DEA Compliance for Online TRT Prescribing: Quick Answer
DEA compliance for online TRT prescribing requires: (1) a valid DEA registration in each state where a patient receives a testosterone prescription, (2) EPCS-certified software in states with mandatory electronic prescribing laws, (3) a PDMP query documented before each new controlled-substance prescription, (4) clinical records demonstrating legitimate medical purpose retained for a minimum of two years federally and longer in many states, and (5) prescriber adherence to the corresponding responsibility doctrine shared with the dispensing pharmacy. The Ryan Haight Act governs online controlled-substance prescribing; testosterone is Schedule III. The COVID-19 PHE telemedicine flexibilities that had permitted telehealth-only prescribing without in-person evaluation have wound down through a series of DEA proposed and interim rules. As of March 2026, the DEA's telemedicine Special Registration framework has been proposed but not finalized, leaving clinics to navigate evolving federal guidance alongside state-specific requirements. These DEA obligations layer on top of the HIPAA compliance requirements for specialty medicine telehealth, which govern how controlled-substance records must be protected and disclosed.
Ryan Haight Act: Background and 2025–2026 Updates
The Ryan Haight Online Pharmacy Consumer Protection Act, enacted in 2008 and codified at 21 U.S.C. §§ 829 and 802(54), amended the Controlled Substances Act to prohibit any person from delivering, distributing, or dispensing a controlled substance via the Internet without a valid prescription issued by a practitioner who has conducted at least one in-person medical evaluation of the patient. The Act was a direct legislative response to the proliferation of online pill mills dispensing opioids and controlled substances to patients who had never physically seen a physician. For a dedicated analysis of the Act's exceptions and 2025–2026 developments, see our guide to Ryan Haight Act telehealth compliance.
Testosterone cypionate, testosterone enanthate, and testosterone propionate are Schedule III controlled substances under 21 U.S.C. § 812 by virtue of the Anabolic Steroid Control Act. The Ryan Haight Act therefore applies in full to any TRT prescription issued following an exclusively online clinical encounter. Violating Ryan Haight is a federal felony — prescribers can face criminal prosecution under 21 U.S.C. § 841, license revocation, and DEA registration cancellation.
"In-person medical evaluation" under Ryan Haight (21 U.S.C. § 802(54)) means a medical evaluation conducted with the patient in the physical presence of the practitioner, regardless of whether portions of the evaluation are performed by other health professionals. A video telehealth visit does not satisfy this requirement unless a specific statutory exception applies.
The Act provides seven narrow exceptions to the in-person evaluation requirement. The most operationally relevant for TRT telehealth are the public health emergency exception under 42 U.S.C. § 1320b-5 and the telemedicine exception for DEA-registered practitioners who meet conditions established by DEA rulemaking. For more than a decade after Ryan Haight was enacted, the DEA declined to promulgate the regulations needed to operationalize the telemedicine exception — leaving providers in a legal gray zone that the COVID-19 pandemic dramatically widened and then began to close.
COVID PHE Flexibilities and the Transition to Special Registration
When the Department of Health and Human Services declared a COVID-19 public health emergency in March 2020, the DEA used its authority under 21 U.S.C. § 1320b-5 to issue blanket telemedicine waivers (DEA Diversion Control Division policy statements, March 16–19, 2020) permitting DEA-registered practitioners to prescribe Schedule III–V controlled substances — including testosterone — via telehealth without any prior in-person evaluation, to patients located anywhere in the United States. These waivers were unprecedented in scope and created the operational model on which the entire direct-to-consumer TRT telehealth industry was built.
The PHE was repeatedly extended through May 11, 2023, when HHS formally ended it. Congress anticipated the abrupt termination of the PHE waivers and enacted § 1262 of the Consolidated Appropriations Act of 2023 directing the DEA to promulgate regulations establishing a telemedicine special registration. In the interim, DEA issued a series of temporary rules extending the PHE telemedicine flexibilities while rulemaking proceeded.
