The Shifting Sands of Telehealth Controlled Substance Prescribing: Navigating DEA and State Requirements in 2025-2026

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for prescribing controlled substances via telehealth is undergoing a profound transformation. With the expiration of PHE flexibilities and new DEA proposals, healthcare businesses must meticulously navigate complex federal and state requirements to avoid severe penalties. This deep dive provides actionable insights for compliant operations.

The promise of telehealth — expanded access to care, enhanced convenience, and improved patient outcomes — has been tempered by a complex and rapidly evolving regulatory environment, particularly concerning the prescribing of controlled substances. As we move into 2025 and 2026, the temporary flexibilities granted during the COVID-19 Public Health Emergency (PHE) are largely behind us, and the U.S. Drug Enforcement Administration (DEA) is finalizing its long-awaited permanent rules. This confluence of factors creates a critical juncture for telehealth founders, operators, and compliance officers, demanding a sophisticated understanding of both federal and state mandates.

> For more on this topic, see our analysis: [Navigating the Minefield: CPOM Compliance for Multi-State Telehealth and Medspa Operations in 2025-2026](/blog/cpom-compliance-multi-state-telehealth-medspa).

TrueEval has closely monitored these developments, and our analysis indicates that the era of broad, unconstrained telehealth prescribing of controlled substances is over. The focus has decisively shifted towards ensuring patient safety, preventing diversion, and upholding the 'legitimate medical purpose' standard, with significant implications for how healthcare businesses structure their virtual care models.

The Post-PHE Reality: Reverting to Ryan Haight and Beyond

During the PHE, the DEA waived the in-person examination requirement of the Ryan Haight Online Pharmacy Consumer Protection Act of 2008. This waiver allowed practitioners to prescribe controlled substances via telehealth without a prior in-person medical evaluation, provided the prescription was issued for a legitimate medical purpose in the usual course of professional practice. This flexibility was a lifeline for many patients, particularly those in rural areas or those seeking treatment for opioid use disorder (OUD).

However, the PHE officially ended on May 11, 2023. While the DEA provided a temporary extension of these flexibilities until November 11, 2023, and an additional year (until November 11, 2024) for patient-prescriber relationships established during the PHE, the underlying principle is clear: the in-person examination requirement is returning.

The Ryan Haight Act generally mandates that a controlled substance prescription issued via the internet must be based on an in-person medical evaluation, or on a medical evaluation performed by a practitioner who has conducted at least one prior in-person medical evaluation of the patient. The Act includes limited exceptions, such as for practitioners acting in the physical presence of another DEA-registered practitioner or those providing care in a hospital setting. The DEA's proposed rules aim to establish a permanent framework that balances access with anti-diversion efforts.

DEA's Proposed Rules: A Glimpse into the Future

The DEA initially issued two proposed rules in February 2023, followed by a supplemental proposed rule in October 2023. While the final rules are still pending, the direction is clear:

1. Initial In-Person Exam for Most Controlled Substances: For Schedule II and non-buprenorphine Schedule III-V controlled substances, an initial in-person medical evaluation will generally be required before a prescription can be issued via telehealth. This significantly impacts telehealth models that rely on purely virtual encounters for these medications. 2. Buprenorphine for OUD: A Nuanced Approach: The supplemental proposed rule offers a more flexible approach for buprenorphine prescriptions for OUD. It suggests that a 30-day supply of buprenorphine can be prescribed via telehealth without a prior in-person examination, provided specific safeguards are met. However, for subsequent prescriptions or beyond the initial 30-day supply, an in-person evaluation or a referral from a practitioner who has conducted one would be necessary. 3. Referral Exception: The proposed rules maintain an exception where a telehealth practitioner can prescribe controlled substances if they are referring the patient to, and the patient has been seen for an in-person medical evaluation by, another DEA-registered practitioner. This highlights the potential for hybrid care models.

These proposals underscore the DEA's commitment to preventing diversion while acknowledging the critical role of telehealth in OUD treatment. For telehealth platforms, this means a significant re-evaluation of patient intake, provider protocols, and technological capabilities.

The Interplay of Federal and State Regulations

Compliance in this space is not merely about adhering to DEA rules; it's a complex dance between federal mandates and diverse state-specific regulations. Every state has its own definition of a valid patient-provider relationship, requirements for telehealth modalities, and specific rules for controlled substance prescribing.

