Navigating the Telehealth Controlled Substance Minefield: DEA Scrutiny and State-Specific Traps in 2025-2026

2026-08-16

The landscape for prescribing controlled substances via telehealth is fraught with escalating federal scrutiny and complex state variations. With the DOJ's new National Fraud Enforcement Division prioritizing telemedicine and controlled substance diversion, healthcare providers must meticulously navigate DEA requirements and diverse state mandates to avoid severe penalties. This deep dive unpacks the critical compliance challenges and provides actionable strategies for robust program development.

The healthcare regulatory environment is in a state of heightened vigilance, particularly concerning the prescription of controlled substances through telehealth. Recent actions by the Department of Justice (DOJ) signal a significant uptick in enforcement, placing telehealth providers firmly in the crosshairs. With the establishment of the National Fraud Enforcement Division (NFED), the DOJ has explicitly listed healthcare, telemedicine, and controlled substance diversion as top priorities. This means an increased allocation of resources, faster investigations, and sophisticated data analytics targeting potential non-compliance across the nation. For telehealth founders, multi-state practice owners, and compliance officers, understanding and meticulously adhering to both federal DEA requirements and the often-more-stringent state laws is no longer merely good practice—it is an existential imperative.

> For more on this topic, see our analysis: [Navigating the Telehealth Chasm: Controlled Substance Prescribing Amidst Heightened Federal Scrutiny and Unfinalized DEA Rules](/blog/telehealth-controlled-substance-compliance-2025).

The DEA's Evolving Stance: From Pandemic Waivers to Permanent Rules

The ability to prescribe controlled substances via telehealth gained significant traction during the COVID-19 Public Health Emergency (PHE). The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 generally requires an in-person medical evaluation before a controlled substance can be prescribed. However, the PHE waivers temporarily suspended this in-person requirement, allowing practitioners to prescribe controlled medications to new patients via telemedicine without a prior in-person visit. This flexibility, while crucial for maintaining access to care during the pandemic, introduced complexities that are now being untangled.

As of the expiration of the PHE, and following subsequent extensions and public comment periods, the DEA has been working to establish permanent telehealth prescribing rules. The core principle emerging is a return to requiring an in-person medical evaluation before prescribing controlled substances, particularly Schedule II medications, for new patients with whom the practitioner has no prior established relationship. Exceptions may apply if the patient is referred by a practitioner who has conducted an in-person examination, or if the telehealth encounter is conducted in the physical presence of another DEA-registered practitioner.

While the specific final rules are still being shaped, the direction is clear: the DEA is moving away from the broad flexibilities of the PHE. Any permanent rule will likely seek to balance patient access with robust safeguards against diversion and abuse. Moreover, the DEA continues its active oversight of controlled substances, as evidenced by its proposed rule to reschedule suvorexant, lemborexant, and daridorexant from Schedule IV to Schedule V. While a shift to Schedule V generally implies a lower potential for abuse, it unequivocally underscores the DEA's continuous monitoring and adjustment of controlled substance regulations, requiring all practitioners to remain current with scheduling changes and associated compliance protocols.

The "Good Faith Exam" Mandate in the Telehealth Context

Central to legitimate medical practice, and particularly critical when prescribing controlled substances, is the concept of a "good faith exam." This refers to a thorough medical evaluation that establishes a legitimate medical purpose for the prescription. In the telehealth environment, performing a compliant good faith exam for controlled substances presents unique challenges and heightened scrutiny.

For initial controlled substance prescriptions without a prior in-person visit (where permissible by current and future DEA rules), the good faith exam typically requires:

Synchronous Audio-Visual Communication: A live, interactive video and audio link allowing for real-time assessment of the patient's condition.
Comprehensive Patient History: Gathering a detailed medical history, including past substance use, family history, and current medications.
Review of Available Medical Records: Accessing and reviewing previous clinical notes, diagnostic test results, and specialist consultations.
Physical Examination (where feasible): While a full in-person physical is often not possible remotely, the practitioner must leverage visual cues, patient self-reporting, and potentially the use of remote monitoring devices to assess relevant physical indicators.
Diagnostic Tools: Ordering appropriate laboratory tests or imaging studies as needed to support a diagnosis and treatment plan.
Risk Assessment: Evaluating the patient's risk for addiction, diversion, or misuse of controlled substances.

