The Controlled Substance Conundrum: Navigating Telehealth Prescribing in the Post-PHE Era (2025-2026)

2026-06-10

The regulatory landscape for telehealth prescribing of controlled substances is undergoing its most significant transformation since the Ryan Haight Act. With key COVID-19 flexibilities set to expire and a new universal DEA training mandate in effect, healthcare practices face unprecedented complexity in 2025-2026. This analysis provides an in-depth guide to the evolving federal and state requirements.

The past five years have witnessed an extraordinary expansion of telehealth, fueled by the imperative of the COVID-19 Public Health Emergency (PHE). Nowhere was this more impactful than in the realm of controlled substance prescribing, where longstanding federal restrictions were temporarily relaxed to ensure continuity of care. As we transition into 2025 and 2026, healthcare providers, telehealth platforms, and compliance officers face a critical juncture. The regulatory environment is shifting dramatically, demanding a proactive and meticulous approach to controlled substance prescribing via telehealth.

> For more on this topic, see our analysis: [Navigating the Patchwork: Corporate Practice of Medicine Compliance in a Multi-State Healthcare Landscape (2025-2026)](/blog/cpom-compliance-multi-state-healthcare-2025-2026).

The Drug Enforcement Administration (DEA) has recently finalized rules that fundamentally alter how buprenorphine for opioid use disorder (OUD) is prescribed and, perhaps more broadly, introduce a **universal one-time training requirement for *all* DEA-registered practitioners who prescribe controlled substances**. Concurrently, the temporary flexibilities that allowed for remote prescribing of controlled substances without an initial in-person medical evaluation are on a strict timeline for expiration. This convergence of new mandates and sunsetting waivers creates a complex, high-stakes environment. Non-compliance is not merely an administrative oversight; it carries severe penalties, including DEA registration revocation, state licensure sanctions, and potential criminal liability.

This deep dive will dissect the current federal framework, anticipate the post-PHE reality for 2025-2026, explore the persistent complexities of state-specific regulations, and provide actionable strategies for maintaining robust compliance.

The Foundational Law: Ryan Haight and the Evolving Definition of a "Valid Patient Relationship"

At the heart of federal controlled substance prescribing via telehealth is the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (P.L. 110-425). Enacted to combat the proliferation of rogue internet pharmacies, this law generally requires at least one in-person medical evaluation of a patient before a controlled substance can be prescribed. The Act provides specific exceptions, but the "in-person medical evaluation" has historically been the bedrock.

The COVID-19 PHE temporarily suspended this cornerstone requirement for telehealth. From March 2020 through May 11, 2023, DEA-registered practitioners were permitted to prescribe controlled substances via telemedicine without an initial in-person examination, provided the prescription was for a legitimate medical purpose, issued by a practitioner acting in the usual course of professional practice, and done in accordance with applicable federal and state laws. This dramatically expanded access to care, particularly for OUD treatment, mental health services, and chronic pain management.

The Post-PHE Telehealth Cliff: What to Expect in 2025-2026

Following the end of the PHE, the DEA extended the full set of COVID-19 telehealth flexibilities for prescribing controlled medications. For patient-practitioner relationships established on or before December 31, 2024, these flexibilities—which include prescribing controlled substances via telehealth without an initial in-person examination—will remain in effect through December 31, 2025. This is a critical grace period.

However, for **new patient-practitioner relationships established *after* December 31, 2024**, the flexibilities for prescribing *non-MAT controlled substances* without an initial in-person examination are currently set to expire. This means, absent new permanent rules from the DEA (which are still under consideration and have seen significant public comment), the **Ryan Haight Act's in-person requirement could fully re-assert itself for *new* patients and *non-MAT controlled substances* beginning January 1, 2026.** This represents a significant operational challenge for multi-state telehealth providers who have come to rely on the remote initiation of controlled substance treatment.

Practices must understand that the DEA published proposed rules in May 2023 for permanent telehealth prescribing of controlled substances. These proposals were met with significant public feedback, leading to the temporary extensions. The future permanent rules remain uncertain but are crucial for long-term planning. The current extensions provide a window, not a permanent solution.