Current Status of the DEA Telemedicine Special Registration
The DEA published its first proposed rules on telemedicine prescribing of controlled substances in February 2023 (88 Fed. Reg. 12875 and 12890), proposing a framework that would have required: a one-time telemedicine prescribing registration, a narrows pathway for Schedule III–V prescribing via audio-video telehealth, enhanced identity verification of patients, and prescribing volume limits. The proposed rules drew over 38,000 public comments — an extraordinary volume — with the majority opposing the restrictive approach.
In response to comment volume, the DEA issued a revised proposed rule in October 2023 and extended the PHE flexibilities through the end of 2024. A supplemental NPRM was published in early 2024 outlining a three-tiered Special Registration structure:
- Tier 1 — Telemedicine Prescribing Registration (Non-Narcotic Schedule III–V): Allows prescribing of non-narcotic Schedule III–V controlled substances, including testosterone, via audio-video telehealth without prior in-person evaluation, subject to enhanced clinical documentation and state compliance requirements.
- Tier 2 — Platform Registration: Applies to telehealth platforms rather than individual prescribers, with platform-level oversight and audit obligations.
- Tier 3 — Narcotic Prescribing Registration: Covers opioids and other scheduled narcotics; higher documentation burden; not relevant to TRT.
As of March 2026, the final Special Registration rule had not been published in the Federal Register. The DEA extended PHE-era telemedicine flexibilities for Schedule III–V controlled substances through an interim final rule that provides a compliance grace period while final rulemaking concludes. TRT telehealth clinics must monitor the Federal Register and DEA Diversion Control Division advisories for the effective date of the final rule, which will trigger new registration and documentation obligations.
When the DEA telemedicine Special Registration final rule is published, most TRT telehealth clinics will need to obtain the new registration, update clinical documentation workflows, and potentially modify EPCS configurations within the compliance deadline — which is expected to be 180 days from publication. LUKE Health's compliance module tracks DEA rulemaking status and will flag required workflow changes automatically.
Schedule III Testosterone: What the Classification Requires
Testosterone and all of its pharmaceutical esters — cypionate, enanthate, propionate, undecanoate — are Schedule III controlled substances under the Anabolic Steroid Control Act of 1990 (amended 2004), codified at 21 U.S.C. § 812 and 21 CFR § 1308.13(f). The classification has operational consequences at every step of the prescribing and dispensing chain.
30-Day Supply / 5 Refills
Schedule III prescriptions may authorize up to a 30-day supply per fill and up to five refills within six months of the original prescription date, after which a new prescription is required. Some states impose tighter limits; always apply the more restrictive rule.
Written, EPCS, or Phone-In
Schedule III prescriptions may be issued in writing, electronically via EPCS-certified systems, or orally (by phone to the pharmacy). In EPCS-mandate states, oral and written paper prescriptions are generally prohibited except in defined emergencies.
Separate CS Logs Required
DEA registrants must maintain separate controlled substance inventory and dispensing records per 21 CFR § 1304. For prescribers, this means the DEA can audit any Schedule III prescription record at any time.
Documented Hypogonadism Required
21 CFR § 1306.04 requires that every Schedule III prescription be issued for a legitimate medical purpose by a practitioner in the usual course of professional practice. For TRT, this means documented low testosterone levels and clinical symptoms — not patient preference alone.
The "legitimate medical purpose" requirement is not merely aspirational. It is the legal standard against which the DEA and state medical boards evaluate every TRT prescription. Prescribers who issue testosterone without lab confirmation of hypogonadism (total testosterone below accepted clinical thresholds, typically 300 ng/dL or below), documented symptoms of testosterone deficiency, and an appropriate differential diagnosis documented in the patient record face DEA investigation and board action regardless of how the prescription was transmitted.
