Multi-State TRT Prescribing:
A State-by-State Compliance Matrix

Multi-State TRT Compliance: Quick Answer

Multi-state TRT prescribing compliance requires a provider to hold an active medical license in the patient's state of residence, a DEA registration number valid in that same state, and a state-specific PMP query before issuing any Schedule III testosterone prescription. Telehealth clinics must verify that their prescribers are licensed in every state where patients are located — not just where providers practice. California, Arizona, Georgia, Ohio, Pennsylvania, Illinois, and North Carolina allow telehealth-only initial evaluations for TRT. Texas, New York, and Florida impose stricter initial in-person evaluation requirements for new controlled substance patients. Over 40 states participate in the Interstate Medical Licensure Compact, which expedites — but does not replace — individual state licensure. Out-of-state compounding pharmacy shipments require both the originating pharmacy and the receiving state to permit the transaction under their respective pharmacy board rules. EPCS (electronic prescribing for controlled substances) is mandatory in at least 14 states for Schedule III prescriptions issued electronically.

Why Multi-State Prescribing Matters for TRT Clinics

The testosterone replacement therapy market has fundamentally transformed. A decade ago, TRT was delivered almost exclusively in brick-and-mortar men's health clinics where the patient, provider, and pharmacy all shared the same state. Today, the dominant model is a telehealth-first, digital-native clinic that acquires patients nationwide through digital advertising, evaluates them via video visit, and ships compounded testosterone cypionate or enanthate directly to their door from a 503A or 503B compounding pharmacy.

This shift creates a multi-jurisdictional compliance problem that catches many operators off-guard. A TRT clinic headquartered in Florida serving patients in 35 states is simultaneously subject to 35 different state medical practice acts, 35 different controlled substance prescribing frameworks, 35 different pharmacy board regulations, and the federal Controlled Substances Act — plus DEA registration requirements in each state where patients receive prescriptions. For the complete foundation on structuring a multi-state TRT practice from the ground up — including legal entity structure, DEA registration timelines, and IMLC enrollment — see the guide to launching a profitable TRT/HRT telehealth practice.

The compliance stakes are high. A provider who issues a testosterone prescription in a state where they are not licensed is engaging in the unauthorized practice of medicine — a criminal offense in every U.S. jurisdiction. A DEA registrant who prescribes Schedule III substances in states where they do not hold a valid state-specific DEA registration is in violation of the Controlled Substances Act. A compounding pharmacy that ships testosterone to a state that prohibits out-of-state compounded controlled substance shipments exposes both the pharmacy and the clinic to board and DEA enforcement action.

The growth of direct-to-consumer TRT brands has also drawn federal regulatory scrutiny. The DEA's proposed telemedicine prescribing rules (2023–2025) specifically addressed controlled substance prescribing by telehealth providers, and the FTC has targeted deceptive subscription practices in the broader men's health telehealth space. Clinics that built rapid growth on regulatory gray areas are now facing the consequences of under-investment in compliance infrastructure.

Federal Framework: Ryan Haight Act, DEA Registration, EPCS

Ryan Haight Act and Controlled Substance Telehealth

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 amended the Controlled Substances Act (21 U.S.C. § 829) to prohibit any person from delivering, distributing, or dispensing a controlled substance via the Internet without a valid prescription issued by a practitioner who has conducted at least one in-person medical evaluation of the patient. Testosterone cypionate, testosterone enanthate, and testosterone propionate are Schedule III controlled substances under the CSA, which means Ryan Haight applies directly to TRT telehealth prescribing.

The Ryan Haight Act includes several exceptions to the in-person evaluation requirement. The most operationally significant for TRT telehealth clinics are:

• Telemedicine exception (21 U.S.C. § 802(54)(F)): Prescribing via telemedicine is permitted when the prescriber is practicing telemedicine in compliance with DEA regulations and is registered with the DEA. The DEA has long interpreted this narrowly to require a prior in-person evaluation unless specific conditions are met.
• Public health emergency exception: During the COVID-19 PHE (2020–2023), the DEA issued waivers under 21 U.S.C. § 1320b-5 that explicitly allowed Schedule III–V prescribing via telehealth without a prior in-person visit. When the PHE ended, Congress extended certain telehealth flexibilities through December 31, 2024, and the DEA subsequently proposed a Special Registration framework for telemedicine practitioners.
• DEA Special Registration (proposed): The DEA's 2023 proposed rule introduced a "telemedicine prescriber" registration that would allow qualified providers to prescribe Schedule III–V controlled substances via telehealth without a prior in-person evaluation, subject to heightened documentation, identity verification, and prescribing volume thresholds. As of early 2026, the final rule had not been published; operators should monitor the Federal Register for updates.

