The extension is the window. The window is not forever.
In December 2025, the DEA and HHS issued the fourth temporary extension of the COVID-era telemedicine flexibilities for controlled substances. The extension carries the existing rules forward through December 31, 2026.
That is the headline. The longer story is more interesting for operators.
For five years, DTC telehealth has been building programs under what was supposed to be a temporary exception. The Ryan Haight Act of 2008 generally requires at least one in-person medical evaluation before a practitioner can prescribe a controlled substance. The COVID public health emergency suspended that requirement. The DEA has now repeatedly extended that suspension while it works on a permanent rule.
The 2025-2026 extension does three things at once:
- It keeps current telehealth controlled-substance prescribing legal at the federal level
- It signals that a permanent rule is still coming, with the special telemedicine registration framework the DEA telegraphed in earlier proposals
- It buys operators another year to build clinically defensible programs, refine prescribing patterns, and prepare for a tighter steady state
This is the moment to either launch the controlled-substance programs you have been planning or to clean up the ones you already run.
This post is for operators deciding what to build under the window, how to build it, and what to put in place so the permanent rule, when it lands, does not break the program.
What the extension actually covers
The extension preserves three core flexibilities that matter for DTC telehealth.
| Flexibility | What it allows | What it does not allow |
|---|---|---|
| Telehealth prescribing of controlled substances without an in-person visit | A DEA-registered practitioner may prescribe Schedules II-V via telemedicine in the course of professional practice | Prescribing outside a legitimate practitioner-patient relationship, or in violation of state law |
| Cross-state prescribing under federal registration | A practitioner registered in their home state may treat patients in other states, subject to that state's licensing | Bypassing state medical licensure or state controlled-substance registration |
| Audio-only telemedicine in limited cases | Audio-only encounters for certain treatments, primarily buprenorphine for opioid use disorder | Audio-only for stimulant or other CII prescribing in most settings |
The extension does not change anything about how state medical boards license practitioners, how state PDMPs operate, or how individual states treat specific drug schedules. State law sits on top of the federal flexibility and is often stricter.
The extension also does not change the Ryan Haight Act itself. The act remains the underlying statute. The extension just keeps suspending the in-person requirement.
The permanent rule, when finalized, is expected to include a special telemedicine registration with practitioner-level requirements (PDMP queries, prescribing limits, geographic limits, possibly identity proofing of patients). Programs built loosely under the window will struggle to convert to the permanent rule. Programs built like the permanent rule already exists will not.
Why operators should treat this as a build year, not a holding pattern
The fourth extension is the clearest signal yet that the DEA is not going to slam the door without warning. It also confirms the permanent rule is still in active drafting.
Two things follow from that.
First, you have time to build correctly. A program launched in June 2026 with strong intake, PDMP integration, prescribing controls, and audit trail will survive the transition. A program that depends on lax intake and high-volume prescribing will not.
Second, the brands that build during the window get a multi-year head start on programs in categories that will not be easy to enter once the permanent rule sets the bar higher.
ADHD telehealth is the cautionary tale of the last cycle. A handful of providers prescribed loosely, the DEA cracked down, several brands were investigated, and the category got a reputation problem that legitimate operators are still working off. The clinics that survived had documented intake, conservative prescribing patterns, real provider review, and PDMP discipline already in place when scrutiny arrived.
The window is for building like the audit has already started.
Programs that become operationally viable
The extension makes several categories meaningfully workable for DTC telehealth right now.
ADHD (CII stimulants)
This is the most scrutinized category. Adderall, Vyvanse, Concerta, and similar Schedule II stimulants are prescribable via telemedicine under the extension, but expect the highest level of regulatory and pharmacy attention.
Operationally:
- Full structured intake including childhood history, current symptoms, prior diagnosis, prior treatments, and substance use screening
- Provider review with documented clinical reasoning, not template checkboxes
- PDMP query at every visit, documented in the chart
- Conservative initial doses, planned titration, scheduled follow-ups
- Strong refusal pathway when criteria are not met
- Documented in-person referral or transition plan
The clinics that get this right have a refusal rate above 25% on adult ADHD intake. If your refusal rate is closer to 5%, regulators will assume you are running a script mill, whether or not you are.
