Telehealth Prescribing Rules After the Public Health Emergency

The federal government has kept telehealth prescribing rules for controlled substances in a holding pattern since 2020, and the pattern just got extended again. As of January 1, 2026, DEA and HHS pushed the deadline for pandemic-era flexibilities to December 31, 2026, marking the fourth such extension since the COVID public health emergency ended. Two permanent rules also kicked in on December 31, 2025, so providers now juggle three separate authorities at once, each with its own conditions. None of this happens in a vacuum: the underlying law still on the books, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, requires at least one in-person medical evaluation before a practitioner can prescribe a controlled substance remotely, full stop, regardless of the drug's schedule or how well the prescriber knows the patient. Everything since 2020 is a modification of that baseline, not a replacement for it. Practitioners aren't working in a rules-free zone; they're working inside a managed exception to a law that never went away.

The creation and repeated extension of COVID flexibilities

The story starts in March 2020, when DEA waived the in-person evaluation requirement under authority tied to the HHS Secretary's January 31, 2020 public health emergency declaration. That waiver let any DEA-registered practitioner prescribe Schedule II through V controlled substances over audio-video telemedicine, no prior face-to-face visit needed. It was meant to be temporary, tied to an emergency with a defined end.

Then the emergency ended, and DEA didn't revert to Ryan Haight's defaults. Instead, it issued a string of temporary rules that kept extending the runway. The first, in May 2023, ran the flexibilities through November 2023 and tacked on a one-year grace period for telemedicine relationships already underway. The second, in October 2023, further expanded the grace period and pushed things to December 2024. The third, in November 2024, carried flexibilities through the end of 2025. The fourth, effective January 1, 2026, extends the same terms through December 31, 2026, Holland & Knight reported.

Each time, the justification is the same: DEA says it needs more time to finish permanent rules, and yanking flexibilities away suddenly would hurt patients who now depend on virtual care for medication access. Fair enough, on its face. But six years is a long time to call something an emergency measure. At some point, the exception starts functioning as the actual policy, even if no one overseeing it wants to say that out loud. The fourth extension doesn't add new documentation requirements or registration steps either; it's a straight continuation of what came before, not a refinement of it.

What the fourth extension permits through December 31, 2026

DEA and HHS issued the fourth temporary rule jointly on December 30, 2025. It published in the Federal Register the next day and took effect January 1, 2026. Under its terms, practitioners can prescribe Schedule II through V controlled substances via audio-video telemedicine without any prior in-person evaluation. Separately, Schedule III through V narcotic medications, buprenorphine included, can be prescribed via audio-only telemedicine for treating opioid use disorder. Both provisions apply across the board, regardless of whether the practitioner-patient relationship started last week or five years ago.

What doesn't change matters just as much. Prescriptions still need a legitimate medical purpose behind them. Prescribers still have to be licensed and operating within both federal and state law. And any state rule that's more restrictive than the federal standard still controls, extension or no extension.

DEA pushed this rule through under a "good cause" exemption, skipping the standard public comment process on the grounds that any delay would run contrary to the public interest. That's a telling detail: the agency treated the deadline as too urgent to wait on comments, even though the deadline itself was one DEA had known about for over a year. DEA calls the extension a bridge to permanent regulation, not a verdict on what the right long-term rule should look like. HHS.gov reported that more than 7 million prescriptions for controlled medications were issued via telemedicine in 2024 alone, without a prior in-person visit. More than 7 million prescriptions for controlled medications were issued via telemedicine in 2024 alone, without a prior in-person visit, HHS.gov reported in January 2026. That's not a niche accommodation. That's a substantial share of how controlled substance care now reaches patients.

The two permanent rules that took effect on December 31, 2025, and how they fit alongside the temporary extension

As of January 2026, three separate authorities govern telehealth prescribing of controlled substances at the same time, DEA.gov reported, and each one carries its own set of conditions.

The first permanent rule, covering buprenorphine and published at 90 FR 6504 under the title "Expansion of Buprenorphine Treatment via Telemedicine Encounter," lets clinicians start patients on buprenorphine, a Schedule III medication used for opioid use disorder, entirely through telemedicine, audio-only included. The initial supply can run up to six months. The clinician has to check the patient's state prescription drug monitoring program and document that check. This rule took two delays to reach its effective date, first pushed from February 18, 2025 to March 21, 2025, then again to December 31, 2025, where it finally landed as permanent, ForaSoft reported.

