The DEA Telehealth Cliff: What to Do in the Next 56 Days

Since the COVID-19 public health emergency, a DEA-registered practitioner has been allowed to prescribe Schedule II–V controlled substances by telemedicine to a patient they have never seen in person. That permission has always been temporary. The current version ends with December 31, 2026, and the permanent rule meant to replace it is still under White House review with no public text.

In January, someone will be asked which providers are still covered. It is usually whoever keeps the DEA and state registration records. This article covers what that team can do in the 56 days left, without waiting for the rule.

The temporary permission ends on December 31, 2026

DEA and HHS announced the fourth temporary extension on December 31, 2025. It lets DEA-registered practitioners prescribe Schedule II–V medications through audio-video telemedicine without a prior in-person evaluation, through December 31, 2026 (DEA).

If no final rule or further extension takes effect by then, the Ryan Haight Act baseline returns. A practitioner would generally need at least one in-person evaluation before prescribing a controlled substance to that patient by telemedicine, unless a narrow statutory exception applies (eCommerce4IM).

Buprenorphine for opioid use disorder is the main exception. A permanent rule finalized in January 2025 lets qualified practitioners start it by telemedicine without an in-person visit, within limits that include a six-month supply and a PDMP check (WCH Service Bureau). Other medications, such as ADHD stimulants for new patients, would have no comparable remote pathway (eCommerce4IM).

The permanent rule is at the White House, and its text is not public

DEA sent its final rule on special registration for telemedicine (RIN 1117-AB40) to OMB's Office of Information and Regulatory Affairs on August 25, 2026. The federal regulatory agenda lists November 2026 as the target for final action (Deko Law). As of November 2, 2026, the text has not been published and DEA has not announced a fifth extension (Frier Levitt).

Outside groups met with OMB and Justice Department staff at least eight times between September 18 and 29, with more meetings scheduled for October 16 and November 2 (eCommerce4IM).

The starting point is the January 2025 proposal. Unless an exemption applied, it would have required a separate telemedicine registration in each state where a patient is treated. DEA received more than 6,400 comments, and the final version may differ (Frier Levitt).

The exposure sits with prescribers who have never met the patient

The practitioners in scope prescribe Schedule II–V controlled substances by telemedicine to patients they have never evaluated in person. Behavioral health, SUD and telehealth-first groups are the obvious ones.

Multi-state groups carry the most exposure. Federal permission has never overridden stricter state rules. A practitioner prescribing to a patient in another state generally needs a DEA registration in that state, and licensure generally follows where the patient is physically located during the visit (WCH Service Bureau). A group with prescribers in two states and patients in nine has a mapping job whatever the final rule says.

If you are a billing company holding a client's DEA and CDS records, the client will ask you which of its providers are exposed.

Medicare's 2027 extension does not cover DEA prescribing

Two telehealth deadlines are in the news at once, and they get confused. Congress extended key Medicare telehealth flexibilities, including the home as an originating site for non-behavioral services and payment for audio-only visits, through December 31, 2027. The package was signed on February 3, 2026 (American Bar Association). That law governs what Medicare pays for.

The DEA flexibilities govern whether a practitioner may prescribe a controlled substance without an in-person evaluation. They come from a different agency under a different law, and they still end December 31, 2026. If nothing changes, a provider could bill Medicare for a video visit in January 2027 and still be unable to prescribe a Schedule II stimulant to a new patient at the end of it.

Six things your team can do this month

None of these steps depend on the rule's text. Together they produce the list you will need on the day it publishes.

1. List every affected prescriber. Identify each provider who prescribes controlled substances by telemedicine to patients they have not seen in person. The credentialing file won't show this, so confirm it with clinical leadership.
2. Map registrations against patient states. For each provider, list the states where they hold a DEA registration and a state controlled substance (CDS) registration, where the state issues one. Put that next to the states where their patients are. The gaps become visible.
3. Check licensure in the same states. Confirm that an active license stands behind every patient state on the map.
4. Record every expiration date. Note when each DEA registration, CDS registration and license expires. A registration that lapses in February is a second deadline behind the first.
5. Name one owner for the Federal Register. One person checks it weekly, on a fixed day. Decide now who reads the rule when it appears, who briefs clinical leadership and counsel, and who updates each client.
6. Settle the January 1 plan with clinical leadership. If nothing changes, decide which patients will need an in-person evaluation or a transition of care, and how they will be told. Frier Levitt gives providers the same advice (Frier Levitt). Clinical leadership makes this call, and credentialing supplies the list it depends on.

Nobody can promise you a date yet

Three questions are open as of November 2, 2026. The first is what the final rule requires, including whether state-by-state registration survives. The second is when it publishes. OIRA review typically runs up to 90 days with one possible 30-day extension (McDermott Will & Schulte), and the November agenda date is a planning target.

The third is when it takes effect. A rule published in December may not apply on January 1, and DEA and HHS could issue an interim extension to give providers time to comply (Frier Levitt). Anyone offering you a firm date is estimating. The six steps above hold up whether the outcome is a final rule, another extension, or a lapse.

Software won't answer the legal question

A credentialing tool can't tell you what the rule will say, or whether a particular prescription is lawful in a particular state. Those are questions for healthcare counsel, and multi-state groups should book that conversation before December.

It also doesn't know where your patients are. That data lives in your EHR or scheduling system. What a tool can do is keep the provider side of the map current and give each gap an owner.

CredyApp keeps the provider side of the map in one place

Your team knows the Ryan Haight Act. The strain is volume. One prescriber may hold DEA and CDS registrations in several states, each with its own expiration date, and nobody tracks that reliably from memory during Q4 re-credentialing.

In CredyApp, DEA and CDS registrations sit in Expiring Items alongside licenses and malpractice. Since September 2026 the list has a State field for DEA and CDS registrations, so you can see where each provider is registered. Each gap can become a task with an owner and a reminder, and so can the weekly Federal Register check. Billing companies can use customizable provider report templates to send each client a status on its own providers.

When the rule publishes, you'll know which providers it touches and have a status ready to send.

Build the map before December. Start a free trial of CredyApp.

Read more articles