The Ryan Haight Act Reloaded: Navigating Telehealth Controlled Substance Prescribing in the Post-PHE Era

The landscape for prescribing controlled substances via telehealth has undergone a seismic shift. With the expiration of the COVID-19 Public Health Emergency (PHE) waivers, the foundational principles of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 are once again the primary federal guide for remote prescribing of controlled medications. This return to pre-PHE stringency, coupled with intensified enforcement from agencies like the DEA and DOJ, demands a meticulous re-evaluation of compliance strategies for any healthcare business operating in the telehealth space.

For more on this topic, see our analysis: The Shifting Sands of Telehealth Controlled Substance Prescribing: Navigating DEA and State Requirements in 2025-2026.

For over three years, the PHE offered a critical lifeline, allowing practitioners to prescribe controlled substances to patients via telehealth without a prior in-person medical evaluation. This flexibility dramatically expanded access to care, particularly for mental health and opioid use disorder (OUD) treatment. However, as of November 11, 2023, and with a further extension for established patient-prescriber relationships until November 11, 2024, those broad waivers have largely receded. The DEA's proposed rules, while still under review, underscore a clear intent to re-establish a more rigorous framework, emphasizing patient safety and diversion prevention.

For more on this topic, see our analysis: The Shifting Sands of Telehealth Controlled Substance Prescribing: Navigating DEA and State Requirements in 2025-2026.

This article will dissect the current federal and state requirements, highlight critical areas of risk, and provide actionable guidance for telehealth brands, medspas, dental practices, chiropractic offices, and other healthcare entities navigating this complex regulatory environment.

The Ryan Haight Act: A Return to Fundamentals

At its core, the Ryan Haight Act mandates that a controlled substance cannot be prescribed via the internet without a prior in-person medical evaluation of the patient. This was a direct response to the proliferation of "rogue online pharmacies" that facilitated the illicit distribution of controlled substances. The Act does provide for certain exceptions, but the general rule is clear: no initial in-person exam, no controlled substance prescription via telehealth.

During the PHE, the DEA issued waivers that effectively suspended this in-person requirement for telehealth. With those waivers largely gone, the default position is a return to the pre-PHE standard. The DEA's proposed rules (initially published in March 2023, with a supplemental rule in May 2023) aim to codify a permanent framework, but until finalized, the spirit of Ryan Haight – emphasizing a legitimate medical purpose and a bona fide patient-prescriber relationship – remains paramount.

Key Provisions of the Ryan Haight Act (Post-PHE Interpretation):

• In-Person Medical Evaluation: Generally required before a controlled substance can be prescribed via telehealth.
• Legitimate Medical Purpose: Any prescription must be issued by a practitioner acting in the usual course of professional practice and for a legitimate medical purpose.
• Bona Fide Patient-Prescriber Relationship: This relationship must be established through a proper medical evaluation.
• Exceptions: The Act outlines specific exceptions, such as for practitioners providing care at a DEA-registered hospital or clinic, or through a "referring practitioner" model where an in-person exam has already occurred. The most significant proposed exception, still under discussion, relates to a limited telehealth exception for buprenorphine for OUD.

DEA's Proposed Rules: What's on the Horizon?

The DEA's proposed rules, while not yet final, offer critical insight into the likely future of controlled substance prescribing via telehealth. The initial proposal was quite restrictive, generally requiring an in-person exam for all Schedule II and certain Schedule III-V controlled substances. The supplemental rule provided a temporary reprieve and introduced a more nuanced approach for buprenorphine.

Highlights of the DEA's Proposed Rules (as of late 2023/early 2024):

1. General In-Person Requirement: For Schedule II and non-buprenorphine Schedule III-V controlled substances, an in-person medical evaluation would generally be required for the initial prescription. Subsequent refills or prescriptions could potentially occur via telehealth if certain conditions are met.
2. Buprenorphine Exception (Proposed): The supplemental rule suggests a 30-day supply of buprenorphine could be prescribed via telehealth without a prior in-person exam, provided the practitioner conducts a real-time, audio-visual telehealth evaluation. After 30 days, an in-person exam or a referral from a practitioner who has conducted one would be necessary.
3. Referral Model: A patient could establish a relationship with a practitioner via telehealth if referred by another practitioner who has conducted an in-person medical evaluation.
4. Temporary PHE Flexibilities: These were extended until November 11, 2023, and for patient-prescriber relationships established during the PHE, an additional year until November 11, 2024. This means that for patients who began receiving controlled substance prescriptions via telehealth during the PHE, their existing virtual relationships could continue for a defined period without an in-person visit.