Per-State DEA Registration Requirements
One of the most widely misunderstood requirements in TRT telehealth compliance is DEA registration. Many operators assume that a single DEA registration number — the "national" DEA number a physician receives when they first register — covers prescribing in all states. This assumption is incorrect and has been the basis for multiple DEA enforcement actions.
Under 21 CFR § 1301.12, a DEA registrant must obtain a separate registration for each "principal place of professional practice" where they dispense or prescribe controlled substances. The DEA's interpretation of this regulation — confirmed in advisory guidance and administrative decisions — is that a practitioner who prescribes controlled substances to patients in multiple states must hold a separate DEA registration for each such state. The fee is currently $888 per registration per three-year cycle.
Several states also require state-level controlled substance registration in addition to DEA registration. These state registrations are independent of DEA and carry separate fees, renewal cycles, and application requirements:
| State | State CS Registration Required? | Issuing Agency | Notes |
|---|---|---|---|
| California | Yes | CA DPH / DEA aligned | Controlled Substance Utilization Review and Evaluation System (CURES) registration required for prescribers |
| New York | Yes | NY DOH Bureau of Narcotic Enforcement | Separate BNE registration; mandatory ISTOP query system enrollment |
| Illinois | Yes | IL IDFPR | Controlled Substance Registration Certificate (CSRC) required in addition to DEA registration |
| Texas | Conditional | TX DPS | DPS Controlled Substances Registration required for dispensers; prescribers use DEA but must register for PDMP |
| Florida | Conditional | FL DOH | No separate state CS registration for prescribers, but EPCS-certified system mandatory; PDMP must-access |
| Ohio | Yes | OH State Board of Pharmacy | Terminal Distributor of Dangerous Drugs license required for certain dispensing activities |
| Georgia | No | N/A | DEA registration alone sufficient for prescribers; PDMP query required |
| Arizona | No | N/A | DEA registration alone sufficient; AZ CSPMP query required |
| Pennsylvania | No | N/A | DEA registration alone sufficient; PA PDMP query required before Schedule III |
| North Carolina | No | N/A | DEA registration alone sufficient; NC CSRS mandatory query |
EPCS Mandate Status by State
Electronic Prescribing for Controlled Substances (EPCS) was established as a voluntary federal framework by the DEA in 2010 (21 CFR Parts 1300, 1304, 1306, 1311). Under EPCS, a prescriber may electronically transmit a Schedule II–V prescription using a DEA-compliant system that employs two-factor authentication at signing. Voluntary at the federal level does not mean optional — an increasing number of states have enacted mandatory EPCS laws that prohibit prescribers from issuing paper or phone-in controlled substance prescriptions except in narrow emergency exceptions.
For TRT telehealth clinics, EPCS compliance is not optional in EPCS-mandate states. Using a non-EPCS prescription workflow where EPCS is mandated constitutes a violation of state pharmacy law and, if the prescription reaches a pharmacist who fills it, triggers the corresponding responsibility doctrine for the pharmacy as well. Below is the current EPCS mandate status for the major TRT telehealth markets:
| State | EPCS Mandate | Effective Date | Exceptions | Notes |
|---|---|---|---|---|
| New York | Mandatory | March 27, 2016 | Technical failure, rural, etc. | First statewide EPCS mandate in U.S.; comprehensive compliance required |
| Minnesota | Mandatory | January 1, 2022 | System outage, veterinarians | All Schedule II–V controlled substances; EPCS system must be DEA-certified |
| Virginia | Mandatory | July 1, 2020 | Technical failure; rural areas | Covers all CS prescriptions; waiver process exists but is narrow |
| Michigan | Mandatory | June 1, 2021 | Emergency / outage | Schedule II–V; DEA-certified system required; MAPS query mandatory |
| Tennessee | Mandatory | January 1, 2021 | Emergency, outage, rural | Applies to all CS; prescribers must be EPCS-enrolled before prescribing |
| Texas | Mandatory | January 1, 2021 (phased) | Technical failure; rural practitioners | Full mandate for CS prescriptions in healthcare settings as of 2022 |
