Telehealth Prescribing Rules in 2026: DEA Flexibilities, State Lines, and What Comes Next
Can providers still prescribe medication over telehealth in 2026? Yes, and for most telehealth verticals the answer is uncomplicated: non-controlled prescriptions like GLP-1s, dermatology, and hair loss are governed by state law and standard of care, not the DEA. The complexity lives in controlled substances. The federal Ryan Haight Act (2008) generally requires an in-person evaluation before a controlled substance can be prescribed, with defined telemedicine exceptions. During the COVID-19 public health emergency, DEA waived the in-person requirement, and since 2020 it has repeatedly extended those telemedicine flexibilities rather than letting them lapse, while working through proposed rulemaking on a special registration framework for telemedicine prescribing. As of mid-2026, that area remains in flux: do not treat any expiration date or draft rule you read online as settled, and confirm current status against DEA's own guidance. This post explains the layers, which medications sit in which layer, how state licensing interacts with all of it, and how founders should build so the next rule change is a configuration update, not a rebuild.
This article is general information, not legal advice. Confirm current requirements with healthcare counsel and primary sources: DEA, FSMB, and the relevant state medical and pharmacy boards.
Key takeaways
- The Ryan Haight Act generally requires an in-person medical evaluation before prescribing controlled substances, subject to telemedicine exceptions, and it applies only to controlled substances, not to most telehealth prescriptions.
- DEA waived the in-person requirement during the COVID-19 public health emergency and has repeatedly extended those telemedicine flexibilities since 2020, while pursuing rulemaking on a special registration framework that was still unsettled as of mid-2026.
- Non-controlled medications such as GLP-1s, most dermatology, and hair loss treatments are outside Ryan Haight entirely and are governed by state law and standard of care.
- Testosterone is a Schedule III controlled substance, so TRT telehealth carries federal prescribing requirements that a non-controlled vertical does not.
- Prescribing always requires a provider licensed in the patient's state, and states differ on whether an asynchronous encounter can establish a valid provider-patient relationship, so multi-state programs need per-state, per-modality logic.
What federal law governs telehealth prescribing?
The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 is the federal anchor. Passed in response to rogue online pharmacies selling controlled substances off a web questionnaire, it amended the Controlled Substances Act to require that a prescriber conduct at least one in-person medical evaluation before prescribing a controlled substance, unless a statutory telemedicine exception applies.
Three points founders routinely get wrong:
Ryan Haight covers controlled substances only. Semaglutide, tirzepatide, finasteride, most dermatology, most women's health: none of these are controlled substances, so Ryan Haight does not apply to them at all. Their prescribing rules come from state law and the clinical standard of care.
The in-person requirement has exceptions. The statute built in telemedicine exceptions from the start, such as a patient being physically located at a DEA-registered facility during the encounter. Those baseline exceptions are narrow, which is why the pandemic-era waivers mattered so much.
Federal law is a floor, not the whole rulebook. Even when federal law permits a telehealth prescription, the prescriber still needs a state license where the patient is located, and the state's own telehealth and prescribing rules still apply. Some states layer additional controlled-substance rules on top of the federal ones.
What are the DEA telemedicine flexibilities, and where do they stand in 2026?
When the COVID-19 public health emergency was declared in 2020, DEA exercised its authority to waive the in-person evaluation requirement, allowing providers to prescribe controlled substances based on a telemedicine encounter alone. That waiver is what made pandemic-era telepsychiatry, addiction medicine, and telehealth TRT possible at scale.
The public health emergency ended in 2023, but the flexibilities did not. DEA, jointly with HHS, has repeatedly extended the telemedicine flexibilities since then rather than letting them lapse, each time citing the need to finish permanent rulemaking without disrupting patient care. This pattern of extension-while-rulemaking has continued through 2025 and into 2026.
Here is the honest status statement, and the one your compliance program should be written around: as of mid-2026, the flexibilities framework remains transitional, and the permanent rules were not settled at the time of writing. Do not build your clinical model on a specific expiration date you saw in a blog post, including this one. Check DEA's current guidance directly, and have counsel confirm before you launch or change a controlled-substance program. This post is refreshed quarterly for that reason.
What history does support is a planning assumption, not a guarantee: DEA has consistently chosen continuity over cliff-edge lapses, and each extension has come with signals about what the permanent framework will care about, including prescriber registration, identity verification, prescription drug monitoring program (PDMP) checks, and data reporting.
