Cerebral’s non-prosecution agreement shows that buyer risk can exist even without a corporate indictment when internal business practices affect controlled-substance prescribing. The resolution is a template for how enforcement agencies read telehealth operating models.
By Noah Green CPA CFE
This article is general due diligence education for buyers, investors, lenders, and operators. It is not legal advice. Enforcement posture, docket status, restitution, and related civil proceedings can change. Verify current posture before publication or reliance.
The Short Version
On Nov. 4, 2024, the U.S. Attorney’s Office for the Eastern District of New York announced that Cerebral Inc. entered a non-prosecution agreement tied to business practices that the government said encouraged unauthorized distribution of controlled substances. The public sources state Cerebral agreed to forfeit \$3.652 million, with a \$2.922 million fine deferred subject to compliance over a 30-month cooperation term.
A separate FTC and DOJ civil matter concerns privacy, cancellation, and data-use allegations. The FTC case page listed consumer refunds activity in 2025. That civil posture should be verified against current court records before any transaction closes.
For buyers and investors, the Cerebral resolution is not primarily a story about a single company. It is a case study in how enforcement agencies reconstruct a telehealth operating model from the inside out, starting with management dashboards and compensation structures rather than individual prescriptions. A buyer who treats the NPA as a historical footnote and moves on to EBITDA modeling is skipping the part of diligence that the government spent years building.
Related SPP reading: Done ADHD telehealth case study, DOJ healthcare fraud diligence guide, and Burgerim: When the Business in a Box Pitch Became a Franchise Buyer Trap.
Public Posture
The EDNY NPA release, dated Nov. 4, 2024, is the controlling public document for the criminal resolution. It states that Cerebral agreed to the NPA, agreed to forfeit \$3.652 million, and accepted a deferred fine of \$2.922 million conditioned on compliance. The cooperation term runs 30 months from the agreement date.
The FTC case page at ftc.gov/legal-library/browse/cases-proceedings/222-3067-cerebral-inc-kyle-robertson-us-v covers a separate civil matter. That page listed consumer refunds activity in 2025 and names Kyle Robertson and related parties in addition to Cerebral Inc. The civil posture for individual defendants and related entities should be verified against current court records. The FTC matter involves allegations under the FTC Act, the Opioid Addiction Recovery Fraud Prevention Act, and ROSCA, which governs negative-option subscription cancellation practices.
Allegation discipline: use resolved corporate NPA language for the EDNY criminal matter. Use pending, alleged, or civil-case language for FTC-related claims and for any individual defendant posture unless current court records confirm resolution.
The Mechanism and the Diligence Problem
The public sources state that Cerebral admitted practices that encouraged unauthorized distribution of controlled substances, including prescription-rate targets and deficient diversion controls. That sentence is the diligence center of gravity for any buyer looking at a behavioral-health or ADHD telehealth platform.
The mechanism matters because it is not unique to Cerebral. Telehealth platforms that prescribe controlled substances face a structural tension: the business model rewards scale and speed, and clinical judgment requires time and individualized assessment. When a company resolves that tension by building prescribing volume into management metrics, it has created a paper trail that enforcement agencies can follow from the boardroom to the prescription pad.
Here is how that paper trail typically forms. A company sets growth targets for patient acquisition and retention. It builds dashboards that track conversion rates, prescription continuation rates, and clinician throughput. It ties clinician compensation or performance reviews to those metrics. It designs patient-facing workflows that make it easier to continue a prescription than to pause or discontinue one. It may also design duplicate-account controls and diversion-monitoring programs that are nominal rather than functional, because rigorous controls would slow the metrics the company is optimizing.
None of those steps requires a single bad actor to make a single corrupt decision. The system produces the outcome without anyone explicitly directing it. That is precisely why enforcement agencies look at the system rather than individual prescriptions when they investigate telehealth controlled-substance cases.
For a buyer, the implication is direct. The revenue you are buying was generated by a clinical operation. The clinical operation was shaped by management systems. Those management systems are discoverable, and if they contain the pattern described above, they represent both historical legal exposure and forward-looking operating risk. A buyer who does not test those systems before closing is not underwriting the business; the buyer is inheriting it blind.