| Florida | Mandatory | January 1, 2020 | Emergency, outage, formulary issues | Schedule II–V; prescribers must use EPCS-certified system from licensed vendor |
| Connecticut | Mandatory | July 1, 2021 | Emergency, outage | All CS schedules; DEA-compliant system required |
| Ohio | Mandatory | January 1, 2022 | Emergency / outage | Schedule II–V; Ohio PDMP query mandatory before prescribing |
| Massachusetts | Mandatory | January 1, 2020 | Emergency, rural, outage | All CS; PDMP (APRS) query required; prescribers must be registered with APRS |
| California | Voluntary | N/A | N/A | EPCS permitted but not mandated statewide; CURES 2.0 query mandatory |
| Georgia | Voluntary | N/A | N/A | No statewide EPCS mandate; PDMP query required before CS Rx |
| Arizona | Voluntary | N/A | N/A | No mandate; CSPMP query required for Schedule II–IV |
| North Carolina | Voluntary | N/A | N/A | No mandate; CSRS query required; NC trending toward mandate |
Clinics must also ensure that any EPCS-certified system they use complies with DEA 21 CFR Part 1311 at the technical level. Specifically, the system must: use logical access controls with two-factor authentication (possession factor plus biometric or knowledge factor), generate an audit trail for every prescription signing event, and provide access controls preventing unauthorized access to the prescriber's signing credential. EPCS certification is issued by the DEA-authorized certification bodies; verify that any vendor a clinic uses maintains current certification.
PDMP Query Obligations
Prescription Drug Monitoring Programs (PDMPs) are state-run databases that collect dispensing information for Schedule II–V controlled substances. Every state except Missouri now operates a PDMP (Missouri counties began participating in NarxCare in 2023). The operational question for TRT telehealth clinics is not whether PDMPs exist but when, how, and how often prescribers must query them before issuing a testosterone prescription.
PDMP query requirements are determined by the state where the patient is physically located at the time of the telehealth visit — not the state where the prescriber is based. A prescriber in Arizona serving a patient located in New York must query the New York PDMP (I-STOP) before issuing the prescription, and must be registered to access I-STOP independently of their Arizona PDMP enrollment.
States mandate PDMP queries before prescribing Schedule II or III controlled substances to new patients as of early 2026. In many states, mandatory query requirements extend to each prescription renewal or at defined intervals (commonly every 90 days).
Key PDMP query requirements that TRT telehealth clinics must implement:
- New patient query: All mandate states require a PDMP query before issuing the first controlled substance prescription to a new patient.
- Recurring query obligations: States including California (CURES), Florida, New York, and Ohio require queries at each prescription issuance or at specific intervals. "Set and forget" workflows that query once at intake and never again are non-compliant in these states.
- Multi-state query via PMPInterConnect: PMPInterConnect enables cross-state PDMP data sharing. Prescribers must query the patient's resident state PDMP, and in some states must also query adjacent states or any state where the patient may have received prior controlled substance prescriptions.
- Documentation: The PDMP query result and the prescriber's clinical interpretation must be documented in the patient record. A query alone is insufficient — the prescriber must note whether the query revealed concerning patterns and describe their clinical response.
- Delegate access: Some states permit authorized clinical staff (medical assistants, nurses) to perform PDMP queries on behalf of a prescriber; others require the prescriber to query personally. Verify the applicable state rule before implementing delegate workflows.
Record Retention: Two-Year Federal Minimum and State Extensions
Record retention for controlled substance prescribing is governed by both federal DEA regulations and state law. The federal floor is established at 21 CFR § 1304.04: DEA registrants must retain all records required under the Controlled Substances Act for a minimum of two years from the date of the recorded activity. For prescribers, this covers prescription records, patient medical records documenting the basis for prescribing, and any controlled substance inventory or dispensing logs.
