As the popularity of telehealth continues to soar, healthcare providers face the challenge of staying compliant with ever-evolving regulations, especially those enforced by the Drug Enforcement Administration (DEA). To assist healthcare organizations in maintaining compliance with DEA telemedicine requirements, Safe Harbor Group, a leading consulting firm, offers expert advice and comprehensive audits of telemedicine programs.
Facing an Audit? Don’t Go at It Alone.
We Saved Our Client $550 Million Last Year.
The DEA Telehealth and Controlled Substances
DEA Telemedicine Rules
Overview: Telehealth Controlled Substance Prescribing Regulations
Telehealth, or the practice of providing healthcare services remotely using telecommunications technology, has gained significant popularity and importance, especially during the COVID-19 pandemic. To ensure safe and effective use of telehealth in prescribing medications, several laws and regulations were in place. Here are some of the key considerations:
- State Medical Board Regulations: Each state has its own medical board that establishes rules and regulations governing medical practice, including telehealth prescribing. These regulations can vary from state to state. Some states require an established provider-patient relationship before prescribing medications via telehealth, while others allow for new patient encounters. State medical boards may also specify the types of medications that can be prescribed via telehealth.
- The Ryan Haight Online Pharmacy Consumer Protection Act: Although not directly related to telehealth prescribing, the Ryan Haight Act addresses online prescribing of controlled substances. It prohibits the delivery, distribution, or dispensing of controlled substances via the internet without a valid prescription. The act sets forth requirements for a valid prescription, such as a prior in-person medical evaluation, with exceptions for telehealth services provided by practitioners who meet specified criteria.
- Federal Drug Enforcement Administration (DEA) Requirements: The DEA regulates the prescribing and dispensing of controlled substances in the United States. Telehealth prescribers who want to prescribe controlled substances must adhere to federal requirements. These include using secure, real-time, two-way audiovisual communication systems and meeting the “in-person medical evaluation” requirement for prescribing. However, during the COVID-19 public health emergency, the DEA temporarily relaxed some of these requirements to facilitate remote prescribing. Federal Drug Enforcement Administration (DEA) Requirements: The DEA regulates the prescribing and dispensing of controlled substances in the United States. Telehealth prescribers who want to prescribe controlled substances must adhere to federal requirements. These include using secure, real-time, two-way audiovisual communication systems and meeting the “in-person medical evaluation” requirement for prescribing. However, during the COVID-19 public health emergency, the DEA temporarily relaxed some of these requirements to facilitate remote prescribing.
- HIPAA Compliance: The Health Insurance Portability and Accountability Act (HIPAA) sets standards for the protection of patients’ personal health information. Telehealth providers must ensure compliance with HIPAA regulations to safeguard patient privacy and security during telehealth consultations. This includes implementing appropriate technical and administrative safeguards to protect electronic health information.
The Ryan Haight Act and Telehealth Prescribing Regulations
In 2008, the Ryan Haight Online Pharmacy Consumer Protection and Drug Enforcement Administration’s (DEA) implementing regulations allowed a practitioner who has first had an in-person medical evaluation with their patient the ability to use telehealth to prescribe that patient any prescription for a controlled medication that the practitioner deems medically necessary in compliance with federal law 21 CFR 1306.04(a).
The Ryan Haight Act and the DEA’s implementing regulations do not apply to other forms of telemedicine, telehealth, or telepsychiatry that are not otherwise addressed in the Controlled Substances Act.
The Drug Enforcement Administration (DEA) was also tasked around this same time with developing a special telehealth-controlled substance prescribing license, which, to this day, they have still not developed or implemented.
DEA Telehealth Regulations and COVID-19 Changes
However, due to the COVID–19 Public Health Emergency (COVID–19 PHE) the Secretary of the Department of Health and Human Services (HHS) on January 31, 2020, pursuant to the authority under section 319 of the Public Health Service Act (42 U.S.C. 247), the Drug Enforcement Administration (DEA) granted temporary exceptions to the Ryan Haight Act and DEA’s implementing regulations under 21 U.S.C. 802(54)(D), thereby allowing the prescribing of controlled medications via telemedicine encounters—even when the prescribing practitioner had not conducted an in-person medical evaluation of the patient—in order to prevent lapses in care.
These telemedicine flexibilities authorized practitioners to prescribe schedule II–V controlled medications via audio-video telemedicine encounters, including schedule III–V narcotic controlled medications approved by the Food and Drug Administration (FDA) for maintenance and withdrawal management treatment of opioid use disorder via audio-only telemedicine encounters, without requiring an in-person medical evaluation, provided that such prescriptions otherwise comply with the requirements outlined in DEA guidance documents, DEA regulations, and applicable Federal and State law. DEA granted those temporary exceptions to the Ryan Haight Act and DEA’s implementing regulations via two letters published in March 2020.
This telehealth-controlled substance prescribing exception was expanded on May 11, 2023, in response to an influx of public comments on the DEA’s proposed telehealth rules, which would have effectively reversed the course of telehealth-controlled substance prescribing back to the outdated regulations of the Ryan Haight Act. The exception is now extended until November 11, 2024, while the DEA continues to weigh and evaluate public comments to formulate new telehealth-controlled substance prescribing rules.