Implications: These rules signal a future where hybrid care models – combining virtual and in-person components – will be the norm for controlled substances. Purely virtual models for initial controlled substance prescribing will be severely limited, especially for Schedule II medications like stimulants or opioids for pain management.

State-Specific Variations: The Layered Compliance Challenge

While the Ryan Haight Act sets the federal floor, states often impose their own, sometimes more stringent, requirements for telehealth and controlled substance prescribing. This creates a complex compliance matrix for multi-state operators.

Examples of State-Specific Considerations:

• Michigan: The Michigan Medical Board is actively monitoring and enforcing regulations related to telehealth, with disciplinary actions often stemming from inadequate supervision and prescribing practices. Practitioners must adhere to Michigan's Public Health Code and administrative rules, which may have specific requirements for establishing patient-provider relationships and prescribing controlled substances via telehealth.
• District of Columbia: DC regulations explicitly require an initial real-time, interactive audio-visual examination to establish a valid provider-patient relationship for prescribing, with limited exceptions. Asynchronous modalities or audio-only consultations are generally insufficient for initiating a prescribing relationship, particularly for new patients or new conditions. This standard must be met before any controlled substance prescribing can even be considered.
• General State Trends: Many states require that the standard of care for telehealth be equivalent to that of in-person care. This implies that even if a federal exception allows for telehealth prescribing, state boards may still scrutinize whether a thorough enough evaluation was conducted remotely to meet the standard of care.

Actionable Insight: Providers must be licensed in the state where the patient is located AND hold a DEA registration in that state if they intend to prescribe controlled substances. This dual requirement necessitates robust credentialing and ongoing monitoring.

Intensified Enforcement: DOJ and DEA on High Alert

The Department of Justice (DOJ) and the DEA are not merely proposing new rules; they are actively prosecuting violations. The DOJ has significantly increased its focus on telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances.

Key Enforcement Triggers:

• Lack of Legitimate Medical Purpose: This is the cornerstone of federal enforcement. If a prescription is deemed to lack a legitimate medical purpose, even if technical boxes were checked, it can lead to severe penalties.
• "Pill Mill" Indicators: Rapid prescribing, lack of proper patient evaluation, prescribing to multiple patients in the same household, or prescribing without adequate medical records are red flags.
• Diversion: Any indication that controlled substances are being diverted for illicit use will trigger intense scrutiny.
• Fraudulent Schemes: The DOJ is targeting systemic failures and business models that prioritize profit over patient safety and compliance.

Consequences of Non-Compliance:

• DEA Registration Revocation: Loss of ability to prescribe controlled substances.
• License Suspension/Revocation: State medical board actions.
• Civil Monetary Penalties: Significant fines.
• Criminal Charges: Imprisonment for practitioners and corporate executives.
• Exclusion from Federal Healthcare Programs: Loss of ability to treat Medicare/Medicaid patients.

Practical Implications for Your Practice

This evolving regulatory environment demands a proactive and comprehensive approach to compliance. Here's what healthcare businesses need to do:

For Telehealth Brands and Platforms:

1. Re-evaluate Patient Intake Workflows: Design workflows that clearly delineate between controlled and non-controlled substance prescribing. For controlled substances, ensure a robust mechanism for verifying prior in-person exams or identifying patients who fall under the temporary PHE extension or proposed buprenorphine exception.
2. Hybrid Care Models: Prepare to integrate in-person components. This might involve partnerships with brick-and-mortar clinics, facilitating referrals for initial in-person exams, or developing your own physical locations.
3. Provider Training & Oversight: Conduct mandatory, ongoing training for all prescribing providers on federal (Ryan Haight, DEA rules) and state-specific controlled substance prescribing requirements via telehealth. Implement rigorous internal audit processes for prescribing patterns.
4. Technology Safeguards: Utilize platforms that support robust audio-visual interactions, secure patient identification, and comprehensive documentation. Implement AI-driven tools to flag potential red flags for diversion or inappropriate prescribing.
5. Documentation, Documentation, Documentation: Ensure all patient encounters, evaluations, medical necessity, and prescribing decisions are meticulously documented. This is your primary defense in an audit or investigation.

