DEA Telemedicine Rule Sits at OMB as December 31 Nears

The Drug Enforcement Administration (DEA) sent its final rule creating a special registration for telemedicine to the White House Office of Management and Budget (OMB) on August 25, 2026, and as of October 11 the rule is still listed as pending review at OMB’s Office of Information and Regulatory Affairs (OIRA). The temporary flexibilities it is meant to replace, which let DEA-registered practitioners prescribe Schedule II through V controlled substances by telemedicine to patients they have never seen in person, expire at the end of December 31, 2026. That leaves 81 days.

The gap matters most for telehealth businesses that start new patients on controlled medications after a video visit: stimulants for attention deficit hyperactivity disorder (ADHD), which are Schedule II, testosterone and buprenorphine, which are Schedule III, and similar lines. In the extension it published last December, DEA cited a stakeholder’s summary of unpublished data reviewed by Epic, Johns Hopkins, and Stanford: of about 44.6 million controlled substance prescriptions written across 258 organizations in 2024, more than 7 million, roughly 16 percent, were issued without a prior in-person evaluation.

What the fourth extension allows, and for how long

DEA and the Department of Health and Human Services (HHS) published the Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities at 90 FR 61301 on December 31, 2025, the same day the third extension was due to lapse. DEA Administrator Terrance C. Cole signed it on December 15. The rule is effective January 1 through December 31, 2026, and the regulation it revises, 21 CFR 1307.41, says the authorization “expires at the end of December 31, 2026.”

Until then, a prescription issued without an in-person evaluation must meet four conditions. It must be for a legitimate medical purpose in the usual course of professional practice. It must come out of a real-time interactive telecommunications system as defined in Medicare rules. The practitioner must hold a DEA registration covering that class of drug, or be exempt from one. And the prescription must satisfy the rest of DEA’s prescription rules in 21 CFR part 1306. DEA’s December 31 announcement describes the visits as audio-video, with audio-only allowed for Schedule III through V medications approved for treating opioid use disorder (OUD).

The deadline does not touch every patient. Under the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, once a practitioner has conducted at least one in-person medical evaluation of a patient, the law’s remote prescribing limits no longer apply to that relationship, however long ago the visit took place. The exposure falls on patients who have only ever been seen on a screen, and on the new patients a telehealth site plans to sign up in January.

Where the special registration rule stands

The rule under review grows out of a proposal DEA published on January 17, 2025, Special Registrations for Telemedicine and Limited State Telemedicine Registrations (90 FR 6541, RIN 1117-AB40). Congress authorized such a registration in the Ryan Haight Act, and the SUPPORT Act of 2018 set a statutory deadline of October 24, 2019 for the regulations. DEA’s entry in the Fall 2025 Unified Agenda still lists that deadline, rates the rule economically significant, and gives November 2026 as the target for final action. The entry also says DEA was working through more than 6,400 public comments on the proposal.

OIRA’s public meeting log shows the rule drawing outside attention since it arrived. Groups met with OMB and Justice Department staff about it at least eight times between September 18 and September 29, including a September 21 call requested on behalf of the American Academy of PAs that also included representatives of the American Psychiatric Association. Two more meetings are scheduled, for October 16 and November 2. The text DEA submitted is not public.

Executive Order 12866 gives OIRA 90 calendar days to review a rule like this one, with a single extension of up to 30 days. Counted from August 25, that puts the outer limits at November 23 and December 23. Those limits govern OIRA’s review, not publication. A rule cleared in late November would still need to be published and take effect, and nothing public yet says whether DEA plans a transition period for practitioners and platforms that would need new registrations.

What the January 2025 proposal would require

The final rule may differ from the proposal, which is the only public version. As proposed, it created three registrations, each on a three-year cycle with an $888 fee:

Telemedicine Prescribing Registration, letting qualified clinicians prescribe Schedule III through V drugs by telemedicine without a prior in-person visit.
Advanced Telemedicine Prescribing Registration, for Schedule II through V drugs, limited to specialists such as psychiatrists treating mental health conditions, hospice and palliative care physicians, physicians treating long-term care residents, pediatricians with a parent or guardian present, and certain neurologists.
Telemedicine Platform Registration, for “covered online telemedicine platforms” acting as intermediaries.

Every special registrant would also need a DEA-issued State Telemedicine Registration for each state where its patients are located, at $50 per state for clinicians and $888 per state for platforms. Prescriptions would have to be sent through electronic prescribing for controlled substances (EPCS) after the prescriber verified the patient’s identity and checked prescription drug monitoring program (PDMP) data, and each prescription would carry the special registration numbers of the clinician and of any platform involved. For Schedule II drugs, the prescriber would have to be in the same state as the patient, and telemedicine prescriptions under the special registration would have to stay below 50 percent of the prescriber’s Schedule II prescriptions each month.