The practical implication for TRT clinics: absent a finalized DEA telemedicine special registration rule, providers seeking to prescribe testosterone via telehealth to new patients without any prior in-person visit face meaningful legal risk under Ryan Haight unless their state has adopted specific telehealth-only exceptions or they can rely on an applicable PHE extension.

State-Specific DEA Registration Requirements

DEA registration is not a single national registration. Under 21 CFR § 1301.12, a DEA registrant must obtain a separate DEA registration in each state where they administer, dispense, or prescribe controlled substances — with a limited exception for practitioners who "regularly engage in dispensing or administering" controlled substances in multiple states during travel. This "principal place of professional practice" exception is narrow and does not broadly permit multi-state telehealth prescribing without state-specific registrations.

For a TRT telehealth clinic with patients in 20 states, each prescriber on the platform must hold 20 separate DEA registrations — one per state. Each registration carries its own annual fee (currently $888 for practitioners), renewal cycle, and associated state-level controlled substance registration requirements. Some states have their own separate state controlled substance registration requirements in addition to DEA registration, including California (CDS permit), Illinois (CSRC), and New York (BNDD registration).

EPCS: Electronic Prescribing for Controlled Substances

The DEA's Interim Final Rule on Electronic Prescribing for Controlled Substances (21 CFR Parts 1300, 1304, 1306, and 1311) established the federal framework for EPCS. Under this framework, a prescriber may electronically transmit a Schedule II–V prescription if the software system is DEA-compliant and the prescriber uses two-factor authentication at the time of signing.

States have layered their own EPCS mandates on top of the federal framework. As of early 2026, states with mandatory EPCS requirements for controlled substances include New York (since 2016), Minnesota, Virginia, Michigan, Tennessee, Texas (phased implementation), Florida, and others. In EPCS-mandatory states, paper or phone-in prescriptions for controlled substances are prohibited except in narrowly defined emergency or system outage scenarios. TRT telehealth platforms must have EPCS-certified software for every state where such mandates are in effect.

Schedule III Classification: What It Means for TRT Prescribing

Testosterone and its esters (cypionate, enanthate, propionate, undecanoate) are classified as Schedule III anabolic steroids under the Anabolic Steroid Control Act of 1990 and its 2004 amendment. This classification has significant downstream implications for every aspect of TRT prescribing and clinic operations.

The Schedule III classification also means that testosterone prescriptions are subject to prescription drug monitoring program reporting in all states. Providers must enroll in each relevant state's PDMP system, and many states now mandate interstate PDMP data sharing through the PMP InterConnect network or other interstate data-sharing frameworks. A patient who is receiving testosterone from multiple providers in multiple states will appear on PDMP reports — and prescribers who fail to query the PDMP before prescribing face disciplinary action.

One critical nuance: while the anabolic steroid scheduling is federal, some states have enacted their own controlled substance schedules that differ from the federal schedule or impose additional restrictions. Florida, for example, has enacted state-level scheduling for additional compounds. Providers must always check the patient's state law, not just the federal CSA schedule.

Interstate Medical Licensure Compact (IMLC)

The Interstate Medical Licensure Compact is an agreement among participating states that creates an expedited pathway for physicians who hold a full, unrestricted license in a state of principal license (SPL) to obtain medical licenses in other compact member states. As of early 2026, 40+ states plus D.C. and Guam participate, making the IMLC highly relevant to multi-state TRT clinic expansion.

How IMLC Works in Practice

The IMLC does not create a single multistate license. Instead, it allows a qualifying physician to apply for licenses in multiple member states through a single streamlined application submitted via the IMLC Commission. The physician designates one state as their State of Principal License — typically the state where they have their primary practice or reside. The SPL must grant a full, unrestricted license, and the physician must meet specific qualifying criteria (no disciplinary actions, active DEA registration, board certification in specialty, etc.).

