Guide

Controlled substances by telehealth: where the rules stand

Summary

As of mid-2026 you can prescribe controlled substances by telehealth, but only because temporary DEA and HHS flexibilities still waive the usual in-person-exam requirement — and they have been extended repeatedly, so confirm the current status with DEA before relying on it. A proposed permanent special-registration framework is not yet final; do not build on it. Layer your state's licensure, PDMP, and controlled-substance-registration rules on top, and run every visit on a HIPAA-compliant platform.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

Can you prescribe controlled substances by telehealth right now?

As of mid-2026, yes — within limits. Federal law normally requires an in-person medical evaluation before a controlled substance is prescribed by telemedicine, but temporary DEA and HHS flexibilities that waive that requirement remain in effect and have been extended repeatedly while DEA finalizes a permanent framework 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.That DEA administers practitioner registration and controlled-substance prescribing rules, including the telemedicine framework and the temporary flexibility now in effect, and that a permanent special-registration rule remains a DEA proposal.. Because the end date has moved more than once, confirm the current status directly with DEA before you rely on it, and layer your state's rules on top.

The honest one-line answer is 'yes, for now, and verify before you rely on it.' The rules in this area have changed on short notice more than once, so anything you read — including this page — should be checked against DEA's current guidance before it drives a prescribing decision. Treat the flexibility as a live status to confirm, not a settled fact.

The rule underneath: the in-person exam requirement

The default federal rule is that a controlled substance may not be prescribed by means of the internet without at least one in-person medical evaluation, subject to statutory exceptions. That baseline — the Ryan Haight framework — is what the telehealth flexibility temporarily sets aside. So 'prescribing without an in-person exam' is legal right now only because a time-limited waiver says so, not because the underlying requirement went away. Keep a DEA registration; without it, none of this applies 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.That DEA administers practitioner registration and controlled-substance prescribing rules, including the telemedicine framework and the temporary flexibility now in effect, and that a permanent special-registration rule remains a DEA proposal..

Why this matters operationally: if the flexibility lapses, the in-person-exam requirement snaps back for new patients, and any workflow built entirely on video-only intake would have to change overnight. Knowing the baseline lets you design a practice that can absorb a rule change instead of being broken by one.

The current flexibility and the proposed permanent rule

Two things are true, and confusing them is the trap. The current flexibility is a temporary extension of pandemic-era telemedicine rules, in effect now but with an end date DEA has repeatedly pushed forward. Separately, DEA has proposed a permanent framework — including a special registration for telemedicine prescribing — but as of mid-2026 that remains a proposal, not a rule you can register under. Do not build your practice on the proposed rule until it is final 1Ref 1Drug Enforcement Administration (2026).Diversion Control Division.That DEA administers practitioner registration and controlled-substance prescribing rules, including the telemedicine framework and the temporary flexibility now in effect, and that a permanent special-registration rule remains a DEA proposal..

The practical consequence: assume the current flexibility could lapse or change, and do not assume the special registration pathway exists yet. Watch DEA's Diversion Control Division for the actual effective dates, and re-check before onboarding a controlled-substance telehealth patient you could not see in person. Extrapolating a proposed rule into today's authority is exactly the error that gets a prescriber crosswise with DEA.

Buprenorphine for opioid use disorder is its own lane

Prescribing buprenorphine for opioid use disorder follows its own rules. The old X-waiver was eliminated in 2023, so any clinician with a standard DEA registration and Schedule III authority may prescribe it for OUD, subject to a one-time training attestation 2Ref 2Substance Abuse and Mental Health Services Administration (2026).Buprenorphine.That the X-waiver was eliminated in 2023 and any prescriber with a standard DEA registration and Schedule III authority may prescribe buprenorphine for OUD subject to the one-time training attestation.. Records of that treatment are also protected under 42 CFR Part 2, whose 2024 final rule — in effect since its February 2026 compliance date — changed how consent works, so use the required consent forms 3Ref 3U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.That SUD-treatment records are protected under 42 CFR Part 2 and the 2024 final rule, now in effect since its February 2026 compliance date, changed the consent framework..

Telehealth initiation of buprenorphine has had its own flexibilities, distinct from the general telemedicine waiver; confirm the current DEA and SAMHSA position before starting a patient on it remotely, because this is one of the most actively revised corners of the rules. Do not assume a rule you used last year still reads the same way today.

Your state's rules sit on top of the federal ones

Federal permission is necessary but never sufficient — the patient's location controls a second layer. You generally need a license in the state where the patient is physically located, most states require a PDMP query before you prescribe, and some require a separate state controlled-substance registration there 4Ref 4PDMP Training and Technical Assistance Center (2026).Prescription Drug Monitoring Program Training and Technical Assistance Center.That most states mandate a PDMP query before controlled-substance prescribing and the requirement varies by the patient's state.. Cross-border prescriptions can therefore need a second license and a state CSR you do not yet hold.

A lapsed license or a missing registration mid-panel stops you cold, so map every state you treat into before the first visit, not after. Your e-prescribing setup must also be enabled for controlled substances in each state's workflow. One thing telehealth spares you: you are not holding controlled inventory yourself, so the storage and inventory rules that bind a dispensing office do not land on you here.