The two-year federal minimum is a floor, not a ceiling. Most states impose longer retention requirements that apply specifically to controlled substance prescribing records or patient medical records generally. TRT telehealth clinics operating across multiple states must comply with the most restrictive applicable requirement for each patient:
| State | Medical Record Retention | CS-Specific Retention | EPCS Log Retention |
|---|---|---|---|
| California | 7 years (adults) | 7 years (CURES) | 7 years |
| New York | 6 years | 6 years (BNE) | 6 years |
| Florida | 5 years | 5 years | 5 years |
| Texas | 10 years (TX Med. Prac. Act) | 10 years | 10 years |
| Ohio | 6 years | 3 years (DEA + state) | 3 years minimum |
| Illinois | 10 years | 5 years | 5 years |
| Georgia | 10 years | 2 years (DEA floor) | 2 years minimum |
| Arizona | 6 years | 2 years (DEA floor) | 2 years minimum |
| Pennsylvania | 7 years | 2 years (DEA floor) | 2 years minimum |
| North Carolina | 10 years | 2 years (DEA floor) | 2 years minimum |
The practical implication: a TRT telehealth clinic using a single records retention policy across all states must apply the most conservative requirement — which in practice means retaining all patient records, EPCS logs, PDMP query records, and clinical documentation for a minimum of ten years to cover Texas and several other high-retention states. Records that must be retained include:
- Patient intake forms and identity verification records
- Lab results (total testosterone, free testosterone, LH, FSH, CBC, hematocrit, PSA where applicable)
- Telehealth visit documentation (audio-video session records or detailed clinical summary where session recording is impractical)
- Informed consent for TRT, including disclosure of Schedule III classification and relevant risks
- PDMP query results and prescriber interpretation notes
- All prescriptions issued (EPCS transaction logs if applicable)
- Compounding pharmacy order confirmations and dispensing records
- Two-factor authentication logs for EPCS signing events (per 21 CFR § 1311.170)
Corresponding Responsibility Doctrine
The corresponding responsibility doctrine is one of the most consequential and least understood concepts in TRT telehealth compliance. Codified at 21 CFR § 1306.04(a), it states: "A prescription for a controlled substance to be effective must be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice. The responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner, but a corresponding responsibility rests with the pharmacist who fills the prescription."
Corresponding responsibility means that a compounding pharmacy that fills a testosterone prescription without adequate clinical documentation — or from a prescriber whose practice pattern suggests a pill mill — bears criminal and civil liability alongside the prescriber. This is not a hypothetical. The DEA has pursued Show Cause Orders against pharmacies filling large-volume TRT prescriptions from telehealth prescribers who lacked proper documentation or state-specific DEA registration.
For TRT telehealth clinics, the corresponding responsibility doctrine has three practical implications:
1. Compounding pharmacy partners must vet clinical documentation. A 503A compounding pharmacy filling testosterone prescriptions from a telehealth clinic is exposed to DEA action if it fills orders without verifying that the prescriber holds a valid DEA registration for the patient's state, that the prescriber is licensed in the patient's state, and that the prescription contains the information required under 21 CFR § 1306.05 (patient name and address, date of issue, drug name, strength and quantity, directions for use, prescriber information, prescriber signature).
2. Clinical documentation quality directly affects compounding pharmacy relationships. Pharmacies that implement quality controls — requiring lab results as a condition of filling, flagging prescriptions from providers without state-specific DEA registration, or declining to fill prescriptions where patient location cannot be verified — are exercising their corresponding responsibility obligations. Clinics that cannot provide adequate documentation will lose compounding pharmacy partners. Compounding pharmacies also operate under federal supply chain requirements — understanding DSCSA compliance for compounding pharmacies is essential for any clinic that relies on 503A or 503B facilities.
3. Prescribers cannot insulate themselves by delegating to clinical staff. If a supervising physician signs testosterone prescriptions based on patient data collected and evaluated by non-physician staff without meaningful prescriber review, the prescriber's corresponding responsibility exposure is no smaller. The DEA expects the practitioner signing a controlled substance prescription to have personally evaluated the patient and reached an independent clinical judgment.
