An abbreviated version of this article is available on Law360 (subscription required).
On February 24, 2023, the Drug Enforcement Agency announced proposed rules for prescribing controlled substances via telemedicine after the COVID-19 Public Health Emergency expires. The proposed rules are open for public comment for only thirty days, after which DEA will issue final regulations.
The proposed rules are intended to bridge between the DEA’s current PHE waivers and a post-PHE environment. In so doing, DEA proposed creating two new limited options for telemedicine prescribing of controlled substances without a prior in-person exam. The options both complex and more restrictive than what has been allowed for the past three years under the PHE waivers. The DEA’s proposal will discontinue the ability for telemedicine prescribing of controlled substances where the patient never has any in-person exam (with the exception of an initial prescription period of no more than 30 days’ supply). Moreover, if the patient requires a Schedule II medication or a Schedule III-V narcotic medication (with the sole exception of buprenorphine for opioid use disorder (OUD) treatment), an initial in-person exam is required before any prescription can be issued.
Unquestionably, the DEA’s proposal is not what most industry stakeholders were anticipating. The initial reaction is the rules are more restrictive than necessary and impose concerning limitations and burdens on clinicians and the patients they treat.
Buprenorphine. Even more alarming are risks the proposed rules could harm patients seeking or already receiving buprenorphine for treatment of OUD. DEA’s companion proposed rule on buprenorphine can be found here. For the last year, there have been repeated assurances by HHS, DEA, SAMHSA, ONDCP, and the White House that these buprenorphine patients will not fall off the Telehealth Cliff. Yet, the DEA’s rule will require these patients to have in-person exams and block them from fully-virtual telemedicine care. This includes those patients who are currently taking buprenorphine for medication assisted treatment (MAT) and who have not had a prior in-person exam. (Keep in mind: buprenorphine is a partial opioid agonist, unlike methadone or morphine, and reported as less likely to be abused or diverted.) Unless the proposed rule is changed, stakeholders are left to ask: Will DEA’s decision to end telemedicine-only buprenorphine help, or will it harm patients struggling with opioid use disorder and trigger more overdoses and diversion?
Special Registration for Telemedicine. In another disappointing turn, the proposed rules fail to include the long-awaited telemedicine special registration regulation, designed to allow certain clinicians the ability to prescribe controlled substances via telemedicine without conducting an in-person exam of the patient.
This guide: 1) summarizes the key elements and requirements contained in the proposed rule; 2) explains how it differs from the special telemedicine registration rule; and 3) describes what stakeholders can do to make their voice heard, including by submitting comments to the proposed rule, during these next 30 days.
The statutory basis for the proposed rule is the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Ryan Haight Act), which prohibits the distributing, dispensing or delivery of controlled substances via the Internet without a valid prescription. It applies only in limited circumstances where the practitioner wishes to prescribe a controlled substance via telemedicine and has never conducted an in-person medical exam of the patient.
The Ryan Haight Act requires a practitioner to conduct at least one in-person medical evaluation of the patient before prescribing a controlled substance by means of the “Internet” (a broadly-defined term that includes telemedicine). Once the practitioner has conducted this in-person medical evaluation, the Ryan Haight Act does not set an expiration period or a minimum requirement for subsequent annual exams. Failure to conduct this in-person medical evaluation can constitute a per se violation of the Controlled Substances Act and result in civil and criminal penalties.
The Ryan Haight Act was designed to combat the proliferation of so-called “rogue Internet sites” that unlawfully dispensed controlled substances by means of the Internet, including online pharmacies offering controlled substances without a valid doctor-patient relationship. Yet the broad language of the Ryan Haight Act applies not only to pharmacies, but also to legitimate practitioners who prescribe controlled substances via telemedicine.
In the years since it was enacted, the DEA has used the Ryan Haight Act to regulate the marketplace, sanctioning practitioners and pharmacies whose unethical and substandard prescribing practices violated the law.
Yes. The Ryan Haight Act contains seven “practice of telemedicine” exceptions to the in-person medical evaluation requirement. These are seven distinct categories Congress determined were appropriate to allow for telemedicine prescribing of controlled substances despite the practitioner never having examined the patient in person. Some of the exceptions are suited to institutional/hospital arrangements, but most have limited to no use in contemporary telemedicine services, particularly direct-to-patient care when the patient is located at home.
The seven exceptions are: 1) treatment in a hospital or clinic; 2) treatment in the physical presence of a DEA-registered practitioner; 3) treatment by Indian Health Service or Tribal practitioners; 4) treatment during a public health emergency as declared by the Secretary of Health and Human Services; 5) treatment by a practitioner who has obtained a “special registration”; 6) treatment by Department of Veterans Affairs practitioners during a medical emergency; and 7) other circumstances specified by regulation. See 21 C.F.R. § 1300.04(i)(1)-(7).
The proposed rule creates a new option under exception #7, a flexible catch-all exception (“The practice of telemedicine is being conducted under any other circumstances that the [DEA] Administrator and the Secretary of Health and Human Services have jointly, by regulation, determined to be consistent with effective controls against diversion and otherwise consistent with the public health and safety.”). The requirements in the proposed rule apply to “telemedicine prescriptions” under 21 C.F.R. § 1306.31 conducted pursuant to 21 U.S.C. § 802(54)(G).
According to the DEA’s statements, the proposed rule is designed to ensure that patients do not experience lapses in care, and to ensure continuity of care under the current telehealth flexibilities in place as a result of the COVID-PHE.
The two new options introduced in the proposed rule are:
Compared to the original Ryan Haight Act, these new options are expanded flexibilities intended to allow more telemedicine-based care, but are more restrictive than what has been allowed for the past three years under the PHE waivers. DEA’s proposal will discontinue the ability for telemedicine prescribing of controlled substances where the patient never has any in-person exam (with the exception of an initial prescription period of no more than 30 days’ supply). Moreover, if the patient requires a Schedule II medication or a Schedule III-V narcotic medication (with the sole exception of buprenorphine for OUD treatment), an initial in-person exam is required before a prescription can be issued.
No. The requirements in the proposed rule affect what DEA refers as “a narrow subset of telemedicine consultations.” Specifically, practitioners who issue “telemedicine prescriptions” under Section 802(54)(G) – the newly-created option under the proposed rule. DEA stated “[t]his rulemaking would not impose any new requirements on practitioners authorized to practice telemedicine under other statutory exceptions in 21 U.S.C. § 802(54) […].” According to the DEA’s commentary, press release documents, and highlight summary, the limitations and requirements in the proposed rule do not apply if:
Telemedicine prescription means “a prescription issued pursuant to § 1306.31 by a physician, or a “mid-level practitioner” as defined in 21 § CFR 1300.01(b), engaging in the practice of telemedicine as defined in 21 C.F.R. § 1300.04(j).” It is a specifically-defined term of art in the proposed rule.
In plain English, the term “telemedicine prescription” refers only to a prescription issued under the new options (virtual first and qualified telemedicine referral) created under the proposed 21 C.F.R. § 1306.31 as authorized by 21 U.S.C. § 802(54)(G). The term does not apply to prescriptions issued under any of the other six “practice of telemedicine” exceptions under the Ryan Haight Act (21 U.S.C. § 802(54)(A)-(F)). Nor does it apply to prescriptions where the practitioner conducts an initial in-person exam and then subsequently prescribes via telemedicine or other modalities. “Telemedicine prescription” does not mean any and all controlled substance prescriptions issued from a telemedicine exam.
This is important to consider because words matter. The term “telemedicine prescription” appears broad to the casual reader, while the actual definition of the term is quite narrow and specific to only the two newly-proposed options. As a result, this terminology will very likely cause widespread confusion among practitioners, pharmacies, health plans, patients, and the industry because many will mistakenly apply the term to any and all prescriptions issued via telemedicine. This could trigger significant administrative burden, unnecessary complexity, and ultimately frustration. The foreseeable result will be fear and reluctance among practitioners to engage in telemedicine post-PHE, leaving patients without access to important, necessary medicines from legitimate practitioners. This includes practitioners who will mistakenly assume that conducting a video visit always means a “telemedicine encounter” or results in a “telemedicine prescription.” If nothing else, DEA might consider swapping “telemedicine prescription” for a different turn of phrase to better reflect how this is specific only to the newly-proposed options under 21 U.S.C. § 802(54)(G) and does not apply to the majority of controlled substance prescriptions issued via telemedicine.