The second permanent rule addresses continuity of care inside the Veterans Health Administration. It allows certain VHA practitioners to prescribe controlled substances via telemedicine to veterans who already had an in-person evaluation from a different VHA clinician, a provision that addresses access for rural and underserved veterans. It followed the same two-stage delay as the buprenorphine rule and became permanent on the same date, December 31, 2025, Holland & Knight reported.

Here's where it gets layered: practitioners covered by either permanent rule can still lean on the fourth temporary rule instead, since it asks for less. The temporary rule asks for less than either permanent rule does, with fewer documentation and eligibility conditions attached. During this bridge period, the temporary rule is functionally the widest-open pathway available. Three authorities now sit on the books, each with a different compliance profile, and a provider's first job is figuring out which one applies to a given patient and what that authority actually demands.

The "telemedicine cliff" is not hypothetical, and what lapsed access looks like in practice

The phrase "telemedicine cliff" describes what happens if flexibilities lapse and prescribing snaps back to Ryan Haight's in-person default overnight. It's not an abstraction. It already happened, briefly, with Medicare telehealth rules.

During the federal government shutdown that began October 1, 2025, Medicare telehealth flexibilities lapsed. Telehealth.org reported that fee-for-service telemedicine visits dropped 24% in the first 17 days after the lapse. The same Telehealth.org coverage found that some states fared worse: Florida, Louisiana, and New York each saw drops of 40% or more. That's not a rounding error. That's a substantial share of patients losing access to care within a couple of weeks.

The fourth DEA/HHS extension itself came within hours of expiring on December 31, 2025. Alexis Apple, deputy executive director of the American Telemedicine Association's ATA Action arm and vice president of federal affairs at ATA, told Behavioral Health Business the timing "created avoidable uncertainty" and put "patients, providers, and health systems on the brink of unnecessary disruption." That phrase, avoidable, captures the situation. This wasn't some unforeseeable crisis. It was a known deadline that the agencies let run down to the wire anyway.

Seniors, rural residents, people with disabilities, and patients in behavioral health or substance use disorder treatment carry the most exposure if a cliff like this hits again. And it's structural, not a one-off risk tied to 2025 specifically. December 31, 2026 will arrive with the same expiration built in, unless permanent rules land first or DEA issues a fifth extension.

The proposed Special Registration framework, and why it remains unfinalized

DEA released a Notice of Proposed Rulemaking for a Special Registration framework on January 15 to 17, 2025, in the final days of the Biden administration. The proposal set up three tiers. Tier 1 covers Schedule III through V telemedicine prescribing registration. Tier 2 covers Schedule II prescribing, limited to a narrow list of specialists. Tier 3 is a platform-level registration aimed at telemedicine companies themselves, not individual prescribers.

Layered on top of all three tiers: a separate State Telemedicine Registration for every state where a prescriber's patients live, identity verification steps, PDMP checks, data-reporting duties to DEA, volume caps on Schedule II prescribing, and a set of practice, documentation, and credentialing standards.

The proposal drew 35,454 public comments, a volume that contributed to delays in DEA's target of finalizing permanent rules. The nationwide PDMP check requirement is the biggest sticking point. Foley & Lardner noted that there's no actual nationwide PDMP database for anyone to check against, which makes the requirement, as written, impossible to satisfy cleanly. Add to that the uncertainty flagged by Bradley in May 2025 around DEA's discretion to grant or deny a Special Registration and what threshold counts as a "legitimate need," and the framework starts to look less like a near-final draft and more like an unresolved sketch.

As of this writing, As of this writing, the Trump administration has not moved to finalize the Special Registration approach. Providers are left without a permanent framework to plan around. The temporary rule and the two final rules from December 2025 are what's operative, nothing more.

Medicare telehealth flexibilities followed a separate but parallel track, and reached a longer extension

DEA's prescribing rules and Medicare's telehealth coverage rules run on different tracks entirely; one comes from DEA rulemaking, the other from a separate legislative act. They intersect in practice, but they don't move together.

