Beyond the Waivers: Navigating Controlled Substance Prescribing via Telehealth in 2025-2026

2026-06-15

As the temporary flexibilities of the public health emergency fade, healthcare businesses face a complex and evolving regulatory landscape for controlled substance prescribing via telehealth. This in-depth analysis unpacks the critical federal and state requirements, offering a strategic roadmap for maintaining compliance and mitigating risk in 2025-2026 and beyond.

The landscape of controlled substance prescribing via telehealth is undergoing a profound transformation. What began as a rapid expansion driven by the COVID-19 public health emergency (PHE) waivers is now settling into a new, more stringent regulatory reality. For telehealth founders, multi-state practice owners, compliance officers, and investors, understanding and adapting to these changes is not merely good practice—it is an existential imperative. The stakes are extraordinarily high, encompassing severe civil penalties, criminal charges, and the potential loss of licensure and DEA registration.

> For more on this topic, see our analysis: [Navigating the New Frontier: Controlled Substance Prescribing via Telehealth in 2025-2026](/blog/controlled-substance-telehealth-2025-2026).

At TrueEval, we continually monitor these shifts, recognizing that fragmented federal guidance, varied state laws, and aggressive enforcement actions demand a proactive and sophisticated compliance strategy. This deep dive will equip your practice to navigate the complexities of controlled substance prescribing in the post-PHE era, focusing specifically on the critical challenges and requirements anticipated for 2025-2026.

> For more on this topic, see our analysis: [Navigating the New Frontier: Controlled Substance Prescribing via Telehealth in 2025-2026](/blog/controlled-substance-telehealth-2025-2026).

The Evolving Federal Framework: Decoding DEA Requirements

Federal oversight of controlled substances primarily stems from the Controlled Substances Act (CSA), enforced by the Drug Enforcement Administration (DEA). While the PHE introduced unprecedented flexibility, those waivers have largely expired or are on a defined timeline for sunsetting. The challenge for 2025-2026 lies in operating under the return of stricter baseline requirements and the uncertainty surrounding pending permanent rules.

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008: The Bedrock Principle

At its core, the Ryan Haight Act (21 U.S.C. § 829(e)) mandates that a controlled substance prescription issued via the internet is *not valid* unless the prescribing practitioner has conducted at least one in-person medical evaluation of the patient. The Act includes limited exceptions, such as for practitioners acting in a hospital or clinic under the direct supervision of another practitioner who has conducted an in-person exam, or in specific emergency situations. However, its most significant provision for telehealth has been the "telemedicine exception", which allows for prescribing without a prior in-person exam if done in accordance with specific DEA regulations.

During the PHE, the DEA exercised its authority under 21 U.S.C. § 802(54)(D) to temporarily waive the in-person examination requirement for all controlled substances prescribed via telehealth. This waiver facilitated critical access to care but created a reliance on a temporary measure. As of the end of the PHE (May 11, 2023), these blanket waivers began to phase out.

Post-PHE Transition and the Pending Permanent Rule

Recognizing the need for a smooth transition, the DEA issued several temporary rules extending some of the PHE flexibilities. Most notably, for patients who established a practitioner-patient relationship *during* the PHE through a telemedicine encounter, the in-person exam waiver was extended through November 11, 2024. For new patients, the waiver was extended only through December 31, 2024, *if* the prescription was issued on or before November 11, 2023. These extensions, while helpful, underscore that the long-term regulatory framework for Ryan Haight's telehealth exception remains in flux.

In February 2023, the DEA issued two Proposed Rules outlining potential permanent telehealth exceptions. These proposals generally suggested that for most Schedule II-V controlled substances (excluding buprenorphine for MAT), an initial in-person evaluation would again be required, or a prior in-person medical evaluation by *any* DEA-registered practitioner. For established patients, subsequent prescriptions could largely be handled via telehealth. However, following significant public comment, the DEA opted to extend the temporary flexibilities and has yet to finalize a permanent rule. This means that for 2025-2026, the precise contours of the Ryan Haight Act's telehealth exception are still undefined, creating a critical area of uncertainty and risk. Practices must operate with the understanding that a more restrictive environment for *initial* controlled substance prescribing (beyond MAT) via telehealth is highly probable.

Elimination of the DATA-Waiver Program and New Training Requirements

One significant and finalized change, as noted in recent regulatory intelligence, is the elimination of the DATA-waiver (or X-waiver) program for prescribing buprenorphine for opioid use disorder (OUD). The DEA's final rule, effective March 1, 2023, implements provisions of the SUPPORT Act (2018) and the Restoring Hope for Mental Health and Well-Being Act of 2022. This removes a long-standing barrier, making buprenorphine more accessible. Critically, this final rule explicitly states that buprenorphine for OUD may be prescribed via telemedicine without an initial in-person examination, provided all other federal and state requirements are met.

