Prescribing on Telehealth Is Still Real Medicine

The rules for prescribing on telehealth have shifted more in the last three years than in the twenty before them. Some of that was pandemic-era flexibility that kept getting extended, some was DEA rulemaking that landed in 2025, and some was quiet state-level tightening that most practices missed until a pharmacist called and asked why they were sending a scheduled prescription across state lines.

The short version: most day-to-day prescribing on telehealth in 2026 is straightforward and looks like it did in 2019. Controlled substances are the exception, and the rules there are a moving target. If you run a small practice and want to stay out of trouble, you need to know four things: what federal law now requires, what your state adds on top, what your platform has to support, and what to document.

This post walks through all four. It is not legal advice, and the DEA's final Special Registration framework is still rolling into practice, so cross-check anything that matters against the current published rule. What follows is the working version most small practices are using right now.

The Easy Stuff: Non-Controlled Prescriptions

Non-controlled medications are the 90 percent case for most primary care, therapy, and specialty practices. Antibiotics, antihypertensives, antidepressants that are not scheduled, statins, PPIs, thyroid meds, GLP-1s, oral contraceptives, most everyday inhalers, and the rest of the everyday formulary are all prescribable on telehealth without any special federal registration.

What you still need:

  • An active state license in the state where the patient is physically located during the visit. Not where they live on paper, where they actually are when the call happens. This is the single most common trip-up in telehealth prescribing.
  • An established provider-patient relationship, which for non-controlled drugs is created by the telehealth visit itself in most states. A few states still require an initial in-person visit for specific medications (abortion medications are the loudest example), so check your own state.
  • A real clinical encounter that supports the prescription. A history, a focused exam appropriate to the medication, an assessment, a plan. A five-line note that says "requested refill, sent" is not a clinical encounter, and it will not hold up if anyone looks.
  • E-prescribing through a Surescripts-connected tool, which almost every state requires for new prescriptions now, controlled or not. Paper prescriptions are functionally gone for telehealth.

Do that, and non-controlled prescribing on telehealth is genuinely no different from prescribing in the exam room. Faxed prescriptions and phone-in refills are the same as they always were. The patient picks it up at their pharmacy of choice.

The Hard Stuff: Controlled Substances

This is where practices actually get in trouble, and where the rules keep moving. The core statute is the Ryan Haight Act, which since 2008 has required an in-person medical evaluation before you can prescribe a controlled substance over the internet. A stack of pandemic waivers suspended that requirement. Those waivers were extended, extended again, and finally replaced by the DEA's 2025 telemedicine rulemaking, which created a narrower, permanent path.

Here is the practical shape of it as of 2026:

  • Schedule III to V, non-narcotic. Many of these (buprenorphine for opioid use disorder, non-narcotic Schedule IV like most benzodiazepines and some sleep meds, testosterone) can be prescribed via telehealth without a prior in-person visit under the current DEA framework, subject to caps and documentation. Buprenorphine for OUD specifically has its own carve-out that lets you start treatment on audio-video telehealth and, in most cases, an audio-only visit for the initial evaluation.
  • Schedule II stimulants and narcotics. The default rule is back to Ryan Haight: an in-person evaluation before you prescribe, or a valid exception. The exceptions include a prior in-person visit with any DEA-registered practitioner (with a signed referral), telemedicine within a DEA-registered hospital or clinic where the patient is physically present, and the new Special Registration for practitioners who meet the qualifying criteria. If none of those apply, you cannot prescribe Schedule II via telehealth alone.
  • Special Registration. The DEA's Special Registration for Telemedicine created a new category of practitioner who can prescribe certain controlled substances via telehealth without an in-person visit. Approval is not automatic, applications take time, and there are ongoing reporting and audit requirements. If your practice model depends on prescribing Schedule II via telehealth, this is the path. If it does not, do not bother.
  • State law can be stricter. Several states have layered on their own rules for controlled prescribing on telehealth, some capping days supply, some requiring in-person follow-up within a set window, some banning specific medications entirely. Federal law is the floor. Your state may raise it.

The consequence of getting this wrong is not a slap on the wrist. It is a DEA action against your registration, a state board complaint, and in the worst cases criminal referral. If a Schedule II prescription is at the edge of your workflow, get a compliance opinion in writing before you rely on it.

EPCS: The Technical Piece You Cannot Skip

Every state now requires electronic prescribing for controlled substances (EPCS) for any controlled prescription, telehealth or not. EPCS is not "e-prescribing plus." It is a specific DEA workflow that requires:

  • Identity proofing of the prescriber, done through a DEA-approved credential service provider, before EPCS is turned on.
  • Two-factor authentication at the moment of signing the prescription, using something you know (password) plus something you have (hardware token, one-time password app, biometric on a device provisioned for you).
  • An audit trail that the DEA can inspect, showing who signed what, when, and how.
  • DEA-audited software on both the prescriber end (your e-Rx tool) and the pharmacy end.

Confirm your e-prescribing tool is EPCS-certified and that your specific account is enabled. A lot of prescribers assume EPCS is on because e-prescribing is on. It is not. You have to complete identity proofing separately, provision your two-factor method, and toggle it on. Small practices often miss this until the first controlled prescription bounces back from the pharmacy.

If you are hiring an associate or a nurse practitioner, EPCS setup is part of their onboarding, not an afterthought. Budget a week for it.

Patient Location: The Question You Ask Every Visit

Prescribing on telehealth turns on where the patient is at the moment of the visit, not where they live, not where their insurance card was issued, not where the pharmacy is. Ask at booking, then ask again at the start of the visit. Chart the answer.

