Telehealth Prescribing of Controlled Substances:
Ryan Haight Act Compliance

Ryan Haight Act Compliance: Quick Answer

Ryan Haight Act telehealth compliance requires every practitioner prescribing a controlled substance (Schedule II–V) via the internet to have completed at least one in-person medical evaluation of that patient before issuing the first prescription, unless a specific statutory exception applies. This federal requirement sits alongside a broader set of HIPAA compliance obligations for specialty medicine telehealth that together define the regulatory floor for any compliant TRT or hormone clinic. Testosterone cypionate, enanthate, and all other testosterone esters are Schedule III anabolic steroids, making them subject to the Ryan Haight Act in every TRT telehealth context. The seven statutory exceptions that permit telehealth-only prescribing are: (1) DEA-registered hospital or clinic, (2) referral by a treating practitioner, (3) Indian Health Service practitioner, (4) VA practitioner, (5) Public Health Service facility practitioner, (6) state-licensed practitioner at a DEA-registered practice where state telemedicine law authorizes it, and (7) DEA Special Registration for Telemedicine. COVID-19 PHE waivers temporarily suspended the in-person requirement from March 2020 through 2024 for Schedule III–V substances. As of early 2026, the DEA has not finalized the Special Registration rule, leaving clinics that relied on COVID-era flexibility in a legally uncertain position that demands immediate remediation.

History and Purpose: Why the Ryan Haight Act Was Enacted

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Public Law 110-425) was signed into law on October 15, 2008, amending the Controlled Substances Act (21 U.S.C. §§ 802, 829, 831) to address a specific and urgent problem: the proliferation of rogue online pharmacies that were dispensing Schedule II–V controlled substances — most notably opioids — to anyone who completed a brief online questionnaire, without any meaningful medical evaluation.

The Act is named after Ryan Haight, who died in February 2001 at the age of 18 after obtaining 30 mg oxycodone tablets from a website that provided a fraudulent prescription based solely on an online questionnaire he completed. Ryan lived in La Mesa, California. His parents, Andrea and John Haight, spent years advocating for federal legislation to close the regulatory gap that made his death possible. Congress ultimately enacted the statute they championed by unanimous consent in 2008, seven years after Ryan's death.

The Act targeted what Congress called "pill mills" operating online — operations that processed tens of thousands of prescriptions per month for opioids, stimulants, and sedatives based on questionnaires, with no physician ever examining the patient. By 2007, the DEA estimated that hundreds of rogue internet pharmacies were operating in the United States, generating hundreds of millions of dollars in illegal prescription drug sales annually.

The legislation also created penalties for internet pharmacies operating without proper DEA registration, established new recordkeeping requirements for internet prescriptions, and added specific definitions to the CSA covering online prescribing and dispensing. The Act's core provision — the in-person evaluation requirement — was written deliberately broadly to cover all forms of remote prescribing, including video, telephone, and text-based encounters, with limited exceptions carved out for legitimate telemedicine practice.

The In-Person Examination Requirement

The Ryan Haight Act's central prohibition is codified at 21 U.S.C. § 829(e)(1): no controlled substance that is a prescription drug may be delivered, distributed, or dispensed by means of the internet without a valid prescription. A prescription is "valid" only if it is issued by a practitioner who has conducted at least one in-person medical evaluation of the patient, or who falls within one of the seven telemedicine exceptions. For a detailed breakdown of how this intersects with DEA registration, PDMP requirements, and EPCS mandates, see our guide to DEA compliance for online TRT prescribing.