Once approved, the physician receives individual state licenses from each requested member state. The process typically takes 2–4 weeks for participating states versus 3–12+ months via standard state-by-state applications. The IMLC has been transformative for TRT clinic expansion, enabling a new provider to become licensed in 10–15 states within a month rather than a year.

IMLC Limitations for TRT Prescribing

The IMLC has several important limitations that TRT clinic operators frequently overlook:

• Does not override controlled substance rules: An IMLC license grants medical practice authority but does not override the state's controlled substance prescribing regulations. A provider licensed in Texas via IMLC must still comply with Texas's in-person visit requirements for new controlled substance patients.
• Does not include DEA registration: State medical licenses obtained via IMLC do not come with DEA registrations. Providers must still apply for state-specific DEA registrations through the DEA's online registration system separately.
• Does not include state CS registrations: States like California, Illinois, and New York that require separate state-level controlled substance registrations in addition to DEA registration are not covered by IMLC.
• Physician MDs/DOs only: The IMLC applies to allopathic (MD) and osteopathic (DO) physicians only. Nurse practitioners and physician assistants have their own separate interstate compacts (NPLC and PALC, respectively), which have different member states and requirements.
• New York exclusion: New York's absence from the IMLC is a significant operational constraint for TRT clinics seeking to serve the 19 million New York residents. Standard NY licensure is required, and the NY Office of Professional Discipline has strict standards.

State-by-State Compliance Matrix

The following matrix covers the 10 largest TRT markets by patient population. Rules reflect the best available information as of March 2026. "Telehealth Rx Allowed" refers to whether a provider can issue a new TRT prescription following a telehealth-only initial evaluation (no prior in-person visit). "Initial Visit Req" refers to whether an in-person initial evaluation is required before prescribing controlled substances to a new patient. Always verify current state law before prescribing.

Legend: "Conditional" indicates the activity is permitted subject to specific requirements. "Restricted" indicates significant barriers or prohibitions in effect. All states require PDMP query, DEA registration, and valid medical license regardless of other column values.

Controlled Substance Telehealth Requirements by State

The following table details specific controlled substance prescribing requirements for telehealth contexts across the same 10 states. These requirements layer on top of the general medical practice and licensing rules in the matrix above.

Compounding Pharmacy and Out-of-State Shipping Rules

Compounded testosterone is a cornerstone product for most TRT telehealth clinics. Custom concentrations, combination formulas (e.g., testosterone + anastrozole), and alternative delivery vehicles (subcutaneous injection, topical cream, subdermal pellet) are available only from compounding pharmacies — not commercial manufacturers. But the regulatory framework governing which pharmacies can ship to which states, under what conditions, is highly fragmented.

503A vs. 503B Compounders

The FDA recognizes two categories of compounding pharmacies under the Drug Quality and Security Act (DQSA) of 2013. The distinction matters critically for multi-state TRT operations:

• 503A pharmacies (traditional compounders) must compound based on a patient-specific prescription. They may ship across state lines, but only when permitted by both the originating state's pharmacy board and the receiving state's pharmacy laws. 503A pharmacies are not subject to FDA current Good Manufacturing Practices (cGMPs) and are primarily regulated by state pharmacy boards. The vast majority of compounding pharmacies serving individual TRT patients are 503A facilities.
• 503B outsourcing facilities may compound without patient-specific prescriptions, in larger batches, for "office use" by licensed practitioners. They are subject to FDA cGMPs and registered with the FDA. 503B facilities can ship to providers and clinics across state lines more freely, but compounded testosterone from 503B facilities must be administered in a clinical setting, not dispensed directly to patients for self-injection.

State-by-State Compounding Pharmacy Shipping Requirements

Key state-specific requirements for receiving compounded testosterone from out-of-state 503A pharmacies include:

• New York: Out-of-state compounding pharmacies shipping into NY must be registered with the New York State Education Department, Office of the Professions. NY has historically been one of the most restrictive states for out-of-state compounding shipments. Telehealth clinics serving NY patients must verify their partner pharmacy holds NY registration.
• Texas: Out-of-state pharmacies must hold a Texas Non-Resident Pharmacy License (issued by the Texas State Board of Pharmacy). Shipment of compounded controlled substances requires additional documentation including proof of DEA registrant authority in Texas for the prescribing provider.
• Florida: Out-of-state pharmacies shipping into Florida must be registered with the Florida Board of Pharmacy as non-resident pharmacies. The Florida prescription drug monitoring program (PDMP) must reflect the prescription before dispensing.
• California: Out-of-state compounding pharmacies shipping into CA must register with the California Board of Pharmacy as non-resident pharmacies. CA has specific sterile compounding standards, and facilities not accredited by PCAB or an equivalent accrediting body may face additional scrutiny.
• Illinois: Out-of-state pharmacies must hold an Illinois Non-Resident Pharmacy Permit from the Illinois Department of Financial and Professional Regulation. Compounded controlled substances require EPCS transmission of the underlying prescription.