The Controlled Substances Act does not have a feature allowing patients to be “grandfathered” from the in-person exam requirement at the conclusion of a PHE. The current DEA waiver of the in-person exam requirement falls under exception #4 of the Ryan Haight Act, i.e., the PHE. It will expire when the COVID-19 PHE ends May 11, 2023.
To address this, the proposed rule creates a new term, “telemedicine relationship established during the COVID-19 public health emergency.” Such a relationship exists if: 1) between March 16, 2020 and May 11, 2023 (i.e., the PHE period); 2) the practitioner prescribed a controlled substance based on a telemedicine encounter; and 3) the practitioner never conducted an in-person exam of the patient.
In that situation, the DEA will extend the in-person exam waiver an additional 180 days, making the new deadline early November 2023 (or later if the final rule publishes after May 11). For any prescribing after that date, that practitioner must either conduct an in-person exam, meet a different telemedicine exception under the Ryan Haight Act, or stop prescribing for the patient.
Note: this feature does not allow practitioners to use PHE waivers for new patients after May 11, 2023. Namely, if a practitioner has a telemedicine consult with a new patient on May 12, 2023, neither the old PHE waivers nor this extension will apply. That’s because this new doctor-patient relationship would not constitute a telemedicine relationship established during the COVID-19 public health emergency.
Yes. According to the DEA’s proposed rule, this allowance “applies to all schedule II-V controlled substances in all areas of the United States.”
Under this proposed process, a practitioner can use telemedicine to issue an initial “telemedicine prescription” for a controlled substance without first conducting an in-person exam of the patient. This process works even if the practitioner cannot meet any other exception under the Ryan Haight Act or if they did not receive a qualifying telemedicine referral. The intended use case is for telemedicine-only consults with new patients.
The process works like this:
If one of the above options is met, the telemedicine practitioner can continue prescribing a controlled substance to the patient without additional in-person exams, so long as doing so was consistent with legitimate medical purposes and a subsequent evaluation is not required by law. If not, the practitioner cannot issue any more telemedicine prescriptions for that patient until one option is met.
As stated in the proposed rule, the DEA “believes that allowing for the prescription of any schedule II substances or the general prescription of narcotic controlled substances as a result of telemedicine encounters would pose too great a risk to the public health and safety.” However, if the prescribing telemedicine practitioner receives a qualifying telemedicine referral for the patient, a prescription may be issued for any controlled substance the practitioner is otherwise authorized to prescribe under applicable laws and regulations, including Schedule II and narcotic controlled substances.
A qualifying telemedicine referral means “a referral to a practitioner that is predicated on a medical relationship that exists between a referring practitioner and a patient where the referring practitioner has conducted at least one medical evaluation in the physical presence of the patient, without regard to whether portions of the evaluation are conducted by other practitioners, and has made the referral for a legitimate medical purpose in the ordinary course of their professional practice. A qualifying telemedicine referral must note the name and National Provider Identifier (NPI) of the practitioner to whom the patient is being referred.”
In plain English, a qualifying telemedicine referral process would work as follows:
There is no requirement for the patient to undergo a subsequent in-person exam by either the first or second practitioner, nor must the patient obtain subsequent referrals in order for the telemedicine practitioner to prescribe again in the future. Of course, if an in-person exam is required by state law, other applicable federal law, or standards of clinical practice, such in-person exam must be conducted.
If, for some reason, multiple DEA-registered practitioners were physically present during the patient’s in-person exam, each of those practitioners would have the ability to issue a qualifying telemedicine referral. Referrals predicated exclusively on a telemedicine exam do not constitute a qualifying telemedicine referral.