The statute defines "in-person medical evaluation" (21 U.S.C. § 802(54)) as a medical evaluation conducted "with the patient in the physical presence of the practitioner, without regard to whether portions of the evaluation are conducted by other health professionals." Several implications flow from this definition:

• Video visits alone do not count. A synchronous video visit, even one conducted at clinical-grade quality with full audio and visual clarity, does not satisfy the in-person evaluation requirement. The patient must be physically in the same room as the practitioner.
• Telephone visits do not count. Audio-only encounters have never satisfied the Ryan Haight Act's in-person requirement, regardless of clinical thoroughness.
• Asynchronous encounters do not count. Store-and-forward evaluations, online questionnaire reviews, and photo or video submissions reviewed later by a provider do not constitute in-person evaluations.
• The evaluation can be partially conducted by other staff. A nurse or medical assistant can perform portions of the evaluation (vital signs, intake history), provided the prescribing practitioner is physically present with the patient at some point during the encounter and conducts an evaluation of the patient themselves.
• The requirement applies per patient, not per prescription. Once a valid in-person evaluation has been conducted and documented for a given patient, subsequent refills and new prescriptions for controlled substances can be issued via telehealth — subject to applicable state law — without repeating an in-person evaluation. The one-time in-person requirement establishes the legitimate physician-patient relationship.

The 7 Telemedicine Exceptions

The Ryan Haight Act defines "practice of telemedicine" in 21 U.S.C. § 802(54) to enumerate specific circumstances in which a practitioner may prescribe a controlled substance via telemedicine without having conducted a prior in-person evaluation. These seven categories are the complete list of federal exceptions — there are no other statutory exceptions under the Ryan Haight Act itself (though COVID-era emergency authority created temporary additional flexibility discussed below).

Exception Comparison Table

The following table summarizes each of the seven Ryan Haight Act telemedicine exceptions, their operational prerequisites, and their practical applicability to private TRT telehealth clinics.

COVID-19 PHE Flexibilities and Their Expiration

The COVID-19 pandemic created an unprecedented policy response that temporarily suspended the Ryan Haight Act's in-person evaluation requirement for most scheduled substances. Understanding what happened — and what has since changed — is essential for any TRT telehealth clinic assessing its current legal posture.

The Emergency Authority Basis

When Secretary Alex Azar declared a public health emergency for COVID-19 on January 31, 2020, this invoked the DEA's authority under 21 U.S.C. § 1320b-5 to temporarily modify or waive requirements of the Controlled Substances Act during the emergency period. On March 16, 2020, the DEA issued a blanket blanket waiver stating that during the PHE, DEA-registered practitioners could prescribe Schedule II through V controlled substances to patients for whom they had not conducted an in-person evaluation, provided the prescription was issued pursuant to a telemedicine encounter conducted in compliance with applicable state law.

This waiver was transformative for TRT telehealth. Overnight, clinics that had previously required patients to visit a local urgent care or affiliate clinic for an initial in-person blood draw and examination could shift entirely to telehealth onboarding. New patient acquisition costs dropped. Geographic reach expanded dramatically. Many TRT telehealth brands built their entire patient acquisition model on COVID-era telehealth-only onboarding.

The PHE Ended — Then Congress Extended Flexibilities

The COVID-19 PHE ended on May 11, 2023, when Secretary Xavier Becerra's PHE declaration expired and was not renewed. Strictly speaking, the DEA's blanket waiver ended with it. However, recognizing that an abrupt end to telehealth controlled substance prescribing would harm millions of established patients, Congress acted to create a bridge period:

• Consolidated Appropriations Act, 2023: Extended Medicare telehealth flexibilities through December 31, 2024, and directed the DEA to finalize telemedicine prescribing rules before the bridge period expired.
• DEA Temporary Rules (2023): The DEA issued temporary rules effective May 11, 2023 that extended certain controlled substance telehealth prescribing flexibility while the permanent rulemaking proceeded. These rules allowed practitioners who had established a telehealth relationship with a patient during the PHE to continue prescribing Schedule III–V controlled substances via telehealth for existing patients without a new in-person evaluation, subject to certain limitations.
• Further Extensions Through 2024: As the DEA's Special Registration rulemaking faced significant delays due to the volume of public comments (over 38,000 received on the 2023 proposed rules) and substantial controversy, the DEA issued additional temporary rules extending the COVID-era flexibility for existing telehealth patients into 2025.