Buprenorphine for opioid use disorder (CIII)
This is the category the DEA has most clearly endorsed. The audio-only telehealth allowance is part of the SUPPORT Act framework and remains durable.
Operationally:
- Specialized intake aligned with ASAM criteria
- DATA-waivered or equivalently qualified providers
- Coordination with behavioral health, even if asynchronous
- PDMP query and naloxone co-prescription
- Long-term retention as the program's actual outcome, not month-one conversion
This is one of the few controlled-substance telehealth programs with a strong public health rationale. Build it right and it is durable.
Testosterone replacement therapy (CIII)
Testosterone is a Schedule III controlled substance, and DTC TRT has expanded rapidly under the flexibility. Both injectable and topical testosterone are prescribable via telemedicine.
Operationally:
- Baseline labs that include total and free testosterone on at least two morning draws, with associated workup (LH, FSH, estradiol, hematocrit, PSA where age-appropriate)
- Documented hypogonadism diagnosis aligned with Endocrine Society guidance, not a symptom-based prescription
- Recurring labs and hematocrit monitoring on a defined cadence
- Pharmacy partner with reliable supply and controlled-substance shipping
- Symptoms-only prescribing is the pattern that gets clinics in trouble
Ketamine for treatment-resistant depression and other indications (CIII)
The most contested category. Ketamine is Schedule III, available compounded as oral or sublingual lozenges, and has been a center of telehealth mental health investment.
Operationally:
- Intake screening for suicidality, psychosis, substance use, cardiac risk
- Provider review by mental health-credentialed clinicians
- Structured dosing protocol with explicit dose limits
- Coordinated psychotherapy or check-in cadence
- Pharmacy partner with controlled-substance compounding registration
- A clear referral pathway when ketamine is not appropriate
Several DTC ketamine providers have closed or been pressured by regulators after prescribing patterns drew attention. The category is real but unforgiving.
Other CIV and CV programs
Several lower-schedule programs are quieter but operationally viable:
- Modafinil and armodafinil (CIV) for narcolepsy and shift-work disorder
- Tramadol (CIV) in carefully scoped pain programs
- Some benzodiazepine prescribing in psychiatric continuity-of-care settings
- Pregabalin (CV) for certain neuropathic conditions
The general rule: lower the schedule, lower the regulatory temperature, but the same intake and PDMP discipline applies.
Intake design for controlled substances
The intake form for a controlled-substance program is not the place to optimize aggressively for conversion. Intake is the first line of clinical and regulatory defense.
What changes from a non-controlled program:
| Element | Non-controlled program | Controlled-substance program |
|---|---|---|
| Symptom history | Current only | Current plus longitudinal history, prior diagnoses, prior treatments |
| Substance use | Optional or light | Mandatory structured screening (AUDIT, DAST, or condition-specific) |
| Past prescribers | Often skipped | Required, with consent to query PDMP and contact prior providers if needed |
| ID verification | Email or phone | Photo ID, address match, identity proofing for higher-risk categories |
| Symptoms tied to function | Light | Required for diagnoses like ADHD where impairment is part of the criteria |
| Risk screening | Generic | Category-specific (suicidality for ketamine, cardiac for stimulants, etc.) |
| Disclosures and consent | Short | Expanded consent covering controlled-substance handling, PDMP, refusal authority |
For the broader intake-form patterns this builds on, see Smart Branching in Intake Forms: Fewer Questions, Better Qualification and The Weight Loss Intake Form Scorecard: 12 UX Checks Before You Launch.
Intake also needs to capture refusal-friendly answers gracefully. If a patient discloses something that would disqualify them, the next screen should be a respectful handoff with referral resources, not a dead end or, worse, a retry loop that lets them edit their answers.
Provider review and prescribing safeguards
Provider review for controlled substances is not a checkbox on an async dashboard. It is a clinical decision with audit consequences.
The patterns that hold up under scrutiny:
- Structured chart note that names the diagnostic criteria met and not met. A note that says "patient meets DSM-5 criteria for ADHD based on items A, B, D, E, F" is defensible. A note that says "approved" is not.
