In 2008, Congress passed the Ryan Haight Act (21 U.S.C. § 802(54)) (“Ryan Haight”) following the death of Ryan Haight, a young man who overdosed on prescription painkillers he purchased from an online pharmacy without a valid prescription. Ryan Haight amended the federal Controlled Substances Act (21 U.S.C. 802 et seq.) and specifically prohibits dispensing controlled substances via the internet without a “valid prescription” which, according to the law, must be issued for a legitimate medical purpose and may only be issued once a physician has conducted at least one in-person evaluation of the patient (i.e., before issuing the remote prescription for the controlled substance). Certain exceptions may apply, but arguably none contemplate the direct-to-patient virtual care models that many of today’s telehealth / telemedicine companies are utilizing.

The intent behind the enactment of Ryan Haight in 2008 was to shut down online pharmacies and to restrict access to painkillers and other controlled substances provided to patients in ways that could circumvent a physician’s examination (and the issuance of a valid prescription, if the physician determined it was an appropriate course of treatment for the patient). Unfortunately, the effect of enacting Ryan Haight was, in reality, much more significant – not only restricting access via online pharmacies to the deadliest or most addictive painkillers, but also banning the issuance of remote prescriptions for any controlled substances unless an in-person visit occurred first between the physician and the patient. What the requirements imposed by Ryan Haight ignore is that there are many more drugs in Schedules II – V that are designed to treat patients for a panoply of non-pain related illnesses, many of which can be prescribed safely and effectively by means of an appropriate telehealth encounter. While Congress largely has ignored calls to revise Ryan Haight to address this issue, some states have started to rethink how, at least at the state level, they will handle the issue of health care providers prescribing controlled substances through non-traditional treatment arrangements, such as the use of telehealth / telemedicine.

An example is Indiana, where the legislature recently amended Indiana Code 25-1-9.5-8 (in 2017) to expand the list of drugs that may be prescribed by authorized prescribers through telehealth / telemedicine. Originally enacted in 2016, the law banned the remote prescribing of all controlled substances if such prescribing was done via a telehealth / telemedicine encounter. The revised law dramatically expands the ability to prescribe, via telehealth / telemedicine, certain controlled substances, and only limits such prescribing practices with respect to opioids, abortion inducing drugs, and/or ophthalmic devices (i.e., contact lenses and glasses). The Indiana law is particularly thoughtful and timely because it excludes from the ban any opioids that act as partial-agonists are used to treat or manage opioid dependence. Therefore, the Indiana law not only expands treatment options by allowing the remote prescribing of many controlled substances, including some that can be used to treat opioid dependence disorders, but does so in a manner that attempts, discretely, to address the opioid dependence epidemic by limiting access to most opioids.

Following a similar path is Hawaii, which like Indiana has excluded the remote prescription of opioids via telehealth as well as medical cannabis. While Hawaii’s laws do not explicitly permit the remote prescription of controlled substances, the fact that Hawaii Statutes Revised § 329-1 does not distinguish between the prescribing of controlled and non-controlled substances (within the context of discussing the rules related to remote prescribing) and that Hawaii Statutes Revised § 453-1.3 only requires an in-person examination prior to prescription of opioids and medicinal cannabis, would logically support the assumption that prescribing other, less controversial controlled substances would be permissible. Like Hawaii, Florida is another state that has taken a more nuanced approach to remote prescribing of controlled substances via telehealth / telemedicine. Florida Administrative Code rule 64B8-9.0141, for example, permits the prescription of controlled substances to treat psychiatric disorders.

Simultaneously, some states also have continued to build, refine, and expand statewide databases that store information regarding the prescriptions for controlled substances written by practitioners licensed by the state. This information can help physicians and other prescribing health care providers to determine, if and when contemplating the issuance of a remote prescription to a certain patient, whether that patient may be “doctor shopping” and/or whether concomitant medications may pose a risk to a patient if he/she is prescribed a particular drug. These databases, and the laws creating and amending them, may be one reason why states are more willing to expand remote prescribing practices given these new additional safeguards.

