Ryan Haight Act: Telehealth Prescribing Rules Explained

The Ryan Haight Act is a 2008 federal law that bars prescribing a controlled substance over the internet unless the prescriber has conducted at least one in-person medical evaluation of the patient. Seven narrow exceptions sit inside the statute. Since March 2020 the in-person step has been set aside for most telemedicine prescribing, first through the statute’s public health emergency exception and, since 2023, through a series of temporary rules from the DEA and HHS. The current one runs through December 31, 2026.

That is the clinical picture. There is a second one that founders meet later and enjoy less. Your prescribing posture is also the first thing a payment underwriter reads. It decides how a sponsor bank sorts your business. It also sets how much risk the bank takes on with you.

Key takeaways

• The statute’s default is one in-person exam before any controlled substance is prescribed online (21 U.S.C. 829(e)). The exam has to happen with the patient physically present.
• Seven excepted categories of telemedicine are written into the Controlled Substances Act at 21 U.S.C. 802(54)(A) through (G).
• The general flexibilities are running on a temporary rule, extended four times since 2023. The current extension was published December 31, 2025 and runs through December 31, 2026 (90 FR 61301).
• Two narrower authorities are already permanent. Final rules on buprenorphine treatment (90 FR 6504) and Veterans Affairs continuity of care (90 FR 6523) took effect December 31, 2025 and do not expire.
• A proposed special registration framework from January 2025 drew more than 6,475 comments and had not been finalized when this post was written.
• Underwriting reads all of this as business-model risk. Platforms that document the model up front get reviewed. Platforms that stay vague get declined.

What is the Ryan Haight Act?

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 is the federal law that governs prescribing controlled substances over the internet. It changed the Controlled Substances Act, and its core rule is one sentence. No controlled substance that is a prescription drug may be delivered, distributed, or dispensed by means of the internet without a valid prescription.

The word carrying the weight is “valid.” The statute spells it out rather than leaving it to custom. A valid prescription is one issued for a legitimate medical purpose in the usual course of professional practice. And it has to come from a practitioner who examined the patient in person at least once, or a covering practitioner standing in for one who did.

Two things follow, and both matter for the business. The law reaches controlled substances, not every prescription. And it sets a default rather than a ban, because the same body of law writes exceptions into the definition of telemedicine itself.

What counts as an in-person medical evaluation?

The statute is specific, and it is stricter than most people expect. An in-person medical evaluation means a medical evaluation conducted with the patient in the physical presence of the practitioner. The definition adds that it does not matter whether portions of the evaluation were handled by other health professionals.

A video visit does not satisfy it. Neither does a long intake form, a phone call, or a review of photos sent in later. That is the whole reason the telemedicine question exists as a separate legal problem. The default rule was written to require a physical room.

If your platform prescribes only medications that are not controlled substances, this particular requirement does not reach you. State telehealth law, licensing, and your own counsel’s read still govern your practice, and none of that is settled by 829(e).

What are the seven telemedicine exceptions?

The Controlled Substances Act defines the “practice of telemedicine” at 21 U.S.C. 802(54) and lists seven categories, labeled (A) through (G). A practitioner operating inside one of them may prescribe without an in-person exam. In plain terms:

• (A) Patient at a registered hospital or clinic. The remote practitioner treats a patient who is physically located at a DEA-registered hospital or clinic.
• (B) Patient with another registered practitioner. The patient is physically present with a second practitioner who holds a DEA registration.
• (C) Indian Health Service. Practitioners employed by or contracted with IHS or tribal organizations, designated as Internet Eligible Controlled Substances Providers.
• (D) Public health emergency. Remote care during an emergency declared by the Secretary of Health and Human Services, limited to the areas and drugs named.
• (E) Special registration. A practitioner holding a special telemedicine registration issued by the Attorney General.
• (F) VA medical emergency. Veterans Health Administration employees and contractors in emergency situations, capped at a 5-day supply that may not be extended or refilled.
• (G) Other circumstances. Other cases that the Attorney General and the Secretary agree are consistent with diversion control.

Read that list next to a typical direct-to-consumer telehealth model. The gap is obvious. Most consumer platforms do not put the patient in a registered clinic. And category (E) points to a special registration that does not yet exist. The January 2025 proposal is what would create it.

Where do the DEA telemedicine flexibilities stand as of September 2026?

They are in force, and the general ones are temporary. Three separate sets of authorities run at once, which is the part most summaries flatten. Two are permanent final rules that took effect December 31, 2025, one covering buprenorphine treatment by telemedicine (90 FR 6504) and one covering continuity of care for Veterans Affairs patients (90 FR 6523). Neither expires. The broad flexibilities everyone else relies on sit in a third document, and that one does expire. It is the Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications. The DEA and HHS issued it jointly. It was published in the Federal Register on December 31, 2025 at 90 FR 61301. It took effect January 1, 2026 and runs through December 31, 2026.

While it is in effect, practitioners may prescribe schedule II through V controlled substances through audio-video telemedicine, with no prior in-person exam. Audio-only encounters are narrower. They cover schedule III through V narcotic medications approved by the FDA for maintenance and withdrawal management treatment of opioid use disorder, and nothing beyond that. The ordinary conditions still apply. The prescriber has to be registered to handle that class of substance. And the prescription has to be issued for a legitimate medical purpose in the usual course of professional practice.

