The Shifting Sands of Telehealth Controlled Substance Prescribing: Navigating DEA and State Requirements in 2025-2026

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for prescribing controlled substances via telehealth is undergoing a seismic shift. With the expiration of PHE waivers and new DEA proposals, healthcare businesses face unprecedented scrutiny. This deep dive unpacks the complex federal and state requirements, offering actionable insights for compliant operations.

The promise of telehealth—expanded access, convenience, and efficiency—has revolutionized healthcare delivery. Yet, for practices involved in prescribing controlled substances, this innovation is met with a formidable and rapidly evolving regulatory labyrinth. As we move into 2025-2026, the temporary flexibilities granted during the COVID-19 Public Health Emergency (PHE) have largely receded, ushering in a new era of heightened scrutiny from the Drug Enforcement Administration (DEA) and state medical boards. Healthcare businesses, from national telehealth brands to local medspas and dental practices, must master these intricate requirements or face severe penalties, including license revocation, hefty fines, and even criminal charges.

> For more on this topic, see our analysis: [Navigating the Minefield: Corporate Practice of Medicine and the MSO Model in 2025-2026](/blog/cpom-mso-compliance-2025-2026).

This article serves as your definitive guide to navigating the complex interplay of federal DEA regulations and diverse state laws governing controlled substance prescribing via telehealth. We will dissect the current landscape, analyze key enforcement trends, and provide practical strategies to ensure your practice remains compliant and resilient.

> For more on this topic, see our analysis: [Navigating the Minefield: Corporate Practice of Medicine and the MSO Model in 2025-2026](/blog/cpom-mso-compliance-2025-2026).

The Ryan Haight Act and the Post-PHE Reality

At the heart of federal controlled substance prescribing via telehealth lies the Ryan Haight Online Pharmacy Consumer Protection Act of 2008. This landmark legislation generally requires an in-person medical evaluation before a controlled substance can be prescribed via the internet. Its intent was clear: prevent the proliferation of 'pill mills' and ensure patient safety by mandating a legitimate medical purpose for such prescriptions.

During the COVID-19 PHE, the DEA issued waivers to the Ryan Haight Act, allowing practitioners to prescribe controlled substances via telehealth without a prior in-person medical evaluation. This flexibility was critical for maintaining access to care during an unprecedented crisis. However, these waivers have largely expired, or are in the process of phasing out, returning the regulatory environment closer to its pre-PHE stringency. While a temporary extension was granted until November 11, 2024, for patient-prescriber relationships established during the PHE, this is a bridge, not a permanent solution.

Key Takeaways for 2025-2026: * Default to In-Person: For new patient relationships involving controlled substance prescriptions, assume an initial in-person medical evaluation will be required unless a specific, permanent exception is finalized by the DEA. * PHE Grandfathering: Patients for whom a controlled substance was prescribed via telehealth during the PHE (before November 11, 2023) may continue to receive prescriptions via telehealth from the same practitioner until November 11, 2024. After this date, these relationships will also likely require an in-person evaluation or fall under new rules. * DEA's Proposed Rules: The DEA has issued proposed rules outlining potential permanent exceptions, particularly for buprenorphine for opioid use disorder (OUD). These proposals are subject to change, but they signal the DEA's intent to balance access with diversion prevention. Stay vigilant for the final rule.

DEA's Proposed Rules: A Glimpse into the Future

The DEA's proposed rules, initially published in March 2023 and subsequently refined, aim to establish a permanent framework for telehealth prescribing of controlled substances. While the final rules are still pending, the direction is clear: stricter controls than during the PHE, but with some targeted flexibilities.

Core Elements of the DEA's Proposed Framework: 1. Initial In-Person Exam (General Rule): For Schedule II and non-buprenorphine Schedule III-V controlled substances, an in-person medical evaluation would generally be required for the initial prescription. Subsequent refills or prescriptions could potentially be managed via telehealth. 2. Buprenorphine for OUD (Specific Exception): The DEA has shown a willingness to create a specific, more flexible pathway for buprenorphine prescribing for OUD. The latest supplemental proposed rule suggests that a telehealth evaluation could suffice for the initial buprenorphine prescription, provided certain safeguards are in place, such as a referral from a practitioner who has conducted an in-person exam, or a robust telehealth evaluation that meets specific criteria. This acknowledges the critical need for access to OUD treatment. 3. Referral Mechanisms: The proposed rules contemplate scenarios where a telehealth practitioner could rely on an in-person evaluation conducted by another DEA-registered practitioner, facilitating collaborative care models. 4. Record-Keeping: Meticulous documentation of all telehealth encounters, assessments, and prescribing decisions remains paramount, consistent with the 'legitimate medical purpose' standard.

Implication for Telehealth Brands: Your operational model must be agile enough to adapt to the final DEA rules. This could mean developing hybrid care models that integrate in-person components, establishing robust referral networks, or investing in technology that supports compliant initial telehealth evaluations for specific conditions like OUD.

Implication for Medspas, Dental, and Chiropractic Practices: While these practices may not frequently prescribe Schedule II narcotics via telehealth, any controlled substance prescribing (e.g., sedatives for dental procedures, muscle relaxants for pain) will fall under these rules. The general requirement for an initial in-person exam will significantly limit purely virtual prescribing for new patients in these settings.

