Most of the digital health companies I work with have a DEA problem they do not know they have. It is not the kind of problem that shows up in a diligence checklist or a board deck. It shows up when a prescriber's DEA registration lists a home address in Arizona, the patient is in New Jersey, the platform is a Delaware MSO, and nobody in the organization can explain why that arrangement is lawful.
For the last six years, it mostly has not mattered. That is about to change, and the change has a date on it.
Where things stand right now
On December 30, 2025, DEA and HHS issued a fourth temporary extension of the COVID-era telemedicine flexibilities. The rule is effective January 1, 2026 through December 31, 2026. Under these flexibilities, DEA-registered practitioners may remotely prescribe Schedule II-V controlled medications via audio-video telemedicine, including Schedule III-V narcotics approved for maintenance and withdrawal management of opioid use disorder via audio-only encounters, without ever having conducted an in-person medical evaluation, provided the prescriptions otherwise comply with DEA guidance, DEA regulations, and applicable federal and state law.
The agencies have said they are still reviewing public comments on the proposed permanent rules and intend to issue final regulations before the new 2026 deadline. HHS framed the extension as buying time to finalize permanent regulations, including the proposed Special Registration for Telemedicine.
We are now past the halfway point of that window. Whatever comes next, whether that is a final rule or a fifth extension, the operational question for founders is the same: if the flexibilities lapse, does your prescriber network still work?
For a lot of companies, the honest answer is no.
The underlying rule has not changed
This is the part people forget. The flexibilities are an exception layered on top of a statute that never went anywhere.
The Controlled Substances Act requires a separate registration at each principal place of business or professional practice where controlled substances are distributed or dispensed. See 21 U.S.C. 822(e)(1) and 21 CFR 1301.12(a). A practitioner who maintains a professional practice location in multiple states has established, for registration purposes, a principal place of business in each of those states, and DEA requires a separate registration in each state. To obtain one, the practitioner must first hold authorization to handle controlled substances in that state.
A DEA individual practitioner registration is based on a state license to practice medicine and prescribe controlled substances. State authority confers rights only within the issuing state. A DEA registration based on a state license cannot authorize controlled substance dispensing outside that state.
The DEA number is federal. The authority behind it is not. That distinction is the whole game.
There is a second layer specific to telemedicine. The Ryan Haight Act added provisions expressly requiring a practitioner to be registered in the state where the patient is located when engaged in certain forms of telemedicine.
Why nobody has been thinking about this
Because DEA turned it off in 2020.
DEA issued a temporary exception to its separate registration requirements across state lines (DEA067, March 25, 2020) allowing practitioners to prescribe controlled substances in states where they are not registered, so long as the practitioner is registered with DEA in at least one state and has permission under state law to practice using controlled substances in the state where the dispensing occurs. Practitioners may use this exception for in-person prescribing or prescribing via telemedicine, and must continue to comply with the laws of both the state where they are DEA-registered and the state where they are practicing.
Because most state laws defer to federal controlled substance prescribing requirements, providers have retained this flexibility beyond the public health emergency period. Providers must still comply with state prescribing and registration requirements that may be more stringent than federal law.
So a prescriber licensed in twelve states, holding one DEA registration in the state where they live, has been operating lawfully. That is not a loophole. It is the rule as it currently exists. The problem is that an entire industry built its network model on a temporary exception and then stopped tracking the expiration date.
The home address issue
This one I want to be direct about, because it is common and people are casual about it in a way I do not think they would be if they understood the trade.
DEA regulations do not prohibit individual and mid-level practitioners from using their home address. If a practitioner does choose to use their home address as a principal place of business or professional practice, the location becomes a "controlled premises" and is subject to unannounced inspections and administrative warrants under existing DEA regulations. A practitioner whose DEA-registered location is a home must comply with the established recordkeeping and security requirements.
Your registered address must be the physical location of your principal place of business or professional practice. A PO Box alone is not a registered address, though you may use a separate mailing address for DEA correspondence.
