual patient based on the receipt of a valid prescription order or a notation, approved by the prescribing practitioner, on the prescription order that a compounded product is necessary for the identified patient” (21 U.S.C. 353a(a)). The same section bars a 503A pharmacy from compounding “regularly or in inordinate amounts” drugs that are essentially copies of a commercially available product. A drug is not essentially a copy when it has a change, made for an identified individual patient, that produces for that patient a significant difference, as determined by the prescribing practitioner, from the comparable commercial product (21 U.S.C. 353a(b)(1)(D) and (b)(2)).

On April 1, 2026, FDA published a statement on its compounding policies as the national GLP-1 supply stabilized. It restates when FDA will treat a compounded product as essentially a copy (same active ingredient in the same, similar, or easily substitutable strength, usable by the same route of administration), and then says: “This is unless a prescriber determines and documents the compounded drug product contains a change that produces a significant difference from the commercially available drug product for an identified individual patient.” A product with that documented determination is not an essentially-a-copy product in FDA’s eyes. For products that are essentially copies, the same statement says FDA does not currently intend to take action against a compounder that fills four or fewer prescriptions of that product in a calendar month. FDA’s own wording is “at this time,” so treat the policy as dated April 1, 2026 and revisit it.

The same FDA page records that the semaglutide and tirzepatide injection shortages are resolved. The April 1, 2026 entry also says outsourcing facilities (503B) may compound from bulk substances only if the substance is on the 503B bulks list or the drug is on FDA’s shortage list, and that tirzepatide and semaglutide appear on neither as of that statement. On May 1, 2026, FDA published a notice (91 FR 23431) proposing not to include semaglutide, tirzepatide, and liraglutide on that list. FDA extended the comment period to July 30, 2026 (91 FR 38719). As of October 1, 2026, a Federal Register search shows no final determination on these substances.

The statement does not specify the form or amount of that documentation. The clinic-side burden is therefore structural: the determination has to be made and written down per patient, and it has to stay attached to the prescription.

The EHR therefore has to give the prescriber a per-patient field for the determination that attaches to the prescription, route the order to the compounding pharmacy, and report which patients are on a compounded product and whether a determination is on file for each. The four-or-fewer count belongs to the compounder, not the clinic; the determination is yours. Ask the vendor: show me where a prescriber documents an individualized clinical difference, and show me that it prints or transmits with the order.

Does a weight loss clinic need EPCS?

Phentermine is a Schedule IV controlled substance, listed at 21 CFR 1308.14(f) (DEA code 1640). Whether electronic prescribing is mandatory for you depends on payer mix and state.

Federally, under 42 CFR 423.160(a)(5), prescribers must conduct at least 70 percent of their Schedule II through V prescriptions that are Part D drugs electronically, with CMS compliance actions for non-LTC prescriptions commencing on or after January 1, 2023. Exempt are prescribers issuing 100 or fewer controlled substance prescriptions for Part D drugs per calendar year, prescribers in a declared emergency or disaster area, and prescribers with a CMS-approved waiver. Because the mandate reaches Part D prescriptions, a purely cash-pay clinic with no Medicare patients is not bound by it. State EPCS mandates vary and many reach every controlled prescription regardless of payer, so check your state board of pharmacy.

If you do send controlled prescriptions electronically, the DEA sets technical conditions on the software. The application must require two of three authentication factors: something only the practitioner knows, something the practitioner is (biometric data), or something the practitioner has (a hard token separate from the computer). The application provider must also have a third-party audit before the application is used for controlled substance prescriptions, and again whenever controlled-substance functionality changes or every two years, whichever occurs first.

The EHR therefore has to support two-factor signing for Schedule IV prescriptions and rest on a current Part 1311 audit. Ask the vendor: which two factors does signing use, and what were the date and scope of your most recent third-party audit? Some systems use a biometric factor in place of a hard token. eRx Mobile works that way.

Can you prescribe weight loss medication by telehealth?

For non-controlled medications, state law and your state board govern, and this post does not survey them. For controlled substances such as phentermine, the federal picture is a temporary one. DEA and HHS extended the COVID-era telemedicine flexibilities through December 31, 2026 (Fourth Temporary Extension, 90 FR 61301, published December 31, 2025, effective January 1, 2026). The flexibilities let DEA-registered practitioners prescribe Schedule II through V controlled substances via telemedicine without a prior in-person medical evaluation.

