The Shifting Sands of Telehealth Controlled Substance Prescribing: Navigating DEA Requirements in 2025-2026

By Shannon Smith, DNP, APRN, FNP-C, PMHNP-BC, PMHNP-C · 2026-04-17

The regulatory landscape for telehealth prescribing of controlled substances is undergoing a seismic shift. As federal waivers expire and new DEA rules emerge, healthcare businesses must meticulously re-evaluate their compliance strategies to avoid severe penalties and ensure legitimate patient care.

The promise of telehealth — expanded access to care, particularly for underserved populations — has been undeniable. However, for controlled substances, this promise has been tempered by a complex and rapidly evolving regulatory environment. As we look towards 2025-2026, healthcare businesses engaged in telehealth prescribing of controlled substances face a critical juncture, navigating the expiration of pandemic-era flexibilities and the solidification of new DEA requirements. This is not merely an administrative hurdle; it is a fundamental challenge to business models and a significant risk area for enforcement.

> For more on this topic, see our analysis: [The Ryan Haight Act Reloaded: Navigating Telehealth Controlled Substance Prescribing in the Post-PHE Era](/blog/ryan-haight-telehealth-controlled-substances-post-phe).

The Ryan Haight Act and the PHE Waivers: A Brief History

At the heart of federal controlled substance prescribing via telehealth is the Ryan Haight Online Pharmacy Consumer Protection Act of 2008. This Act generally requires an in-person medical evaluation before a practitioner can prescribe a controlled substance to a patient whom they have not previously examined. The intent was clear: prevent rogue online pharmacies from indiscriminately distributing controlled substances without a legitimate medical purpose.

The COVID-19 Public Health Emergency (PHE) dramatically altered this landscape. To ensure continuity of care during lockdowns, the DEA issued waivers that allowed practitioners to prescribe controlled substances via telehealth without an initial in-person examination, provided the prescription was for a legitimate medical purpose and the practitioner was acting in the usual course of professional practice. These waivers, initially a lifeline, created a temporary paradigm shift, enabling widespread telehealth prescribing of controlled substances, including buprenorphine for opioid use disorder (OUD).

However, the PHE officially ended on May 11, 2023. While the DEA provided temporary extensions for patient-prescriber relationships established during the PHE (initially until November 11, 2023, and then extended for another year until November 11, 2024), the underlying principle is a return to stricter pre-PHE requirements. This means that for new patient-prescriber relationships, the full force of the Ryan Haight Act, or its permanent telehealth exception, will apply.

DEA's Proposed Rules: A Glimpse into the Future

The DEA has been actively working to establish a permanent framework for telehealth prescribing of controlled substances. In February 2023, they issued proposed rules, followed by a supplemental proposed rule in May 2023, reflecting significant public comment and the ongoing need for clarity. While these rules are not yet final, they offer the clearest indication of the likely future state:

General Rule for Schedule II and Non-Buprenorphine Schedule III-V Controlled Substances: The proposed rules generally reinstate the requirement for an in-person medical evaluation for initial prescriptions of these substances. This means a purely virtual initial encounter for these medications will likely not be permissible for new patients.
Buprenorphine for OUD: Recognizing the unique public health imperative of OUD treatment, the DEA has proposed a specific exception for buprenorphine. An initial 30-day supply of buprenorphine can be prescribed via telehealth without a prior in-person medical evaluation, provided the practitioner conducts a real-time, two-way audio-visual communication. After the 30-day supply, an in-person medical evaluation or a referral for one would be required for continued prescribing. This exception reflects a nuanced approach to balancing access and diversion prevention.
Referral Exception: The proposed rules also include an exception where a practitioner can prescribe controlled substances via telehealth if they are acting on a referral from a practitioner who has conducted an in-person medical evaluation of the patient.
Telemedicine Practice Standards: The rules emphasize that the prescribing must be for a legitimate medical purpose, in the usual course of professional practice, and adhere to generally accepted standards of medical care. This includes comprehensive patient evaluations, appropriate record-keeping, and adherence to state laws.