Safe Harbor Group is hopeful that the DEA will not roll back these rules to 2008 and instead focus on the success of telehealth prescribing in an era of new and exciting technological advances, while balancing compliance and risk mitigation.
One avenue of telehealth that will end at the end of this year is your ability to not disclose the location where you are practicing telehealth. So, we highly recommend that if you practice from home or another location that was not registered with the government and private payors, you add this location as soon as possible to remain compliant and ensure proper payment.
Safe Harbor Group can help ensure your healthcare business or practice is fully compliant and protected from government and payor scrutiny.
We will continue to actively monitor any developments in this evolving and ongoing process of telehealth prescribing rule-making and update our valued clients accordingly.
Complying with DEA Telehealth Rules: DEA Telehealth Prescribing Checklist
The following telehealth-controlled substance prescribing guidance is based solely on federal law and rules. It does not take into consideration state rules and regulations related to telehealth-controlled substance prescribing that your state may have implemented. Chapman Consulting Group always recommends researching all federal and state rules and laws to ensure compliance, consulting a qualified healthcare attorney, or contacting us for a compliance consultation.
Safe Harbor Group has developed the following telehealth checklist, which we recommend using at your practice with each patient to help you maintain compliance.
- Telehealth visits should be conducted only via HIPAA-compliant, face-to-face video with audio.
- The practitioner is currently licensed in the state where the patient resides (practitioner state licenses should be verified at least once a year and documented in the provider’s file).
- The patient’s state or federally issued picture identification is collected and added to the patient’s chart. The patient’s identification picture is verified against the actual patient on video. The identification verifies the current address of the patient’s residence, or if the address on the identification is not correct, a current utility bill with the correct address should be collected and added to the patient’s file for verification purposes (the patient’s current address should be verified verbally at every subsequent visit and documented in the patient’s medical record).
- The patient signed informed consent and a telehealth waiver, and the form was added to the patient’s medical record (renewed annually with the patient).
- The provider will verify that the patient is in a private setting and that unauthorized individuals cannot overhear their medical care.
- The patient will be offered the option to have their telehealth medical records shared with their primary care physician, if applicable, and only if written or electronic patient consent is obtained.
- The patient’s past personal and family history will be obtained and reviewed by the medical provider. (A patient medical history paper or electronic form may be utilized to collect this information, but should be reviewed with the patient at the telehealth visit.)
- The practitioner will introduce themselves to the patient, provide their name, contact information, medical license, and board certification(s), if applicable, and document the introduction in the patient’s medical record.
- Establishment and documentation of a medical diagnosis through the use of acceptable medical practices, such as patient history, mental status examination, physical examination (unless not warranted by the patient’s mental condition), medical decision making, and appropriate diagnostic and laboratory testing to establish diagnoses, as well as identification of underlying conditions or contra-indications, or both, for treatment recommended or provided. Personalized patient medical history collected should be documented in the patient record, including specific activities of daily living or functional limitations related to their medical diagnosis.
- Discussion with the patient and documentation of any medical diagnosis and supporting evidence, as well as risks and benefits of various treatment options. (If prescriptions are issued, a signed informed consent should be utilized with each medication listing the possible side-effects and treatment goals, and added to the patient’s medical record.)
- If the prescription is for a controlled substance, a state PDMP report will be obtained and reviewed for the patient before issuance of the prescription and at every prescription refill request. The report results will be documented in the patient’s medical record as compliant or non-compliant, and the medical provider will document and address with the patient any concerns noted on the report, such as potential drug-drug interactions with the prescribed medication, signs of diversion or addiction, etc.
- Medication efficacy will be evaluated and documented at each subsequent patient visit in the medical record. Personalized patient statements collected concerning how the medication(s) have improved activities of daily living or function should be documented in the patient’s medical record. Medication refills will be medically justified in the patient’s medical record due to improved condition and/or improved diagnostic testing.
- Diagnostic testing will be provider-ordered, evaluated, documented, and discussed with the patient as medically necessary and at medically appropriate intervals.
- The patient will have access to their medical record as requested or needed.
Why Choose Safe Harbor Group for Telehealth Compliance Support in Detroit?
Safe Harbor Group offers guidance shaped by real DEA, SIU, and regulatory experience — giving providers clear direction in a rapidly changing telehealth environment. Our team closely tracks evolving DEA rules, state board expectations, HIPAA requirements, and prescribing safeguards to help organizations avoid missteps that can trigger investigations. With in-depth audits, policy development, and hands-on program support, SHG helps practices build compliant telemedicine workflows that withstand scrutiny.
Telemedicine Question? Contact Telemedicine and Controlled Substance Prescribing Experts Today
As the popularity of telehealth continues to soar, healthcare providers face the challenge of staying compliant with ever-evolving regulations, especially those enforced by the Drug Enforcement Administration (DEA). To assist healthcare organizations in maintaining compliance with DEA telemedicine requirements, Safe Harbor Group, a leading consulting firm, offers expert advice and comprehensive audits of telemedicine programs. Their team of specialists ensures that healthcare providers have the tools and knowledge needed to comply with telemedicine regulations seamlessly.
By partnering with Safe Harbor Group, healthcare professionals can focus on delivering quality care while being confident in their compliance with DEA regulations. Contact Safe Harbor Group today to optimize your telemedicine program and stay on the right side of telehealth prescribing regulations.
