What Expires December 31, 2026 for Telehealth Controlled Substances

This is the fourth extension, and the last one arrived with a day to spare.

If your program prescribes testosterone, ketamine or a stimulant to patients a clinician has never met in person, the authority you rely on expires at the end of December 31, 2026. It has been extended three times already: through November 11, 2023, then through December 31, 2024, then through December 31, 2025. Most operators have reasonably concluded it will be extended again.

Two things argue against planning on that. The fourth extension was published on December 31, 2025, the day the third one expired, and took effect the next morning. And the permanent replacement is now written: the final rule went to the White House budget office for review on August 25, 2026, and nobody outside government has read it.

Semaglutide and tirzepatide are not controlled substances, so none of this reaches a GLP-1 program. Compounded versions of either are not FDA approved, which is a separate question with its own rules.

What exactly expires?

Under the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, a practitioner may remotely prescribe a controlled substance only after at least one in-person medical evaluation of that patient, subject to exceptions. One of those exceptions, at 21 U.S.C. 802(54)(E), is a special registration the DEA was required to create by regulation and never did.

Since May 2023 a temporary rule at 21 CFR 1307.41 has stood in for it, authorizing a DEA-registered practitioner to prescribe Schedule II to V controlled substances by telemedicine without an in-person evaluation if four conditions are met. The fourth extension, published at 90 FR 61301 on December 31, 2025, did one thing: it moved the expiry from December 31, 2025 to the end of December 31, 2026.

Why the DEA keeps extending rather than letting it lapse is in the extension itself. Citing unpublished data reviewed by Epic, Johns Hopkins and Stanford, it reports that of roughly 44.6 million controlled substance prescriptions across 258 organizations in 2024, about 16 percent were issued without a prior in-person evaluation.

Which authority are you prescribing under right now?

There are three, and they are separate. The extension says so plainly: with the two final rules published January 17, 2025, it describes three distinct sets of authorities, each with its own requirements.

1. The temporary flexibility, 21 CFR 1307.41. Schedules II to V, four conditions, expires at the end of December 31, 2026. Almost every commercial telehealth program runs on this one.
2. Buprenorphine for opioid use disorder, 21 CFR 1306.51. Schedules III to V, FDA-approved medications for OUD only, with a monitoring program review, a six calendar month limit, and a requirement that the pharmacist verify the patient's identity before filling.
3. Continuity of care for Veterans Affairs patients, 21 CFR 1306.52.

The extension adds that the first is the least demanding, and that a practitioner covered by one of the other two may still use it. So December 31, 2026 is the date that matters to nearly everybody.

The condition most intake flows do not satisfy

Condition two, at 21 CFR 1307.41(c)(2), requires that the prescription be issued pursuant to a communication between practitioner and patient using an interactive telecommunications system referred to in 42 CFR 410.78(a)(3). That definition is specific: multimedia equipment including, at a minimum, audio and video permitting two-way, real-time interactive communication. It reaches real-time audio-only only for a patient at home, where the practitioner is technically capable of video and the patient is not capable of it or does not consent.

Asynchronous store and forward technology has its own definition in the same section, at 42 CFR 410.78(a)(1). It is not the system (a)(3) describes.

Read the buprenorphine rule next to it. 21 CFR 1306.51(b) permits a communication "using an interactive telecommunications system, including an audio-only telecommunications system, as described in 42 CFR 410.78(a)(3)." The drafters knew how to write audio-only into a rule when they meant it. 1307.41 does not carry that phrase.

So a controlled substance line needs a scheduled, real-time, two-way audio-video visit in the patient path, with the narrow audio-only fallback treated as a documented exception. That is a different product from a form that drops into a chart review queue, and the difference lives in the booking layer, the video layer and the record. It is the handoff problem in telehealth intake, booking, checkout and follow-up, with the order of operations fixed by a rule rather than by preference.

Why the replacement rule put the platform in scope

The January 2025 proposal, at 90 FR 6541, is the only published version of what comes next. It proposed three special registrations: a Telemedicine Prescribing Registration for Schedule III to V, an Advanced Telemedicine Prescribing Registration for Schedule II to V limited to named specialties such as psychiatry and hospice care, and a Telemedicine Platform Registration. It would also require a State Telemedicine Registration, issued by the DEA rather than by states, for every state in which a patient is treated, unless exempted.

