In 2008, Congress passed the Ryan Haight Act (21 U.S.C. § 802(54)) (“Ryan Haight”) following the death of Ryan Haight, a young man who overdosed on prescription painkillers he purchased from an online pharmacy without a valid prescription. Ryan Haight amended the federal Controlled Substances Act (21 U.S.C. 802 et seq.) and specifically prohibits dispensing controlled substances via the internet without a “valid prescription” which, according to the law, must be issued for a legitimate medical purpose and may only be issued once a physician has conducted at least one in-person evaluation of the patient (i.e., before issuing the remote prescription for the controlled substance). Certain exceptions may apply, but arguably none contemplate the direct-to-patient virtual care models that many of today’s telehealth / telemedicine companies are utilizing.

The intent behind the enactment of Ryan Haight in 2008 was to shut down online pharmacies and to restrict access to painkillers and other controlled substances provided to patients in ways that could circumvent a physician’s examination (and the issuance of a valid prescription, if the physician determined it was an appropriate course of treatment for the patient). Unfortunately, the effect of enacting Ryan Haight was, in reality, much more significant – not only restricting access via online pharmacies to the deadliest or most addictive painkillers, but also banning the issuance of remote prescriptions for any controlled substances unless an in-person visit occurred first between the physician and the patient. What the requirements imposed by Ryan Haight ignore is that there are many more drugs in Schedules II – V that are designed to treat patients for a panoply of non-pain related illnesses, many of which can be prescribed safely and effectively by means of an appropriate telehealth encounter. While Congress largely has ignored calls to revise Ryan Haight to address this issue, some states have started to rethink how, at least at the state level, they will handle the issue of health care providers prescribing controlled substances through non-traditional treatment arrangements, such as the use of telehealth / telemedicine.

An example is Indiana, where the legislature recently amended Indiana Code 25-1-9.5-8 (in 2017) to expand the list of drugs that may be prescribed by authorized prescribers through telehealth / telemedicine. Originally enacted in 2016, the law banned the remote prescribing of all controlled substances if such prescribing was done via a telehealth / telemedicine encounter. The revised law dramatically expands the ability to prescribe, via telehealth / telemedicine, certain controlled substances, and only limits such prescribing practices with respect to opioids, abortion inducing drugs, and/or ophthalmic devices (i.e., contact lenses and glasses). The Indiana law is particularly thoughtful and timely because it excludes from the ban any opioids that act as partial-agonists are used to treat or manage opioid dependence. Therefore, the Indiana law not only expands treatment options by allowing the remote prescribing of many controlled substances, including some that can be used to treat opioid dependence disorders, but does so in a manner that attempts, discretely, to address the opioid dependence epidemic by limiting access to most opioids.

Following a similar path is Hawaii, which like Indiana has excluded the remote prescription of opioids via telehealth as well as medical cannabis. While Hawaii’s laws do not explicitly permit the remote prescription of controlled substances, the fact that Hawaii Statutes Revised § 329-1 does not distinguish between the prescribing of controlled and non-controlled substances (within the context of discussing the rules related to remote prescribing) and that Hawaii Statutes Revised § 453-1.3 only requires an in-person examination prior to prescription of opioids and medicinal cannabis, would logically support the assumption that prescribing other, less controversial controlled substances would be permissible. Like Hawaii, Florida is another state that has taken a more nuanced approach to remote prescribing of controlled substances via telehealth / telemedicine. Florida Administrative Code rule 64B8-9.0141, for example, permits the prescription of controlled substances to treat psychiatric disorders.

Simultaneously, some states also have continued to build, refine, and expand statewide databases that store information regarding the prescriptions for controlled substances written by practitioners licensed by the state. This information can help physicians and other prescribing health care providers to determine, if and when contemplating the issuance of a remote prescription to a certain patient, whether that patient may be “doctor shopping” and/or whether concomitant medications may pose a risk to a patient if he/she is prescribed a particular drug. These databases, and the laws creating and amending them, may be one reason why states are more willing to expand remote prescribing practices given these new additional safeguards.

By contrast, to date the Drug Enforcement Agency (DEA) has taken no additional steps to clarify or refine the requirements under Ryan Haight since it was enacted. When Ryan Haight was first passed, it included an exception on its applicability for prescribers who obtain a “special registration” from the Attorney General or the Administrator of DEA per 28 CFR 0.100. When Ryan Haight was passed, Congress contemplated that DEA would “promulgate regulations governing the issuance to practitioners of a special registration relating to the practice of telemedicine;” however, neither DEA nor any other agency has provided any additional information regarding this special registration since Ryan Haight was first signed into law in 2008. In 2015, DEA proposed making a rule that would provide clarity to the “special registration” exception; however, in 2016 DEA amended the proposed rule-making to a “Long-Term Action” with no set deadline, further delaying even the idea of providing additional clarity. Perhaps the DEA’s response is a reaction to states that strongly oppose providing prescribing information to other states or even to the federal government for various reasons, including privacy concerns. That is to say, perhaps states are more willing to loosen remote prescribing laws for controlled substances because the databases they control and the data provided thereunder have eased concerns with allowing prescribers to prescribe as they see fit based on the information available regardless of whether the prescriber is physically present in the same room as the patient.

In the end, and regardless of the reasons, Ryan Haight continues to be good law, meaning that it is enforceable against prescribing health care practitioners. Despite an apparent lack of actual enforcement (the last case against a physician to enforce Ryan Haight was in July of 2011), the DEA technically can choose to enforce Ryan Haight at any time. Prescribers should therefore be cautious and understand that remote prescribing of controlled substances, even within the confines of a state law, still could be considered a violation of federal law with penalties including prison, fines, and temporary or permanent loss of the prescriber’s DEA Registration. Health care providers contemplating the prescribing of any controlled substances through telehealth / telemedicine can benefit from doing diligence with the support of legal counsel to fully understand the potential impacts of Ryan Haight, relevant state laws, and the potential risk involved in such a venture before proceeding.