The DOJ's sharpened focus means that merely engaging in a brief video call is insufficient. Investigators will scrutinize whether the encounter genuinely established a legitimate medical need for the controlled substance. High-volume telehealth practices, those prescribing controlled substances without adequate documentation, or those failing to integrate with broader patient care records, are particularly vulnerable. A deficient good faith exam is a primary trigger for enforcement actions, carrying severe consequences under the False Claims Act and the Controlled Substances Act.

State-Specific Labyrinths: Beyond Federal Mandates

While the DEA sets the federal floor for controlled substance prescribing, individual states often impose more stringent or specific requirements, creating a complex compliance labyrinth for multi-state telehealth operations. A federal waiver or DEA allowance does not supersede state law. Therefore, any telehealth provider prescribing controlled substances must adhere to the strictest applicable rule.

Consider these examples of state-specific variations:

Texas: Has historically maintained some of the most restrictive stances on telehealth prescribing of controlled substances. Texas law (e.g., Texas Occupations Code § 111.001) generally requires an in-person exam for the initial prescription of Schedule II controlled substances, with limited exceptions. While some waivers were granted during the PHE, the expectation is a return to these stringent requirements, potentially with explicit prohibitions on certain telehealth-only prescribing models for specific drug classes.
Florida: Florida Statute § 456.47 and rules from the Florida Board of Medicine outline specific requirements for telehealth services, often requiring an in-person exam or a prior established relationship for controlled substances, especially for initial prescriptions. Florida has also been a hotspot for enforcement actions related to alleged "pill mills" and illicit controlled substance distribution, leading to enhanced scrutiny of any high-volume prescribing.
California: While generally progressive in telehealth adoption, California medical board regulations (e.g., Business and Professions Code § 2290.5) still emphasize the need for a comprehensive medical evaluation equivalent to an in-person encounter. This includes documentation of medical necessity, patient identity verification, and appropriate follow-up. While direct prohibitions on telehealth-only prescribing for controlled substances may be less explicit than in some other states, the expectation of a robust good faith exam is high, and any perceived deviation could lead to enforcement.
Other States: Many states have specific lists of controlled substances that cannot be prescribed via telehealth, or require specific technologies or referral patterns. Some states might require explicit consent forms for telehealth controlled substance prescribing, or have unique PDMP reporting requirements for out-of-state prescribers.

Furthermore, virtually all states mandate the use of Prescription Drug Monitoring Programs (PDMPs). Practitioners must check the patient's PDMP history before prescribing a controlled substance and at regular intervals during treatment, regardless of federal guidance. Failure to adhere to these state-mandated PDMP checks is a common compliance infraction that draws immediate regulatory attention.

Enforcement Spotlight: Lessons from Recent Actions

The DOJ's new National Fraud Enforcement Division is not merely an administrative reorganization; it represents a paradigm shift towards more aggressive and coordinated enforcement against healthcare fraud, with a direct focus on telemedicine and controlled substances. This means an increased likelihood of:

Investigations: More proactive investigations, leveraging advanced data analytics to identify suspicious prescribing patterns, billing irregularities, and potential diversion schemes.
Civil and Criminal Charges: Practitioners and healthcare organizations face potential civil penalties under the False Claims Act for improper billing (e.g., billing for services not legitimately rendered or medically unnecessary) and criminal charges under the Controlled Substances Act for unlawful distribution or dispensing.
Provider Exclusions: The Office of Inspector General (OIG) can exclude providers from participation in federal healthcare programs (Medicare, Medicaid, CHIP), effectively ending a practice's ability to serve a significant patient population.
State Board Actions: Federal enforcement often triggers parallel investigations and disciplinary actions by state medical and pharmacy boards, including license suspensions or revocations.

Recent enforcement actions, even before the full activation of the NFED, provide stark warnings. We've seen cases where telehealth companies and their affiliated physicians have faced charges for allegedly prescribing medically unnecessary controlled substances or for failing to conduct proper patient evaluations. These cases often highlight common deficiencies such as:

High-Volume Prescribing: A large number of controlled substance prescriptions without corresponding complex patient needs.
Lack of Individualized Assessment: "Template" prescribing without tailoring treatment plans to individual patient circumstances.
Inadequate Documentation: Insufficient medical records to justify the prescription, including lack of history, physical exam findings, or rationale for the chosen medication.
Failure to Use PDMPs: Not checking state PDMP databases to identify potential doctor shopping or diversion.
Prescribing for Non-Legitimate Medical Purposes: Issuing prescriptions for illicit gain or without a bona fide physician-patient relationship.

