Telemedicine, Controlled Substances, and the Ryan Haight Act

The Ryan Haight Act governs telemedicine prescribing of controlled substances by requiring at least one in-person medical evaluation before a practitioner can issue such a prescription online. That requirement is still federal law, but the DEA and HHS have suspended it for most telemedicine encounters through December 31, 2026, under a temporary extension of COVID-era flexibilities.¹ Until that date, a DEA-registered practitioner can prescribe Schedule II through V controlled substances by video without ever meeting the patient in person, so long as the prescription is for a legitimate medical purpose and complies with state law.

What the Act Requires

Under 21 U.S.C. § 829(e), no controlled substance that is a prescription drug may be dispensed over the internet without a “valid prescription.” A valid prescription is one issued for a legitimate medical purpose in the usual course of professional practice by a practitioner who has conducted at least one in-person medical evaluation of the patient.² The practitioner and patient must be in the same physical location during that evaluation. Online questionnaires, chat exchanges, and email consultations do not satisfy the requirement.

Once a practitioner has completed the initial face-to-face visit, subsequent prescriptions for the same patient can be issued remotely, so long as the prescribing stays within normal professional practice. The rule applies identically to Schedules II through V. There is no lower-risk exemption for benzodiazepines, testosterone, or cough preparations with codeine.

The statute also recognizes a “covering practitioner” who can step in when the patient’s regular prescriber is temporarily unavailable. That covering practitioner may evaluate the patient remotely and prescribe, provided the patient’s regular provider conducted a qualifying in-person evaluation within the previous 24 months and the covering practitioner is acting at the regular provider’s request.²

Current Telemedicine Flexibilities Through 2026

Most remote controlled-substance prescribing today does not fit any of the Act’s permanent exceptions. It runs on temporary authority. On December 31, 2025, the DEA and HHS jointly issued a fourth extension of the COVID-era flexibilities, keeping them in place through December 31, 2026.³

Under the extension, a DEA-registered practitioner may prescribe Schedule II through V controlled substances by telemedicine without a prior in-person evaluation. The prescription must be for a legitimate medical purpose, comply with all other DEA regulations, and satisfy applicable state law.¹

Video Is Required for Most Drugs

The encounter must include a live audio-video component for almost all controlled substances. Audio-only telemedicine is permitted only for Schedule III through V narcotic medications approved by the FDA for treating opioid use disorder, which in practice means buprenorphine products such as Suboxone.¹ A phone-only consultation to prescribe Adderall or oxycodone does not qualify, regardless of the patient’s circumstances.

Buprenorphine Has Its Own Track

On January 17, 2025, the DEA and HHS published a final rule titled “Expansion of Buprenorphine Treatment via Telemedicine Encounter,” which took effect December 31, 2025 and authorizes practitioners to prescribe Schedule III through V opioid use disorder medications via telemedicine, including by audio-only encounter.⁴ The DEA has noted that the fourth temporary extension imposes fewer requirements than this final rule, so practitioners may currently follow whichever framework is less restrictive.¹

Permanent Exceptions to the In-Person Exam

If the temporary flexibilities expire at the end of 2026 without being extended or replaced, telemedicine prescribing of controlled substances would revert to a narrow set of situations Congress wrote into the statute. Under 21 U.S.C. § 802(54), the “practice of telemedicine” bypasses the in-person requirement in these circumstances:⁵

The patient is physically located in a hospital or clinic that holds its own DEA registration, and the remote practitioner is registered in the patient’s state.
The patient is in the physical presence of another DEA-registered practitioner in the patient’s state while the prescribing practitioner communicates remotely.
The practitioner works for the Indian Health Service or a tribal organization under an IHS contract and has been designated as an Internet Eligible Controlled Substances Provider.
The Secretary of Health and Human Services has declared a public health emergency covering the patients and substances involved.
The practitioner holds a special telemedicine registration issued by the Attorney General under 21 U.S.C. § 831(h).
The prescribing occurs within the Department of Veterans Affairs system under specific VA exemptions.