Recent DEA Enforcement Actions Against TRT Telehealth Providers
DEA enforcement activity in the TRT telehealth space intensified significantly from 2023 through early 2026, tracking the end of PHE flexibilities and the parallel growth of direct-to-consumer testosterone platforms. The following timeline summarizes the major enforcement developments:
Proposed Rulemaking Timeline
The following timeline captures the full sequence of federal rulemaking actions directly affecting online TRT prescribing since the PHE began, providing the regulatory context TRT telehealth clinics need to understand where the current compliance environment came from and where it is heading:
| Date | Action | Impact on TRT Prescribing |
|---|---|---|
| Mar 2020 | DEA PHE Telemedicine Waiver | Permitted Schedule III–V prescribing via telehealth without in-person evaluation; enabled DTC TRT model |
| 2020–2023 | PHE Renewals (repeated) | Continuously extended waiver framework; TRT telehealth industry scaled under this flexibility |
| May 2023 | PHE End / SUPPORT Act Mandate | Congress directed DEA to create Special Registration; temporary extension issued to bridge rulemaking gap |
| Feb 2023 | DEA Proposed Rule (NPRM) — 88 Fed. Reg. 12875 | Proposed restrictive Special Registration framework; 38,000+ comments opposing approach |
| Oct 2023 | DEA Revised Proposed Rule + PHE Extension | Broadened proposed framework; extended PHE flexibilities through Dec 2024 while revisions proceeded |
| Early 2024 | Supplemental NPRM — Three-Tier Special Registration | Introduced tiered registration structure; Tier 1 covers non-narcotic Schedule III–V (TRT); comment period reopened |
| Late 2024 | Interim Final Rule — PHE Grace Period Extension | Extended Schedule III–V telemedicine flexibilities while final rule is under review; current compliance basis |
| 2025 | Final Rule Under OIRA Review | Special Registration final rule submitted to OMB OIRA for review; publication pending as of March 2026 |
| Expected 2026 | Final Special Registration Rule Publication | Will establish permanent framework for Schedule III–V telehealth prescribing; 180-day compliance deadline expected |
Compliance Checklist for TRT Telehealth Clinics
The following checklist represents the minimum compliance infrastructure every TRT telehealth clinic should have in place before the Special Registration final rule is published. Clinics that implement these controls now will be best positioned to adapt to the final rule with minimal operational disruption.
-
Per-State DEA Registration Audit: Verify that each prescriber holds a current, valid DEA registration for every state in which they have active patients. Compile a registration matrix (prescriber × state) and flag any gaps. Initiate new registrations immediately for any state with patients but no registration.
-
State CS Registration Cross-Check: For states requiring separate state-level controlled substance registration (CA CURES, NY BNE, IL CSRC, OH Pharmacy Board), confirm each prescriber holds the applicable state registration in addition to DEA registration.
-
EPCS System Certification Verification: Confirm that your prescribing platform uses a DEA-certified EPCS system (21 CFR Part 1311 compliant), with two-factor authentication active for every prescription signing event. Audit that the system generates tamper-evident audit logs retained for the applicable period.
-
EPCS Mandate Coverage: Map your patient states against the EPCS mandate table above. Confirm that your EPCS system is active and in use for 100% of prescriptions issued in mandate states. Verify that paper or phone-in prescription workflows are disabled for those states except in documented emergencies.
-
PDMP Enrollment by Prescriber by State: Confirm every prescriber is enrolled in the PDMP for each patient state. Verify that PDMP queries are being performed before each new prescription issuance, and at mandatory intervals for established patients, with query results documented in the patient record.
-
Clinical Documentation Protocol — Lab-First Requirement: Implement a protocol requiring confirmed low serum testosterone (documented lab result) before any testosterone prescription is issued. Document symptoms consistent with hypogonadism, rule out alternative diagnoses, and ensure prescriber review of all clinical data prior to signing.