For a fully remote prescriber who stores nothing and dispenses nothing, the practical risk today is low. But "low" is not "zero," and the calculus changes the moment your platform's prescribing volume makes you interesting. A registered home address is a front door DEA can knock on without an appointment.
State controlled substance registrations
Separate from the DEA registration, a number of states require their own controlled substance license, and without it DEA will not approve the application. States requiring one include Alabama, Connecticut, Delaware, District of Columbia, Guam, Hawaii, Idaho, Illinois, Indiana, Iowa, Louisiana, Maryland, Massachusetts, Michigan, Missouri, Nevada, New Jersey, New Mexico, Oklahoma, Puerto Rico (currently suspended), Rhode Island, South Carolina, South Dakota, Utah, and Wyoming. DEA maintains a state-by-state guide with contact information for the relevant agencies.
These take longer than people plan for. Two to eight weeks depending on the state, and they gate the DEA application behind them. The federal application itself runs $888 for a three-year term with roughly four to six weeks of processing.
If you are standing up a multi-state prescriber network, the state CSR timeline is your critical path, not the DEA one.
What the proposed rule would add
The January 2025 proposed rule contemplates three special registrations: a Telemedicine Prescribing Registration for Schedule III-V, an Advanced Telemedicine Prescribing Registration for specialized clinicians (psychiatrists, hospice physicians) covering Schedule II-V, and a Telemedicine Platform Registration for covered online telemedicine platforms. A special registrant would also be required to maintain a State Telemedicine Registration, issued by DEA, for every state in which a patient is treated, unless exempted.
Stacked together, a practitioner would need a conventional DEA registration, one of the three special registrations, and a State Telemedicine Registration for each state where a patient receiving a prescription is located. DEA proposed a three-year cycle for both the special registrations and the State Telemedicine Registrations, and individual clinician special registrants would have to be physically located within the United States during the encounter.
The proposal also requires PDMP checks in the states where both the patient and provider are located, imposes monthly pharmacy reporting on Schedule II and certain Schedule III-V dispensing, and requires special registrants to report annual aggregated data on their telemedicine practice, including new patient counts. DEA also asked for comment on whether the special registrant should be physically located in the same state as a patient receiving Schedule II medications, and whether Schedule II telemedicine prescribing should be limited to practitioners whose practice is less than 50 percent telemedicine.
Whether this administration moves forward with the proposal remains unclear. Industry groups have already argued the rule would be significantly burdensome and asked that it be withdrawn.
My take
I have said this in a dozen different contexts and it holds here: regulators take time to catch up, and the gap between what a rule says and how it gets enforced is where most companies quietly build their operating model.
That gap is not permission. It is a lag.
I do not think DEA is going to relax back toward a world where a single home-address registration covers fifty states of remote prescribing. Everything in the proposed rule points the other direction: more registration surface, more reporting, a platform-level registrant that did not previously exist, and per-state visibility into who is prescribing what and where. DEA's own framing describes the proposal as an evolution in how providers, telemedicine companies, and patients interact with controlled substances. Companies, not just clinicians. That word choice matters. When a regulator starts naming the platform as a registrant, the platform has become the enforcement target.
My hypothesis, and I will be clear that it is a hypothesis: the core in-person waiver survives in some form because the access argument is politically overwhelming. More than seven million prescriptions for controlled medications were issued via telemedicine without a prior in-person visit in 2024 alone. Nobody is turning that off. What gets tightened is everything around it. Registration geography, PDMP discipline, data reporting, platform accountability. The permissive thing stays permissive and the administrative burden goes up.
Which means the companies that get hurt are not the ones prescribing inappropriately. They are the ones with sloppy infrastructure who suddenly have to produce a per-state registration map on a compliance deadline and cannot.
The other thing worth naming: states do not wait for DEA. States are moving from broad expansion to refinement, and providers must still comply with state requirements that may be more stringent than federal law. You can be perfectly aligned with a federal flexibility and still be out of compliance with a state board that decided to write its own rule. That is where I see the near-term enforcement, not from DEA.
How to get ahead of it
None of this requires you to guess at the final rule. It requires you to know what you have.
Build the registration map. For every prescriber, every state they are licensed in, their DEA registration and registered address, and their state CSR status where applicable. If you cannot produce this in an afternoon, that is the finding.
Fix the home addresses that should not be home addresses. If a prescriber is dedicated to your platform and you have a real practice location, register that. Understand that a home address makes the home controlled premises, and decide that on purpose rather than by default.
Get the state CSRs now for your top volume states. They are the long pole. Doing this early costs you money and nothing else. Doing it in December costs you revenue.
Document your PDMP workflow. The proposed rule would require checks in both the patient's and the prescriber's state. Building that into your clinical workflow now is cheap. Retrofitting it under a compliance deadline is not.
Assume platform-level obligations are coming. If your entity would meet the definition of a covered online telemedicine platform, start identifying who owns that registration, what disclosures you would have to make about your relationships with prescribers and pharmacies, and whether your current corporate structure survives that disclosure cleanly.
Put December 31, 2026 on the board calendar. Not as a compliance item. As a business continuity item. If the flexibilities lapse without a workable replacement, what percentage of your prescribing volume stops?
Answer that question in July, not in November.
This post is for informational purposes only and does not constitute legal advice. Requirements vary by state and change frequently. Verify with the DEA, your state medical or pharmacy board, and qualified counsel before acting.
Sources
- Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, 90 Fed. Reg. (Dec. 31, 2025): https://www.federalregister.gov/documents/2025/12/31/2025-24123/fourth-temporary-extension-of-covid-19-telemedicine-flexibilities-for-prescription-of-controlled
- DEA press release, DEA Extends Telemedicine Flexibilities to Ensure Continued Access to Care (Dec. 31, 2025): https://www.dea.gov/press-releases/2025/12/31/dea-extends-telemedicine-flexibilities-ensure-continued-access-care
- HHS press release, HHS and DEA Extend Telemedicine Flexibilities Through 2026 (Jan. 2, 2026): https://www.hhs.gov/press-room/dea-telemedicine-extension-2026.html
- Special Registrations for Telemedicine and Limited State Telemedicine Registrations (proposed rule, Jan. 17, 2025): https://www.federalregister.gov/documents/2025/01/17/2025-01099/special-registrations-for-telemedicine-and-limited-state-telemedicine-registrations
- DEA press release, DEA Announces Three New Telemedicine Rules (Jan. 16, 2025): https://www.dea.gov/press-releases/2025/01/16/dea-announces-three-new-telemedicine-rules-continue-open-access
- DEA Diversion Control Division, Registration Q&A: https://www.deadiversion.usdoj.gov/faq/registration-faq.html
- DEA Diversion Control Division, Use of a Home Address as a Principal Place of Business (DEA-DC-052 / EO-DEA183): https://www.deadiversion.usdoj.gov/GDP/(DEA-DC-052)(EO-DEA183)_Home_as_Registered_Location_(Revision_1).pdf
- DEA Diversion Control Division, Telemedicine and State Registration Q&A (DEA-DC-044 / EO-DEA192): https://www.deadiversion.usdoj.gov/GDP/(DEA-DC-044)(EO-DEA192)_Telemed_State_Reg_QA_(Final).pdf
- DEA Diversion Control Division, state-by-state controlled substance license requirements: https://www.deadiversion.usdoj.gov/drugreg/reg_apps/pract-state-lic-require.html
- DEA registration application portal: https://www.deadiversion.usdoj.gov/drugreg/registration.html
- 21 U.S.C. 822(e)(1); 21 CFR 1301.12(a); 21 CFR 1316.01-1316.13
Camino Strategy Group | caminostrategygroup.com