Key Takeaway: The direction is clear – a hybrid model combining virtual and in-person elements will become the norm for many controlled substance prescriptions, with specific carve-outs for OUD treatment reflecting public health priorities.

The DOJ's Intensified Enforcement: A Wake-Up Call

The Department of Justice (DOJ) has made it unequivocally clear that it is intensifying enforcement against telehealth companies and practitioners involved in illegal prescribing and distribution of controlled substances. This isn't just about technical compliance with the Ryan Haight Act; it's about the underlying legitimate medical purpose standard.

Recent DOJ actions highlight several critical areas of scrutiny:

Lack of Legitimate Medical Purpose: The DOJ is targeting cases where telehealth platforms are perceived to be facilitating drug-seeking behavior, prescribing without adequate patient evaluation, or prioritizing profit over patient safety. This includes instances where practitioners are pressured to prescribe, or where the platform's design makes it difficult to conduct a thorough medical assessment.
High Volume Prescribing: Platforms with unusually high volumes of controlled substance prescriptions, particularly for medications with high abuse potential, are under intense scrutiny.
Inadequate Patient Evaluation: Cases where practitioners are found to be prescribing based on minimal information, without proper physical exams (when clinically indicated), or without addressing red flags for diversion are leading to severe penalties, including criminal charges.
Exploitation of PHE Waivers: While the waivers provided flexibility, they did not negate the requirement for a legitimate medical purpose. The DOJ is prosecuting cases where companies allegedly abused these waivers to operate as de facto pill mills.

Implication: Compliance is not merely about ticking boxes; it's about demonstrating a genuine commitment to patient safety and legitimate medical practice. The DOJ's focus is on systemic failures and fraudulent schemes, meaning a robust, top-down compliance culture is essential.

Multi-State Operations and DEA Registration

For telehealth providers operating across state lines, the complexity of DEA registration is a significant hurdle. The general rule is that a practitioner must be licensed in the state where the patient is located and hold a DEA registration in that state if they intend to prescribe controlled substances to patients there. This is a critical point often overlooked by rapidly scaling telehealth platforms.

Considerations for Multi-State Prescribing:

1. State Licensure: Ensure all prescribing practitioners are appropriately licensed in *each state* where they treat patients. This is foundational. 2. State-Specific DEA Registration: For controlled substances, practitioners must possess a DEA registration associated with a physical address in the state where the patient is located. This can be a significant operational challenge for a fully remote provider. 3. State-Specific Controlled Substance Prescribing Rules: Beyond federal DEA requirements, each state has its own regulations regarding controlled substance prescribing, including Prescription Drug Monitoring Program (PDMP) checks, limits on dosage or duration, and specific telehealth rules. For example, some states may have stricter requirements for initial in-person exams or specific telehealth modalities.

Example: A provider licensed in New York and registered with the DEA in New York cannot simply prescribe a controlled substance to a patient located in Pennsylvania via telehealth without also being licensed in Pennsylvania and holding a DEA registration in Pennsylvania (or operating under a specific, limited exception).

Practical Implications for Healthcare Businesses

This evolving landscape demands a proactive and comprehensive compliance strategy. Here's what this means for various stakeholders:

For Telehealth Brands (especially DTC Weight Loss, Mental Health, Pain Management)

Re-evaluate Patient Intake & Onboarding: Design protocols that clearly identify whether a patient-prescriber relationship was established during the PHE (and thus falls under the extension) or is new. For new patients requiring controlled substances, prepare for the necessity of an initial in-person exam or a referral from a practitioner who has conducted one.
Hybrid Care Models: Begin developing or strengthening partnerships with brick-and-mortar clinics or establishing your own physical locations to facilitate required in-person evaluations for controlled substances.
Technology & Workflow Audits: Ensure your platform can track and enforce these requirements. Can your system flag patients needing an in-person visit? Can it verify DEA registrations by state? Is your platform HIPAA-compliant and secure?
Provider Training & Oversight: Conduct rigorous training for all prescribing providers on the nuances of the Ryan Haight Act, DEA proposed rules, and state-specific controlled substance laws. Implement robust internal auditing of prescribing practices.
Compliance Infrastructure: Invest in compliance officers, legal counsel specializing in telehealth and DEA regulations, and potentially compliance software to manage licensure, DEA registrations, and prescribing protocols across states.