The history explains why nobody treats this as settled. DEA and HHS issued a first temporary extension on May 10, 2023 (88 FR 30037). A second followed on October 10, 2023 (88 FR 69879), and a third on November 19, 2024 (89 FR 91253). The fourth is the one described above. Each has bought roughly a year to eighteen months. The agency says it extended the rule to buy time to finish permanent regulations, and to stop the old pre-pandemic limits from snapping back.

The permanent answer is supposed to be the special registration framework. DEA published a proposed rule on January 17, 2025 titled “Special Registrations for Telemedicine and Limited State Telemedicine Registrations,” and it drew more than 6,475 comments. As of this writing it is still a proposed rule. It has not been finalized, and no telehealth business should plan as though it has.

One caveat, because this is the kind of fact that rots. Everything in this section is the status as of September 17, 2026, verified against the Federal Register. Before you make a decision on it, check the Federal Register yourself, and talk to your own counsel about what any of it means for your specific practice. We price payment risk here. We do not tell you what you may lawfully prescribe.

Why prescribing posture is a payment underwriting question

Here is the part nobody warns telehealth founders about. Every fact above lands on your merchant account file, whether or not anyone asks about it.

Payment underwriting is a bet on whether a business will still look the same in eighteen months. A consult-only telehealth platform is, from a risk desk’s point of view, a subscription business with ordinary refund behavior. A platform that issues prescriptions is something else. It carries a licensing footprint across many states. It also runs on a rule that has been renewed one year at a time since 2023. A change to that rule could reshape its revenue overnight.

That is not a reason to decline anyone. It is a reason to underwrite the model rather than the label. That is the difference between an account that holds and one that freezes the first time the category makes news.

It is worth being precise about where the mainstream platforms actually put this category, because founders often assume a flat ban that is not there. Stripe lists “Telemedicine and telehealth services” as restricted rather than prohibited, alongside online pharmacies and prescription-only products. Adyen restricts “e-doctors” and medical practices. PayPal restricts “providing medical services and consultations in a remote fashion.” Square is the stricter case, prohibiting internet and telephone order pharmacies “where fulfillment of medication is performed with an internet or telephone consultation, absent a physical visit.”

Restricted is the tier that matters here, and it is the one people misread as safe. It means you can be approved, process for months, and then be re-reviewed when your volume grows or the category makes news. That is the approve-then-reverse pattern behind so many health-category shutdowns, and it is the reason a model that was documented up front holds up better than one that slipped through on a category name.

What underwriting actually asks a prescribing telehealth platform

The questions are specific, and having the answers ready is most of the work. Expect a reviewer to want:

• Whether the platform issues prescriptions at all, and whether any of them are controlled substances. This single answer routes the whole file.
• Your state licensing footprint, meaning where your prescribers are licensed and where you accept patients.
• Who does the prescribing, whether they are employed or contracted, and how you check their credentials.
• Your billing model, since memberships, per-visit consults, and hybrid plans produce different dispute patterns. Subscription telehealth in particular needs recurring billing set up so a renewal is easy for the cardholder to recognize.
• How consultation connects to fulfillment, if a pharmacy sits downstream. Platforms that link the two often get reviewed alongside online pharmacy processing rather than as a pure consult business.
• Your refund and cancellation policy, in writing, as the customer sees it at checkout.

None of that asks you to argue a legal position. It asks you to describe your business plainly. A platform that answers plainly is reviewable. A platform that gets vague about prescribing gets declined, often without being told why. A reviewer who cannot see the model has to assume the worst version of it.

One caution. HIPAA compliant payment processing is a real duty, and it is nearly invisible to a payments risk desk. A strong posture in one does not replace the other.

What to do before the rules move again

Assume they will move. The general flexibilities have been extended four times. The permanent special registration framework is still a proposal, and the current extension carries an expiry date on its face. Only the buprenorphine and Veterans Affairs rules are settled, and they cover a narrow slice of prescribing. That is not a prediction about the outcome. It is a description of the structure.

Three steps lower your risk without asking you to guess right:

1. Document your prescribing model now, in writing. If your controlled-substance flow depends on the current flexibilities, say so in your own compliance file. An underwriter who sees that you know what you depend on reads it as a sign you run a tight shop.
2. Keep your dispute exposure low, because your billing model is the part you control. Subscription billing tends to produce non-fraud disputes such as unrecognized renewals, and those are the winnable kind. Accertify’s 2023 to 2024 client data puts median win rates near 57% for non-fraud disputes against roughly 37% for fraud-coded ones. Clear descriptors, renewal reminders, and an easy cancellation path keep more of your revenue on the winnable side.
3. Do not let a shutdown become a listing. A frozen account is recoverable. A termination that lands you on the MATCH list follows you to the next application. So knowing your MATCH and TMF options matters more than most founders realize.

The Ryan Haight Act sets a default, seven exceptions bend it, and a temporary rule holds the door open one year at a time. Your clinical team manages that. Your payment stack has to survive it.

Most telehealth platforms want an account that reads the care model before approval, not after a hold. Our telemedicine merchant accounts are built that way on purpose. Pricing is quoted per business from your statement and risk profile rather than from a rate card, with the rate, any reserve, and settlement timing set out in writing before you sign.