DEA's Pivotal Final Rule: Reshaping MAT and All Controlled Substance Prescribing

Amidst the evolving Ryan Haight landscape, the DEA has issued a separate, but equally impactful, final rule titled "Medication-Assisted Treatment and Controlled Substance Prescribing" (88 FR 56914, August 21, 2023). This rule, implementing provisions from the SUPPORT Act of 2018 and the Restoring Hope for Mental Health and Well-Being Act of 2022, brings two major changes.

1. The End of the DATA-Waiver Program

The most significant change is the elimination of the "DATA-waiver" program (Drug Addiction Treatment Act of 2000). Previously, practitioners needed a specific waiver (often referred to as an X-waiver) from the Substance Abuse and Mental Health Services Administration (SAMHSA) to prescribe buprenorphine for OUD. This created an administrative barrier, limiting the number of providers able to offer this critical treatment.

Impact: The removal of the DATA-waiver aims to significantly increase access to buprenorphine treatment for OUD. Any DEA-registered practitioner with a Schedule III authority can now prescribe buprenorphine for OUD, provided they meet the new training requirement (discussed next) and comply with all other federal, state, and local laws. This shift empowers a broader range of primary care providers, mental health professionals, and other specialists to integrate OUD treatment into their practices. For telehealth providers focusing on mental health or substance use disorder, this removes a specific bureaucratic hurdle but places greater emphasis on clinical competency and general compliance.

2. The Universal One-Time Training Requirement

Replacing the DATA-waiver is a **new, broader one-time training requirement for *all* DEA-registered practitioners who prescribe controlled substances. This mandate applies to any practitioner seeking to renew or obtain a new DEA registration on or after June 27, 2023**.

Key Details of the Training: * Who it applies to: All DEA-registered practitioners authorized to prescribe Schedule II, III, IV, or V controlled substances. This is a crucial expansion; it's not just for OUD prescribers. * What it entails: A minimum of eight hours of training on the treatment and management of patients with opioid or other substance use disorders, including the appropriate prescribing of Schedule II, III, IV, and V drugs, or generally on pain management. * Accredited Providers: The training must be provided by organizations accredited to offer continuing education, such as: * The American Medical Association (AMA) * The American Osteopathic Association (AOA) * The American Nurses Credentialing Center (ANCC) * The American Academy of Physician Associates (AAPA) * The American Dental Association (ADA) * Or other organizations approved by SAMHSA. * Existing Training Counts: Any equivalent training completed prior to the rule's effective date (e.g., prior DATA-waiver training, certain medical school curricula) may satisfy the requirement. Practitioners who graduated medical, dental, or PA school within five years of the rule's effective date and completed *at least* eight hours of relevant training during their program are also deemed compliant.

Impact: This universal training requirement represents a significant compliance undertaking for all healthcare practices employing prescribers. From telehealth platforms to medspas, dental offices, and chiropractic practices (if they prescribe controlled substances), every practitioner must ensure this one-time mandate is met. Failure to comply could impact DEA registration renewals and expose practitioners and their employers to regulatory scrutiny.

3. Pharmacy Delivery of Controlled Substances for MAT

The final rule also codifies provisions allowing pharmacies to deliver certain controlled substances (specifically buprenorphine for MAT) to a practitioner's registered location for maintenance or detoxification treatment. This can facilitate direct administration in a clinic setting, improving patient access and adherence to treatment regimens.

The State-Level Labyrinth: Where Federal Minimums Meet Local Nuances

While federal regulations set a baseline, state laws frequently impose additional, often stricter, requirements for controlled substance prescribing, particularly via telehealth. A common misconception is that complying with federal law is sufficient; in healthcare, the stricter rule almost always applies.

Key State-Specific Compliance Areas:

1. Prescription Drug Monitoring Programs (PDMPs): Almost all states mandate the use of PDMPs before prescribing controlled substances, with varying requirements on frequency, lookback periods, and specific substances. Many states also require reporting of prescriptions within a very short timeframe (e.g., 24 hours). Telehealth providers must ensure their prescribers are registered with and actively utilizing the PDMP in the patient's state of residence for every controlled substance prescription.

Interstate Data Sharing: While PDMP data sharing across state lines is increasing, it's not universal. Practitioners must be aware of their obligations when prescribing across state borders.

