The Ryan Haight Act Online Pharmacy Consumer Protection Act of 2008 (21 U.S.C. § 802(54)) (the “Ryan Haight Act” or “Act”) expanded the federal Controlled Substances Act to define appropriate internet usage in the dispensing and prescribing of schedule drugs, and in doing so effectively banned the issuance of prescriptions via telemedicine services for any controlled substances unless the ordering physician has conducted at least one in-person evaluation of the patient. The Act includes multiple exceptions that permit prescribing of controlled substances without conducting an in-person evaluation, the most relevant to the practice of telemedicine being the mandate that the Drug Enforcement Administration (“DEA”) or other federal agency establish rules for a “Special Registration” to be utilized by health care providers. However, despite the statutory mandate, since the 2008 passing of the Act neither the DEA nor any other federal agency has promulgated any regulation or other guidance regarding the development and implementation of such a Special Registration process.

Several previous TechHealth Perspectives blog posts have highlighted the pressures imposed from Congress on the DEA to promulgate the Special Registration process in the wake of the opioid crisis and the recent passage of House Bill 5483, entitled the “Special Registration for Telemedicine Clarification Act of 2018” (the “Bill”), which seeks to address the lack of regulatory guidance regarding the Special Registration exception to the Ryan Haight Act.  Ironically, the Bill would require the DEA to promulgate rules that are already required under the Ryan Haight Act to allow health care providers to apply for a Special Registration.

In the interim, state legislatures have started passing their own laws to address the issue of remote prescribing of controlled substances by telemedicine providers. State remote prescribing legislation varies widely among the states that have enacted such provisions, but generally fits into one of three categories:

Category I—Remote Prescribing is Allowed. Many states have not regulated the remote prescribing of controlled substances any differently than how the state has regulated in-person prescribing practices, or states have placed very minimal, added responsibilities on telemedicine providers seeking to do remote prescribing of controlled substances, which primarily are intended to ensure that the standard of care provided in the telemedicine delivery setting sufficiently mirrors the standard of care provided in the traditional in-person delivery setting. Examples of states that have taken this route include Arizona, Kentucky, Maine, Minnesota, Missouri, Tennessee, and Vermont.

Category II—Remote Prescribing is Prohibited. A handful of states have completely prohibited the remote prescribing of controlled substances or only permit it to occur in rare instances. Connecticut and Georgia (citation available just past verification page) are examples of two states that have adopted this approach.

Category III—Remote Prescribing is Allowed, But Additional Burdens and Barriers Are Placed on Prescribing Providers. Several states, including New Jersey, North Dakota, Oklahoma, and South Carolina, require at least one in-person appointment before a health care provider can remotely prescribe controlled substances or scheduled narcotics / medications to their patients. While these states may allow for the remote prescribing of controlled substances, there may be limits on prescribing activities, including limits on the types of controlled substances that can be remotely prescribed (and expressly prohibiting the prescribing of certain controlled substances entirely, such as opioids and certain schedule narcotics).

Regardless of which category a state may fall into, many of these states’ laws would be in direct conflict with the Special Registration exception under the Act, if it is ever formulated. That is, many states either prohibit the remote prescribing of controlled substances without an initial in-person consult, or impose more stringent conditions on remote prescribing than what is mandated under current federal law. The question is whether federal law would preempt any state law that is inconsistent with the Special Registration exception and would prohibit remote prescribing without an in-person examination even if the health care provider holds a Special Registration from the federal government.

Congress expressly retained supremacy and preemption through provisions of the Controlled Substances Act (21 U.S.C. § 903): “[n]o provision of this subchapter shall be construed as indicating an intent on the part of the Congress to occupy the field in which that provision operates, including criminal penalties, to the exclusion of any State law on the same subject matter which would otherwise be within the authority of the State, unless there is a positive conflict between that provision of this subchapter and that State law so that the two cannot consistently stand together.” The legislative intent is clear that upon the passing of the Controlled Substances Act, Congress anticipated federal and state conflicts of law and expressly directed that federal law would control. However, the drafting yields some authority to the states and is somewhat ambiguous on relevant points.