What is the proposed special registration for telemedicine?
Congress told DEA to create a "special registration" for telemedicine, a credential that would let qualified prescribers issue controlled-substance prescriptions via telehealth without a prior in-person visit, as far back as 2008. DEA has since issued proposed rulemaking around a special registration framework, and refining that framework is the central open question in this space through 2025 and 2026.
The drafts and public commentary that have circulated point to recurring themes, all of which should be read as directional rather than final:
- A registration tier system. Different registration types for different prescriber roles and drug schedules, with stricter requirements for higher-risk prescribing.
- Heightened obligations for telemedicine prescribers. Expect some combination of PDMP checks, identity verification, recordkeeping, and possibly limits on which schedules can be prescribed without any in-person or camera-on encounter.
- A distinction between schedules. Schedule II drugs (stimulants, most opioids) draw the tightest proposed restrictions; Schedules III-V generally see more workable telemedicine pathways in the proposals.
Because none of this is final as of mid-2026, the practical advice is procedural: subscribe to DEA's announcements, track FSMB's telehealth policy summaries, and treat any program that depends on a specific proposed provision as at-risk until the final rule publishes.
Which medications are affected, and which are not?
This is the question that determines how hard your vertical is. The regulatory weight scales with drug schedule.
| Category | Example telehealth medications | Federal layer | Practical telehealth implications (as of mid-2026) |
|---|---|---|---|
| Non-controlled | Semaglutide, tirzepatide, finasteride, minoxidil, most dermatology, most women's health | Not subject to Ryan Haight | Governed by state law and standard of care; asynchronous prescribing possible where states allow it; the operational work is state-modality mapping, not DEA compliance |
| Schedule III-V | Testosterone (Schedule III), buprenorphine (Schedule III), some sleep and anxiety medications (Schedule IV) | Ryan Haight applies; telemedicine flexibilities and proposed special registration are the live issues | Telehealth prescribing has generally remained possible under the extended flexibilities, but expect requirements such as synchronous encounters, identity verification, PDMP checks, and EPCS; verify current DEA guidance before launch |
| Schedule II | Stimulants (e.g., for ADHD), most opioids | Strictest tier of Ryan Haight and of every proposed framework | Highest scrutiny and tightest proposed limits; most infrastructure-based telehealth programs treat Schedule II as out of scope or heavily restricted; specialist counsel is mandatory |
Two vertical-specific notes.
GLP-1 weight loss brands often assume they have a DEA problem. They do not. Semaglutide and tirzepatide are not controlled substances, so the compliance work is state prescribing law, compounding rules, and honest marketing, not Ryan Haight.
TRT is the canonical Schedule III vertical. Testosterone's Schedule III status is why an online TRT clinic carries prescribing requirements a hair-loss brand never sees: EPCS-capable e-prescribing, per-state controlled-substance rules, and direct exposure to whatever the DEA's final telemedicine framework says. Our guide to launching an online TRT clinic covers the vertical end to end.
How do state lines and licensing work for telehealth prescribing?
The DEA layer gets the headlines, but state law does most of the day-to-day work, and it applies to every prescription, controlled or not.
Licensure follows the patient. A provider must be licensed in the state where the patient is physically located at the time of the encounter. A "50-state" telehealth offering really means a provider network whose licenses collectively cover all 50 states plus DC, with routing that matches each patient to a clinician licensed for their location. The Interstate Medical Licensure Compact speeds multi-state licensing for physicians, but it expedites getting licenses; it does not remove the requirement.
States differ on how a provider-patient relationship is formed. Some states allow a valid relationship to be established asynchronously, through a structured intake reviewed by a clinician with store-and-forward messaging. Others require a synchronous encounter, by video or sometimes phone, for the initial visit. A few impose stricter modality rules for specific drug classes. This is the single biggest driver of unit economics across states, and it is why the async versus sync telehealth decision is a compliance question before it is a product question.
Controlled substances add a second state layer. Beyond the federal rules, some states require their own controlled-substance registrations, mandate PDMP checks before prescribing, or restrict telehealth prescribing of specific schedules more tightly than federal law does. The strictest applicable rule wins.
The compound effect: a single national telehealth program needs a rules matrix of state times modality times drug class, and that matrix changes as legislatures and boards act. This is the same reason the MSO model and its compliance stack exist as standard architecture: the clinical entity has to encode these rules per state, and someone has to maintain them.