- Documented PDMP query result. Not just "queried," but what was found and how it influenced the decision.
- Explicit titration plan and follow-up cadence. Most defensible programs have a defined number of touchpoints in the first 90 days.
- Refusal authority that providers actually use. If providers never decline a prescription, that pattern itself is a red flag. A healthy program declines 20-40% of intakes in stimulant categories.
- Co-signature or peer review for higher-risk decisions. Some clinics run a second-provider check for first-time CII prescriptions.
The CRM and EHR architecture needs to make all of this visible, traceable, and exportable to support an audit response in days, not months. For the underlying field-ownership patterns, see EHR and CRM Field Ownership: Preventing Duplicate and Conflicting Data.
PDMP integration is a build requirement, not a nice-to-have
The Prescription Drug Monitoring Program is the federal-state mechanism that lets prescribers see a patient's controlled-substance history. Under the extension, federal expectations and state laws both increasingly require PDMP queries before controlled-substance prescribing.
Operationally, telehealth programs should treat PDMP integration as a hard build requirement.
The patterns:
- Automated query at intake with results attached to the patient chart
- Re-query at defined intervals (most state laws require query at first prescription and at six-month intervals, but several require every prescription)
- Multi-state query for patients who have lived in or filled prescriptions in multiple states
- Documented review of the PDMP result, not just retrieval
PDMP coverage varies. Some states have direct integrations available through health information exchange partners. Others require manual portal lookup. A telehealth program that operates in 20 states will likely use a vendor that aggregates multi-state PDMP access (Bamboo Health, RxCheck, and similar providers are the common choices).
Pharmacy partners and DEA registration
Not every pharmacy can fill a controlled-substance prescription written via telemedicine. The pharmacy partner needs:
- DEA registration for the schedules involved
- State controlled-substance registration in each ship-to state
- Compliance infrastructure for delivery, signature capture, and reporting
- For compounded controlled substances (ketamine lozenges, certain testosterone formulations), 503A or 503B registration as appropriate
Several DTC programs have run into trouble because their pharmacy partner was technically compliant but operationally fragile. Lost shipments, controlled-substance loss reports, and inconsistent delivery confirmation are real risks.
The patterns that hold up:
- Dual pharmacy redundancy across schedules where possible
- Documented chain-of-custody from prescription transmission to delivery confirmation
- Signature-required delivery for CII shipments
- Reconciliation process for missed or returned shipments
- Vendor SLAs that include reporting cadence to your team
For the broader pharmacy-selection framework, see How to Choose a Compounding Pharmacy for Your Telehealth Program.
The state law layer
Federal flexibility under the DEA extension is the floor. State law is everything above it.
A few state patterns that controlled-substance telehealth programs need to navigate:
| State pattern | What it means |
|---|---|
| State controlled-substance registration | Several states require a separate state CSR in addition to DEA registration, for prescribers and sometimes pharmacies |
| In-state prescriber requirement | Some states limit telehealth controlled-substance prescribing to providers licensed in the patient's state at the time of the encounter |
| In-person establishment requirement | A handful of states require an in-person evaluation within a defined period (often 12 months) before telehealth prescribing of controlled substances continues |
| Telemedicine modality restrictions | Some states require synchronous video for controlled-substance prescribing and disallow audio-only or asynchronous |
| Specific drug or category restrictions | States can restrict particular drugs or categories beyond the federal level (some states restrict telehealth stimulant prescribing more tightly than others) |
| PDMP query mandates | Most states require PDMP review at first prescription, some require it every time |
| Refill limits and electronic prescribing requirements | EPCS is now broadly required, but specific refill rules vary |
A clean operating model is to maintain a state matrix that tracks all of these dimensions per state, integrated with the CRM so providers cannot accidentally prescribe outside scope.
For the broader state expansion playbook, see State Expansion for Telehealth: The Ops Checklist Before You Launch a New State.
What to build now, what to wait on
Not every controlled-substance program is equally attractive under the window.