The DOJ's Intensified Enforcement: Beyond Technical Compliance

The Department of Justice (DOJ) has made it unequivocally clear that it is intensifying enforcement against telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This goes beyond mere technical compliance with the Ryan Haight Act and delves into the fundamental question of whether a prescription serves a 'legitimate medical purpose.'

Recent DOJ actions highlight that even if a telehealth encounter technically satisfies an in-person waiver, if the underlying medical evaluation is perfunctory, lacks appropriate diagnostic steps, or appears designed to facilitate diversion, it will be scrutinized. The DOJ is targeting systemic failures and fraudulent schemes, not just isolated incidents.

Red Flags Under DOJ Scrutiny: * High Volume/Rapid Prescribing: Platforms that prioritize patient volume over thorough clinical assessment. * Lack of Individualized Assessment: 'Cookie-cutter' treatment plans or prescribing based solely on questionnaires without real-time, interactive clinical evaluation. * Inadequate Physical Exams: Failure to conduct appropriate physical examinations when clinically indicated, or to document why one was not performed. * Prescribing for Non-Medical Purposes: Prescribing controlled substances for weight loss, performance enhancement, or other off-label uses without robust clinical justification. * Patient Shopping/Diversion: Failure to identify and address signs of drug-seeking behavior or potential diversion. * Fee-Splitting/Inducements: Financial arrangements that incentivize prescribing or are disguised kickbacks.

Actionable Insight: Your compliance program must demonstrate that your telehealth operations are designed to deliver high-quality, legitimate medical care. This requires robust provider training, rigorous clinical protocols, comprehensive auditing of prescribing patterns, and a culture that prioritizes patient safety and ethical practice above all else. Ignorance of the law or reliance on 'technicalities' will not be a defense against DOJ prosecution.

State-Specific Variations: The Patchwork of Regulations

While federal law sets a baseline, state laws and medical board regulations often impose additional, sometimes more stringent, requirements for telehealth prescribing of controlled substances. Operating across state lines means navigating a complex patchwork of rules, and compliance in one state does not guarantee compliance in another.

Critical State-Level Considerations: * Licensure: Providers must be licensed in the state where the patient is located at the time of the telehealth encounter. This is non-negotiable. * DEA Registration: If prescribing controlled substances, providers must hold a valid DEA registration in the state where the patient is located, even if the provider is physically located elsewhere. This often requires obtaining a state-specific DEA registration or ensuring your existing registration covers that state. * Definition of Valid Patient-Provider Relationship: States vary widely on what constitutes a valid patient-provider relationship for telehealth prescribing. Some, like the District of Columbia, explicitly require a real-time, interactive audio-visual examination for initial prescribing. Others may allow for audio-only or asynchronous modalities under specific circumstances. For example, the Michigan Board of Medicine actively monitors and enforces regulations related to telehealth, including proper initial evaluations and prescribing practices. * Specific Substance Restrictions: Some states may have additional restrictions on prescribing certain controlled substances via telehealth (e.g., Schedule II narcotics) or for specific conditions. * Prescription Monitoring Programs (PMPs): Most states require practitioners to check the state's PMP before prescribing controlled substances. Ensure your telehealth workflow integrates this critical step for every state you operate in. * Consent and Documentation: State laws often dictate specific informed consent requirements for telehealth and mandate comprehensive documentation equivalent to in-person care.

Example: Michigan's Scrutiny: The Michigan Board of Medicine's increased scrutiny of telehealth services signals a critical need for robust compliance. This includes ensuring all practitioners are appropriately licensed, patient-provider relationships are established in accordance with state law (e.g., proper initial evaluations, informed consent), and prescribing practices, especially for controlled substances, strictly adhere to Michigan's Public Health Code and administrative rules (Michigan Administrative Code R 338.2301 et seq.).

Example: Kentucky's CPOM: While not directly about controlled substances, states with strict Corporate Practice of Medicine (CPOM) doctrines like Kentucky and Iowa can indirectly impact telehealth prescribing. If your business structure is non-compliant, the validity of any medical services, including prescribing, could be jeopardized. This underscores the need for a holistic compliance strategy.

What This Means For Your Practice: Actionable Steps for 2025-2026

The evolving regulatory landscape demands a proactive and comprehensive approach to compliance. Here’s a checklist for healthcare businesses engaged in or considering telehealth controlled substance prescribing:

Compliance Checklist:

Review and Update Clinical Protocols:

Credentialing and Licensure Management:

Technology and Security:

Documentation and Record-Keeping:

Training and Education:

Auditing and Monitoring:

Looking Ahead: The Future of Telehealth Controlled Substance Prescribing

The regulatory environment for telehealth controlled substance prescribing will remain dynamic. While the immediate future points towards stricter enforcement and a return to pre-PHE principles for initial encounters, the DEA and policymakers are also exploring pathways for legitimate access, particularly for conditions like OUD. The key for healthcare businesses will be agility, transparency, and an unwavering commitment to patient safety and regulatory compliance.

TrueEval believes that robust compliance is not a burden, but a strategic advantage. By proactively addressing these complex requirements, your practice can not only mitigate significant legal and financial risks but also solidify its reputation as a provider of safe, ethical, and high-quality telehealth care. The era of 'move fast and break things' in telehealth controlled substance prescribing is over; the future belongs to those who build with precision and compliance at their foundation.