The Cerebral case also illustrates a second diligence problem: the gap between corporate resolution and individual civil exposure. The NPA resolved the criminal matter at the entity level. The FTC civil case page names individual parties. A buyer acquiring Cerebral-adjacent assets, a successor entity, or a platform with similar operating characteristics needs to understand which obligations travel with the business and which remain with individuals, and whether any of those individuals are involved in the target company.
Warning Signs for Buyers
The following warning signs are drawn from the public source description of the Cerebral matter and from the structural features of telehealth controlled-substance platforms generally. They are not exhaustive, and their presence does not establish liability. They are indicators that additional diligence is warranted.
Prescribing metrics in management materials. If board decks, management dashboards, or clinical operations reports contain targets for prescription rates, continuation rates, refill retention, or stimulant conversion, those materials require careful review. The question is not whether the company tracked clinical outcomes. The question is whether the tracking was designed to influence clinical judgment in a direction that served business metrics.
Clinician compensation tied to prescribing behavior. Bonus structures, performance reviews, or staffing decisions that reward clinicians for higher prescription volume, faster assessments, or lower discontinuation rates are a direct link between business incentives and clinical outcomes. Request all compensation plans, performance review templates, and any documentation of how clinician performance was evaluated.
Informal or delayed controlled-substance audits. A telehealth platform prescribing Schedule II stimulants should have a documented, regular, and clinician-specific audit program. If audits were informal, infrequent, or not tied to corrective action, that gap is both a compliance failure and a signal about how seriously the company treated its diversion-control obligations.
Duplicate-account and diversion controls that do not match the risk profile. A platform prescribing Adderall or other Schedule II stimulants to a large patient population should have controls that match that risk. If the controls are generic, undocumented, or were not updated as the platform scaled, the gap between risk and control is a diligence finding.
Patient reassignment rules that preserve prescriptions when clinicians leave. If the platform’s workflow automatically reassigns patients to new clinicians and continues prescriptions without a new clinical assessment, that design choice prioritizes retention over clinical integrity. Request the patient reassignment policy and any documentation of how prescription continuity was handled during clinician turnover.
Privacy, cancellation, and data-use issues. The FTC civil matter involves allegations about cancellation practices and data use. A platform that made it difficult for patients to cancel, that used patient data in ways patients did not authorize, or that had a high volume of consumer complaints about billing or cancellation has a consumer-protection risk profile that is separate from the controlled-substance risk but often correlates with it. Both reflect a management culture that prioritized growth metrics over consumer and patient welfare.
Subpoena and litigation-hold history. If the company received a subpoena, civil investigative demand, or other government inquiry and did not implement a litigation hold, or if the litigation hold was narrow and did not cover the management systems described above, that is a spoliation risk that can affect the buyer’s post-closing position.
Diligence Tests Before Signing or Before the Wire
The following tests are organized by document category. They are designed to be run before a letter of intent is signed if possible, and certainly before closing. Each test is tied to a specific risk identified in the public source record.
KPI and Dashboard Review
Request all management dashboards, board materials, investor updates, and clinical operations reports for the full look-back period, at minimum the three years before the transaction. Search for any metric that could affect clinical judgment: prescription rates, conversion rates, refill retention, stimulant continuation, clinician throughput, and patient churn.
When you receive these materials, read them as an enforcement agency would. Ask: does this metric reward a clinician for prescribing, or does it reward a clinician for good clinical outcomes? Those are not always the same thing. A metric that rewards speed of assessment, volume of patients seen, or continuation of existing prescriptions is a metric that creates pressure on clinical judgment.
Also request the history of how these metrics changed over time. A platform that started with outcome-focused metrics and shifted to volume-focused metrics as it scaled is showing you the moment when the business model began to diverge from the clinical model.
