Telehealth Prescribing Rules for Controlled Substances
Federal extensions keep pandemic flexibilities alive while permanent rules remain stuck in limbo.
Telehealth prescribing rules for controlled substances are stuck in a holding pattern that started as a pandemic emergency measure and has, somehow, become a five-year-old policy. If you're a patient getting Adderall or buprenorphine through a video visit, or a practitioner trying to figure out what you're actually allowed to do, the honest answer is: it depends on which of several overlapping federal authorities applies to you, and that answer is still being written in real time.
How COVID-era flexibilities suspended that baseline and why they are still in effect in 2026
Back up to 2008 for a second, because you can't understand the mess without understanding the floor beneath it. The Ryan Haight Act amended the Controlled Substances Act to require at least one in-person medical evaluation before a practitioner could prescribe a controlled substance over the internet. Seven statutory exceptions exist, but they're narrow; most require the patient to be sitting in a hospital, a clinic, or physically next to another practitioner when the prescription happens. The home-to-home model (the one most of us actually use when we log into a telehealth app from the couch) falls outside every one of those exceptions. Here is the nuance that can trip you up: the in-person requirement only applies to that first visit. Once any in-person evaluation has occurred, even for something unrelated like a sprained ankle, DEA has never required a follow-up in-person visit, and the practitioner can prescribe remotely to that patient indefinitely. That's the baseline, and it's still the law, with everything else layered on top functioning as an exception to it.
Then March 2020 happened, and DEA invoked its public health emergency authority to let any DEA-registered practitioner prescribe Schedule II through V controlled substances via telemedicine with zero prior in-person evaluation, no exceptions needed. The formal public health emergency ended in 2023, but the flexibility didn't. Instead of letting it lapse, DEA started issuing extensions like a landlord who keeps renewing the lease one month at a time because nobody wants to deal with moving. May 2023 brought the first extension. October 2023 brought a second, jointly with HHS, running through the end of 2024. November 2024 brought a third, through the end of 2025. And on December 31, 2025, itself, DEA and HHS issued a fourth extension pushing the deadline to December 31, 2026.
Each extension has been issued "in anticipation of" permanent rules that never quite arrive. The 2023 proposal alone drew tens of thousands of public comments and two days of listening sessions, which tells you this isn't a niche regulatory footnote. It's a genuinely contested piece of policy that touches ADHD treatment, opioid use disorder care, and a multibillion-dollar telehealth industry all at once.
What practitioners can actually do under the current rules through December 31, 2026
Under the current fourth extension, any DEA-registered practitioner can prescribe Schedule II through V controlled substances via telemedicine without a prior in-person visit, as long as three conditions hold. The prescription has to serve a legitimate medical purpose within the practitioner's normal scope of practice. The encounter has to use an "interactive telecommunications system" as defined in federal regulation, meaning real-time audio-video, not a text message exchange. And the practitioner needs proper DEA registration for whatever substance they're prescribing, or a valid federal exemption.
Worth pausing on what this rule covers and what it leaves out. It applies when no prior in-person visit has happened at all, which is a narrower situation than a blanket grant of unlimited remote prescribing once any visit has occurred. Those are two different legal pathways that happen to land in the same place practically. The rule also doesn't distinguish by drug class within Schedules II through V. Stimulants, benzodiazepines, opioids: all technically covered under the same three conditions, which is exactly why so much of the debate below centers on whether that's a sensible design.
One more wrinkle: practitioners who qualify under either of the two permanent rules finalized in January 2025 aren't forced to use those stricter frameworks. They can still rely on the fourth temporary extension, which asks less of them, and unsurprisingly, they generally don't opt into more paperwork voluntarily, which is part of why the permanent rules haven't reshaped much of anything yet.
Two narrow permanent rules that took effect at the end of 2025
DEA and HHS finalized two permanent rules on January 17, 2025. Thanks to a regulatory freeze that's become a rite of passage for incoming administrations, they didn't actually take effect until December 31, 2025, exactly as the fourth temporary extension was kicking in. Timing like that suggests triage rather than coincidence.
The first permanent rule covers buprenorphine for opioid use disorder. Practitioners can now prescribe up to a six-month initial supply of Schedule III through V controlled substances for OUD treatment via audio-only telemedicine, no prior in-person evaluation required. That's a real expansion; the previous authorization covered a shorter initial supply, and six months matters for people trying to stay in treatment without a gap. The rule requires a mandatory prescription drug monitoring program (PDMP) check before prescribing, with the date and time documented in the patient's chart, and pharmacists have to verify identity with a government-issued photo ID before dispensing.
A second permanent rule addresses the VA. VA practitioners can prescribe Schedule II through V controlled substances via telemedicine to a patient they've never personally seen, as long as another VA practitioner completed an in-person evaluation somewhere in the system. This is a care-coordination fix for a specific institution rather than a template for the general public.
Both rules are deliberately narrow. They solve for opioid use disorder patients and VA patients specifically, and they leave the much bigger question (ordinary outpatient telehealth prescribing for the rest of us) sitting with the framework discussed next.
The special registration framework DEA proposed but has not finalized
Alongside those two permanent rules, DEA published a notice of proposed rulemaking on January 17, 2025, laying out a three-tier "special registration" system. The three tiers work as follows: (i) Tier one, the Telemedicine Prescribing Registration, would let registered practitioners prescribe Schedule III through V substances without any prior in-person visit; (ii) Tier two, the Advanced Telemedicine Prescribing Registration, covers Schedule II medications, but only for board-certified psychiatrists, hospice physicians, long-term care facility physicians, and pediatricians; and (iii) Tier three, the most novel, is a Platform Practitioner Registration that would, for the first time, require telehealth platforms themselves (not just individual prescribers) to register directly with DEA.
That platform tier didn't come out of nowhere. It's a direct response to the enforcement cases covered further down, where the platform's business model, rather than any individual doctor's judgment, was the thing driving inappropriate prescribing. Across all three tiers, the proposal layers in (i) mandatory PDMP checks, (ii) audio-video requirements, (iii) identity verification, (iv) credentialing standards, (v) data reporting to DEA, and (vi) record retention rules.
DEA received thousands of comments on the NPRM, and as of mid-2026, the current administration hasn't moved to finalize it. It was issued under the prior administration, it drew real opposition from telehealth companies and some clinician groups, and its political fate is genuinely unclear. That stall is precisely why the fourth temporary extension had to happen: there's no finished permanent system sitting on the shelf ready to swap in. The extension functions less as a policy choice and more as an admission that the homework isn't done.
Why Schedule II drugs (especially stimulants) sit at the center of the policy debate
Schedule II drugs, Adderall and Ritalin chief among them, are the most contested category in this whole conversation, because they carry the highest abuse and diversion potential of anything commonly prescribed through telehealth. DEA and IQVIA data show overall stimulant dispensing in the U.S. rose 60% from 2012 to 2023. That trend predates the pandemic entirely; telehealth didn't start it. Regulators now look at that curve and the post-2020 telehealth boom sitting side by side, and they're asking whether the second accelerated the first. According to research summarized by telehealth.org, roughly 4.4% of adults ages 18 to 25 report nonmedical use of prescription stimulants each year. Younger patients are also more likely to start stimulant treatment through a telehealth visit in the first place, which regulators flag as a factor worth watching for inappropriate prescribing and diversion risk.
The special registration proposal makes its position on this pretty explicit: Schedule II prescribing authority gets restricted to a narrow slice of specialty-board-certified practitioners. Read between the lines and the message is that general practitioners, as a population, aren't meant to be the long-term channel for remote Schedule II prescribing under any permanent system DEA is currently imagining. DEA is still seeking comment on questions that sound simple but aren't: should a telehealth prescriber of Schedule II drugs be physically located in the same state as their patient? Should practitioners whose practice is mostly telehealth prescribing face tighter limits than those for whom it's a small slice of a broader practice? Nobody's answered those yet, which is sort of the whole point of this article.
What enforcement actions against Done Global and Cerebral reveal about where the rules can break down
To see where the theory can run into the pavement, look at Done Global. This was the Department of Justice's first criminal drug distribution prosecution built around telemedicine prescribing, and the allegations are not subtle: prescribers issued tens of millions of prescriptions for Adderall and other stimulants to subscription members over roughly three years, from around February 2020 to January 2023. The alleged mechanism is the part that should make anyone pause: prescribers were reportedly paid per patient who received a prescription, rather than per visit or per hour spent with a patient, and the platform had an auto-refill feature that generated monthly refill requests automatically, without requiring a fresh clinical check-in each time. Done's founder and CEO and its clinical president were convicted by a jury in November 2025 on conspiracy and unlawful distribution charges in a scheme alleged to total hundreds of millions of dollars in unlawful distribution.
Cerebral took a different path: a non-prosecution agreement with the U.S. Attorney's Office for the Eastern District of New York, paying several million dollars over alleged conduct from 2019 to 2022. The pattern described is eerily similar: prescribing metrics that didn't account for clinical appropriateness, financial incentives tied to volume, and disciplinary pressure on providers who prescribed "too little." Too little compared to what benchmark, exactly? That's the question that should bother you.