-
Informed Consent Documentation: Ensure every patient signs a TRT-specific informed consent that discloses Schedule III classification, risks (polycythemia, cardiovascular, fertility), monitoring requirements, and the patient's state of residence at time of consent. Retain signed consent with medical records.
-
Compounding Pharmacy Due Diligence: Confirm every pharmacy partner has reviewed and accepted your clinical documentation standards, holds the required DEA registration and state pharmacy licenses for states it ships into, and has a written policy for exercising corresponding responsibility review before filling telehealth-sourced testosterone orders.
-
Record Retention Policy by State: Implement a multi-state record retention matrix. Apply the most conservative retention period applicable to each patient's records based on their state. Configure EHR and document management systems to enforce these retention periods automatically.
-
Special Registration Monitoring: Designate a compliance officer responsible for monitoring the Federal Register for the DEA telemedicine Special Registration final rule. Establish a response plan: when the rule publishes, trigger registration applications, documentation workflow updates, and prescriber training within the compliance deadline.
Technology Solutions for DEA Compliance
Manual compliance management at scale — tracking per-state DEA registrations, EPCS mandate status, PDMP query completion, and record retention across dozens of prescribers and 30+ states — is not operationally viable. Clinics that attempt to manage this through spreadsheets and manual workflows will inevitably experience compliance gaps that create DEA exposure. The right technology infrastructure converts compliance from a constant firefighting exercise into a systematic, auditable process. State telehealth parity laws also affect which states permit initial controlled-substance evaluations via video — your technology stack must track parity status alongside DEA registration. All prescription records must also be protected by tamper-evident audit trails that satisfy both HIPAA's six-year retention requirement and DEA's EPCS logging standards.
What a Purpose-Built TRT Compliance Platform Must Do
The technology stack for a compliant TRT telehealth operation requires several integrated capabilities that general-purpose EHR systems typically do not provide out of the box:
Per-State DEA Registration Tracking
Automated tracking of each prescriber's DEA registration status across all active patient states, with expiration alerts and gap detection when a patient in an unregistered state enters the system.
EPCS-Integrated Controlled Substance Prescribing
Built-in EPCS with DEA-certified two-factor authentication, state-specific prescribing rule enforcement (supply limits, mandate detection), and automatic PDMP query prompts before prescription signing.
Lab-First Protocol Enforcement
Workflow gates that prevent testosterone prescription signing until required lab values are on file and within acceptable timeframes, reducing corresponding responsibility exposure for prescribers and compounding pharmacy partners.
Audit-Ready Records by State
Automatic retention enforcement by patient state, structured PDMP query logging, EPCS audit trail storage, and one-click DEA audit package generation with all records required under 21 CFR § 1304.
Rulemaking and EPCS Mandate Monitoring
Automated monitoring of DEA Federal Register publications, state EPCS mandate changes, and PDMP requirement updates, with in-platform notifications when compliance workflows need to be updated.
State-Specific Workflow Routing
Intelligent routing that applies the correct prescribing rules, consent requirements, and documentation standards based on the patient's state at time of visit — not the provider's home state.
LUKE Health's platform was built specifically for hormone therapy and TRT telehealth workflows, with DEA compliance integrated at every step of the clinical workflow rather than bolted on as an afterthought. The platform manages per-state DEA registration status for each prescriber, enforces EPCS mandates by patient state, integrates PDMP query prompts into the prescribing flow, maintains state-specific record retention policies automatically, and generates DEA-audit-ready documentation packages on demand.
Built for DEA-Compliant TRT Telehealth
LUKE Health manages per-state DEA registration tracking, EPCS mandate enforcement, PDMP query workflows, and audit-ready record retention automatically — so your clinical team can focus on patients, not compliance spreadsheets.
Frequently Asked Questions
Can a telehealth provider prescribe testosterone online without an in-person visit in 2026?
