The Ryan Haight Act requires the prescriber to examine the patient in person at least once before prescribing a controlled substance over the internet. It lists seven telemedicine exceptions. Every federal telehealth extension since 2020 has used one of those exceptions for a limited period. As of September 2026, the current one ends December 31, 2026.
The rule is one sentence long
“No controlled substance that is a prescription drug” under federal law “may be delivered, distributed, or dispensed by means of the Internet without a valid prescription” (21 U.S.C. § 829(e)(1)). A valid prescription is one issued for a legitimate medical purpose in the usual course of practice by “a practitioner who has conducted at least 1 in-person medical evaluation of the patient,” or by a covering practitioner.
Congress passed it in October 2008 and it took effect on April 13, 2009. The Senate report explains the name. Ryan Haight died in February 2001, at 17, from an overdose of drugs he ordered online. His family learned that “a doctor Ryan had never seen prescribed the medications, and an online pharmacy had delivered them to him at home.” The statute was written for that fact pattern. It reaches your telehealth program because the text does not distinguish a rogue pharmacy site from a video visit.
It applies only to controlled substances. Testosterone, ketamine and the stimulants are scheduled. Semaglutide, tirzepatide and estradiol are not, so a good faith exam by video for those drugs is a state law question and this statute has nothing to say about it.
What counts as an in-person evaluation
The definition is short: “a medical evaluation that is conducted with the patient in the physical presence of the practitioner, without regard to whether portions of the evaluation are conducted by other health professionals” (§ 829(e)(2)(B)).
Three points follow from the text.
- It is the prescriber’s evaluation. Staff can do parts of it. The practitioner who writes the prescription has to have been in the room.
- Once is enough for this statute. DEA has said that after one in-person evaluation, the Act’s remote prescribing requirements “no longer apply to that specific practitioner-patient relationship.”
- Once is not a safe harbor. The statute says one evaluation does not by itself show that a prescription “has been issued for a legitimate medical purpose within the usual course of professional practice.”
A covering practitioner may prescribe without seeing the patient, but only at the request of a colleague who evaluated that patient in person or through lawful telemedicine “within the previous 24 months” and who is temporarily unavailable. That is cross-coverage. It does not let one examiner qualify patients for a whole network.
The seven exceptions
The in-person rule does not apply to “a practitioner engaged in the practice of telemedicine.” The statute then defines that phrase with seven categories (21 U.S.C. § 802(54)).
| Category | When it applies | Use to a cash-pay telehealth program |
|---|---|---|
| (A) | The patient is being treated in a DEA-registered hospital or clinic | Works if you have a registered site |
| (B) | The patient is “in the physical presence of” another DEA-registered practitioner | Works with a partner practitioner in the room |
| (C) | Indian Health Service or tribal practitioners with a federal designation | None |
| (D) | A declared public health emergency, for the areas and drugs the HHS Secretary designates | None since May 11, 2023 |
| (E) | The prescriber holds a special registration | None until a final rule takes effect |
| (F) | Veterans Affairs emergencies, up to a five-day supply | None |
| (G) | Other circumstances DEA and HHS allow by joint regulation | This is where every current flexibility lives |
Categories (A) and (B) are permanent law. They are the reason a hybrid model works: your prescriber stays remote, and the patient sits with a DEA registrant.
How the pandemic rules were built on exceptions (D) and (G)
On March 16, 2020, HHS and DEA used category (D). A DEA letter to registrants records that the designation “applies to all schedule II-V controlled substances in all areas of the United States.” That lasted as long as the emergency, which ended May 11, 2023.
Since then DEA and HHS have used category (G), by temporary joint rule, four times:
- 88 Fed. Reg. 30037 (May 10, 2023), through November 11, 2023, with a grace period for existing patients.
- 88 Fed. Reg. 69879 (October 10, 2023), through December 31, 2024.
- 89 Fed. Reg. 91253 (November 19, 2024), through December 31, 2025.
- 90 Fed. Reg. 61301 (December 31, 2025), through December 31, 2026.
Each one is a regulation with an end date written into it. The fourth says its purpose is to avoid “the reinstatement of the pre-pandemic restrictions imposed by the CSA, which could potentially and abruptly limit patients’ access to care until promulgation of a final set of regulations.” The statute underneath was never amended. What happens on January 1, 2027 walks through the three outcomes.
The special registration Congress ordered in 2018
Category (E) has been empty since 2008. In 2018 Congress ordered DEA to fix that “not later than 1 year after October 24, 2018.” DEA proposed a rule on January 17, 2025. As of September 17, 2026, a final version is under White House review and has not been published. The proposal, explained covers what it would have required.
Three duties people confuse with Ryan Haight
Meeting the in-person rule, or an exception to it, settles only one question. These stand on their own.
Legitimate medical purpose. A prescription “must be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice” (21 C.F.R. § 1306.04(a)). A video visit that is too short to support a diagnosis fails this test with or without an extension. This is the clinical core of a good faith exam.
Registration by location. “A separate registration is required for each principal place of business or professional practice at one general physical location where controlled substances are manufactured, distributed, imported, exported, or dispensed.” An office where drugs are only prescribed, with no stock, is exempt if the practitioner is registered elsewhere in the same state.
Registration by state. DEA’s stated position is that practitioners must register “both in the state in which the practitioner dispenses controlled substances and in the state in which the patient is located,” unless an exception applies. A 2020 DEA letter waived that for the length of the public health emergency.
We found no DEA statement on whether that waiver still operates under the temporary rules. Ask counsel before you assume it does.
What this means for you
Sort your controlled substance patients into two lists: examined in person by their prescriber, and never examined in person. The first list is outside this statute for good. The second list depends on a regulation that ends December 31, 2026. If you run hormone therapy by telehealth, decide now where an in-person evaluation could happen, under category (A) or (B), in each state you serve. Then check that every prescriber’s registration matches the states where their patients sit. The TRT deadline post applies this to testosterone.
Related reading
Frequently asked questions
What does the Ryan Haight Act require?
It bars dispensing a controlled substance by means of the internet without a valid prescription. A valid prescription comes from a practitioner who has conducted at least one in-person medical evaluation of the patient, or from a covering practitioner. Seven defined categories of telemedicine are exempt. The law took effect April 13, 2009.
Does the Ryan Haight Act apply to testosterone?
Yes. Testosterone is a Schedule III controlled substance, so a prescription issued after an online visit falls under the Act. It can be prescribed without an in-person evaluation today only because a temporary DEA and HHS rule allows it. As of September 2026 that rule ends December 31, 2026.
Does one in-person visit satisfy the Ryan Haight Act permanently?
For that prescriber and that patient, yes. DEA has said that once a practitioner conducts one in-person evaluation, the Act’s remote prescribing requirements no longer apply to that relationship. The statute adds that one visit does not by itself prove later prescriptions were for a legitimate medical purpose.
Does the Ryan Haight Act apply to GLP-1 medications?
No. The Act covers only controlled substances. Semaglutide and tirzepatide do not appear in the federal schedules as of September 16, 2026. State telehealth, licensure and examination rules still apply to those prescriptions, and a state can schedule a drug that federal law does not.
Was the Ryan Haight Act repealed during COVID?
No. The in-person requirement was never repealed or amended. In March 2020 the government used the statute’s public health emergency exception. Since May 2023 DEA and HHS have used a different exception, by temporary rule, four times. The statute applies in full whenever a temporary rule ends without a replacement.
This is general information, not legal advice. Rules vary by state and change. Confirm your own facts with counsel.