The third is the one a DTC brand should read. It defined a covered online telemedicine platform as an entity facilitating patient to clinician connections by audio-video, for the diagnosis and treatment of patients that may result in a controlled substance prescription, that is not a hospital, clinic, local in-person medical practice or insurance provider, and that meets one or more of four criteria:

1. It explicitly promotes or advertises the prescribing of controlled substances through the platform.
2. It has financial interests tied to the volume or types of controlled substance prescriptions issued through it, including ownership in the pharmacies that fill them, or rebates from those pharmacies.
3. It exerts control or influence on clinical decision-making or prescribing, including protocols for clinicians it employs or contracts, prescribing rates counted in hiring or compensation, explicit or de facto quotas, or directing patients to preferred pharmacies.
4. It has control or custody of the prescriptions or medical records of patients prescribed through it.

Any one of the four was enough, because each marks the platform as an integral intermediary in remote dispensing, which is what pulls it in as a dispenser rather than a vendor. So read the list as a build inventory rather than a legal test. One is the ad account and the landing page. Two is the pharmacy relationship and how money moves. Three includes which pharmacy the checkout routes to. Four is where the chart lives and who owns the database.

Other proposed machinery reached the same layer: electronic prescribing after identity verification and a monitoring program check, both registration numbers on the prescription, and a form on which a platform attests to every relationship it has with a prescriber or an online pharmacy.

What is actually known about the final rule

Less than the volume of commentary suggests. The proposal drew over 6,475 comments. The final rule, RIN 1117-AB40, reached the Office of Information and Regulatory Affairs on August 25, 2026, sits there pending at the final rule stage marked economically significant, and the Unified Agenda lists final action for November 2026. The text under review is not public.

Which means the framework above has been revised behind closed doors since anyone saw it. It is the best guide to the DEA's thinking and a poor guide to what will be required. Building to the proposal as though it were the rule is a way to spend the money twice.

What to have ready either way

These hold whether the rule lands in November, slips, or arrives behind a fifth extension.

• Know which of the three authorities each prescription is issued under. If nobody can name it for a line of business, fix that first.
• Put a real-time audio-video encounter in the controlled substance path, and keep the asynchronous path for programs that can use it. One intake flow serving both is how the condition gets missed.
• Record the modality per prescription: which encounter, when, audio-video or audio-only, and if audio-only, why. A system that cannot produce that cannot evidence condition two.
• Write down your four criteria answers. What the ads say, how the pharmacy is paid, who authors the protocol, who holds the records. Three of the four you can change.
• List every domain and brand running the same clinical offer. Registration and disclosure regimes ask for all of them, and so does LegitScript certification.
• Separate the states you are licensed in from the states you advertise into. A state-by-state requirement, if it survives, turns that gap into a compliance problem rather than a growth question.

Where this leaves a build

If a controlled substance program is on the roadmap, the architecture question is not which platform has the nicest intake. It is whether the patient path can carry a scheduled real-time encounter, a documented modality, a clean pharmacy handoff and a record you can produce on request, without the GLP-1 funnel beside it collapsing into the same flow. That is the work in telehealth and GLP-1 website development, and it is worth a telehealth program fit review before the ad spend rather than after.

If the program is GLP-1 only, the useful move is the opposite: make sure nothing in the funnel, the advertising or the pharmacy arrangement quietly puts a scheduled drug in the cart. The compounding questions that do apply are in 503A vs. 503B peptides.

This is operational guidance for building a website and a patient path, not legal, regulatory, pharmacy or medical advice, and nothing here says what any patient should be prescribed. The temporary rule has an expiry date, the replacement is unpublished, and state prescribing law sits on top of both. Have qualified counsel review your program before you launch or change it.

Common questions

Sources

• Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, 90 FR 61301 (Dec. 31, 2025) checked 2026-10-03
• 21 CFR 1307.41, temporary extension of certain COVID-19 telemedicine flexibilities, current text checked 2026-10-03
• 42 CFR 410.78, telehealth services, definitions of interactive telecommunications system and asynchronous store and forward checked 2026-10-03
• Special Registrations for Telemedicine and Limited State Telemedicine Registrations, NPRM, 90 FR 6541 (Jan. 17, 2025) checked 2026-10-03
• Pending EO 12866 Regulatory Review, RIN 1117-AB40, received August 25, 2026 checked 2026-10-03
• Unified Agenda entry for RIN 1117-AB40, final rule stage, final action November 2026 checked 2026-10-03
• 21 CFR 1306.51, telemedicine prescribing of schedule III-V medications for the treatment of Opioid Use Disorder checked 2026-10-03
• 21 CFR 1308.12, Schedule II checked 2026-10-03
• 21 CFR 1308.13, Schedule III checked 2026-10-03

Want this costed for your build?

Tell us what you already have and what is not working, and we will come back with the shape of the work and what drives the number.