As of March 2026, the DEA's proposed telemedicine Special Registration rule has not been finalized. However, the DEA extended PHE-era telemedicine flexibilities for Schedule III–V controlled substances through an interim final rule that provides a compliance grace period while final rulemaking concludes. Providers operating under a valid DEA registration who comply with applicable state telehealth statutes and clinical documentation requirements may prescribe testosterone via telemedicine without a prior in-person visit in states that have adopted telehealth parity laws permitting initial controlled-substance evaluations via video. Clinics must monitor the Federal Register for the final Special Registration rule, which will establish the permanent framework and trigger new registration obligations.
Does a TRT telehealth provider need a separate DEA registration for each state?
Yes. Under 21 CFR § 1301.12, a DEA registrant must obtain a separate DEA registration in each state where they dispense or prescribe controlled substances. A TRT telehealth prescriber serving patients in 20 states requires 20 individual DEA registrations — one per state. Each registration carries its own fee (currently $888 per three-year cycle), renewal cycle, and in some states associated state-level controlled substance registration requirements. The "principal place of professional practice" exception under 21 CFR § 1301.12(b) is narrow and does not cover routine multi-state telehealth prescribing operations.
What is the "corresponding responsibility" doctrine and how does it apply to TRT prescribing?
The corresponding responsibility doctrine (21 CFR § 1306.04) holds that a pharmacist who fills a prescription for a controlled substance — including testosterone — bears co-responsibility for ensuring the prescription was issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. For TRT telehealth, this means compounding pharmacies cannot simply fill all orders that arrive electronically; they must exercise independent professional judgment about whether each prescription appears legitimate. Pharmacies have faced DEA enforcement actions for filling TRT prescriptions from telehealth providers where there was no documented diagnosis of hypogonadism, no lab confirmation of low testosterone, or no documented prescriber-patient relationship consistent with standard of care.
Are PDMP checks required before prescribing testosterone via telehealth?
PDMP query requirements vary by state and are determined by the patient's physical location at the time of the telehealth visit. As of 2026, at least 38 states mandate PDMP queries before prescribing Schedule II or III controlled substances to new patients, and many require recurring queries at each prescription issuance or at defined intervals such as every 90 days. States with mandatory PDMP query laws for Schedule III prescribing include California, Florida, New York, Texas, Ohio, Georgia, Illinois, and Pennsylvania. Telehealth TRT providers must query the PDMP of the state where the patient is physically located — not the state where the provider is based — and must document the query result and clinical interpretation in the patient record.
How long must a TRT telehealth clinic retain controlled substance prescription records?
Federal DEA regulations (21 CFR § 1304.04) require controlled substance records to be maintained for a minimum of two years from the date of the recorded activity. However, most states impose longer requirements: California requires 7 years, New York 6 years, Florida 5 years, Texas 10 years, Illinois 10 years, and Ohio 6 years. TRT telehealth clinics operating across multiple states must comply with the longer of the federal minimum and the applicable state requirement for each patient. Records subject to retention obligations include all prescriptions, EPCS transaction and authentication logs, PDMP query records, clinical documentation, lab results, and informed consent forms.
What DEA enforcement actions have targeted online TRT providers?
DEA enforcement activity against online TRT telehealth providers intensified significantly from 2023 through early 2026. Notable actions include DEA administrative subpoenas to multiple direct-to-consumer TRT platforms requesting prescribing volume data and per-state DEA registration documentation; Show Cause Orders to at least three telehealth-affiliated compounding pharmacies alleging corresponding responsibility violations for filling testosterone prescriptions without adequate clinical documentation or where prescribers lacked state-specific DEA registrations; and state attorney general investigations in Florida, Texas, and California. Multiple large TRT telehealth companies entered consent decrees requiring clinical protocol overhauls, including lab-first prescribing requirements and prescriber credentialing audits. The DEA also conducted a voluntary compliance outreach initiative in 2024 offering favorable treatment to companies that self-reported registration gaps and implemented remediation.