The message is unambiguous: the tolerance for non-compliance, particularly in controlled substance prescribing via telehealth, has reached an all-time low. Proactive compliance is no longer a strategic advantage; it is a fundamental requirement for operational survival.

Building an Ironclad Controlled Substance Compliance Program

For any healthcare practice engaging in telehealth and controlled substance prescribing, a robust, dynamic, and meticulously executed compliance program is essential. This is not a one-time project but an ongoing commitment. Here's a practical checklist for your compliance officers to bookmark:

1. Comprehensive Legal Assessment: Engage with specialized healthcare counsel to conduct a 50-state review of your current telehealth controlled substance prescribing models against federal DEA regulations, relevant state medical board rules, and state pharmacy board regulations. Identify any state-specific prohibitions or heightened requirements.
2. Robust Patient Intake and Identity Verification: Implement stringent protocols for patient identity verification (e.g., government-issued ID, two-factor authentication) and thorough screening for substance use history, prior controlled substance prescriptions, and red flags for diversion.
3. Good Faith Exam Standardization: Develop clear, auditable protocols for what constitutes a compliant "good faith exam" for controlled substance prescribing via telehealth. This must include minimum requirements for synchronous audio-visual interaction, review of medical records, and appropriate diagnostic workups. Document the rationale for every prescription.
4. Strict Prescribing Guidelines: Establish internal formularies and prescribing limits aligned with both federal and state laws. Mandate that practitioners only prescribe controlled substances for legitimate medical purposes within the scope of their practice and for patients for whom they have established a bona fide practitioner-patient relationship.
5. Mandatory PDMP Utilization: Implement system-level integrations and workflow mandates ensuring that all practitioners check the relevant state PDMP database prior to every initial controlled substance prescription and at defined intervals for ongoing prescriptions. Document the PDMP check and its findings in the patient's medical record.
6. Meticulous Documentation: Require comprehensive and contemporaneous documentation for every telehealth encounter where a controlled substance is prescribed. This includes detailed patient history, physical assessment (as feasible via telehealth), diagnosis, rationale for prescribing the controlled substance, treatment plan, dosage, quantity, and follow-up instructions. Ensure electronic health records (EHR) are secure and compliant.
7. Ongoing Staff Training & Education: Conduct regular, mandatory training for all prescribing practitioners and support staff on current DEA regulations, state-specific requirements, good faith exam standards, PDMP use, and red flags for diversion. Document all training.
8. Internal Audits and Monitoring: Implement a proactive internal audit program to review a statistically significant sample of telehealth controlled substance prescriptions. Identify deviations from protocols, documentation deficiencies, and potential non-compliance, and take immediate corrective action.
9. Secure E-Prescribing for Controlled Substances (EPCS): Ensure all electronic prescribing systems meet DEA requirements for EPCS, enhancing security and reducing the risk of prescription fraud.
10. Incident Response Plan: Develop a clear plan for responding to suspected diversion, patient misuse, or regulatory inquiries. This includes clear reporting pathways and protocols for internal investigations.

What This Means For Your Practice

The landscape for telehealth controlled substance prescribing is more treacherous than ever. The DOJ's increased enforcement capabilities and specific focus on this area mean that complacency is not an option. For telehealth founders, multi-state practice owners, and compliance officers, the imperative is clear: proactive, comprehensive, and continuously updated compliance is non-negotiable.

Failure to adapt to this new reality exposes your practice to significant risks—from substantial civil monetary penalties and False Claims Act liability to criminal prosecution, loss of state licenses, and exclusion from federal healthcare programs. The reputational damage alone can be devastating.

TrueEval understands the intricate federal and state requirements governing controlled substance prescribing via telehealth. We equip practices with the actionable intelligence and robust frameworks necessary to navigate this complex regulatory environment, ensuring your operations remain compliant, secure, and poised for sustainable growth. Don't wait for an enforcement action to assess your vulnerabilities; the time for a rigorous review and fortification of your compliance program is now.