2. State Telehealth Parity Laws and Restrictions: Many states have specific statutes governing telehealth, and some explicitly restrict the prescribing of certain controlled substances via telemedicine.

Schedule II Limitations: States like Texas generally require an initial in-person exam for Schedule II controlled substances prescribed via telehealth, with limited exceptions. Florida has historically had strict rules for telehealth prescribing of Schedule II and III controlled substances, particularly for chronic pain management.

3. Licensing and DEA Registration: Practitioners must hold a valid medical license in the state where the patient is located *at the time of the telehealth encounter*. Furthermore, their DEA registration must be valid for that state. This is a foundational, non-negotiable requirement for multi-state telehealth operations.

4. Collaborative Practice/Supervision Agreements: For Advanced Practice Providers (APPs) like Nurse Practitioners (NPs) and Physician Assistants (PAs), state laws dictate the scope of practice, including their authority to prescribe controlled substances and the level of physician supervision or collaboration required. These agreements often have specific stipulations for telehealth and controlled substance prescribing.

5. E-Prescribing Mandates: Most states, and Medicare Part D, now mandate electronic prescribing of controlled substances (EPCS). Practices must ensure their telehealth platforms and EHR systems support secure EPCS to comply with both state and federal requirements.

Blueprint for Compliance: Navigating 2025-2026

For healthcare practices operating or planning to operate in the telehealth space for controlled substance prescribing, the following compliance components are paramount.

1. Robust Good Faith Medical Evaluation Protocols

Even in a remote setting, a "good faith medical evaluation" remains a legal and ethical imperative. This requires: * Patient Identity Verification: Implementing robust identity verification processes (e.g., photo ID, secure authentication) to prevent fraud. * Comprehensive Patient Assessment: Conducting a thorough medical history, review of systems, and, where appropriate, utilizing remote monitoring tools or requiring specific diagnostic tests before prescribing. * Medical Necessity Documentation: Clearly articulating the medical necessity for the controlled substance, considering alternatives, and documenting the risk/benefit discussion with the patient. * Risk Assessment: Evaluating the patient for potential substance use disorder, diversion risk, and co-occurring mental health conditions.

2. Ironclad Documentation Standards

Documentation for controlled substance prescriptions must go beyond standard charting: * Detailed Clinical Rationale: Justify the choice of controlled substance, dosage, and duration. * PDMP Checks: Document the date, time, and findings of all PDMP queries. * Informed Consent: Obtain and document explicit informed consent, especially for long-term controlled substance use, outlining risks, benefits, and responsibilities. * Treatment Plan and Follow-up: Clearly define the treatment plan, including expected outcomes, monitoring parameters (e.g., UDS, pill counts), and scheduled follow-up appointments. * Communication Records: Document all communications with the patient, pharmacy, and other providers.

3. Technology & Security Infrastructure

HIPAA Compliance: Ensure all telehealth platforms, EHRs, and communication tools are fully HIPAA-compliant, protecting Protected Health Information (PHI).
EPCS Implementation: Utilize a DEA-certified EPCS system to prevent diversion and improve prescribing accuracy. This involves identity proofing, two-factor authentication, and secure transmission.
Data Security: Implement robust cybersecurity measures to protect patient data from breaches.

4. Continuous Monitoring and Risk Management

Controlled substance prescribing necessitates ongoing vigilance: * Patient Monitoring: Regular follow-up appointments, including re-evaluations for continued medical necessity, adverse effects, and signs of misuse or diversion. * Urine Drug Screens (UDS): Implement a protocol for periodic UDS, especially for patients on long-term controlled substances. * Pill Counts: Consider periodic pill counts for patients on high-risk medications. * Intervention Protocols: Establish clear protocols for addressing non-compliance, aberrant drug-seeking behavior, or suspected diversion.

5. Credentialing, Licensing, and DEA Registration Management

For multi-state operations, robust processes are essential: * Licensure Verification: Continuously verify the active, unrestricted licensure of all practitioners in every state where they provide care. * DEA Registration Management: Ensure all prescribers hold valid DEA registrations for each state where controlled substances are prescribed. Monitor expiration dates and renewal requirements. * Exclusion Screening: Regularly screen all practitioners and employees against federal and state exclusion lists (e.g., OIG LEIE).