The DEA Special Registration for Telemedicine (SRTM)

The SUPPORT for Patients and Communities Act (P.L. 115-271, signed October 2018) added § 831(h) to the Controlled Substances Act, which directed the DEA to establish a Special Registration for Telemedicine (SRTM) that would allow qualified practitioners to prescribe Schedule III–V controlled substances via telemedicine without a prior in-person evaluation. The SUPPORT Act gave the DEA 180 days to issue regulations — a deadline the DEA missed by years.

The 2023 Proposed Rule

In March 2023, as the COVID PHE neared its end, the DEA published proposed rules in the Federal Register to establish the SRTM. The proposals were notable for their restrictions, which many in the telehealth industry found unworkable:

• Prescribers would need to obtain a separate SRTM registration in addition to their standard DEA registration, with associated fees and qualification requirements.
• Prescribing via the SRTM would be limited to Schedule III–V substances (not Schedule II), meaning it would cover testosterone as Schedule III.
• Patients would need to undergo identity proofing via DEA-approved methods before receiving a controlled substance telehealth prescription.
• The DEA proposed prescribing volume limits — thresholds above which SRTM registrants would face heightened scrutiny or restrictions.
• Buprenorphine for opioid use disorder would have a distinct, more permissive track within the SRTM framework, given the public health urgency of OUD treatment access.

The proposed rules drew over 38,000 public comments — one of the largest comment volumes in DEA rulemaking history — with the vast majority opposing the restrictions as overly burdensome. Patient groups, mental health advocates, TRT patients, and chronic pain patients all submitted comments arguing that the proposed rules would effectively eliminate telehealth access to controlled substances for millions of Americans who had benefited from COVID-era flexibility.

Where SRTM Stands in 2026

As of April 2026, the DEA has not published a final SRTM rule. The agency has indicated through public statements and regulatory agenda publications that it is continuing to revise its approach in response to the public comments. Several factors have continued to delay finalization:

• Ongoing political debate about the appropriate balance between diversion prevention and patient access.
• Concerns from HHS and SAMHSA about the impact of restrictive SRTM rules on buprenorphine access for OUD treatment.
• Industry lobbying from both established telehealth platforms and traditional medical associations.
• Continued DEA issuance of temporary rules to maintain some controlled substance telehealth prescribing flexibility while the permanent rules are developed.

The SRTM remains the most consequential pending regulatory action in telehealth controlled substance prescribing. When finalized, it will either create a workable pathway for TRT telehealth clinics to onboard new patients via telehealth-only — or impose restrictions severe enough to require clinics to redesign their patient acquisition model entirely.

Current Status as of 2026

The practical compliance landscape for Ryan Haight Act telehealth compliance as of early 2026 can be summarized across three patient categories:

How Testosterone (Schedule III) Is Affected

Testosterone in all its pharmaceutical forms — testosterone cypionate injection (the most commonly prescribed TRT formulation), testosterone enanthate, testosterone propionate, testosterone undecanoate (Jatenzo oral, Aveed injectable), and compounded preparations — is a Schedule III anabolic steroid under the Controlled Substances Act (21 U.S.C. § 812, Schedule III(e)(1)) as amended by the Anabolic Steroid Control Act of 1990 and the Anabolic Steroid Control Act of 2004.

The Schedule III classification places testosterone squarely within the Ryan Haight Act's scope. Every Ryan Haight Act requirement applies to testosterone prescriptions issued via telehealth:

• In-person evaluation required before the first internet prescription for any new patient, absent an applicable exception.
• DEA registration in the patient's state is required. A single national DEA registration is insufficient — practitioners must have a DEA registration valid for the state where the patient physically receives the prescription.
• PDMP query mandatory in virtually every state before issuing or refilling a Schedule III prescription. Most states require the prescriber to query the state PDMP and document the results in the patient record before prescribing any controlled substance.
• 30-day supply limit per fill for Schedule III substances in most states, with up to five refills permitted within six months. After six months, a new prescription is required, which may require updated lab work and a clinical reassessment.
• EPCS mandatory in an increasing number of states for all controlled substance prescriptions issued electronically. Prescribers in EPCS-mandatory states cannot issue paper or phone-in testosterone prescriptions.
• DEA record retention for a minimum of two years under 21 CFR § 1304.04, with many states requiring five to ten years under their medical practice acts.

State-Level Variations That Add Requirements

The Ryan Haight Act establishes a federal floor for controlled substance telehealth prescribing. States are free to impose stricter requirements, and many do. TRT telehealth clinics must comply with both federal Ryan Haight Act requirements and any applicable state-level requirements in each state where patients receive prescriptions.

States With Stricter In-Person Evaluation Requirements

Texas: The Texas Medical Board (TMB) has long required that a valid physician-patient relationship be established before a physician prescribes, and the TMB has interpreted this as requiring a face-to-face evaluation before prescribing controlled substances to new patients. Texas's telemedicine statute (Tex. Occ. Code Ann. § 111.005) permits telehealth prescribing but requires that the prescriber "review available medical records" and that the encounter meet the applicable standard of care. For controlled substances, the TMB has consistently applied heightened scrutiny to telehealth prescribing, and many Texas practitioners require an in-person visit before TRT initiation regardless of federal flexibility.

New York: New York's prescribing regulations (10 NYCRR Part 80) and the Office of the Professions require that controlled substance prescriptions be issued only in the context of a legitimate practitioner-patient relationship. New York has been particularly active in enforcing EPCS requirements (mandatory since 2016) and has issued guidance indicating that Schedule III prescriptions issued to patients seen only via telehealth face heightened scrutiny regarding the adequacy of the patient evaluation.

Florida: Florida's Telehealth Act (Fla. Stat. § 456.47) permits telehealth prescribing but requires that the prescriber use appropriate technology that provides audio and visual communication and that the prescriber adhere to the applicable standard of care. For controlled substances specifically, Florida administrative rules require documentation demonstrating that prescribing meets the standard of care for the patient's condition, and the Florida Department of Health has pursued disciplinary actions against prescribers whose controlled substance telehealth prescribing has been deemed inadequate.

State PDMP Requirements That Exceed Federal Standards

While federal law does not mandate PDMP queries before prescribing controlled substances, virtually every state does. Several states impose particularly stringent PDMP requirements relevant to TRT prescribing:

• New York: Requires a PDMP query before every prescription and every refill of a Schedule II, III, or IV substance. The query results must be documented in the patient record.
• Kentucky: Requires queries on initial prescriptions and at least every 90 days for ongoing controlled substance therapy.
• Tennessee: Requires PDMP queries for all controlled substance prescriptions, with a specific requirement that prescribers document their clinical decision-making when a patient has received controlled substances from multiple prescribers in the 12 months preceding the prescription.
• Virginia: Requires a PDMP query before issuing any controlled substance prescription and mandates that prescribers obtain and review a patient's prescription history from the PMP before issuing a new Schedule II–IV prescription.

States With EPCS Mandates for Controlled Substances

As of 2026, states with mandatory EPCS requirements for controlled substance prescriptions include New York, Minnesota, Virginia, Michigan, Tennessee, Texas (phased implementation since 2021), Florida (mandatory from 2023), Ohio, Connecticut, Maine, and Massachusetts. In these states, issuing a testosterone prescription by paper, phone, or fax is prohibited except in documented emergency or system-outage situations. TRT telehealth platforms must use DEA-compliant EPCS software (certified under 21 CFR Part 1311) in every state with an EPCS mandate. Every EPCS transaction must be captured in a tamper-evident log; see our article on hash-chained audit trails for specialty medicine for how to implement immutable prescribing records that satisfy DEA record retention requirements.