What replaces them is not settled. DEA published the Special Registrations for Telemedicine NPRM on January 17, 2025 (90 FR 6541), proposing that practitioners holding a Special Registration could prescribe controlled substances by audio-video telemedicine without ever conducting an in-person evaluation, subject to prescription, recordkeeping, and reporting requirements. DEA received over 6,475 comments. As of October 1, 2026, no final rule has been published. The extension exists in part to “allow patients, practitioners, pharmacists, service providers, and other stakeholders sufficient time to prepare for the implementation of future regulations.”

The EHR therefore has to record, per patient, whether and when an in-person evaluation occurred and whether a controlled prescription was issued under the temporary flexibilities, because that authority ends on a date certain and whatever replaces it carries recordkeeping requirements. It also needs built-in video visits that write to the same chart. Ask the vendor: can you pull a list of every patient who received a controlled prescription without an in-person evaluation on file?

What records does in-office dispensing of injectables require?

If you keep and dispense product in the office, two things shape the records: the data that arrives on the label of every compounded injectable, and the DEA rules that apply to controlled substances.

For compounded injectables, a 503B outsourcing facility’s label must carry, among other things, the lot or batch number, the date compounded, the expiration date, and storage and handling instructions, plus the statement “Office Use Only” when the drug is distributed other than on a prescription for an identified patient (21 U.S.C. 353b(a)(10)). That is a labeling duty on the outsourcing facility, not a recordkeeping rule for the clinic. The practical consequence is traceability: if your inventory captures the same lot and expiration data per unit, a recall or a beyond-use question can be traced to the patients who received that lot. If it does not, it cannot.

For controlled substances kept in the office, such as phentermine, DEA rules add specifics:

The EHR therefore has to store lot and expiration per unit, link each dispense or administration to a patient and a lot, and produce the DEA dispensing elements and inventory counts on request. Ask the vendor: pick a lot number and show me every patient who received it, and show me the controlled-substance dispensing report.

Labs, orders, and progress visits: what the chart has to trend

The rules above create the documentation that surrounds the prescription. Florida’s Board of Medicine rule on Standards for the Prescription of Drugs to Treat Obesity (64B8-9.012, amended effective August 8, 2022) shows what a state rule can require, and it is one example. Other states set their own intervals or none, so verify yours. Florida requires:

• An initial evaluation before prescribing that includes a physical, a complete history, and tests related to medical treatment for weight loss.
• Written informed consent, with a signed copy in the medical record.
• Re-evaluation at least once every 3 months.
• A legible copy of the Weight-Loss Consumer Bill of Rights given to each patient.

The rule also sets BMI eligibility: 30 or above, above 27 with a comorbidity, or body-fat thresholds.

The EHR therefore has to order and store labs, hold a signed consent in the chart (intake and consent forms can be built with a form builder), attach a state-required patient notice, and turn each prescription date into a recurring re-evaluation task. Ask the vendor: if my state requires a visit every 3 months, how does the system remind me and show me who is overdue?

Memberships and subscriptions: the auto-renewal overlay

A program sold as a recurring membership puts the billing system under auto-renewal law. Our membership auto-renewal laws post carries the primary citations. Per that post, starting October 1, 2026, New York City’s click-to-cancel rule requires an online cancellation path even for in-person sign-ups, with restitution of every charge after a member’s first cancellation attempt and penalties of $525, $1,050, and $3,500. The FTC’s 2024 click-to-cancel rule was vacated by the Eighth Circuit on July 8, 2025. The FTC recodified the pre-2024 rule effective February 12, 2026 and opened an ANPRM whose comments closed April 13, 2026, so state law governs today.

The EHR therefore has to offer online cancellation that is at least as easy as sign-up, record when renewal and price-change notices were sent, support a medical pause, and keep a timestamped cancellation log, because the NYC restitution clock runs from the first attempt. Ask the vendor: show me the cancellation log for a member who tried to cancel twice.