Both cases point at the same failure mode: a platform that turns prescribing into a productivity metric, quietly severing the link between clinical judgment and the money changing hands. Certain business models built on top of telehealth incentivize exactly the wrong thing, which, not coincidentally, is also why the platform registration tier showed up in the NPRM. Regulators looked at Done and Cerebral and concluded that policing individual practitioners wasn't enough when the platform architecture itself is shaping the encounter.
What the research actually shows about safety outcomes from telehealth stimulant prescribing
Here's where the data gets genuinely interesting, and less alarmist than the enforcement headlines might suggest. A 2025 study in the American Journal of Psychiatry, using electronic health records from several thousand patients ages 12 and older in a Northeastern academic health system, found no overall increase in later substance use disorder when comparing telehealth stimulant prescribing to in-person prescribing. That's the headline, and it cuts against the assumption that telehealth is inherently riskier.
Yet the same study found something more specific underneath that headline: receiving an initial stimulant prescription via telehealth may signal an elevated risk of subsequent stimulant-related substance use disorder. That's a narrower and more useful finding than a blanket claim about telehealth's overall danger or safety. It suggests the moment of first contact matters more than the ongoing modality.
Separately, a study looking at psychiatrists and primary care physicians found most reported monitoring for diversion in some form, but their methods were inconsistent, and telehealth settings didn't look meaningfully different from in-person ones on this front. Monitoring gaps, in other words, reflect a broader prescribing-culture problem that telehealth happens to inherit, rather than something unique to telehealth itself.
Research also consistently shows telehealth widens access to care for rural and underserved patients facing transportation barriers or a shortage of nearby clinicians. That access benefit is real, and it's easy to lose sight of when the conversation is dominated by enforcement cases. Being honest about the limits of the evidence base matters too: most studies here draw on single health systems, short timeframes, or narrow populations. The research hasn't caught up to the scale of what's actually happened in telehealth prescribing since 2020. Real access gains, a specific and narrow risk signal, and thin diversion-monitoring data: put those three things together and you get exactly the muddled picture that's kept this debate from resolving into a clean "loosen it" or "tighten it" answer.
How state law interacts with the federal framework, and why federal extensions do not end the compliance question
Every DEA extension discussed so far governs the federal controlled substance prescribing requirement. Federal law does not touch state law, and state law has plenty to say on its own. States run their own telehealth prescribing rules, their own licensing requirements, and their own controlled substance statutes. If you are fully compliant with the fourth federal extension, you can still be out of compliance the moment a state adds its own restriction on remote prescribing of a specific drug, or on prescribing across state lines.
Then there's the PDMP layer. The buprenorphine permanent rule mandates a PDMP check; the proposed special registration framework would require them broadly if it ever gets finalized. Yet PDMP participation and the data-sharing agreements between states remain inconsistent, meaning a check in one state may not surface data from a neighboring one. Interstate prescribing (a practitioner licensed in State A treating a patient sitting in State B) sits at the crossroads of DEA registration, state medical licensing, and state telemedicine practice standards. None of those three are fully lined up with each other, which means if you lean entirely on the federal extension without checking your state's rules, you are carrying compliance risk the federal framework simply does not cover.
What patients and practitioners should understand about where the rules go after 2026
Right now you are operating under three federal authorities at once: (i) the fourth temporary extension, which asks the least of practitioners; (ii) the buprenorphine permanent rule; and (iii) the VA continuity rule. Knowing which one actually governs your situation is not optional homework; it is the whole ballgame.
December 31, 2026, is a real deadline, not a soft one. Absent a fifth extension or a finished permanent rule, the original Ryan Haight in-person requirement snaps back into place automatically. Will DEA issue a fifth extension? History says probably, since every deadline so far has been extended rather than allowed to lapse. Every extension so far has also landed close to the wire, though, which leaves practices and patients planning in the dark until the last minute. It's a strange way to run a health system, but here we are.
The special registration NPRM remains unfinished and politically uncertain, and practitioners shouldn't build their operations around a rule that might never take effect under this administration. For patients currently getting controlled substances through telehealth, the coverage is legally continuous through the end of 2026; the real exposure sits at the transition point, whenever and however that arrives. For practitioners, the compliance floor is straightforward on paper: (i) legitimate medical purpose, (ii) proper DEA registration, and (iii) an interactive telecommunications system, a live audio-video visit, for instance, not a text-message exchange. What the Done Global and Cerebral cases make clear is that meeting that floor on paper doesn't insulate a business model built on volume-based compensation or automatic refills. DOJ has shown it will look past the letter of the extension straight at the incentive structure underneath it, and that is a distinction you should keep in mind regardless of which rule happens to govern your practice in any given year.