6. Staff Training Beyond Prescribers

Compliance is a team effort: * Intake Staff: Train on patient identity verification, initial screening for controlled substance needs, and explaining telehealth procedures. * Support Staff: Educate on proper handling of PHI, communication protocols, and scheduling follow-up for controlled substance patients. * Billing Staff: Ensure accurate coding and billing for telehealth encounters involving controlled substances, adhering to payer-specific rules.

Enforcement Environment and Consequences

The enforcement landscape for controlled substance violations is unforgiving. Federal agencies like the DEA and the Department of Justice, alongside state medical boards and pharmacy boards, actively pursue cases of non-compliance.

Potential Consequences include: * DEA Registration Revocation: Loss of ability to prescribe controlled substances, effectively ending a practitioner's career in this area. * State Licensure Sanctions: Fines, suspension, or revocation of medical licenses. * Civil Monetary Penalties: Substantial financial penalties for violations of the False Claims Act or other federal statutes. * Criminal Charges: For intentional diversion, illicit distribution, or prescribing outside the usual course of professional practice, leading to imprisonment. * Reputational Damage: Significant harm to a practice's standing and patient trust.

What This Means For Your Practice: An Actionable Checklist for 2025-2026

The evolving regulatory environment demands immediate and ongoing attention. Healthcare leaders must proactively assess and update their compliance programs. Here's your essential checklist:

Universal DEA Training Audit: Immediately identify all DEA-registered practitioners within your organization. Confirm that each has completed the new one-time, 8-hour training requirement on opioid and substance use disorder and appropriate prescribing of controlled substances. Document this compliance meticulously.
Anticipate Ryan Haight Post-PHE: Understand that for new patient-practitioner relationships established *after December 31, 2024*, the ability to prescribe *non-MAT controlled substances* via telehealth without an initial in-person exam is set to expire. Develop contingency plans for how your practice will onboard and evaluate new patients for controlled substance needs in 2025 and, critically, in 2026 if no new permanent rules are in place.
Review State-Specific Protocols: Conduct a comprehensive audit of your telehealth controlled substance prescribing protocols against the laws of *each state* where your patients reside. Pay close attention to PDMP mandates, specific substance restrictions, and requirements for initial in-person exams or established patient relationships.
Enhance Good Faith Evaluation & Documentation: Refine your clinical protocols for telehealth encounters involving controlled substances. Ensure robust patient identity verification, comprehensive medical evaluations, clear medical necessity documentation, and detailed follow-up plans are consistently executed and recorded.
Verify EPCS Compliance: Confirm that all e-prescribing systems are DEA-certified for controlled substances and meet all state EPCS mandates.
Ongoing Practitioner Credentialing & DEA Monitoring: Implement a robust system for verifying practitioner licensure in all relevant states and ensuring their DEA registrations are current and valid for those jurisdictions.
Develop a "Regulatory Watch" Function: Designate a team or individual responsible for continuously monitoring DEA, state medical board, and legislative updates regarding telehealth and controlled substance prescribing. Given the dynamic nature, this is non-negotiable.
Engage Expert Legal Counsel: Proactively consult with healthcare compliance attorneys specializing in telehealth and controlled substances. Their expertise will be invaluable in interpreting complex regulations and mitigating risk.

Looking Ahead

The period of 2025-2026 will be a defining one for telehealth models relying on controlled substance prescribing. The landscape is shifting from a temporary, permissive environment to a more structured, and in many ways, more stringent one. While the elimination of the DATA-waiver streamlines MAT access, the universal training requirement and the impending return of Ryan Haight's core principles for non-MAT controlled substances underscore a clear message from regulators: expanded access comes with heightened responsibility.

Practices that invest now in robust, state-of-the-art compliance infrastructure will not only mitigate significant legal and financial risks but also position themselves as leaders in delivering safe, effective, and compliant healthcare. The future of telehealth prescribing for controlled substances belongs to those who embrace proactive, meticulous compliance as a core operational principle. TrueEval stands ready to partner with you in navigating this intricate regulatory terrain, ensuring your practice is not just compliant, but positioned for sustainable growth.