HSA, FSA, and letters of medical necessity

When a patient wants to pay program fees from an HSA or FSA, the clinic’s documents are what the plan administrator sees. This section covers what the documentation must separate, not tax advice. IRS Publication 502 (2025 edition, for 2025 returns) says amounts paid to lose weight are a medical expense if the weight loss is a treatment for a specific disease diagnosed by a physician, such as obesity, hypertension, or heart disease, and that this includes fees for membership in a weight reduction group and fees for attendance at periodic meetings. It says the opposite when the purpose is the improvement of appearance, general health, or sense of well-being. The same publication says gym, health club, or spa dues are not includible, though separate fees charged there for weight loss activities can be. It excludes the cost of diet food and beverages, and it excludes nutritional supplements unless recommended by a medical practitioner as treatment for a specific medical condition diagnosed by a physician.

The EHR therefore has to hold the diagnosis in the chart, let a letter of medical necessity cite it, and itemize program fees separately from food, supplements, and any general-fitness component so the patient’s administrator can tell them apart. Ask the vendor: show me a receipt where program fees and supplements are separate lines.

Is a cash-pay weight loss clinic a HIPAA covered entity?

Under 45 CFR 160.103, a health care provider is a covered entity only if it “transmits any health information in electronic form in connection with a transaction covered by this subchapter.” A transaction includes health care claims, payment and remittance advice, coordination of benefits, claim status, enrollment and disenrollment, eligibility for a health plan, premium payments, and referral certification and authorization. A cash-only practice that never transmits any of those electronically may fall outside the definition. The definition turns on the transmission, not on who presses the button, so the question to answer is whether anyone transmits an eligibility check or a claim electronically on the practice’s behalf.

The safer build is to assume coverage: a business associate agreement with the EHR, portal, messaging, and telehealth vendors, and Security Rule safeguards across all of them. Our HIPAA form builder post covers the BAA and Security Rule detail.

The EHR therefore has to sign a BAA and cover every channel that carries patient information, including portal, messaging, and video. Ask the vendor: which of these components are covered by your BAA, and which are third-party tools that are not?

Patient texting and the TCPA

A program built on recurring visits leans on text reminders, and the TCPA rules in 47 CFR 64.1200 limit them. Autodialed or prerecorded calls and texts to a cell phone require prior express consent (64.1200(a)(1)(iii)). Telemarketing texts require prior express written consent, except that a “health care” message made by or on behalf of a HIPAA covered entity or business associate is carved out of the written-consent requirement (64.1200(a)(2)).

Healthcare-provider calls and texts to a wireless number are exempt from the prior-express-consent requirement only if every condition in 64.1200(a)(9)(iv) is met:

A membership renewal reminder or a promotion carries billing or marketing content, so it is not a health care message under (a)(9)(iv).

The EHR therefore has to separate clinical notifications from marketing, record consent per channel, enforce STOP automatically, cap clinical messages at one per day and three per week, and keep a log. Ask the vendor: what happens if two clinical reminders are queued for the same patient on the same day?

Exercise and nutrition programs inside the chart

No federal rule on this list requires an exercise or nutrition module, but the HSA and membership sections above explain why program content belongs in the same record as the diagnosis and the billing: the program is what the letter of medical necessity describes and what the receipt itemizes. The practical requirement is that assigned programs, patient-facing weight and BMI trends, and program fees live where the diagnosis and consent live, rather than in a separate app with its own login and its own privacy terms.

The EHR therefore has to assign exercise and nutrition programs from within the chart and show the patient their progress in the portal. Ask the vendor: is the program library part of the medical record, and is it covered by the same BAA?

The requirements checklist and the demo questions

Use this table as the demo script.

Three follow-ups to calendar from this post: the DEA telemedicine flexibilities end on December 31, 2026, the 503B bulks list determination on semaglutide, tirzepatide, and liraglutide was still pending as of October 1, 2026, and FDA’s four-or-fewer policy is dated April 1, 2026.

A weight loss clinic’s compliance stack runs through the chart: the prescription, the controlled-substance signature, the lot record, the membership, and the text. PrismEHR for wellness and weight loss practices includes prescription sending with EPCS, labs and orders, inventory management for injectables with lot and expiry tracking, subscriptions and memberships, a patient portal, built-in messaging, video telehealth, GLP-1 management and progress-visit documentation templates, and HIPAA-compliant nutrition programs. The portal shows patients their weight and BMI trends and assigned programs. If you are also setting up recurring programs, read our guide to auto-renewal laws for clinic memberships, then run the checklist above against any system you are considering, ours included.