Concrete workflow that catches almost every case:

  • Intake form collects state and, for controlled prescribing, a specific city or ZIP. Not just for the mailing address, for the actual location at visit time.
  • Provider verification at visit start. First question after "how are you?" is "where are you calling from today?" If it is not a state you are licensed in, you cannot see the patient, full stop. Reschedule and offer a referral.
  • Snowbird patients. A patient who splits time between two states needs your license in both, or you need to schedule visits when they are in the state you can see them in. Do not wing this.
  • Travel visits. A patient calling from a hotel in Vegas while their home is in Denver is a Vegas visit for licensing purposes. Even for a simple refill. The number of state boards that have opened files on out-of-state travel prescribing has quietly climbed.
  • Cross-border pharmacies. You can send a prescription to a pharmacy in a state other than where the patient is, but the prescribing act happens where the patient is. Do not let a pharmacy address confuse the licensing analysis.

The Interstate Medical Licensure Compact, the PSYPACT compact for psychology, the Nurse Licensure Compact, and various physical therapy and counseling compacts make multi-state work cheaper than it used to be. Use them. Add compact licenses in the states where you already have patients before you take a new patient in a state you are not licensed in.

What Your Telehealth Platform Actually Has to Do

Your telehealth platform does not write the prescription. Your e-Rx tool does. But the platform still has to support the workflow around prescribing, and small practices often discover a gap the first time they try to prescribe something regulated.

The minimum your platform needs to do:

  • Confirm patient identity on the visit. For controlled prescribing you should be able to see the patient's face and match it to a government ID on file, at least at the first visit. A video-only or SMS-only relationship for a new controlled prescription is a red flag.
  • Capture and store the patient's location. Ideally as a required field at visit start, with the answer in the chart note.
  • Support real audio-video visits that meet the DEA's definition of a two-way interactive telecommunications system. Phone-only visits are allowed for a shrinking list of use cases (buprenorphine for OUD is one), but the default for controlled prescribing is video.
  • Integrate or coexist with your e-Rx tool. You do not need one tool that does both, but you do need a workflow where the provider is not alt-tabbing between six windows during a visit.
  • Provide a defensible chart note. Timestamps, participants, duration, mode (video, audio, SMS), and location. If your platform's note export cannot answer "who, what, when, where, how" at a glance, replace it before the first audit.

You do not need a platform that markets itself as a "prescribing platform." You need a solid telehealth platform, a compliant e-Rx tool, and a workflow you have actually walked through end-to-end at least once for each visit type you offer.

What to Document, Every Single Time

Documentation is what turns a defensible prescription into a bulletproof one. It is also what turns a lazy prescription into a board complaint. Small practices tend to over-document non-controlled prescriptions and under-document controlled ones, which is exactly backwards.

For every prescription written on telehealth:

  • Visit mode (video, audio-only, SMS) and the reason if it was not video.
  • Patient location at the time of the visit, at least state and city.
  • Chief complaint and history that supports the prescription. Even for a refill, note the ongoing condition and how it is being managed.
  • Focused exam appropriate to the medication. What you can see and hear on video counts as an exam. Say what you observed.
  • Medication reconciliation confirming what the patient is currently taking, including OTC and supplements. Interactions are the number-one avoidable harm.
  • Assessment and plan tying the prescription to the diagnosis. "Refill Lexapro 20 mg, tolerating well, no side effects, no red flags" is a plan. "Refill" alone is not.

For controlled substances, add:

  • PDMP check (Prescription Drug Monitoring Program) at every visit where you are prescribing a controlled substance, and document the result. Most states require this by law. All of them expect it.
  • Signed controlled substance agreement on file, especially for chronic controlled prescribing. Renew annually.
  • Risk assessment for misuse or diversion when clinically indicated. Screening tools like the ORT for opioids or the SBIRT approach for stimulants are the standard of care.
  • The legal basis for the prescription if you are using a Ryan Haight exception (prior in-person visit, referral, Special Registration). One line in the chart that names the exception is enough.
  • Days supply and refill plan that reflects both clinical need and any state cap on telehealth-issued controlled prescriptions.

Templates help. Boilerplate is fine. What matters is that the fields have real values in them and reflect what actually happened on the visit.

A Simple Decision Tree Before You Prescribe

When a telehealth visit ends with "I need to write a prescription," run through this quickly. It takes ten seconds and it will keep you out of most of the trouble small practices actually run into.

  1. Am I licensed where this patient is right now? If no, stop. Reschedule or refer.
  2. Is this drug controlled? If no, prescribe as you would in the exam room. Document normally.
  3. If controlled, what schedule? Schedule III to V: check your state's telehealth rules for that specific class, then proceed with PDMP, agreement, and full documentation. Schedule II: verify you have a valid Ryan Haight exception or Special Registration before writing. If not, do an in-person or referral instead.
  4. Is EPCS enabled on my account? If not, you cannot send it. Fix your setup before you tell the patient you will send the prescription today.
  5. Have I documented state, mode, exam, plan, and any exception used? If not, do it now, not next week.

The Bottom Line

Prescribing on telehealth in 2026 is easier than the noise suggests for non-controlled medications and harder than most practices realize for Schedule II. The rules are stable enough now that you can build a workflow you trust, as long as you actually build it.

Know your licensure, know your drug schedules, keep EPCS working, ask where the patient is every visit, and document like an adult. Pick a telehealth platform that gets out of the way so you can spend the visit on the patient instead of on your setup. Do that, and prescribing on telehealth is not a source of risk, it is one of the reasons your patients love the practice.