What should founders build for?
You cannot build for a specific rule when the rule is moving. You can build for adaptability. Four concrete pieces:
A 50-state licensed provider network with per-state routing. Whatever the DEA finalizes, the licensure-follows-the-patient rule is not going anywhere. A network mapped to every state, with routing logic that only matches patients to properly licensed clinicians, is the invariant layer. MyOrbitHealth's provider network covers 1,240+ board-certified providers across 38+ specialties in all 50 states for exactly this reason.
EPCS-ready e-prescribing from day one. Electronic prescribing of controlled substances, with two-factor identity proofing, is already required in most contexts and features in every proposed federal framework. Retrofitting it is painful. OrbitRx routes prescriptions via Surescripts to a LegitScript-certified pharmacy network and is EPCS-ready, so a brand that starts non-controlled can add a Schedule III vertical without replatforming. (LegitScript certification itself is a separate, parallel requirement for advertising and payments; see the LegitScript certification guide.)
Modality flexibility in the encounter layer. If your platform can run asynchronous, synchronous video, and hybrid flows per state and per drug class, a rule change is a configuration update. If it can only do one modality, a rule change is a roadmap crisis.
A partner whose job is watching the rules. Solo founders should not be parsing DEA interim rules quarterly. Infrastructure partners that track DEA and state changes daily, and push updates into the prescribing logic your clinicians actually use, convert regulatory monitoring from a founder liability into a vendor deliverable. What to verify before trusting a vendor with that job is covered in the white-label telehealth platform guide.
The founders who get hurt by regulatory change are the ones who hard-coded one snapshot of the rules. The ones who do fine treat the rules as data.
Frequently asked questions
Is it still legal to prescribe controlled substances via telehealth in 2026?
Generally yes, under the DEA telemedicine flexibilities that have been repeatedly extended since 2020, subject to state law and the prescriber holding the required licenses and registrations. But the framework remains transitional as of mid-2026, so confirm current status against DEA's own guidance and with healthcare counsel before building or changing a controlled-substance program.
Does the Ryan Haight Act apply to GLP-1 medications like semaglutide?
No. Semaglutide and tirzepatide are not controlled substances, so the Ryan Haight Act does not apply to them. Their telehealth prescribing is governed by state law and the clinical standard of care, including each state's rules on how a provider-patient relationship can be established.
Why is TRT harder to offer via telehealth than hair loss or dermatology?
Testosterone is a Schedule III controlled substance, which brings the federal Ryan Haight framework, EPCS requirements, and state controlled-substance rules into play. Hair loss and most dermatology medications are non-controlled, so they carry only the state-law layer. Same telehealth product, materially different compliance stack.
What is the DEA special registration for telemedicine?
It is a proposed framework under which qualified prescribers could register with DEA specifically to prescribe controlled substances via telehealth without a prior in-person exam. DEA has issued proposed rulemaking around it, but as of mid-2026 founders should not treat any specific provision as final. Track DEA announcements and FSMB summaries for the current status.
Can a provider prescribe to a patient in another state?
Only if the provider is licensed in the state where the patient is physically located at the time of the encounter. That rule applies to controlled and non-controlled prescriptions alike. Multi-state programs solve it with a provider network licensed across all 50 states and routing logic that matches patients to appropriately licensed clinicians.
Can telehealth prescriptions be issued from an intake form alone, without a video visit?
For non-controlled medications, some states permit asynchronous prescribing where a clinician reviews a structured intake and messages the patient, while other states require a synchronous initial encounter. For controlled substances, expect stricter modality requirements at both the federal and state level. The rules vary by state and drug class, so per-state, per-modality logic is a requirement, not an optimization.
Build on infrastructure that adapts when the rules move
Telehealth prescribing rules will keep shifting through 2026 and beyond. That is a reason to choose adaptable infrastructure, not a reason to wait. MyOrbitHealth provides the pieces that stay valid under any plausible final rule: a 50-state licensed provider network, EPCS-ready e-prescribing through OrbitRx and Surescripts into a LegitScript-certified pharmacy network, per-state and per-modality prescribing logic, and a compliance layer maintained daily so rule changes reach your clinic as updates rather than emergencies. Book a demo with MyOrbitHealth to see how founders ship regulated verticals on infrastructure built for regulatory change.