By contrast, to date the Drug Enforcement Agency (DEA) has taken no additional steps to clarify or refine the requirements under Ryan Haight since it was enacted. When Ryan Haight was first passed, it included an exception on its applicability for prescribers who obtain a “special registration” from the Attorney General or the Administrator of DEA per 28 CFR 0.100. When Ryan Haight was passed, Congress contemplated that DEA would “promulgate regulations governing the issuance to practitioners of a special registration relating to the practice of telemedicine;” however, neither DEA nor any other agency has provided any additional information regarding this special registration since Ryan Haight was first signed into law in 2008. In 2015, DEA proposed making a rule that would provide clarity to the “special registration” exception; however, in 2016 DEA amended the proposed rule-making to a “Long-Term Action” with no set deadline, further delaying even the idea of providing additional clarity. Perhaps the DEA’s response is a reaction to states that strongly oppose providing prescribing information to other states or even to the federal government for various reasons, including privacy concerns. That is to say, perhaps states are more willing to loosen remote prescribing laws for controlled substances because the databases they control and the data provided thereunder have eased concerns with allowing prescribers to prescribe as they see fit based on the information available regardless of whether the prescriber is physically present in the same room as the patient.

In the end, and regardless of the reasons, Ryan Haight continues to be good law, meaning that it is enforceable against prescribing health care practitioners. Despite an apparent lack of actual enforcement (the last case against a physician to enforce Ryan Haight was in July of 2011), the DEA technically can choose to enforce Ryan Haight at any time. Prescribers should therefore be cautious and understand that remote prescribing of controlled substances, even within the confines of a state law, still could be considered a violation of federal law with penalties including prison, fines, and temporary or permanent loss of the prescriber’s DEA Registration. Health care providers contemplating the prescribing of any controlled substances through telehealth / telemedicine can benefit from doing diligence with the support of legal counsel to fully understand the potential impacts of Ryan Haight, relevant state laws, and the potential risk involved in such a venture before proceeding.

While tremendous strides continue to be made in the growth and adoption of telehealth services, significant legal obstacles remain.  Among these obstacles are state drug prescribing laws.  In many states, physicians cannot lawfully prescribe drugs during a telehealth encounter, except in very limited circumstances.  For example, California requires that physicians perform a “physical exam” before prescribing drugs, and explicitly outlaws prescribing on “the internet” without a prior examination.  These restrictions vary from state to state, but many share certain characteristics, such as the following:

  1. In several states the law says that physicians cannot prescribe medication without first performing a “physical” examination (e.g. Alabama, Massachusetts, Tennessee and California).   This physical examination requirement is generally interpreted to mean that the physician must have an in-person encounter with the patient, but this is not necessarily the case everywhere. 
  2. Some states only limit telehealth prescribing to certain classes of drugs.  For example, Minnesota’s prescribing law requires that the physician complete an “in person examination” before prescribing controlled substances, muscle relaxants, and certain other classes of medication.  Louisiana has a similar restriction for certain controlled substances, but not other classes of drugs. 
  3. Many states now have prescribing laws that explicitly prohibit prescribing solely based on an internet questionnaire (e.g.  Louisiana and Mississippi) or internet consultation (e.g. Oregon).  

Nevertheless, there are some states that do explicitly permit certain forms of telemedicine prescribing (e.g. New Mexico and Virginia).   Historically, the most telehealth friendly prescribing laws have been in rural states, such as New Mexico, where access to care is a major issue.   

Among regulators and policymakers, the wisdom of granting telehealth providers more freedom to prescribe is very much in question.  As recently noted by the Center for Telehealth and eHealth Law (CTEL), growing concerns about widespread prescription drug abuse and illicit prescribing and dispensing activities on the internet are likely going to complicate efforts to improve prescribing laws for telehealth providers.  Additionally, the lack of standards for when and under what circumstances it is appropriate to prescribe drugs in a telehealth setting may be affecting progress in this area.  

In the current regulatory environment, telehealth providers that wish to prescribe drugs without a prior in-person encounter with the patient will need to carefully review the prescription drug laws in the states where they operate as well as the states where their patients are located, and may need different procedures and protocols across states in order to comply with each state’s laws.