If your telehealth program prescribes any controlled substances (stimulants for ADHD, benzodiazepines for anxiety, buprenorphine for opioid use disorder, or certain weight management medications), the Ryan Haight Act is one of the most important laws governing your business. And the temporary flexibilities that have allowed telehealth prescribing of controlled substances without an in-person exam are set to expire on December 31, 2026.
This isn't a future problem. It's a present planning challenge. Telehealth operators who prescribe controlled substances need to understand what the Ryan Haight Act requires, what the current exemptions allow, and how to build operations that work regardless of what the DEA decides about permanent rules.
What Is the Ryan Haight Act?
The Ryan Haight Online Pharmacy Consumer Protection Act, enacted in 2008, requires that prescribers conduct at least one in-person medical evaluation before prescribing controlled substances (Schedule II through V) via the internet. The law was designed to prevent rogue online pharmacies from distributing controlled substances without legitimate medical oversight.
In practical terms, this means a telehealth provider cannot prescribe Adderall, Xanax, Ambien, or other controlled substances to a patient they've never met in person. At least, that's what the law requires when no exemptions are active.
The COVID-Era Telehealth Flexibilities
During the COVID-19 public health emergency, the DEA waived the in-person examination requirement for controlled substance prescribing via telehealth. This waiver enabled the explosive growth of telehealth programs for ADHD, mental health, weight management, and pain management, all of which frequently involve controlled substances.
These flexibilities have been extended multiple times and currently remain in effect through December 31, 2026. The DEA has signaled that permanent telehealth prescribing rules will be published before the flexibilities expire, but as of early 2026, permanent rules have not been finalized.
What the Current Flexibilities Allow
- Audio-video telehealth prescribing: Schedule II-V controlled substances can be prescribed via real-time video telehealth without a prior in-person evaluation
- Audio-only for opioid use disorder: Buprenorphine and other OUD medications can be prescribed via audio-only (phone) visits
- No geographic restrictions: The provider must be licensed in the patient's state, but neither party needs to be at a registered DEA location
- Electronic prescribing: E-prescribing of controlled substances via EPCS-compliant systems is permitted and increasingly required
What Happens When the Flexibilities Expire?
If the flexibilities expire without permanent replacement rules, the Ryan Haight Act's original requirements snap back into effect. This would mean:
- A patient must have at least one in-person examination before receiving a controlled substance prescription via telehealth
- This applies to all new patients. Existing patients who already had a valid in-person exam may be grandfathered, depending on how the DEA interprets the transition
- Audio-only prescribing of controlled substances would be prohibited in most cases
- Programs that built their entire model on telehealth-only controlled substance prescribing would need to establish in-person touchpoints
The Most Likely Outcome
Most industry observers expect the DEA to publish permanent rules that are less restrictive than the original Ryan Haight Act but more restrictive than the current full waiver. Likely requirements for permanent rules:
- Video-based telehealth (not audio-only) as a baseline for initial controlled substance prescribing
- Possible in-person follow-up requirement after a set period (e.g., 12 months) for ongoing prescriptions
- Enhanced PDMP (prescription drug monitoring) checking requirements
- Specific provider-to-patient ratios and documentation standards
Which Telehealth Programs Are Affected?
Only programs that prescribe controlled substances. Common telehealth verticals and their exposure:
- GLP-1 / Weight Loss: Semaglutide and tirzepatide are NOT controlled substances. Most GLP-1 programs are not affected by the Ryan Haight Act. However, some weight loss programs prescribe phentermine (Schedule IV), which is affected.
- ADHD: Highly affected. Stimulant medications (Adderall, Ritalin, Vyvanse) are Schedule II. This vertical is most at risk from flexibility expiration.
- Mental Health: Partially affected. SSRIs and most antidepressants are not controlled. Benzodiazepines (Xanax, Klonopin) and sleep medications (Ambien) are Schedule IV.
- TRT / HRT: Testosterone is Schedule III. Programs prescribing testosterone via telehealth are affected.
- Opioid Use Disorder: Buprenorphine is Schedule III. Audio-only prescribing flexibilities are specifically at risk.
How to Prepare Your Operations
- Audit your formulary: Identify which of your prescribed medications are controlled substances and would be affected by flexibility expiration.
- Build in-person capability: Even if you don't use it now, having partnerships with in-person clinics (or mobile phlebotomy/exam services) lets you pivot quickly if required.
- Ensure video-only compliance: If permanent rules require video (not audio-only), make sure your platform supports HIPAA-compliant video visits that meet DEA standards.
- Strengthen documentation: The permanent rules will likely require more rigorous documentation of the provider-patient relationship. Build documentation workflows now.
- Monitor DEA rulemaking: Follow the Federal Register for proposed and final rules. Comment periods are opportunities to shape the outcome.
- Diversify beyond controlled substances: If controlled substances are a single-digit percentage of your prescriptions, the risk is manageable. If they're your entire model, diversification reduces regulatory concentration risk.
Build telehealth infrastructure that adapts
Thimble Hub's modular architecture lets you adjust intake flows, provider workflows, and treatment offerings as regulations evolve, without rebuilding from scratch.
Explore the platform →The Bottom Line
The Ryan Haight Act is a known risk with a known timeline. The DEA telehealth flexibilities expire December 31, 2026, and permanent rules are expected before then. The operators who prepare now, by auditing their formulary, building in-person capability, ensuring video compliance, and diversifying their service offerings, will navigate the transition smoothly regardless of what the permanent rules look like.
The worst strategy is assuming the flexibilities will be extended indefinitely. Build for resilience, not optimism.
Frequently Asked Questions
- Does the Ryan Haight Act affect GLP-1 telehealth programs?
- Generally no. Semaglutide (Ozempic/Wegovy) and tirzepatide (Mounjaro/Zepbound) are not controlled substances and are not subject to the Ryan Haight Act. However, if your weight loss program also prescribes phentermine (Schedule IV) or other controlled substances, those prescriptions are affected.
- What happens to existing patients if flexibilities expire?
- The DEA's transition guidance will determine this. Existing patients with established provider relationships and a history of in-person or video visits may be treated differently than new patients. Build documentation of your provider-patient relationships now to support continuity claims during any transition.
- Will permanent DEA telehealth rules be published before the flexibilities expire?
- The DEA has signaled intent to publish permanent rules before December 31, 2026. However, federal rulemaking processes are complex and delays are common. The safest approach is to prepare for both scenarios: permanent rules that allow continued telehealth prescribing under specific conditions, and a scenario where the original Ryan Haight requirements snap back temporarily.