For online businesses, the platform definition is the most consequential part. The proposal covered an entity that connects patients with clinicians by audio-video for care that may lead to a controlled substance prescription, is not a hospital, clinic, insurer, or local in-person practice, and meets at least one of four tests. It explicitly promotes or advertises controlled substance prescribing. It has a financial interest tied to the volume or type of those prescriptions, such as owning or taking rebates from the pharmacies that fill them. It influences prescribing through protocols, quotas, prescriber pay tied to prescribing rates, or steering patients to preferred pharmacies. Or it controls the prescriptions or medical records of those patients. In its background discussion, DEA noted that some of these platforms charge patients a monthly subscription for consultations.

The buprenorphine rule stays in effect either way

One permanent pathway is already in place. DEA’s Expansion of Buprenorphine Treatment via Telemedicine Encounter final rule, which added 21 CFR 1306.51 and took effect December 31, 2025, lets practitioners prescribe Schedule III through V medications approved for OUD by telemedicine, audio-only included. The prescriber must first review the patient’s PDMP history for the past year in the state where the patient is located, and the pharmacist must check the patient’s identification before filling. Prescriptions under the rule are capped at six calendar months from the first one. After that, the patient needs an in-person evaluation or another lawful telemedicine pathway. A companion rule covers Veterans Affairs patients.

That rule does nothing for ADHD stimulants, testosterone, or other controlled drugs prescribed for anything other than OUD. For those lines, the special registration rule or a fifth extension is the only route to new remote patients after December 31.

What the Ryan Haight default means for online intake

If neither arrives in time, the baseline in the Controlled Substances Act returns for patients who have never been seen in person. A “valid prescription” for a controlled substance dispensed by means of the internet then requires at least one in-person medical evaluation, unless the practitioner fits one of the statute’s narrow telemedicine exceptions, such as certain visits where the patient is physically inside a DEA-registered hospital or clinic.

The statute’s internet provisions already reach past prescribers. Among the examples of unlawful conduct listed in 21 U.S.C. 841(h) are knowingly serving as an intermediary that uses the internet to bring together a buyer and seller of controlled substances in a way the statute does not authorize, and offering to fill a controlled substance prescription based solely on an online questionnaire. Those provisions apply now. What changes on January 1 without new authority is how many remote prescriptions to new patients fall outside the law’s exceptions.

Where the checkout and payments exposure sits (analysis)

For site owners, the most direct exposure is money already collected for care that may not be deliverable. A patient who buys a three-month membership in November expecting a stimulant or testosterone prescription after a video visit, and who has never seen the clinician in person, could reach January without a remote path to that prescription if nothing changes. Membership terms, renewal notices, and refund policies written around the current rules may need a version that covers that case, and pages that describe controlled prescriptions after a video visit will need to match whatever rule is in force on January 1. Businesses that already split consult fees from pharmacy charges, an approach EC4IM covered in its report on telehealth checkout flows that separate consult payment from pharmacy fulfillment, have a clearer line for deciding what to refund.

Intake logic is the second pressure point. Whatever happens in December, the in-person question and the buprenorphine rule’s clock will still matter, so a sign-up flow may need to record whether the patient has had an in-person evaluation with the prescriber, which state the patient is in at the time of the visit, and, for OUD programs, when the six-month clock started. If the final rule keeps platform registration, an operator’s own marketing, pharmacy relationships, and clinical protocols would help determine whether it has to register, which turns site copy and partner agreements into compliance records.

Payments partners read the same signals. LegitScript, whose healthcare merchant certification it says Visa and Mastercard recognize, requires certified businesses to comply with relevant telemedicine laws and asks for DEA certificate information where controlled substances are involved, according to its certification standards. A telehealth brand that described its stimulant or testosterone service to its acquirer, or to a telemedicine payments specialist like Organic Payment Gateways, in terms of today’s remote prescribing rules has built that underwriting file on a regulation with a printed end date. Updating the description before a renewal review is likely to be an easier conversation than explaining a jump in refunds and disputes after January 1.

What remains unknown

Several facts that would settle planning are still missing. The final rule’s text, including whether the platform registration survived the comment period, has not been released. Neither has its effective date, or any word on whether DEA will give current practitioners and platforms time to register. DEA has not said whether it is preparing a fifth extension, though each expiration since 2023 has been headed off with a temporary rule, the latest published on the final day of 2025. EC4IM found no DEA or HHS statement since that December 31 announcement on the timing of either step.

A deadline with one fixed date and several moving parts

DEA’s pandemic-era authority for remote controlled substance prescribing runs out at the end of December 31, 2026, and the permanent special registration rule meant to follow it has been at OMB since August 25 with a November target and no public text. The January 2025 proposal would add three DEA registrations, state-by-state credentials, Schedule II limits, and a registration duty for some online platforms, while the separate buprenorphine rule already keeps a six-month remote pathway open for OUD treatment. For telehealth sites selling consults that lead to stimulant, testosterone, or similar prescriptions, the practical work over the next 11 weeks involves memberships, refunds, intake questions, and the description of the business their payments partners have on file, because the rule that governs those prescriptions in January may not be known until late in the year.

DEA Telemedicine Flexibilities Near Their December 31 End With the Final Rule Still at White House Review