Telehealth and Telemedicine

In 2008, Congress passed the Ryan Haight Act (21 U.S.C. § 802(54)) (“Ryan Haight”) following the death of Ryan Haight, a young man who overdosed on prescription painkillers he purchased from an online pharmacy without a valid prescription. Ryan Haight amended the federal Controlled Substances Act (21 U.S.C. 802 et seq.) and specifically prohibits dispensing controlled substances via the internet without a “valid prescription” which, according to the law, must be issued for a legitimate medical purpose and may only be issued once a physician has conducted at least one in-person evaluation of the patient (i.e., before issuing the remote prescription for the controlled substance). Certain exceptions may apply, but arguably none contemplate the direct-to-patient virtual care models that many of today’s telehealth / telemedicine companies are utilizing.

The intent behind the enactment of Ryan Haight in 2008 was to shut down online pharmacies and to restrict access to painkillers and other controlled substances provided to patients in ways that could circumvent a physician’s examination (and the issuance of a valid prescription, if the physician determined it was an appropriate course of treatment for the patient). Unfortunately, the effect of enacting Ryan Haight was, in reality, much more significant – not only restricting access via online pharmacies to the deadliest or most addictive painkillers, but also banning the issuance of remote prescriptions for any controlled substances unless an in-person visit occurred first between the physician and the patient. What the requirements imposed by Ryan Haight ignore is that there are many more drugs in Schedules II – V that are designed to treat patients for a panoply of non-pain related illnesses, many of which can be prescribed safely and effectively by means of an appropriate telehealth encounter. While Congress largely has ignored calls to revise Ryan Haight to address this issue, some states have started to rethink how, at least at the state level, they will handle the issue of health care providers prescribing controlled substances through non-traditional treatment arrangements, such as the use of telehealth / telemedicine.

An example is Indiana, where the legislature recently amended Indiana Code 25-1-9.5-8 (in 2017) to expand the list of drugs that may be prescribed by authorized prescribers through telehealth / telemedicine. Originally enacted in 2016, the law banned the remote prescribing of all controlled substances if such prescribing was done via a telehealth / telemedicine encounter. The revised law dramatically expands the ability to prescribe, via telehealth / telemedicine, certain controlled substances, and only limits such prescribing practices with respect to opioids, abortion inducing drugs, and/or ophthalmic devices (i.e., contact lenses and glasses). The Indiana law is particularly thoughtful and timely because it excludes from the ban any opioids that act as partial-agonists are used to treat or manage opioid dependence. Therefore, the Indiana law not only expands treatment options by allowing the remote prescribing of many controlled substances, including some that can be used to treat opioid dependence disorders, but does so in a manner that attempts, discretely, to address the opioid dependence epidemic by limiting access to most opioids.

Following a similar path is Hawaii, which like Indiana has excluded the remote prescription of opioids via telehealth as well as medical cannabis. While Hawaii’s laws do not explicitly permit the remote prescription of controlled substances, the fact that Hawaii Statutes Revised § 329-1 does not distinguish between the prescribing of controlled and non-controlled substances (within the context of discussing the rules related to remote prescribing) and that Hawaii Statutes Revised § 453-1.3 only requires an in-person examination prior to prescription of opioids and medicinal cannabis, would logically support the assumption that prescribing other, less controversial controlled substances would be permissible. Like Hawaii, Florida is another state that has taken a more nuanced approach to remote prescribing of controlled substances via telehealth / telemedicine. Florida Administrative Code rule 64B8-9.0141, for example, permits the prescription of controlled substances to treat psychiatric disorders.

Simultaneously, some states also have continued to build, refine, and expand statewide databases that store information regarding the prescriptions for controlled substances written by practitioners licensed by the state. This information can help physicians and other prescribing health care providers to determine, if and when contemplating the issuance of a remote prescription to a certain patient, whether that patient may be “doctor shopping” and/or whether concomitant medications may pose a risk to a patient if he/she is prescribed a particular drug. These databases, and the laws creating and amending them, may be one reason why states are more willing to expand remote prescribing practices given these new additional safeguards.