Compensation Plan Reconciliation
Request all clinician compensation plans, bonus structures, and performance review templates. Reconcile those plans to the dashboard metrics. If the dashboard tracks stimulant continuation rates and the compensation plan pays bonuses for high continuation rates, you have a direct link between business incentives and prescribing behavior.
Also request any documentation of how compensation plans were reviewed by the clinical board, compliance function, or outside counsel. A compensation plan that was never reviewed for controlled-substance compliance implications is a gap. A compensation plan that was reviewed and approved despite containing prescribing incentives is a more serious finding.
Controlled-Substance Governance Documents
Request the clinical board charter, meeting minutes, and any resolutions related to controlled-substance prescribing. Request the diversion-control policy, the audit program documentation, and the results of any audits conducted. Request corrective-action records for any clinician who was flagged in an audit.
When reading these documents, look for the gap between policy and practice. A well-written diversion-control policy that was never operationalized is not a control. It is a document. The audit results will tell you whether the policy was real. If audits were conducted but no corrective action was ever taken, that is a signal that the audit program was nominal.
Also request the duplicate-account controls documentation. For a platform prescribing Schedule II stimulants, the question is whether the platform had a mechanism to identify patients who were obtaining prescriptions from multiple sources, and whether that mechanism was actually used.
Privacy and Cancellation Controls
Because the public sources include the FTC civil case page, diligence should include a review of data-sharing practices, cancellation workflows, refund practices, and consumer complaint history. Request all consumer complaint logs, Better Business Bureau records, state attorney general correspondence, and any internal escalation records related to cancellation or billing disputes.
Also request the data-use agreements, privacy policy version history, and any documentation of how patient data was shared with third parties. The FTC matter involves allegations about data use that are separate from the controlled-substance issues but reflect the same management culture.
NPA Compliance Testing
If the target is operating under the Cerebral NPA or a similar resolution, diligence must test ongoing compliance obligations directly. Request the full text of the NPA and any related compliance plans. Identify every obligation, every reporting deadline, and every practice that the NPA requires the company to stop or modify.
Build a closing checklist that maps each NPA obligation to a responsible party post-closing. Identify which obligations the buyer will assume, which require government consent to transfer, and which default provisions could trigger the deferred fine or renewed enforcement attention. The \$2.922 million deferred fine is not a sunk cost; it is a contingent liability that the buyer may be acquiring.
Also verify whether the 30-month cooperation term creates any post-closing reporting obligations that the buyer needs to understand before signing. A cooperation term that requires the company to report certain events to the government is an ongoing relationship with the enforcement agency that does not end at closing.
Payer Claims Reconciliation
Request a sample of claims submitted to payers for ADHD and stimulant-related services. Reconcile those claims to clinical notes, prior authorization records, and prescribing decisions. Look for patterns: claims submitted without adequate documentation, prior authorizations that were templated rather than individualized, or prescribing decisions that do not appear to be supported by the clinical record.
This reconciliation is not a full audit. It is a sampling exercise designed to test whether the revenue the buyer is acquiring was generated by a clinical operation that would survive scrutiny. If the sample reveals documentation gaps, the buyer needs to understand the scope of those gaps before pricing the deal.
How to Read the Primary Source Documents
The EDNY NPA release is a press release, not the NPA itself. It summarizes the resolution but does not contain the full compliance obligations, cooperation terms, or default provisions. A buyer should request the full NPA text and read it directly. Pay particular attention to the section describing the admitted conduct, the compliance obligations, and the conditions under which the deferred fine becomes due.
The FTC case page at ftc.gov is a docket summary, not a final order. It lists case activity and links to filed documents. A buyer should review the actual complaint, any consent order or proposed order, and the most recent docket entries to understand current posture. The consumer refunds activity listed in 2025 suggests the civil matter was still active at that time. Verify current status before closing.
The DOJ 2024 National Health Care Fraud Enforcement Action release provides context for the scale of the enforcement environment in which the Cerebral matter sits. It is useful for understanding that the Cerebral resolution was not an isolated event but part of a coordinated enforcement posture across telehealth, behavioral health, and controlled-substance prescribing.