For Medspas, Dental Practices, and Chiropractic Offices (and other specialties):

1. Scope of Practice Review: If your practice is considering offering telehealth for any prescribing, especially controlled substances (e.g., pain management in dental/chiropractic, certain aesthetic treatments in medspas), conduct a thorough review of your state's scope of practice laws and board regulations.
2. Limited Telehealth for Controlled Substances: Recognize that purely virtual models for initial controlled substance prescribing are highly restricted. If you prescribe controlled substances, a hybrid model with an initial in-person exam will likely be necessary.
3. Referral Protocols: If your practice refers patients to telehealth platforms that prescribe controlled substances, ensure those platforms are compliant. Your referral practices could be scrutinized if the referred platform is found to be operating illegally.
4. Ancillary Services: For non-controlled substance telehealth services, ensure compliance with general telehealth best practices: patient identification, informed consent, secure platforms, and meticulous documentation.

Checklist for Controlled Substance Telehealth Compliance

• Federal Requirements:
  • Is an initial in-person medical evaluation required for this patient and this controlled substance? (Refer to Ryan Haight Act and current DEA guidance/proposed rules).
  • If no in-person, does the patient fall under the PHE extension (established relationship by 11/11/2023, valid until 11/11/2024)?
  • If buprenorphine, does it meet the proposed 30-day telehealth exception criteria?
  • Is the prescription for a legitimate medical purpose and by a practitioner acting in the usual course of professional practice?
  • Is the prescribing provider DEA-registered in the patient's state?
• State Requirements:
  • Is the prescribing provider licensed in the patient's state?
  • Does the state have specific requirements for establishing a patient-provider relationship via telehealth (e.g., real-time audio-visual in DC)?
  • Are there state-specific restrictions on prescribing controlled substances via telehealth (e.g., specific drug classes, quantity limits)?
  • Are there state-specific PMP (Prescription Drug Monitoring Program) requirements for telehealth prescribers?
• Operational & Documentation:
  • Are patient identities verified and locations confirmed?
  • Is informed consent for telehealth obtained and documented?
  • Are comprehensive medical records maintained for all telehealth encounters, including rationale for prescribing controlled substances?
  • Are there clear internal policies and procedures for controlled substance prescribing via telehealth?
  • Is there a robust system for monitoring prescribing patterns and identifying potential red flags?
  • Are all technology platforms HIPAA-compliant and secure?

Looking Ahead

The regulatory environment for telehealth controlled substance prescribing is dynamic. While the DEA's proposed rules offer a glimpse into the future, the final framework is still subject to change. What is clear, however, is that the era of broad, unrestricted telehealth prescribing of controlled substances is over.

Healthcare businesses must proactively adapt. This means investing in robust compliance infrastructure, fostering a culture of regulatory adherence, and prioritizing patient safety above all else. The "wild west" days of telehealth are behind us; the future demands sophisticated, compliant operations that can navigate a complex web of federal and state regulations. TrueEval stands ready to help you build and maintain that infrastructure, ensuring your practice remains compliant and sustainable in this evolving landscape.

Don't wait for an enforcement action to review your protocols. The time to act is now.

---

Further Reading

• The Shifting Sands of Telehealth Controlled Substance Prescribing: Navigating DEA and State Requirements in 2025-2026
• Navigating the Minefield: CPOM Compliance for Multi-State Telehealth and Medspa Operations in 2025-2026
• The Compliance Crucible: Navigating Intensified Enforcement in Telehealth and Digital Health
• Navigating the Shifting Sands: Critical Regulatory Updates for Telehealth, Medspas, and Clinical Practices