Build now, with strong guardrails:
- Buprenorphine for OUD (clearest regulatory blessing)
- Testosterone replacement (mature pharmacy supply, clear clinical guidance)
- Low-volume CIV and CV programs in narcolepsy, neuropathic conditions
Build now, only with senior clinical and legal leadership:
- ADHD stimulants (high regulatory attention, but viable if intake and review are tight)
- Ketamine for treatment-resistant depression (high attention, narrow patient profile)
Wait or de-prioritize:
- New benzodiazepine-led anxiety programs (regulatory risk does not match the patient outcome story)
- Any program where the clinical rationale is thin and the revenue model depends on volume
The wait-or-de-prioritize list is not about the legality. It is about whether the program can survive the permanent rule. If it cannot, the cost of building, marketing, and unwinding it in two years is high.
Audit trail and risk management
The brands that survive a DEA inquiry or state board investigation share a common operating pattern: they can produce evidence of how a prescription decision was made within hours.
That means:
- Time-stamped intake responses tied to a specific patient
- Provider note that names diagnostic criteria and reasoning
- PDMP query record
- Prescription transmission record with pharmacy
- Delivery confirmation
- Follow-up encounter cadence
Some operational practices that pay off:
- Run periodic internal audits. Pull 50 random charts each quarter and review them with clinical and legal leadership. Document the findings and what changed.
- Track refusal and titration patterns by provider. A provider whose approval rate is dramatically above peers is a risk indicator.
- Maintain a documented training program. New providers complete training on the controlled-substance program before prescribing. Document who trained, who completed, and what the curriculum was.
- Have an inquiry response playbook. When the DEA, state board, or pharmacy board calls, the response should be clear, fast, and consistent.
For the broader risk and compliance framing tied to GLP-1 marketing, see What Telehealth Teams Should Change After the FDA's Compounded GLP-1 Marketing Crackdown.
Implementation checklist
Use this when scoping a controlled-substance telehealth build.
Legal and regulatory
- DEA registration confirmed for all prescribing providers
- State medical licensure confirmed in every state of operation
- State controlled-substance registration where required
- Pharmacy partner DEA and state registration confirmed
- EPCS workflow tested end to end
- State matrix of telehealth controlled-substance rules maintained and integrated
- Legal review of program scope, intake, consent, and refusal pathway
Clinical
- Diagnostic criteria written for each condition the program treats
- Structured intake that captures the criteria, not just symptoms
- Risk screening matched to category (suicidality, cardiac, substance use)
- Refusal pathway with referral resources
- Provider training program with documentation
- Defined titration and follow-up cadence
PDMP and data
- PDMP integration for every state of operation
- Automated query at intake and at defined intervals
- Documented review of PDMP results in the chart
- Multi-state query for patients with prior addresses
Pharmacy and delivery
- Dual pharmacy redundancy where possible
- Signature-required delivery for CII
- Lost-shipment and return reconciliation process
- Vendor reporting cadence agreed and tracked
Audit readiness
- Quarterly internal chart audit
- Provider-level refusal and titration tracking
- Inquiry response playbook documented
- Training records retained per provider
Final takeaways
The DEA extension through December 2026 is the most valuable build window DTC telehealth has had in two years.
What to remember:
- The extension preserves current prescribing flexibility but does not change the underlying Ryan Haight Act
- A permanent rule is coming, and it will include a special telemedicine registration framework
- Programs built loosely under the window will struggle to convert
- Programs built like the permanent rule already exists will earn a multi-year head start
- ADHD, ketamine, and buprenorphine are the highest-attention categories, with very different regulatory tones
- Testosterone and lower-schedule programs are operationally easier under the window
- State law sits on top of federal flexibility and is often stricter
- PDMP integration, structured intake, provider refusal authority, and a real audit trail are the things that hold up
- Volume-led models with thin intake are the things that do not
This is the year to build the programs that will survive the next ten, not the next twelve months.
Sources for the regulatory and clinical references:
- Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Substances - Federal Register
- HHS and DEA Extend Telemedicine Flexibilities Through 2026 - HHS
- Ryan Haight Online Pharmacy Consumer Protection Act - DEA Diversion
- SUPPORT for Patients and Communities Act - Congress.gov
- Endocrine Society Clinical Practice Guideline on Testosterone Therapy - JCEM
- DEA Prescription Drug Monitoring Program Overview
- Bamboo Health PDMP Integration