Practical Compliance Strategies for TRT Telehealth Clinics

Given the complexity and evolving nature of Ryan Haight Act compliance, TRT telehealth clinics need structured, operationally integrated compliance programs — not just awareness of the rules. The following strategies represent current best practices for TRT telehealth operators seeking to maintain Ryan Haight Act compliance while continuing to grow their patient base.

Strategy 1: Build the In-Person Pathway Into Your Patient Journey

The most legally secure approach for new patient onboarding is to require an in-person evaluation before any controlled substance prescription is issued. Leading TRT clinics have implemented this through:

• Affiliate clinic networks: Contracting with urgent care, primary care, or men's health clinic networks nationally to provide initial evaluation services. The patient visits the affiliate for an in-person blood draw and physical examination; the telehealth provider reviews results and conducts a video follow-up, then prescribes. This satisfies Ryan Haight via the base in-person evaluation requirement rather than relying on an exception.
• Mobile phlebotomy services: Using mobile phlebotomy (at-home blood draws) combined with an in-person examination requirement at a local clinic establishes a partial in-person touchpoint, though clinics should evaluate whether the examination component meets the "physical presence" standard.
• Referral partnership model: Positioning the TRT telehealth service as a management platform for patients who have received an initial evaluation from a referring primary care provider. The referring PCP conducts the in-person evaluation (Exception 2), and the telehealth provider manages ongoing TRT via telehealth thereafter.

Strategy 2: Implement Geographic Prescribing Rule Enforcement

Ryan Haight compliance is not just a one-time policy decision — it requires enforcement at the point of prescribing, and it intersects directly with state telehealth parity laws that determine which controlled substance services must be covered and how cross-state prescribing is regulated. Clinics need technology systems that automatically verify, at the time each prescription is issued:

• The patient's current physical location (which state governs this prescription)
• The prescriber's active DEA registration in that state
• The prescriber's active medical license in that state
• Whether a qualifying in-person evaluation is documented in the patient record
• Whether a PDMP query has been completed and documented for this state
• Whether EPCS is required in the patient's state and whether the prescription workflow is EPCS-compliant

Strategy 3: Segment Your Patient Population by Compliance Status

Many TRT telehealth clinics have heterogeneous patient populations with different compliance postures — some with in-person evaluations, some onboarded during the COVID PHE, and some onboarded under various exception claims. Clinics should segment their patient database by compliance basis and implement different management protocols for each segment:

• Patients with documented in-person evaluation: lowest risk, most flexibility for ongoing telehealth management
• COVID PHE-onboarded patients: medium risk, require monitoring of evolving DEA temporary rules and may need in-person catch-up evaluations
• Patients without documented in-person evaluation or applicable exception: highest risk, require immediate remediation before continued prescribing

Strategy 4: Monitor DEA Regulatory Activity Continuously

The Ryan Haight Act regulatory landscape is more fluid than at any point since the Act's enactment. Clinics must monitor the Federal Register and DEA guidance documents for:

• Any final SRTM rule publication
• Extensions or expiration of current temporary rules on controlled substance telehealth prescribing
• DEA guidance documents or policy statements clarifying the scope of applicable exceptions
• State-level changes to controlled substance prescribing rules, PDMP requirements, or EPCS mandates

Documentation Requirements

Ryan Haight Act compliance is only as strong as the documentation supporting it. DEA investigations of TRT telehealth clinics typically begin with a document review — and clinics that cannot produce clear documentation of the basis for each controlled substance prescription face presumptive findings of non-compliance. Comprehensive documentation requirements include:

Patient Record Documentation

• In-person evaluation record: Date, location, provider of record, clinical findings documented in the medical record, and explicit notation that this was a qualifying in-person medical evaluation under the Ryan Haight Act or applicable exception. For Exception 2 (referral), retain the referring practitioner's records and referral documentation.
• Lab results: Total testosterone, free testosterone, LH, FSH, CBC with differential, hematocrit, PSA (where applicable), and metabolic panel. Lab results must be current (within the prescriber's clinical judgment as to appropriate intervals, typically 3–6 months for monitoring).
• Clinical indication documentation: Explicit documentation of the diagnosis, symptom presentation, and clinical rationale for testosterone therapy.
• Informed consent: State-specific informed consent for TRT (including risks of polycythemia, suppression of spermatogenesis, and cardiovascular considerations) and separate informed consent for telehealth delivery where required by state law.
• Patient location verification: At each telehealth encounter, document the patient's physical location (state and city). This determines which state's rules govern the encounter and prescription. Many platforms auto-capture this via IP geolocation confirmation, but the record should explicitly state the patient-attested location.