The qualifying referral process requires special documentation and timing. The written referral must be based on the diagnosis, evaluation, or treatment that occurred as a result of the in-person medical evaluation. Along with the written referral form, the referring practitioner must communicate the results of the in-person evaluation by sharing the relevant information in the patient’s medical record which includes, at a minimum, the diagnosis, evaluation, and treatment of the patient. All of this must occur and be received by the second practitioner before a prescription is issued by the second practitioner.
The written referral form must also include: 1) the name and NPI of the referring practitioner (i.e. the one who conducted the in-person exam) and 2) the name and NPI of the telemedicine practitioner (i.e., to whom the patient is being referred). This means the referring practitioner cannot simply refer a patient to a business entity, medical group, facility, or specialist practice, but instead must name a specific practitioner on the referral form.
Both the referring practitioner and the receiving practitioner must maintain copies of all qualifying telemedicine referrals they issue or receive.
Yes. According to the DEA, if the qualifying telemedicine referral requirements are met, the prescription issued may be for any controlled medication the telemedicine practitioner is otherwise authorized to prescribe under applicable laws and regulations.
The referring practitioner must be DEA-registered practitioner acting in the usual course of professional practice.
Yes, there are many specific recordkeeping requirements, some of which will be burdensome on practitioners and patients, particularly as the proposed referral documentation is more onerous and complicated than how practitioners currently make referrals for patients. Practitioners must keep detailed records of the “telemedicine prescriptions” they issue and all “qualifying telemedicine referrals” they send or receive.
For each “telemedicine prescription,” the prescribing practitioner must maintain a written or electronic record indicating:
The following additional records must be maintained when using the 3-party exam option under the virtual first “telemedicine prescription” process:
According to DEA’s commentary in the proposed rule, these new recordkeeping requirements only apply “telemedicine prescriptions” via Ryan Haight Act exception #7 (21 USC 802(54)(G)). Practitioners who rely on any of the other six “practice of telemedicine” exceptions under the Ryan Haight Act (21 U.S.C. 802(54)(A)-(F)), are not subject to these additional recordkeeping requirements because those prescriptions do not fall within the definition of “telemedicine prescription.” The same goes for a practitioner who conducts an in-person exam of the patient and later uses telemedicine technologies for subsequent prescribing. (Under the standard federal rule at 21 CFR 1304(c), a DEA-registered individual practitioner is not required to keep records of controlled substances in Schedules II, III, IV, and V that are prescribed in the lawful course of professional practice, unless such substances are prescribed in the course of maintenance or detoxification treatment of an individual.)
The records must be maintained at the practitioner’s registered location. This would be the place listed on the certificate of registration issued pursuant to section 303(f) of the Act (21 U.S.C. § 823(g)) (i.e., the practitioner’s 21 C.F.R. § 1301.13(e)(1)(iv) registration). The records must be in digital or paper form that is readily accessible.
If the practitioner holds more than one registration location, the practitioner must designate one location and maintain all such records at that location. The DEA’s proposed rule recognizes how “a practitioner using telemedicine may operate out of multiple locations” and DEA investigators therefore want the ability to easily obtain all records from a single or centralized location.
If the practitioner is exempt from registration, the practitioner must maintain these telemedicine records at the location where they maintain other records related to controlled substances.
These special recordkeeping rules, DEA contends, would “serve to reinforce the obligation of practitioners who practice telemedicine to prescribe within the limited circumstances set forth in the proposed rule.” Ensuring ready access to these records in a consolidated manner in a central location during investigations facilitates DEA’s ability to detect patterns of potential illegitimate prescribing and thus enhance its ability to prevent further diversion of controlled medications.
Yes. All “telemedicine prescriptions” issued pursuant to a telemedicine encounter must include a notation on the face of the prescription, or within the prescription order if prescribed electronically, that the prescription has been issued via a telemedicine encounter. This will be a flag to all pharmacies that the prescription was from a telemedicine consult. It could result in pharmacies electing not to fill otherwise valid prescriptions, simply because the consult was conducted via telemedicine. Indeed, news reports reveal these denials are already occurring. This probability is particularly troubling due to the likelihood practitioners will misinterpret the term “telemedicine prescription” and assume it applies to all prescriptions issued via telemedicine. The DEA’s proposed use of the term “telemedicine prescription” could become a stigma.