Key State-Level Considerations:

Provider Licensing: Practitioners must be licensed in the state where the patient is located at the time of the telehealth encounter. This is a foundational requirement, and states like Michigan are actively enforcing it, as seen in their increased scrutiny of telehealth operations.
DEA Registration: A practitioner must hold a DEA registration in the state where they are prescribing controlled substances, particularly when crossing state lines. This adds another layer of complexity for multi-state telehealth operations.
Definition of Telehealth: States vary on what constitutes a permissible telehealth encounter. The District of Columbia, for example, explicitly requires a real-time, interactive audio-visual examination to establish a valid provider-patient relationship for prescribing. Asynchronous modalities or audio-only calls are often insufficient for initial prescribing of controlled substances.
State Prescription Drug Monitoring Programs (PDMPs): Most states mandate that prescribers check their state's PDMP before issuing a controlled substance prescription. Telehealth platforms must integrate PDMP checks into their workflows to ensure compliance and identify potential drug-seeking behavior.
Specific Drug Restrictions: Some states have additional restrictions on certain controlled substances, such as limits on dosage or duration for opioids, or specific requirements for buprenorphine prescribing. For instance, Michigan's Public Health Code and administrative rules govern all prescribing practices, including those via telehealth.

Actionable Implications for Healthcare Businesses

For Telehealth Brands and Platforms:

Re-evaluate Patient Intake Workflows: Your intake process must clearly differentiate between patients who have had a prior in-person exam (or qualify for a specific exception) and those who have not. For new patients requiring controlled substances, prepare for a hybrid model that incorporates in-person evaluations or referrals.
Technology Adaptation: Ensure your platform supports robust, real-time audio-visual encounters as required by many states (e.g., DC). Develop systems to track the history of patient-prescriber relationships, especially for those established during the PHE, to manage the November 2024 cutoff.
Provider Training & Credentialing: Intensify training for all prescribers on the nuances of federal and state controlled substance regulations. Implement rigorous credentialing processes to verify state licenses and DEA registrations in every state where care is provided.
Robust Compliance Program: Implement a comprehensive compliance program that includes regular audits of prescribing patterns, documentation, and adherence to the 'legitimate medical purpose' standard. The DOJ is intensifying enforcement against telehealth controlled substance prescribing violations, making this non-negotiable.
PDMP Integration: Mandate and facilitate real-time PDMP checks for all controlled substance prescriptions across all relevant states.

For Medspas, Dental Practices, and Chiropractic Offices Expanding into Telehealth:

Scope of Practice Review: Understand the specific limitations of your license and scope of practice regarding controlled substance prescribing via telehealth. While direct prescribing may be limited, any adjunctive services or referrals must align with federal and state telehealth rules.
Hybrid Models: If your practice intends to prescribe controlled substances, prepare for a model that combines virtual consultations with necessary in-person assessments, particularly for initial evaluations.
Referral Networks: Establish compliant referral networks with primary care physicians or specialists who can conduct in-person evaluations when required by DEA rules.
Documentation: Maintain meticulous documentation of all telehealth encounters, including the rationale for prescribing controlled substances, PDMP checks, and confirmation of any in-person evaluations.

For All Healthcare Businesses:

Stay Informed: The regulatory environment is dynamic. Continuously monitor updates from the DEA, state medical boards, and other relevant agencies. TrueEval provides ongoing intelligence to help you navigate these changes.
Legal Counsel: Engage legal counsel specializing in telehealth and controlled substance regulations to review your protocols and ensure compliance. Proactive legal guidance is far less costly than reactive enforcement actions.
Patient Safety First: Always prioritize patient safety and the prevention of diversion. Ensure that your telehealth models are designed to deliver high-quality, legitimate medical care, not to circumvent regulations.

What This Means For Your Practice

The landscape for telehealth controlled substance prescribing is maturing, moving from emergency flexibilities to a more structured, albeit complex, regulatory framework. For businesses that embraced telehealth during the pandemic, this transition demands a strategic pivot. The DEA's proposed rules, coupled with stringent state-specific requirements, necessitate a robust, multi-layered compliance approach.

Ignoring these changes is not an option. The Department of Justice (DOJ) is actively pursuing cases against telehealth companies and practitioners for illegal prescribing, with severe consequences including license revocation, substantial fines, and criminal charges. Your ability to operate sustainably and ethically in the telehealth space hinges on your commitment to understanding and meticulously adhering to these evolving federal and state requirements.

TrueEval stands ready to assist your organization in building and maintaining the sophisticated compliance infrastructure necessary to thrive in this new era of telehealth. The future of healthcare is virtual, but the foundation of compliance remains rigorously real.