By contrast, to date the Drug Enforcement Agency (DEA) has taken no additional steps to clarify or refine the requirements under Ryan Haight since it was enacted. When Ryan Haight was first passed, it included an exception on its applicability for prescribers who obtain a “special registration” from the Attorney General or the Administrator of DEA per 28 CFR 0.100. When Ryan Haight was passed, Congress contemplated that DEA would “promulgate regulations governing the issuance to practitioners of a special registration relating to the practice of telemedicine;” however, neither DEA nor any other agency has provided any additional information regarding this special registration since Ryan Haight was first signed into law in 2008. In 2015, DEA proposed making a rule that would provide clarity to the “special registration” exception; however, in 2016 DEA amended the proposed rule-making to a “Long-Term Action” with no set deadline, further delaying even the idea of providing additional clarity. Perhaps the DEA’s response is a reaction to states that strongly oppose providing prescribing information to other states or even to the federal government for various reasons, including privacy concerns. That is to say, perhaps states are more willing to loosen remote prescribing laws for controlled substances because the databases they control and the data provided thereunder have eased concerns with allowing prescribers to prescribe as they see fit based on the information available regardless of whether the prescriber is physically present in the same room as the patient.

In the end, and regardless of the reasons, Ryan Haight continues to be good law, meaning that it is enforceable against prescribing health care practitioners. Despite an apparent lack of actual enforcement (the last case against a physician to enforce Ryan Haight was in July of 2011), the DEA technically can choose to enforce Ryan Haight at any time. Prescribers should therefore be cautious and understand that remote prescribing of controlled substances, even within the confines of a state law, still could be considered a violation of federal law with penalties including prison, fines, and temporary or permanent loss of the prescriber’s DEA Registration. Health care providers contemplating the prescribing of any controlled substances through telehealth / telemedicine can benefit from doing diligence with the support of legal counsel to fully understand the potential impacts of Ryan Haight, relevant state laws, and the potential risk involved in such a venture before proceeding.

You need not spend much time reading the news to know that recent Hurricanes Harvey and Irma have disrupted the lives of tens of thousands of individuals, many of whom may already have behavioral health needs; however, the trauma caused by these recent natural disasters, and others, has created an immense need for additional behavioral and mental health services. For example, a 2012 study entitled “The Impact of Hurricane Katrina on the Mental and Physical Health of Low-Income Parents in New Orleans” reported elevated rates of incidence of Post-Traumatic Stress Disorder (“PTSD”), depression, and a need for mental health services for as much as 50 percent of the low-income population affected by Hurricane Katrina, which hit in August 2005. A Fortune Magazine article reported elevated incidences of PTSD, depression, and anxiety experienced by victims of Hurricane Sandy, which hit in October 2012. In the wake of Hurricane Harvey, some telehealth providers have offered free telehealth services to hurricane victims and a few behavioral health providers have established specific programs focused on providing access to behavioral health services. However, additional services are still needed to treat the long-term mental health needs of these victims.

Providers of health services, especially behavioral health services, who utilize telehealth technologies to treat and diagnose victims of natural disasters, should be acutely aware of certain limitations in state laws that may create liability associated with the services they are providing. Treating victims of natural disasters through telehealth technologies can be difficult because a treating provider must determine the patient’s home state and quickly assess how this may affect the provider’s ability to treat the patient; yet, answering this seemingly simple question can be extremely difficult given the uncertainty and displacement for many in the wake of a natural disaster. Consider the following examples involving Amanda, a Houston resident driven from her home by Hurricane Harvey who has decided to seek the services of a psychologist to deal with the significant emotional and psychological upheaval caused by the recent events:

  • Scenario #1: Amanda’s Houston home has been destroyed, so she purchases a new home in another state. In this scenario, a psychologist treating Amanda must be licensed to practice in the new state where Amanda now lives.
  •  Scenario #2: Amanda’s Houston home is damaged, but is not destroyed, so she plans to move back to Houston once the home has been repaired. In the interim, Amanda moves in with family located in Indiana. Ind. Code § 25-1-9.5-7(b) is fairly clear in that a “Telemedicine Provider Certification with the Indiana Professional Licensing Agency . . . [is required] before the provider may establish a provider-patient relationship or issue a prescription for an individual located in Indiana.” Thus, a psychologist treating Amanda must be licensed to practice in Indiana.
  •  Scenario #3: Amanda’s Houston home is damaged, but is not destroyed, so she plans to move back to Houston once the home has been repaired. In the interim, Amanda moves in with family located in West Virginia. W. Va. Code § 30-21-3 allows a psychologist to practice up to ten days per year without seeking licensure or providing any notice to the State. Therefore, Amanda could seek limited treatment from an out-of-state psychologist; however, the psychologist must become licensed in West Virginia if the repairs to Amanda’s home cannot be completed (and, thus, she does not move back to Houston) before her eleventh day of treatment. Please also note that this law pertains to psychologists, only; if Amanda seeks treatment from a psychiatrist or a therapist, different West Virginia laws and regulations may apply.

The question that must be addressed at the very onset of taking on a new patient, or learning that an existing patient has moved, is whether the provider is even permitted by law to treat the patient utilizing telehealth technologies. If the telehealth program through which the provider is treating the patient is only established in one or a few states, the provider may lack the proper professional licensure to provide treatment to patients who move, or even temporarily relocate, to a different state.  Some states, like Washington, have special temporary provisions that will allow a provider to treat patients residing in the state without requiring that the provider obtain a full and unrestricted license to practice; however, many more states do require that providers obtain full and unrestricted licenses to practice in the state before the provider may treat any patients who are residing in the state, even temporarily.  Some states, like West Virginia, may establish a “middle ground” by allowing for limited treatment of patients without having a full and unrestricted license to practice in the state.

Even if a physician has the proper professional licensure to treat a patient residing in a given state, the provider also must understand what the state requires the provider to do in order to establish a physician-patient relationship, as well as any limits placed on the provider’s ability to treat the patient using telehealth technologies under the state’s relevant laws. For example, in Arkansas, a physician-patient relationship may not be established through telehealth means.  Ark. Code Ann. § 17-80-118(e)(1) requires the treating telehealth physician to either already have a relationship with the patient or to act in concert with another provider who has established such a relationship with the patient.  Yet, the opposite is true in other states, including California, where a physician-patient relationship may be established through telehealth means to the extent that the physician can conduct an examination of the patient (utilizing telehealth technology) that is sufficiently comprehensive for the treatment being provided to the patient. Additionally, the treating physician must ensure that any medication she/he prescribes through telehealth encounters can be prescribed under the state’s remote prescribing laws. Most states require that an in-person visit has occurred between the physician and the patient before certain classes or schedules of drugs may be prescribed. This is further complicated by the fact that states often differ with regard to how they schedule these drugs. As a result, a physician may not be able to newly prescribe or help a patient maintain an existing prescription using certain prescription-only drugs, if the patient moves to a state with these types of restrictions in place.

In spite of these potential regulatory obstacles, behavioral health providers have tough choices to make between managing the potential risks of non-compliance with treating victims of natural disasters who can benefit greatly from having access to behavioral health services. Providers can consider options such as establishing questionnaires that request even temporary or part-time address information from patients, so that the providers have this information at the outset of their interactions with the patient rather than learning this information during the initial (or later) therapy sessions. Providers would then have the option to consult counsel or directly discuss the issue with state regulators, if the application of state laws of one possible “home state” could potentially limit or change how the provider would treat the patient, or to give providers the option of seeking a professional license from any additional states in order to provide services to such patients in a compliant manner.

Epstein Becker Green released an Appendix to its “50-State Survey of Telemental/Telebehavioral Health (2016)” with new and updated analysis on the laws, regulations and regulatory policies affecting the practice of telemental/telebehavioral health in all 50 states and the District of Columbia. Since the Survey was released in 2016, states have been incredibly active in their legislative efforts with respect to the provision of telehealth services. As a result, EBG again conducted extensive research to share relevant changes with providers and consumers who are navigating this complex legal and regulatory landscape.

To access the 2017 Appendix, click here. To access the 2016 50-State Survey of Telemental/Telebehavioral Health, click here.