Alongside this, the Restoring Hope Act also introduced a new, universal one-time training requirement for all practitioners who prescribe controlled substances. As of June 27, 2023, prescribers are generally required to complete 8 hours of training on treating and managing patients with OUD and other substance use disorders. This training is mandatory for all DEA-registered prescribers applying for or renewing their registration. Healthcare businesses must ensure all their prescribing practitioners have completed this mandate to avoid compliance pitfalls.

Navigating the State-Specific Minefield

Even with federal clarity (or lack thereof), state laws and regulations layer on additional, often more restrictive, requirements. Federal law sets a floor, but states frequently establish a higher ceiling. This means a compliant federal practice may still be non-compliant with state rules.

State oversight typically comes from: * State Medical Boards: Govern physician licensure, scope of practice, and telehealth practice standards. * State Pharmacy Boards: Regulate pharmacies, dispensing practices, and frequently, aspects of prescribing. * State Controlled Substances Acts: Mirror federal law but can add unique provisions.

Key areas of state variation include:

Initial In-Person Examination Requirements: Many states maintained or are reverting to requiring an initial in-person examination for *certain* controlled substances, even if federal rules eventually become more lenient. For example, some states explicitly prohibit prescribing Schedule II substances (like Adderall or opioids) without a prior in-person visit for *any* condition.
Specific Drug Class/Schedule Restrictions: Some states may have tighter controls or outright prohibitions on prescribing specific schedules (e.g., Schedule II) or classes of drugs (e.g., stimulants for ADHD, benzodiazepines for anxiety) via telehealth, regardless of federal guidance.
Telehealth Modality Restrictions: While federal law often permits live audio-visual, some states may impose stricter requirements, such as mandating specific technologies or even prohibiting audio-only for controlled substances. Texas, for instance, has long had relatively conservative telehealth laws for initial prescriptions.
Patient Age Restrictions: Some states impose age restrictions for telehealth prescribing of controlled substances, particularly for minors.
Prescription Drug Monitoring Programs (PDMPs): All states operate PDMPs, and nearly all states mandate that prescribers consult their state's PDMP before prescribing a controlled substance and periodically thereafter. Non-compliance with PDMP mandates is a significant source of state enforcement actions. Practices must ensure seamless PDMP integration into their telehealth workflow across all states of operation.

Critical Compliance Pillars for Telehealth Controlled Substance Prescribing (2025-2026)

To withstand scrutiny from DEA, state medical boards, and other enforcement bodies, healthcare operators must build robust compliance infrastructure. This goes beyond mere policy documents; it requires integrated systems and diligent execution.

1. Good Faith Medical Evaluation & Documentation

The cornerstone of any compliant prescription, especially for controlled substances, is a "good faith" medical evaluation. While the definition may evolve with federal rules, the core principle remains: the prescriber must perform a clinical assessment sufficient to establish a legitimate medical purpose for the prescription. In a telehealth context, this means: * Comprehensive Patient History: Detailed medical, social, and substance use history. * Symptoms and Physical Exam (where clinically appropriate): While a hands-on physical exam is impossible remotely, objective data collection (e.g., vital signs from home devices, patient-reported symptoms, visual inspection) and a thorough mental status exam are crucial. Some conditions may still necessitate an in-person component for initial assessment. * Differential Diagnosis: Clear articulation of the diagnostic process. * Treatment Plan and Rationale: Detailed justification for the controlled substance, including non-pharmacological alternatives considered. * Risk Assessment: Evaluation of the patient's risk for substance use disorder or diversion. * Referral Pathways: Clear protocols for when an in-person referral is necessary for further evaluation or ongoing care.

Documentation is your strongest defense. Every step of the evaluation and decision-making process must be meticulously recorded, demonstrating clinical appropriateness and adherence to federal and state standards.

2. DEA Registration and State Licensure Verification

Practitioners must hold active, unencumbered state licenses in *every state where the patient is located* at the time of the telehealth encounter. Similarly, they must possess a valid DEA registration for each state where they prescribe controlled substances. Regular verification of both licensure and DEA status is non-negotiable. Any lapse or restriction can invalidate prescriptions and expose the practice to significant liability.

3. Mandated PDMP Utilization

As previously mentioned, virtually all states mandate PDMP consultation. Your compliance program must ensure: * Automated Integration: Where possible, integrate PDMP queries directly into the EHR or e-prescribing workflow. * Pre-Prescription Query: Require prescribers to check the PDMP *before* issuing a controlled substance prescription. * Periodic Review: Establish protocols for subsequent PDMP checks for ongoing prescriptions. * Red Flag Protocols: Train prescribers to identify and respond appropriately to red flags identified through PDMP data (e.g., multiple prescribers, early refills, high dosages).