Each exception demands strict documentation. The DEA expects the patient’s chart to identify which specific category applied.

The Special Registration That Was Never Finished

The Ryan Haight Act anticipated a permanent telemedicine pathway. Section 831(h) of the Controlled Substances Act directs the Attorney General to create a “special registration” that would let practitioners prescribe controlled substances by telemedicine without an in-person exam, and required the DEA to finalize the regulations within one year of October 24, 2018.⁶ The DEA has not finalized those regulations. The repeated temporary extensions exist largely because that rulemaking has not been completed, and the agency has said the latest extension is meant to give it more time to “finalize and implement regulations that balance access to care with the necessary safeguards against drug diversion.”¹ For practitioners and patients, that means the current system rests on temporary authority that could change at the end of any calendar year.

Cross-State Licensing and DEA Registration

Telemedicine creates a licensing problem that in-person practice does not. When a practitioner in one state treats a patient sitting in another state, two separate authorities have to line up in the patient’s state: a state medical license and a DEA registration.

The DEA has clarified that a practitioner’s registration in one state does not authorize prescribing controlled substances in another, because DEA registrations are tied to the underlying state license.⁷ A practitioner licensed and DEA-registered in New York who treats a patient sitting in New Jersey by video needs a New Jersey medical license and a New Jersey DEA registration.

State approaches to cross-border telemedicine licensing differ. Some states offer streamlined telemedicine registrations for out-of-state providers. Others participate in multi-state licensure compacts. Some require a full license with no shortcuts.⁸ Confirming where the patient is physically located before each appointment matters, because a patient who crossed a state line since the last visit can put the prescriber outside their authority.

Penalties for Prescribing Outside the Rules

The consequences are heavy. Distributing a Schedule I or II controlled substance without authorization carries a maximum sentence of 20 years in federal prison and fines up to $1 million for an individual. For Schedule IV substances, the maximum drops to five years’ imprisonment and $250,000 in fines. If a patient dies or suffers serious bodily injury from the substance, a Schedule I or II violation carries a mandatory minimum of 20 years.⁹

Civil penalties reach $25,000 per violation under the general provision, with a $10,000 cap on certain reporting and record-keeping failures and a $100,000 cap for opioid-related reporting failures by registered manufacturers or distributors.¹⁰ The DEA can also revoke a practitioner’s registration, ending the ability to prescribe any controlled substance.

State Law Adds Another Layer

Federal law is the floor. Many states require practitioners to check a Prescription Drug Monitoring Program database before prescribing or refilling a controlled substance. No federal PDMP consultation mandate exists; the rules come entirely from state law, and the details vary in which schedules trigger a check, how often, and whether refills are treated the same as initial prescriptions. A practitioner treating patients in multiple states needs to know each state’s PDMP rules.

Some states also impose telemedicine-specific limits that go beyond the Ryan Haight Act, such as capping the supply a single remote visit can produce, requiring periodic in-person follow-ups, or excluding certain drug classes from telemedicine prescribing. A prescription that is legal under the federal temporary flexibilities can still violate state law, and the practitioner is responsible for both.

1
Drug Enforcement Administration. DEA Extends Telemedicine Flexibilities to Ensure Continued Access to Care
2
Office of the Law Revision Counsel. 21 USC 829 – Prescriptions
3
Federal Register. Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications
4
Federal Register. Expansion of Buprenorphine Treatment via Telemedicine Encounter and Continuity of Care via Telemedicine
5
Office of the Law Revision Counsel. 21 USC 802 – Definitions
6
Office of the Law Revision Counsel. 21 USC 831 – Additional Requirements Relating to Online Pharmacies
7
Federal Register. Clarification of Registration Requirements for Individual Practitioners
8
Telehealth.HHS.gov. Licensing Across State Lines
9
Office of the Law Revision Counsel. 21 USC 841 – Prohibited Acts A
10
GovInfo. 21 USC 842 – Prohibited Acts B