The October 1 to November 12, 2025 government shutdown caused the Medicare telehealth lapse discussed above. H.R. 5371, signed November 12, 2025, ended the shutdown and restored Medicare telehealth flexibilities retroactively, as though the lapse hadn't happened, through January 30, 2026. Then a subsequent appropriations bill, signed February 3, 2026, extended the core Medicare telehealth provisions through December 31, 2027, a considerably longer runway than DEA's prescribing extension gets.... 7148), signed February 3, 2026, extended the core Medicare telehealth provisions through December 31, 2027, a considerably longer runway than DEA's prescribing extension gets.

That 2027 extension covers a fair amount of ground: expanded coverage for virtual visits, audio-only services, no geographic or originating-site restrictions, wider provider participation, continued use of federally qualified health centers and rural health clinics as distant-site providers, delayed in-person requirements for behavioral health visits, and permission to use telehealth for hospice recertification. The same Act also extends the Acute Hospital Care at Home waiver program, separately, through September 30, 2030.

A rule under CMS-1832-F, dated October 31, 2025, would have cut physical therapists, occupational therapists, speech-language pathologists, and audiologists off from furnishing Medicare telehealth services starting January 31, 2026, per reporting from a physical therapy professional association in November 2025. The Consolidated Appropriations Act, 2026 reversed that cutoff and extended eligibility for those provider types through December 31, 2027 as well.

The expiration dates don't match: DEA's flexibilities run out December 31, 2026; Medicare's run out a year later, December 31, 2027. DEA's flexibilities run out December 31, 2026; Medicare's run out a year later, December 31, 2027. Providers aren't facing one cliff to plan around. They're facing two, staggered a year apart, each requiring its own attention.

State law adds a third compliance layer that federal extensions do not resolve

Federal extensions get most of the attention, but they only settle part of the question. Most states default to federal controlled substance prescribing rules, so when federal flexibilities are in place, state law tends to follow along without friction. The trouble starts where state law goes further than federal law does.

States differ on whether audio-only contact is enough to establish a patient relationship in the first place, on what counts as a qualifying prior examination, on what has to appear in telehealth consent paperwork, and on registration requirements that sit apart from DEA registration entirely. None of that gets preempted by a federal extension. A provider licensed in several states can be fully compliant with the DEA's fourth temporary rule and still be out of compliance in a specific state whose rules are tighter.

Epstein Becker Green noted that providers continue to face confusion over compliance obligations, platform requirements, and the state-by-state differences layered on top of federal rules. And if DEA's Special Registration framework ever does get finalized, it adds a State Telemedicine Registration requirement for every state where a prescriber has patients, which compounds the state-level complexity rather than resolving it. The practical rule for anyone prescribing across state lines: the federal extension sets the ceiling, but a state can always set a lower floor, and compliance means checking both, not just the one that's easier to find.

Enforcement is intensifying at the same time that rules remain unsettled

The clearest signal of where enforcement is headed comes from the Done Global case. Done Global ran a virtual platform prescribing stimulants for ADHD, and DOJ's prosecution of the company marks its first criminal case against a telehealth company for illegal controlled substance distribution. The numbers involved include more than 40 million stimulant pills and roughly $100 million in revenue, Holland & Knight reported. A federal jury convicted founder and CEO Ruthia He and former Clinical President David Brody in November 2025. Sentencing followed on July 7, 2026: six years in prison and a $1 million fine for He, two years and a $1 million fine for Brody, Reporting from Holland & Knight noted.

That case draws a fairly specific line. DOJ isn't targeting telehealth broadly; it's targeting business models where prescribing volume and aggressive patient acquisition tactics function as the engine driving controlled substance distribution. Platforms built around scale and speed, rather than individualized clinical judgment, are the ones drawing federal attention.

Structurally, enforcement has been building capacity to match. Federal enforcement efforts targeting telehealth fraud, aimed at tighter coordination and faster case development between the two agencies. More coordinated investigation is now running in parallel with a prescribing framework that still hasn't found its permanent shape, and that combination produces the headline numbers. Providers are operating under rules that keep getting extended a year at a time, while the agencies charged with enforcing those rules build out sharper tools to police them. That combination, unsettled policy paired with sharpening enforcement, is the real story here. It's not a comfortable place for a compliance program to sit, and there's no fixed date yet when it stops.