Thus, states may also regulate remote prescribing and many have taken the opportunity to do so. If the DEA or any other federal agency promulgate rules that potentially could affect any of the existing state laws pertaining to remote prescribing, the supremacy provision  in the Controlled Substances Act is sufficiently vague such that states could craft creative legal arguments providing that the federal and the state laws can consistently stand together. Currently, no entity (federal or state) has challenged any of the existing state laws as conflicting with the Ryan Haight Act or the exceptions for remote prescribing without an initial in-person examination. However, should such an action be filed, federal preemption could overrule any inconsistent state laws, rules, or regulations.

Recently, we have seen some indicia of federal preemption in the telehealth arena with the Department of Veterans Affairs asserting dominance over any state regulation and oversight of telemedicine services with the promulgation of recent regulation (38 C.F.R. § 17.417) which states in no uncertain terms that the federal rule overrides any conflicting state laws. Moreover, the notice and comments from the Department of Veterans Affairs strongly invoke federalism in this area.

Ultimately, federal law could preempt the various state laws that completely prohibit telehealth prescribing, as well as those state laws that have put in place barriers to remote prescribing that are inconsistent with the Ryan Haight Act. Upon the promulgation of the Special Registration process, if and when it may occur, each state will have to assess and address any inconsistencies with federal law in the area of remote prescribing. Of course, while the provisions in the Ryan Haight Act addressing Special Registration do not have limitations on what kind of controlled substances could be remotely prescribed without an in-person examination under the exception, the Special Registration could incorporate limitations on the type of controlled substances that can be remotely prescribed without an in-person examination (similar to current requirements in a number of states).

In the end, the DEA (or whatever other federal agency decides to address the issue of remote prescribing) will need to find a balance when developing the Special Registration process, as there are legitimate concerns surrounding how to address the opioid crisis which is at the forefront of ongoing public health discussions. The current federal stance related to the opioid abuse in this country may prompt federal regulators to turn a blind eye to any conflicting state law or, in the alternative, it may prompt the federal regulators to exercise the power to promote access to needed treatment. The federal government may have the right to preempt and enforce against state laws inconsistent with the Ryan Haight Act; however, most state laws are generally aligned with the public policy intent behind the Ryan Haight Act. Below are additional resources which will be helpful in attaining a broader understanding of the current public information on both the state and federal level concerning the Opioid Crisis:

Rebecca Francis, a Summer Associate (not admitted to the practice of law) in the firm’s Houston Office, contributed significantly to the preparation of this post.

In 2008, Congress passed the Ryan Haight Act (21 U.S.C. § 802(54)) (“Ryan Haight”) following the death of Ryan Haight, a young man who overdosed on prescription painkillers he purchased from an online pharmacy without a valid prescription. Ryan Haight amended the federal Controlled Substances Act (21 U.S.C. 802 et seq.) and specifically prohibits dispensing controlled substances via the internet without a “valid prescription” which, according to the law, must be issued for a legitimate medical purpose and may only be issued once a physician has conducted at least one in-person evaluation of the patient (i.e., before issuing the remote prescription for the controlled substance). Certain exceptions may apply, but arguably none contemplate the direct-to-patient virtual care models that many of today’s telehealth / telemedicine companies are utilizing.

The intent behind the enactment of Ryan Haight in 2008 was to shut down online pharmacies and to restrict access to painkillers and other controlled substances provided to patients in ways that could circumvent a physician’s examination (and the issuance of a valid prescription, if the physician determined it was an appropriate course of treatment for the patient). Unfortunately, the effect of enacting Ryan Haight was, in reality, much more significant – not only restricting access via online pharmacies to the deadliest or most addictive painkillers, but also banning the issuance of remote prescriptions for any controlled substances unless an in-person visit occurred first between the physician and the patient. What the requirements imposed by Ryan Haight ignore is that there are many more drugs in Schedules II – V that are designed to treat patients for a panoply of non-pain related illnesses, many of which can be prescribed safely and effectively by means of an appropriate telehealth encounter. While Congress largely has ignored calls to revise Ryan Haight to address this issue, some states have started to rethink how, at least at the state level, they will handle the issue of health care providers prescribing controlled substances through non-traditional treatment arrangements, such as the use of telehealth / telemedicine.