In short, an interactive audio-video telecommunications system. The proposed rule revises the modality definition to mirror the Medicare definition under 42 C.F.R. § 410.78(a)(3). This is not a substantive change to Ryan Haight Act requirements, with the exception of treatments for a mental health disorder (discussed further below).
Yes, it is possible but the use case is limited and situational. Under most circumstances, a telemedicine practitioner must use interactive audio-video. But because the proposed rule now incorporates by reference the Medicare definition of telehealth modality, it also incorporates the recent Medicare changes for audio-only telemental health services while the patient is located at home.
In the proposed rule, DEA set forth four requirements before audio-only equipment is allowed:
If the telemedicine practitioner meets all the various requirements under the Medicare regulation (42 C.F.R. § 410.78(a)(3)) to use audio-only equipment for telemental health, that practitioner may conduct a telemedicine encounter and prescribe a controlled substance to the patient without using interactive audio-video. These requirements should be documented in the patient’s record. Of course, the practitioner must meet all the other requirements of the rule as well as relevant state and federal laws.
No. The Ryan Haight Act preempts state law on telemedicine prescribing of controlled substances, but only to the extent the federal provisions are more restrictive/stringent than the state law. If the federal Ryan Haight Act is more restrictive than the state law, the more restrictive federal provisions apply. If the state law is more restrictive than the federal Ryan Haight Act, the more restrictive state law provisions apply. Therefore, the prescribing practitioner must comply with both state and federal laws, and can do so by following the most restrictive provisions under each.
As a general matter, the federal Ryan Haight Act in-person exam requirement is more stringent than most state laws or state telemedicine requirements. In some states, an in-person examination is not a prerequisite to prescribe controlled substances. Instead, the state law permits a practitioner to treat a patient through telemedicine, provided the practitioner creates a valid doctor-patient relationship, conducts a sufficient examination of the patient via telemedicine, and meets other state requirements.
No. Under the proposed rule, a practitioner who wishes to issue a “telemedicine prescription” must be located in a State, Territory, or possession of the United States; the District of Columbia; or the Commonwealth of Puerto Rico at the time or the telemedicine encounter. Note: this geographic restriction applies to the new options for “telemedicine prescriptions” under 21 C.F.R. § 1306.31 conducted pursuant to 21 U.S.C. § 802(54)(G).
Yes. Under the proposed rule, if a practitioner wishes to issue a “telemedicine prescription,” they must have a DEA registration in both the state where the patient is located and the state where the practitioner is located (i.e., even if the practitioner does not prescribe to patients located in that state, such as a vacation home). Note: this registration requirement applies to the new options for “telemedicine prescriptions” under 21 C.F.R. § 1306.31 conducted pursuant to 21 U.S.C. § 802(54)(G).
However, outside the “telemedicine prescription” option, the proposed rule makes no mention of the current COVID-19 PHE waivers on DEA state-by-state practice location registrations. The proposed rule does not explain what DEA will do with that waiver come May 11, 2023. Will the DEA will also apply a 180 day extension to its state-by-state registration requirements? And if so, does DEA have a proposal for practice location registration applications when the practitioner has a multistate telemedicine practice? This is an area that deserves clarification in the responses to comments in the final rule.
On February 24, 2023, the DEA also announced a Notice of Proposed Rulemaking on “Expansion of induction of buprenorphine via telemedicine encounter.” That rule, a companion to this proposed rule, is available here. It would expand the circumstances under which the induction of buprenorphine can occur for maintenance treatment and detoxification treatment OUD via telemedicine. Although the content of that proposed rule is not summarized in this guide, there is much overlap between the two proposed rules. So much so that DEA is seeking comments on whether it should combine the two Notices of Proposed Rulemaking when publishing the final rule, as both documents refer to prescribing via telemedicine pursuant to 21 U.S.C. § 802(54)(G).