For Medspas, Dental Practices, and Chiropractic Offices

Limited Direct Impact, but Indirect Scrutiny: While these practices may not frequently prescribe controlled substances via telehealth, the overall regulatory climate for telehealth is becoming more stringent. If you offer any telehealth services, ensure they meet general telehealth best practices (patient identification, informed consent, documentation).
Referral Networks: If you refer patients to telehealth platforms that prescribe controlled substances, ensure those platforms are compliant. Indirect association with non-compliant entities could carry reputational and even legal risks.
Ancillary Services: If you are considering expanding into services that might involve controlled substances (e.g., pain management in dental care, or certain aesthetic treatments in medspas), understand that a purely virtual initial encounter for these medications will likely be severely restricted.

For Healthcare Compliance Officers

Stay Abreast of Final Rules: The DEA's proposed rules are not yet final. Continuously monitor the Federal Register for updates and the publication of the final rule. The details matter.
Cross-Functional Collaboration: Work closely with legal, clinical, and technology teams to implement necessary changes to policies, procedures, and platforms.
Risk Assessments: Conduct regular, comprehensive risk assessments specifically focused on controlled substance prescribing via telehealth. Identify potential vulnerabilities in your current model.
Documentation, Documentation, Documentation: Ensure meticulous documentation of patient evaluations, clinical rationale for prescribing, informed consent, and any in-person visits or referrals. This is your primary defense in an audit or investigation.
PDMP Compliance: Verify that all prescribing providers are registered with and routinely check state Prescription Drug Monitoring Programs (PDMPs) before prescribing controlled substances.

What This Means For Your Practice

The era of widespread, purely virtual controlled substance prescribing initiated by the PHE waivers is drawing to a close. For healthcare businesses, particularly those in the telehealth space, this necessitates a strategic pivot. The future demands a more integrated approach, often combining virtual convenience with the safeguards of in-person evaluations. This is not a barrier to innovation but a call for responsible innovation.

Actionable Checklist for 2025-2026:

By Q4 2024: Finalize your strategy for managing the expiration of the PHE controlled substance prescribing waivers on November 11, 2024. This includes identifying all patients who received controlled substances under the waiver and developing a plan for their transition to compliant care models.
Ongoing: Implement robust systems to verify practitioner licensure and DEA registration in *every state* where controlled substances are prescribed via telehealth.
Immediate: Review and update all patient intake forms, consent documents, and clinical protocols to align with the anticipated DEA final rules and state-specific requirements for controlled substance prescribing via telehealth.
Regularly: Conduct internal audits of prescribing practices, focusing on documentation, legitimate medical purpose, and adherence to state and federal regulations.
Proactively: Explore and establish partnerships with brick-and-mortar facilities or develop your own physical presence to facilitate required in-person evaluations for controlled substances.
Continuously: Invest in ongoing education and training for all clinical staff on the evolving regulatory landscape for controlled substances and telehealth.

Ignoring these shifts is not an option. The DOJ's heightened enforcement, coupled with the DEA's move towards a permanent framework, means that non-compliance carries severe risks, including substantial fines, license revocation, exclusion from federal healthcare programs, and even criminal prosecution. TrueEval is committed to helping you navigate these complexities, ensuring your operations remain compliant, secure, and sustainable in this dynamic environment.

Looking Ahead

The regulatory environment for telehealth controlled substance prescribing will continue to evolve. While the DEA's proposed rules offer significant clarity, there may be further modifications based on public feedback and ongoing public health considerations. Furthermore, states may introduce their own specific requirements that either mirror or diverge from federal guidelines. The key to success will be agility, a deep understanding of the regulatory nuances, and an unwavering commitment to compliance and patient safety. This is not merely about avoiding penalties; it's about building trust and ensuring the long-term viability of telehealth as a legitimate and essential component of healthcare delivery.