Documentation Requirements That Vary by State

Beyond licensing and prescribing authority, states impose varying documentation requirements that TRT telehealth platforms must build into their clinical workflows. Deficiencies in documentation are the most common trigger for state medical board investigations of telehealth TRT clinics.

Clinical Documentation Standards

All states require that TRT prescribing be supported by appropriate clinical documentation establishing medical necessity. The minimum standard in most states includes:

• Documented clinical history and review of systems supporting hypogonadism or testosterone deficiency
• Laboratory results: total testosterone, free testosterone (calculated or direct), LH, FSH, CBC with differential, and hematocrit at minimum. Many states and standard-of-care guidelines also require PSA, estradiol, and metabolic panel
• Clinical decision rationale explaining why testosterone replacement is indicated and why alternative treatments were considered or rejected
• Risk/benefit discussion with patient and documented informed consent
• PDMP query results documented in the patient record
• Follow-up monitoring plan specifying laboratory re-evaluation intervals (typically 3 months after initiation, then annually)

State-Specific Documentation Variations

Several states have enacted requirements that go beyond the general standard of care:

• Texas: The Texas Medical Board has issued specific guidance on telehealth prescribing documentation, requiring that the medical record contain evidence of adequate evaluation, diagnosis, and treatment plan sufficient to justify the controlled substance prescription. For testosterone, TMB guidance suggests documentation of multiple low testosterone readings on properly collected morning samples.
• New York: New York's prescription monitoring program (I-STOP) requires that the prescriber attest to having reviewed the PDMP patient report before issuing each new Schedule III prescription. This attestation must be documented in the record. NY also requires patient consent for telehealth delivery, which must be documented with the date and method of consent.
• Florida: Florida mandates that providers document the physical location of both the provider and the patient at the time of a telehealth visit in which a controlled substance prescription is issued. This protects against scenarios where a patient is physically located in a state where the provider is not licensed.
• California: The Medical Board of California has issued interpretive guidance indicating that a "good faith exam" — defined as a physical examination or review of medical records establishing the patient's health history — is required before prescribing. For telehealth, the MBC has indicated that a comprehensive telehealth evaluation can satisfy this requirement if thorough, but providers must document the basis for their clinical judgment explicitly.

Informed Consent for Telehealth and Controlled Substance Prescribing

Many states require separate written (or electronically documented) informed consent for telehealth delivery of care. Several additionally require informed consent specific to controlled substance prescribing. TRT clinics should maintain state-specific consent forms that address both telehealth modality and controlled substance risks, signed by patients prior to the initiation of TRT. These consents should be revisited annually or when the patient's clinical status changes materially. For an operational guide to collecting digital consent efficiently at intake, see the best practices for hormone clinic patient onboarding, including how to embed consent forms within the intake questionnaire to eliminate separate DocuSign steps.

Technology Solutions: Automated Compliance Checking

Managing multi-state TRT prescribing compliance manually — with spreadsheets, reminder emails, and ad hoc licensing audits — is not sustainable beyond a handful of states. High-growth TRT clinics serving patients across 20–40 states require technology that automates the compliance enforcement layer at the point of clinical action. Evaluating platforms specifically for multi-state compliance tooling is covered in depth in the TRT telehealth software buyer's guide for 2026, including side-by-side comparison of PDMP integration, state-specific prescribing rule alerts, and DEA registration tracking across five leading platforms.

Geo-Based Rule Engines

A geo-based rule engine determines the patient's state of physical location at the time of the telehealth visit and applies the correct set of compliance rules to that encounter. At minimum, this system should:

• Verify provider licensure in the patient's state before allowing prescription creation
• Verify DEA registration status in the patient's state
• Block or flag prescriptions that would exceed state supply limits
• Prompt PDMP query and record the query result in the encounter documentation
• Apply state-specific EPCS requirements to the prescribing workflow
• Flag encounters where state-specific documentation requirements are not yet complete

Automated License Expiration Tracking

With each provider potentially holding 10–25 state licenses, state controlled substance registrations, and DEA registrations, expiration tracking is a significant administrative burden. An automated system should monitor all credential expiration dates, trigger renewal workflows at 90/60/30-day intervals before expiration, and automatically restrict provider prescribing in states where credentials have lapsed or are not current. A single expired state medical license caught retroactively can invalidate dozens of prescriptions and trigger mandatory reporting obligations.

PDMP Integration

Every state's PDMP has an API or integration pathway that allows EHR and telehealth platforms to query patient prescription histories programmatically. Modern TRT platforms integrate these PDMP APIs so that the required pre-prescribing query is executed automatically within the clinical workflow, with results surfaced to the provider and documented in the encounter record. PMP InterConnect provides a hub-and-spoke architecture allowing query of multiple state PDMPs through a single API connection.

Real-Time Regulatory Update Feeds

State telehealth and controlled substance regulations change frequently. A mature compliance infrastructure should include a regulatory monitoring capability — whether through subscription to legal update services, state medical board monitoring, or purpose-built regulatory intelligence feeds — that detects relevant law and rule changes and flags them for compliance review before they take effect.

Common Compliance Failures and Penalties

The TRT telehealth space has seen a notable increase in regulatory enforcement actions since 2022. Understanding the most common failure modes is essential for any clinic building or scaling a multi-state operation.

Most Common Compliance Failures

• Prescribing without valid state licensure: Providers prescribing in states where they hold no active medical license. This is the unauthorized practice of medicine — a criminal offense. Often discovered during routine audits or patient complaints, triggering multi-state board investigations.
• Missing or expired DEA state registrations: Providers holding national DEA numbers but lacking state-specific DEA registrations for states where patients receive Schedule III prescriptions. The DEA can revoke the practitioner's federal DEA number for this violation.
• Failure to query PDMP: Issuing testosterone prescriptions without querying the patient's state PDMP. In states where PDMP queries are mandatory, failure to query is itself a prescribing violation independent of any adverse outcome.
• Inadequate clinical documentation: Medical boards investigating TRT clinics frequently cite inadequate documentation of the basis for prescribing — missing lab values, absent risk/benefit documentation, no follow-up monitoring plan. This is particularly common in high-volume, assembly-line telehealth models where visit time is minimized.
• Out-of-state pharmacy shipping violations: Compounding pharmacies shipping into states where they are not registered, or shipping under prescriptions that do not meet the receiving state's patient-specific prescription requirements. Both the pharmacy and the prescribing clinic can face action.
• Non-compliant EPCS in mandatory states: Issuing controlled substance prescriptions via phone, fax, or non-certified electronic systems in states where EPCS is mandatory. New York has been particularly active in enforcing its EPCS mandate against telehealth providers.
• Patient location confusion: Prescribing under one state's rules when the patient is physically located in a different state at the time of the visit. The state where the patient is physically present at the time of the telehealth encounter governs which rules apply — not the patient's state of residence, not the provider's location.

Penalties and Enforcement Consequences

Consequences for multi-state TRT compliance violations range from administrative to criminal:

• State medical board disciplinary action: Reprimand, probation, license suspension, or revocation. A suspension or revocation in one state often triggers mandatory reporting obligations to the DEA and other state boards, creating cascading consequences.
• DEA enforcement: Show Cause Orders to revoke or suspend DEA registration. Order to Show Cause proceedings have been used against TRT telehealth prescribers for prescribing outside the usual course of professional practice. DEA revocation effectively ends the ability to prescribe any controlled substance nationally.
• Federal criminal prosecution: Intentional violations of the Controlled Substances Act and Ryan Haight Act can be prosecuted as federal felonies. Sentences for unlawful distribution of controlled substances can range from 5 to 20+ years depending on quantity and circumstances.
• Civil monetary penalties: State attorneys general and the FTC have pursued civil actions against telehealth clinics for deceptive practices related to TRT prescribing, resulting in settlements of $1–10 million or more.
• Pharmacy board actions against compounders: Compounding pharmacies serving out-of-state TRT prescriptions without proper registration in receiving states risk pharmacy board disciplinary actions, including suspension of compounding authority.