There are additional rules and requirements for practitioners employed by the Department of Veterans Affairs, who must comply with an additional administrative requirement. Before issuing a “telemedicine prescription,” such practitioners must review not only 1) the state PDMP but also 2) the Department of Veterans Affairs internal prescription database.
No, it is not. The proposed rule is definitively and categorically not the same as the special registration rule. The special registration is exception #5 under the Ryan Haight Act (21 U.S.C. § 802(54)(E)) (“The practice of telemedicine is being conducted by a practitioner who has obtained from the [DEA] Administrator a special registration”). The proposed rule is exception #7 under the Ryan Haight Act (21 U.S.C. § 802(54)(G)). The two exceptions reflect different statutory sections and authority, different processes, and serve to fulfill different, although overlapping, public policy goals.
The telemedicine special registration is important because it can more readily allow for legitimate direct-to-patient services when the patient is located outside a hospital facility (e.g., at home). The registration is for practitioners willing to go an extra level further, completing an second application and undergoing (presumably) a more extensive and specialized application than what is required for standard DEA registration. And the special registration process itself is the medium for DEA to realize the centralized recordkeeping, prescription tracking, and data monitoring tools it requests to police prescribing practices while not saddling patients with an arbitrary in-person exam.
The special registration statutory exception has been around since 2008, but the DEA has never published a rule allowing clinicians to use it. For nearly 14 years, patients, clinicians, industry stakeholders, and federal elected officials have asked the DEA to activate the special registration.
Moreover, DEA has been mandated, by both the Legislative and Executive Branches of the United States government, to publish final regulations activating the special registration. The statutory requirement is contained in the SUPPORT Act, and the DEA was required to promulgate such regulations by October 24, 2019. Nonetheless, no rule has been published.
In the proposed rule, DEA explained its reasoning why it chose not to publish the special registration rule. It said:
DEA considered allowing the practice of telemedicine pursuant to an application and issuance of a “special registration” allowing such practice. Upon further consideration, this alternative was deemed potentially burdensome for both prospective telemedicine providers and patients. Therefore, DEA decided against this alternative.
In other words, despite the history of the Ryan Haight Act, 14 years of advocacy efforts and calls for action, and a 2018 federal law mandating DEA publish the special registration, DEA decided not to do so on the grounds it “was deemed potentially burdensome for both prospective telemedicine providers and patients.” Instead, DEA proposed a rule with a complex architecture of different and new exceptions, confusing terminology, and extensive administrative recordkeeping.
Even more, DEA now claims its current proposed rule satisfies its duty to promulgate the special registration. DEA wrote:
In the SUPPORT for Patients and Communities Act (SUPPORT Act), signed into law on October 24, 2018, Congress required DEA to promulgate regulations concerning such special registrations. See id. 831(h)(2). This instance of rulemaking [i.e., the DEA’s February 2023 proposed rule], which sets forth circumstances under which telemedicine encounters may result in the prescription of controlled substances without an in-person evaluation and also provides safeguards for such prescriptions, is consistent with, and fulfills, DEA’s obligations under both the Ryan Haight Act and the SUPPORT Act.
The DEA contends it has somehow fulfilled its legal obligation to publish the special registration rule, despite never actually publishing the special registration rule. The DEA provided no legal basis or analysis for its assertion.
DEA is soliciting comments until 11:59 p.m. on March 28, 2023. Anyone may submit comments – anonymously or otherwise – via electronic submission at this link. When commenting, refer to “Docket No. DEA-407” on all correspondence, including attachments. Alternatively, commenters may submit comments by mail to:
Potential areas for comment include, but are not limited to:
The DEA proposed a complex rule with many technical features that will deeply affect a cohort of patients whose clinical care is dependent upon their medications. The DEA gave the public only 30 days to comment on the proposals, after which DEA will prepare final regulations. Providers, facilities, technology companies, professional associations, and patients themselves must consider submitting comments to make your voices heard.
For more information on telemedicine, telehealth, virtual care, remote patient monitoring, digital health, and other health innovations, including the team, publications, and representative experience, visit Foley’s Telemedicine & Digital Health Industry Team.