Prescriber Credential Documentation

• Current DEA registration certificate for each state where prescriptions are issued, with expiration date tracking
• Current state medical license for each prescribing state, with expiration date tracking
• State-specific controlled substance registration where required (California, Illinois, New York, and others)
• EPCS two-factor authentication logs for each prescription issued in EPCS-mandatory states
• PDMP query records — date of query, state queried, results reviewed, and clinical decision documented

Retention Periods

• Federal minimum: 2 years from the date of the controlled substance transaction (21 CFR § 1304.04)
• Most state medical practice acts: 5–10 years from last patient encounter or from patient reaching majority age
• EPCS records: must be retained and producible upon DEA request per 21 CFR Part 1311
• Practical recommendation: retain all TRT patient records for a minimum of 7 years from last prescription issuance to accommodate the longer tail of state and federal limitation periods

Compliance Timeline: Key Dates

Enforcement Examples

The DEA's Diversion Control Division, state medical boards, and the Department of Justice have pursued several notable enforcement actions against telehealth-based controlled substance prescribing that illustrate the types of Ryan Haight Act violations that attract regulatory attention. While specific clinic names are not cited here given the ongoing nature of many proceedings, the patterns are well documented in DEA and DOJ press releases and administrative law decisions.

DEA Order to Show Cause Actions Against Telehealth Prescribers

The DEA has issued Orders to Show Cause (OSC) — the administrative mechanism for seeking to revoke a DEA registration — against multiple telehealth prescribers who prescribed controlled substances via telemedicine without a qualifying in-person evaluation and without a recognized Ryan Haight exception. Common factual patterns in these actions include:

• Prescribers who issued hundreds to thousands of controlled substance prescriptions via telehealth based solely on online questionnaires, without any video evaluation
• Prescribers who authorized prescriptions for patients in states where they held no active DEA registration or state medical license
• Prescribers who issued prescriptions for patients who were clearly seeking controlled substances for non-medical purposes, as evidenced by PDMP data showing multiple concurrent prescribers
• Prescribers who failed to conduct or document any clinical justification for controlled substance prescribing — no labs, no symptom documentation, no follow-up monitoring plan

DOJ Criminal Prosecutions

The Department of Justice has prosecuted several individuals operating telehealth-based controlled substance prescribing operations as criminal violations of the CSA and Ryan Haight Act. The highest-profile recent cases involved online prescribers of stimulants (Adderall, Ritalin) and sedatives (benzodiazepines), but the legal theory applies equally to anabolic steroids. Convictions in these cases have resulted in sentences ranging from probation with license revocation to multi-year federal prison terms, depending on the volume of prescriptions, evidence of knowing CSA violations, and diversion outcomes.

State Medical Board Actions Against TRT Clinics

Multiple state medical boards — particularly in Florida, Texas, California, and New York — have initiated disciplinary proceedings against physicians affiliated with TRT telehealth clinics based on allegations including:

• Prescribing testosterone to patients the prescriber had never personally evaluated
• Inadequate clinical documentation of the basis for TRT prescribing (missing labs, no symptom assessment, no monitoring plan)
• Prescribing without querying the state PDMP
• Operating outside the applicable standard of care by prescribing TRT based solely on a patient-completed questionnaire
• Failure to conduct appropriate follow-up monitoring (hematocrit, PSA, cardiovascular risk assessment) for patients on ongoing testosterone therapy