By the Numbers
| Metric | Public figure or posture | Why it matters for diligence | Source |
|---|---|---|---|
| NPA announcement date | Nov. 4, 2024 | Establishes the date of the resolved corporate criminal posture; sets the start of the 30-month cooperation term | EDNY NPA release |
| Forfeiture amount | \$3.652 million | Direct economic consequence of the resolution; verify whether this has been paid and whether any clawback provisions apply | EDNY NPA release |
| Deferred fine | \$2.922 million | Contingent liability that travels with the business if compliance conditions are not met; buyer must map the conditions before closing | EDNY NPA release |
| Cooperation term | 30 months from NPA date | Ongoing government relationship that may affect operations, reporting obligations, and transaction timing; verify whether government consent is required for a change of control | EDNY NPA release and public source context |
| FTC civil matter | Consumer refunds activity listed in 2025; individual defendants named including Kyle Robertson | Separate consumer-protection exposure that may not be resolved by the corporate NPA; verify current posture against FTC case page and court records | FTC case page |
| Total public resolution value | Over \$36 million per EDNY release headline | Headline figure includes forfeiture, deferred fine, and related amounts; verify components against full NPA text | EDNY NPA release |
| Admitted conduct | Practices encouraging unauthorized controlled-substance distribution, including prescription-rate targets and deficient diversion controls | The admitted conduct defines the compliance perimeter and the historical operating model; it is the starting point for every diligence test in this article | EDNY NPA release |
Source footer: Figures and posture are drawn from the public primary sources listed below. Verify all figures against current primary source documents before publication or reliance.
Buyer and Investor Takeaway
A non-prosecution agreement is not a diligence footnote. It is a legal instrument that defines the future operating perimeter of the business, creates contingent financial liabilities, and establishes an ongoing relationship between the company and the enforcement agency. A buyer who prices a deal based on historical EBITDA without underwriting the NPA compliance obligations is not buying a business; the buyer is buying a compliance program with revenue attached.
The Cerebral case also illustrates a point that applies across behavioral-health and telehealth M&A: the most important diligence documents are often not in the data room. They are in the management systems. Dashboards, compensation plans, clinical board minutes, audit exception reports, and patient reassignment policies are the documents that tell you how the business actually operated. If those documents are not in the data room, ask for them specifically. If they cannot be produced, that is itself a finding.
Before signing, build a closing checklist organized around the NPA and any related consumer-protection orders. That checklist should answer the following questions: Who owns each compliance obligation post-closing? Which obligations require government consent to transfer? Which reporting deadlines fall within the first 12 months after closing? Which practices must stop before or at closing? Which consumer workflows must be preserved? What triggers the deferred fine, and what is the cure period if a default occurs?
If the answers to those questions are not available before signing, the buyer is not ready to close.
For investors evaluating a telehealth platform that has not yet been subject to enforcement, the Cerebral case provides a checklist of the management practices that create enforcement risk. A platform that has prescription-rate targets in its dashboards, clinician compensation tied to prescribing volume, and nominal diversion controls is not a platform with a compliance problem waiting to be discovered. It is a platform that has already built the compliance problem into its operating model. The question is only whether enforcement has found it yet.
SPP Bottom Line
In controlled-substance telehealth diligence, the key evidence is almost always in the management systems: dashboards, incentives, audit exceptions, and escalation records. The Cerebral NPA is a public record of what those systems looked like at one company and what the government concluded about them. SPP would not underwrite revenue quality at any behavioral-health or ADHD telehealth platform until those materials have been produced, reviewed, and reconciled to prescribing behavior and payer claims.
The deferred fine structure in the Cerebral NPA is a specific buyer risk that deserves its own line in the deal model. It is not a historical cost. It is a contingent liability with conditions attached. Any buyer who does not map those conditions to post-closing operations before signing has left a material risk unpriced.
The FTC civil matter adds a second layer. Consumer-protection exposure in telehealth is not separate from clinical compliance exposure. Both reflect how the company treated the people it was supposed to serve. A platform with weak cancellation controls and weak diversion controls is showing you the same management culture from two different angles.