4. Robust Patient Identity Verification

Preventing diversion and fraud starts with confirming the patient's identity. Telehealth platforms must implement multi-factor identity verification processes that go beyond simple self-attestation. This could include government-issued ID checks, biometric verification, or other secure methods.

5. Prescriber Training and Continuing Education

Beyond the new universal DEA training requirement, practices should implement ongoing training modules that cover: * Federal and state regulations for controlled substance prescribing via telehealth. * Risk assessment and mitigation strategies for diversion. * Best practices for patient monitoring and follow-up. * Documentation standards. * Specific protocols for high-risk substances or patient populations.

6. Secure E-Prescribing and Technology

Using a HIPAA-compliant, secure e-prescribing system is paramount. The system should integrate with PDMPs, allow for clear documentation, and prevent unauthorized access or tampering. Practices must ensure their telehealth platform meets all security and privacy standards required for handling protected health information (PHI), especially when dealing with sensitive controlled substance prescriptions.

7. Internal Auditing and Monitoring

A proactive compliance program includes regular internal audits of prescribing practices, patient records, and PDMP utilization. Identify potential areas of non-compliance *before* regulators do. Utilize data analytics to flag unusual prescribing patterns, high-volume prescribers, or patients receiving prescriptions from multiple providers.

Enforcement Trends and Risks

The Department of Justice (DOJ) and the DEA are actively scrutinizing healthcare providers for fraud and non-compliance. The recent sentencing of an Illinois Chiropractor for healthcare fraud, mail fraud, and wire fraud, resulting in federal prison time, serves as a stark reminder of the government's unwavering commitment to prosecuting fraudulent schemes. While that case wasn't specific to controlled substances, it underscores the intense scrutiny on any scheme designed to unlawfully enrich providers at the expense of payers, or in violation of federal funding integrity.

For controlled substances, specific risks include: * False Claims Act Violations: Prescribing controlled substances without a legitimate medical purpose, or in violation of federal/state laws, can lead to false claims submissions to federal healthcare programs (Medicare, Medicaid). Penalties include treble damages and significant fines. * DEA Investigations: Direct investigations by the DEA can lead to revocation of DEA registration, civil penalties, and criminal charges for unlawful dispensing or distribution. * State Medical Board Actions: Licensing boards can revoke or suspend medical licenses, impose fines, and require remedial education for violations of state practice acts. * Professional Liability: Increased malpractice risk due to inadequate patient evaluation or inappropriate prescribing.

What This Means For Your Practice: A 2025-2026 Checklist

To thrive in the evolving regulatory environment for controlled substance telehealth prescribing, proactive measures are essential. Consider this immediate action checklist for your practice:

Review and Update Policies: Immediately review all internal policies and procedures related to controlled substance prescribing via telehealth. Ensure they reflect the elimination of the DATA-waiver, the new universal training requirement, and the current state of Ryan Haight Act flexibilities (and prepare for their eventual sunset). Pay close attention to individual state laws where you operate.
Verify Prescriber Readiness: Confirm all DEA-registered prescribers have completed the required 8 hours of training for controlled substance prescribers. Implement a system for tracking and verifying ongoing licensure and DEA registrations.
Enhance Good Faith Exam Protocols: Strengthen your telehealth patient intake and evaluation protocols to ensure a "good faith" medical evaluation is consistently performed and meticulously documented, especially for initial prescriptions.
Mandate PDMP Integration and Use: Ensure seamless, mandatory PDMP integration and utilization before every controlled substance prescription, across all relevant states. Train staff on red flag identification and response.
Strengthen Identity Verification: Implement robust, multi-factor patient identity verification processes within your telehealth platform.
Establish Clear Referral Pathways: Develop clear protocols for when in-person evaluations or specialty referrals are necessary, particularly when telehealth limitations arise for complex controlled substance cases.
Stay Abreast of DEA's Permanent Rule: Actively monitor DEA announcements regarding the finalized Ryan Haight Act permanent rule for telehealth controlled substance prescribing. Be prepared to swiftly adapt your operations based on the final requirements.
Conduct Regular Internal Audits: Implement a schedule for regular internal audits of controlled substance prescribing practices to identify and rectify any compliance gaps proactively.

Looking Ahead

The landscape for controlled substance prescribing via telehealth is not static; it is a dynamic regulatory environment demanding continuous vigilance. While the recent DEA rules have provided some clarity, the pending permanent rules regarding Ryan Haight's in-person requirement for most controlled substances represent a significant area of uncertainty and potential risk for 2025-2026. Forward-thinking healthcare businesses will not wait for final pronouncements but will proactively build compliance frameworks that anticipate stricter requirements.

TrueEval provides the advanced compliance infrastructure and expert insights necessary to navigate these complex regulatory challenges. By partnering with TrueEval, your practice can transform regulatory uncertainty into a strategic advantage, ensuring robust compliance and sustainable growth in the evolving telehealth ecosystem.