The Ryan Haight Act's In-Person Exam Rule and Its Seven Exceptions

Since 2008, federal law has required at least one in-person medical evaluation before a controlled substance is prescribed over the internet, with seven exceptions. What counts as an in-person evaluation, who can rely on someone else's, and why most of the exceptions do not fit a direct-to-consumer telehealth company.

The rule is one sentence long. Under 21 U.S.C. 829(e), no controlled substance that is a prescription drug "may be delivered, distributed, or dispensed by means of the Internet without a valid prescription," and a valid prescription is one issued by a practitioner who has conducted at least one in-person medical evaluation of the patient, or by a covering practitioner. Congress added it through the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (Pub. L. 110-425, signed October 15, 2008). Everything about telemedicine prescribing of controlled substances, including the temporary flexibilities that expire December 31, 2026, is an exception to that sentence.

What counts as an in-person medical evaluation?

The statute defines it at 829(e)(2)(B) as an evaluation "conducted with the patient in the physical presence of the practitioner, without regard to whether portions of the evaluation are conducted by other health professionals." So a medical assistant can take vitals, but the prescribing practitioner has to be in the room for the evaluation. A video visit with a nurse in the room with the patient is not an in-person evaluation by the remote practitioner, though it may fit one of the telemedicine exceptions below.

The statute adds a caution: one in-person evaluation does not by itself show a prescription was issued for a legitimate medical purpose. The visit opens the door; it does not excuse what follows.

How long does an in-person evaluation last?

Indefinitely, for that relationship. In the preamble to the fourth temporary extension (90 FR 61301, December 31, 2025), DEA wrote that once a practitioner has conducted one in-person evaluation, the Ryan Haight Act's remote prescribing requirements "no longer apply to that specific practitioner-patient relationship," regardless of how much time has passed "or whether that evaluation was for a separate medical concern." State law can be stricter. Some states expect an in-person visit for specific drugs or conditions on a schedule; check the state pages in our telehealth law index.

Can a practitioner rely on a colleague's in-person visit?

Only as a covering practitioner. Section 829(e)(2)(C) defines one as a practitioner who evaluates the patient at the request of a practitioner who has conducted an in-person evaluation, or a telemedicine evaluation, within the previous 24 months and "is temporarily unavailable." It fits vacation and on-call coverage. It does not fit a model where one clinician sees patients in person and a pool of remote clinicians prescribes for them indefinitely.

What are the seven exceptions?

The statute does not call them exceptions. It defines "practice of telemedicine" at 21 U.S.C. 802(54), and 829(e)(3)(A) says the in-person requirement does not apply to a practitioner engaged in it. Each of the seven categories requires the practitioner to be at a location remote from the patient, communicating through a telecommunications system referred to in the Medicare telehealth statute, and to practice in accordance with federal and state law.

(A) Patient in a registered hospital or clinic. The patient is being treated by, and physically located in, a DEA-registered hospital or clinic, and the remote practitioner is registered in the state where the patient is.
(B) Patient with a registered practitioner. The patient is being treated by, and in the physical presence of, a DEA-registered practitioner acting in the usual course of practice, registered in the patient's state.
(C) Indian Health Service. IHS and tribal practitioners designated as Internet Eligible Controlled Substances Providers.
(D) Public health emergency. During an emergency declared by the HHS Secretary, for areas and drugs the Secretary designates with the Attorney General's concurrence. This was the basis for DEA's March 2020 letters. The COVID-19 emergency ended May 11, 2023, and the flexibilities since then have rested on temporary rules under (G).
(E) Special registration. A practitioner with a special registration under 21 U.S.C. 831(h). DEA has proposed but not finalized the rule; see the special registration as proposed.
(F) VA medical emergencies. A narrow category for VA practitioners, limited to a five-day supply that cannot be extended or refilled.
(G) Other circumstances set by joint regulation. Circumstances DEA and HHS jointly determine, by regulation, to be consistent with effective controls against diversion. The four temporary extensions (codified at 21 CFR 1307.41), the buprenorphine rule (21 CFR 1306.51) and the VA continuity rule (21 CFR 1306.52) all rely on this one.

Which exceptions can a direct-to-consumer telehealth company use?

Very few. Categories A and B need the patient in a registered facility or with a registered practitioner, which describes hospital telepsychiatry or a tele-presenter model, not a patient on a phone at home. C and F belong to the IHS and the VA. D needs a declared emergency. That leaves the temporary rule under G until December 31, 2026, the buprenorphine rule under G, and the special registration under E once it exists. That is why the January 1, 2027 date matters so much to virtual-first prescribers; see what changes on January 1, 2027.

What does the registration piece add?

Categories A and B require the remote practitioner to be DEA-registered "in the State in which the patient is located," and the special registration statute uses the same test. Treat it as the working rule: registration follows the patient. A DEA number in Texas does not cover a patient in Colorado. If you need registrations in more states, our sisters handle the filings: White Glove APRN for NPs, White Glove PA for PAs, and White Glove IMLC for physicians.

What should an operator do with this?

Record, for every controlled-substance patient, whether the prescribing clinician examined them in person, the date, and the location. That field is your fallback if the temporary rule lapses.
If you use a hub-and-spoke or tele-presenter model, write down which 802(54) category you rely on and confirm the presenting clinician and facility registrations match it.
Do not stretch the covering practitioner definition to cover a standing team. It requires the original practitioner to be temporarily unavailable.

Our DEA Telemedicine Readiness engagement ($1,450) builds that roster and maps each patient to a lawful pathway, for your counsel to review. More on the federal rules at the DEA telemedicine rules hub.

Common questions

Does a video visit count as an in-person evaluation?

No. The statute requires the patient to be in the physical presence of the practitioner. A video visit can qualify only under one of the telemedicine categories in 21 U.S.C. 802(54), such as the temporary DEA rule in effect through December 31, 2026.

Does the in-person visit have to be recent?

Not under federal law. DEA says that once the prescribing practitioner has conducted one in-person evaluation, the remote prescribing restrictions no longer apply to that relationship, however long ago it was. Some states set their own in-person intervals for certain drugs.

Can a nurse practitioner prescribe based on a physician's in-person exam?

Only as a covering practitioner, meaning at the request of a practitioner who evaluated the patient within 24 months and is temporarily unavailable. It does not support an ongoing arrangement where one clinician examines and others prescribe.

When was the Ryan Haight Act passed?

It was signed on October 15, 2008 as Public Law 110-425. It amended the Controlled Substances Act, adding the internet prescribing rule at 21 U.S.C. 829(e) and the definition of practice of telemedicine at 21 U.S.C. 802(54).