An example is Indiana, where the legislature recently amended Indiana Code 25-1-9.5-8 (in 2017) to expand the list of drugs that may be prescribed by authorized prescribers through telehealth / telemedicine. Originally enacted in 2016, the law banned the remote prescribing of all controlled substances if such prescribing was done via a telehealth / telemedicine encounter. The revised law dramatically expands the ability to prescribe, via telehealth / telemedicine, certain controlled substances, and only limits such prescribing practices with respect to opioids, abortion inducing drugs, and/or ophthalmic devices (i.e., contact lenses and glasses). The Indiana law is particularly thoughtful and timely because it excludes from the ban any opioids that act as partial-agonists are used to treat or manage opioid dependence. Therefore, the Indiana law not only expands treatment options by allowing the remote prescribing of many controlled substances, including some that can be used to treat opioid dependence disorders, but does so in a manner that attempts, discretely, to address the opioid dependence epidemic by limiting access to most opioids.

Following a similar path is Hawaii, which like Indiana has excluded the remote prescription of opioids via telehealth as well as medical cannabis. While Hawaii’s laws do not explicitly permit the remote prescription of controlled substances, the fact that Hawaii Statutes Revised § 329-1 does not distinguish between the prescribing of controlled and non-controlled substances (within the context of discussing the rules related to remote prescribing) and that Hawaii Statutes Revised § 453-1.3 only requires an in-person examination prior to prescription of opioids and medicinal cannabis, would logically support the assumption that prescribing other, less controversial controlled substances would be permissible. Like Hawaii, Florida is another state that has taken a more nuanced approach to remote prescribing of controlled substances via telehealth / telemedicine. Florida Administrative Code rule 64B8-9.0141, for example, permits the prescription of controlled substances to treat psychiatric disorders.

Simultaneously, some states also have continued to build, refine, and expand statewide databases that store information regarding the prescriptions for controlled substances written by practitioners licensed by the state. This information can help physicians and other prescribing health care providers to determine, if and when contemplating the issuance of a remote prescription to a certain patient, whether that patient may be “doctor shopping” and/or whether concomitant medications may pose a risk to a patient if he/she is prescribed a particular drug. These databases, and the laws creating and amending them, may be one reason why states are more willing to expand remote prescribing practices given these new additional safeguards.

By contrast, to date the Drug Enforcement Agency (DEA) has taken no additional steps to clarify or refine the requirements under Ryan Haight since it was enacted. When Ryan Haight was first passed, it included an exception on its applicability for prescribers who obtain a “special registration” from the Attorney General or the Administrator of DEA per 28 CFR 0.100. When Ryan Haight was passed, Congress contemplated that DEA would “promulgate regulations governing the issuance to practitioners of a special registration relating to the practice of telemedicine;” however, neither DEA nor any other agency has provided any additional information regarding this special registration since Ryan Haight was first signed into law in 2008. In 2015, DEA proposed making a rule that would provide clarity to the “special registration” exception; however, in 2016 DEA amended the proposed rule-making to a “Long-Term Action” with no set deadline, further delaying even the idea of providing additional clarity. Perhaps the DEA’s response is a reaction to states that strongly oppose providing prescribing information to other states or even to the federal government for various reasons, including privacy concerns. That is to say, perhaps states are more willing to loosen remote prescribing laws for controlled substances because the databases they control and the data provided thereunder have eased concerns with allowing prescribers to prescribe as they see fit based on the information available regardless of whether the prescriber is physically present in the same room as the patient.

In the end, and regardless of the reasons, Ryan Haight continues to be good law, meaning that it is enforceable against prescribing health care practitioners. Despite an apparent lack of actual enforcement (the last case against a physician to enforce Ryan Haight was in July of 2011), the DEA technically can choose to enforce Ryan Haight at any time. Prescribers should therefore be cautious and understand that remote prescribing of controlled substances, even within the confines of a state law, still could be considered a violation of federal law with penalties including prison, fines, and temporary or permanent loss of the prescriber’s DEA Registration. Health care providers contemplating the prescribing of any controlled substances through telehealth / telemedicine can benefit from doing diligence with the support of legal counsel to fully understand the potential impacts of Ryan Haight, relevant state laws, and the potential risk involved in such a venture before proceeding.