The platform and the standard of care

Where you prescribe from does not lower the bar for how you prescribe. Run the visit on a HIPAA-compliant telehealth platform under a business associate agreement — the pandemic-era enforcement discretion that tolerated consumer video apps has ended 5Ref 5HHS Office for Civil Rights (2026).HIPAA and Telehealth.That telehealth must run on a HIPAA-compliant platform under a business associate agreement now that the pandemic-era enforcement discretion has ended.. Meet the same standard of care you would in person: an adequate evaluation, informed consent for remote treatment, a plan for emergencies at the patient's location, and clear documentation. Telepsychiatry practice resources spell out these operational and legal dimensions 6Ref 6American Psychiatric Association (2026).Telepsychiatry Toolkit.The practice, legal, and reimbursement dimensions of delivering video-based psychiatric care to the same standard of care as an in-person visit..

Practically, that means a documented evaluation appropriate to the medium, consent that names the limits of remote care, an emergency plan tied to where the patient actually is, and the same PDMP and records discipline you use in person. The medium changes the logistics, not the obligations.

Whether you get paid is a separate question

Do not confuse legal authority to prescribe with insurance coverage to bill. Whether Medicare pays for a given telehealth service depends on CMS's published list of telehealth-eligible codes, including which are permanent, which are temporary, and which allow audio-only 7Ref 7Centers for Medicare & Medicaid Services (2026).List of Telehealth Services.That CMS publishes the definitive list of Medicare telehealth-payable codes, including permanent versus temporary status and audio-only eligibility, which governs payment separately from prescribing authority.. Commercial and Medicaid coverage vary again on top of that.

So a telehealth controlled-substance visit can be fully lawful yet reimbursed differently than the same in-person visit — check the Medicare telehealth list and your payer contracts before you assume the pay is identical. The prescribing question and the payment question travel on separate tracks, and answering one does not answer the other.

Common questions

As of mid-2026, yes, under temporary DEA and HHS flexibilities that waive the usual in-person-exam requirement. Those flexibilities have been extended repeatedly and could change on short notice, so confirm the current status with DEA before you rely on them. The underlying Ryan Haight requirement has not gone away; it is only being set aside temporarily while the flexibility is in effect.

As of mid-2026, no. DEA has proposed a permanent framework that includes a special registration for telemedicine controlled-substance prescribing, but it remains a proposal, not a rule you can register under. Do not build your practice on the proposed pathway until it is finalized, and watch DEA's Diversion Control Division for the actual effective date.

Yes. Federal permission is the floor, not the ceiling. You generally need a license in the state where the patient is located, most states require a PDMP check before prescribing, and some require a separate state controlled-substance registration. A telehealth prescription that is lawful federally can still violate the patient's state law, so map every state you treat into first.

The X-waiver is gone, so a standard DEA registration with the required one-time training lets you prescribe buprenorphine for OUD. Telehealth initiation has had its own flexibilities separate from the general telemedicine waiver, and this is one of the most actively revised areas, so confirm the current DEA and SAMHSA position before starting a patient remotely.

No — those are separate questions. Whether a payer covers the visit depends on the code and the plan: Medicare publishes a list of telehealth-eligible services, and commercial and Medicaid coverage vary on top of that. A lawful telehealth controlled-substance visit can still be reimbursed differently than the same visit in person, so check coverage before you assume the pay is identical.

A HIPAA-compliant telehealth platform under a business associate agreement. The pandemic-era enforcement discretion that tolerated ordinary consumer video apps has ended, so a casual video call is no longer a defensible choice for a clinical visit. Beyond the platform, meet the same standard of care, consent, and documentation you would for an in-person controlled-substance visit.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Drug Enforcement Administration (2026). Diversion Control Division. U.S. Drug Enforcement Administration. link ✓That DEA administers practitioner registration and controlled-substance prescribing rules, including the telemedicine framework and the temporary flexibility now in effect, and that a permanent special-registration rule remains a DEA proposal.
2.Substance Abuse and Mental Health Services Administration (2026). Buprenorphine. SAMHSA. link ✓That the X-waiver was eliminated in 2023 and any prescriber with a standard DEA registration and Schedule III authority may prescribe buprenorphine for OUD subject to the one-time training attestation.
3.U.S. Department of Health and Human Services (2024). Fact Sheet: 42 CFR Part 2 Final Rule. U.S. Department of Health and Human Services. linkThat SUD-treatment records are protected under 42 CFR Part 2 and the 2024 final rule, now in effect since its February 2026 compliance date, changed the consent framework.
4.PDMP Training and Technical Assistance Center (2026). Prescription Drug Monitoring Program Training and Technical Assistance Center. PDMP TTAC (Brandeis University, BJA-funded). link ✓That most states mandate a PDMP query before controlled-substance prescribing and the requirement varies by the patient's state.
5.HHS Office for Civil Rights (2026). HIPAA and Telehealth. U.S. Department of Health and Human Services. linkThat telehealth must run on a HIPAA-compliant platform under a business associate agreement now that the pandemic-era enforcement discretion has ended.
6.American Psychiatric Association (2026). Telepsychiatry Toolkit. American Psychiatric Association. link ✓The practice, legal, and reimbursement dimensions of delivering video-based psychiatric care to the same standard of care as an in-person visit.
7.Centers for Medicare & Medicaid Services (2026). List of Telehealth Services. Centers for Medicare & Medicaid Services (CMS). link ✓That CMS publishes the definitive list of Medicare telehealth-payable codes, including permanent versus temporary status and audio-only eligibility, which governs payment separately from prescribing authority.

https://www.gale.care/for-providers/bhp-telehealth-controlled-substances · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers