Use tiers: a government-issued photo ID shown on video and recorded at the first visit, a match against that record at later visits, and stricter checks for controlled substances. DEA's buprenorphine rule already requires pharmacists to verify identity, and DEA's proposed special registration rule would require prescribers to keep a photo record renewed every two years.
Verify identity in tiers. Every new patient shows a government-issued photo ID on video at the first visit and you keep a record of it; later visits are matched against that record; controlled-substance prescribing gets the strictest version. No general federal rule prescribes this for telehealth, but DEA's rules already require identity checks in specific places, and DEA's proposed special registration rule would make a photo record mandatory for many telemedicine prescriptions of controlled substances.
Where do current rules already require identity checks?
- Buprenorphine for opioid use disorder. DEA's final rule on buprenorphine treatment via telemedicine (90 FR 6504, January 17, 2025) requires the pharmacist to verify the identity of the patient before filling a prescription issued under that rule. A rejected fill because the patient's name does not match the ID lands back on your clinicians.
- Prescriber identity for EPCS. Electronic prescriptions for controlled substances require identity proofing of each prescriber and two-factor signing under 21 CFR part 1311. That is the prescriber, not the patient, but the same compliance team usually owns both.
- State law and payer contracts. Some state telehealth rules and many payer agreements expect you to confirm who you are treating. Read the ones that apply to your states.
What would DEA's proposed special registration rule require?
The Special Registrations for Telemedicine proposal (90 FR 6541, January 17, 2025) would add a new 21 CFR 1304.04(i). As proposed, a clinician special registrant, or a delegated employee or contractor under their direct supervision, would:
- verify the patient's identity before issuing a special registration prescription over an audio-video connection;
- at the first telemedicine encounter, capture a photographic record of the patient presenting a federal or state government-issued photo ID, or accept and keep a copy of the ID;
- renew the photographic record at least every two years;
- confirm the patient's identity against that record at every telemedicine encounter that results in a special registration prescription;
- where the patient lacks a photo ID, verify identity with other documents and keep a record of what was used. DEA's examples include a pay stub or a bill with the home address, a letter from a shelter employee for an unhoused patient, or a school ID for a minor.
DEA proposed that these records be kept in the patient's chart, separate from prescription data reported to DEA. The final rule was sent to OIRA on August 25, 2026 and has not been published, so these terms may change. Our DEA telemedicine rules hub will carry the final terms the day they publish.
How does a tiered process work?
Tier 1: every new patient.
- Patient holds a government-issued photo ID to the camera; staff compare the face, name and date of birth with the account.
- Capture an image of the ID, or the patient holding it, into the chart, with the patient's consent.
- Record who verified, when, and what document was used.
Tier 2: returning patients.
- Visual match against the stored image at the start of each video visit.
- Two identifiers (name and date of birth) confirmed verbally.
- For asynchronous or audio-only visits, a second factor such as a code sent to the phone on file.
Tier 3: controlled substances and high-risk prescriptions.
- Video visit with a live ID check at the first prescription.
- A refresh of the stored ID image at least every two years, matching the proposed DEA interval.
- Name on the prescription matches the ID exactly, so the pharmacy check does not fail.
- Escalation to the medical director for mismatches, shared payment methods across several accounts, or one address used by many patients.
Should you use an automated ID verification vendor?
Automated document and selfie checks can scale Tier 1, especially for asynchronous intake. If you use one:
- the vendor handles PHI on your behalf, so it needs a business associate agreement;
- it is processing biometric data, which some states regulate separately (Illinois's Biometric Information Privacy Act is the best known), so have counsel review consent language for each state;
- keep a human review path for failures, because automated checks fail some legitimate patients more than others.
How do you handle minors and patients without photo ID?
Write the exceptions down. For minors, verify the parent or guardian and their authority to consent under the patient's state law. For adults without photo ID, accept alternative documents in a defined list and record which were used, which is the approach DEA proposed.
How does identity fit with location and consent?
Run all three at the start of the visit, in the same order every time: who the patient is, where they are, and what they have consented to. See patient location verification and telehealth consent form requirements.
Identity procedures are part of our DEA Telemedicine Readiness work ($1,450) and our Policies & Consent Kit ($1,950). See pricing.
Common questions
- Is ID verification required for telehealth?
- There is no single federal rule for all telehealth visits. DEA's buprenorphine telemedicine rule requires pharmacists to verify patient identity before filling, and DEA's proposed special registration rule would require prescribers to keep a photo ID record. Many payers and some states also expect it.
- What would DEA's proposed rule require for patient ID?
- As proposed in January 2025, a special registrant would capture a photographic record of the patient showing a government-issued photo ID at the first telemedicine encounter, renew it at least every two years, and check identity against it at each encounter that leads to a special registration prescription. The rule is not final.
- What if a patient has no photo ID?
- Accept alternative documents from a defined list and record which were used. DEA's proposal gave examples such as a pay stub or utility bill with the home address, a letter from a shelter employee, or a school ID for a minor.
Planning a Telehealth Service Line?
We research every state's rules for your service line, write the policies and consent forms, file telehealth registrations and keep it current, at published prices.