Ryan Haight Online Pharmacy Consumer Protection Act of 2008

Long-term care organizations may use telehealth to provide remote medical consultations and prescription services to residents. Some long-term care organizations may also partner with online pharmacies or telemedicine platforms to facilitate medication management and prescription refills for residents. To ensure patient safety and regulatory compliance, LTC organizations must comply with telehealth regulations, such as the Ryan Haight Act.

In this Article, we will review the application and regulatory requirements of the Ryan Haight Act to the LTC telehealth practices.

The Ryan Haight Online Pharmacy Consumer Protection Act, often referred to simply as the Ryan Haight Act, is a federal law in the United States enacted in 2008 that amended the Controlled Substances Act (“CSA”) in part by adding several new provisions to prevent the illegal distribution and dispensing of controlled substances by means of the Internet. 

While the Ryan Haight Act amended the CSA to generally require that the dispensing of controlled substances by means of the internet be predicated on a valid prescription involving at least one in-person medical evaluation, it also established seven distinct categories [1] of telemedicine [2] pursuant to which a practitioner may prescribe controlled medications for a patient despite never having evaluated that patient in person, provided that, among other things, such practice is in accordance with applicable Federal and State laws.

The Act is named after Ryan Haight, a teenager who died of an overdose in 2001 after obtaining prescription drugs from an online pharmacy without a valid prescription. His death highlighted the dangers of illicit online pharmacies and the need for regulation in this area.

Key provisions of the original Act:

• In-Person Medical Evaluation Requirement: The Act generally requires that a practitioner conduct at least one in-person medical evaluation of a patient before prescribing a controlled substance to them via the internet. This requirement aims to ensure that prescriptions are based on a thorough assessment of the patient's medical condition.
• Exceptions to the In-Person Requirement: The Act includes exceptions to the in-person evaluation requirement in certain circumstances, such as when the patient is being treated in a hospital or clinic, or when the prescription is issued by a DEA-registered practitioner as part of a telemedicine consultation that meets specified criteria.
• DEA Registration: The Act imposes requirements on online pharmacies and practitioners who prescribe controlled substances via the Internet, including registration with the Drug Enforcement Administration (DEA). Registered practitioners must comply with the Act's provisions regarding patient evaluations and prescription practices.
• Criminal Penalties: The Act establishes criminal penalties for violations, including fines and imprisonment for individuals or entities that engage in the illegal sale of controlled substances over the internet without complying with the Act's requirements.

A couple of important definitions under this law includes:

• Internet means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected worldwide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocol to such protocol, to communicate information of all kinds by wire or radio.
• Practitioner means physicians, physician assistants, nurse practitioners, clinical nurse specialists, nurse-midwives, clinical psychologists, clinical social workers, registered dietitians or nutrition professionals, certified registered nurse anesthetists, marriage and family therapists, and mental health counselors.

COVID-19 pandemic forced the federal government to relax its restrictive telemedicine rules to ensure patients access to proper care and treatment without in-person interactions. In the beginning of the pandemic, Secretary Azar declared a Public Health Emergency with regards to COVID-10 and, with concurrence of the Action DEA Administrator, allowed DEA-registered practitioners to prescribe Schedule II-V controlled substances using telemedicine and without first conducting an in-person medical evaluation. During the Public Health Emergency, the practitioner could issue a prescription either electronically (for schedules II-V drugs) or by calling in an emergency schedule II prescription to the pharmacy, or by calling in a schedule III-V prescription to the pharmacy.  

As a result of significant flexibilities afforded to practitioners during the COVID-19 Public Health Emergency, DEA witnessed a successful and growing telemedicine market.  So, in March 2023, DEA and HHS proposed a rule (Proposed Rule) [3] to continue the telemedicine flexibilities offered during the PHE under Act, and allowing practitioners to prescribe controlled substances to patients whom the practitioner has never evaluated in person. In May 2023, DEA issued a First Temporary Rule to extend the full set of telemedicine flexibilities to November 11, 2023 and again on October 10, 2023, DEA issued a Second Temporary Rule extending these flexibilities to December 31, 2024 [4].

A summary of the flexibilities that DEA would like to keep are as follows [5]: 

First, the Proposed Rule addressed the definition of a few terms.

For example, the Proposed Rule clarified the definition of “practice of telemedicine” to include “using an interactive telecommunications system [6].” 

The Proposed Rule also defined a “qualifying telemedicine referral” to clarify the nature of the medical evaluation relationship that is required for the referral to enable the prescribing practitioner to issue prescriptions in excess of the 30-day limit as described in proposed § 1306.31(c)(2). This definition would require the referring practitioner to have conducted at least one medical evaluation of the patient in the physical presence of the referring practitioner, without regard to whether portions of the evaluation are conducted by other practitioners. As such, referrals, such as those predicated on a telemedicine visit exclusively, would not constitute a qualifying telemedicine referral.

Furthermore, the Proposed Rule added the definition of the phrase ““telemedicine relationship established during the COVID-19 public health emergency.”

Second, because the DEA believes that remote prescribing of controlled medications through the internet to patients who have not been seen in person by the prescriber presents a heightened risk of diversion, the Proposed Rule imposed specific requirements on the records of registrants. 

In particular, the proposed recordkeeping rules require a practitioner to maintain - 

• a written or electronic log for each prescription issued pursuant to a telemedicine encounter indicating the date the prescription was issued; 
• the full name and address of the patient; 
• the drug name, strength, dosage form, quantity prescribed, and directions for use; 
• the address at which the practitioner, and the city and State in which the patient, is located during the telemedicine encounter; 
• if issued through a qualifying telemedicine referral, the name and National Provider Identifier (“NPI”) of the referring practitioner, a copy of the referral and any communications shared;
• all efforts to comply to access the PDMP system; and
• copies of all qualifying telemedicine referrals they issue

Third, the Proposed Rule added a set of requirements practitioners must satisfy to issue a prescription for controlled substances as a result of a telemedicine encounter [7], such as including on the face of the prescription, or within the prescription order if prescribed electronically, that it is issued via telemedicine encounter.    

Fourth the Proposed Rule added additional requirements [8] that a practitioner would have to satisfy to issue a prescription for a controlled substance as a result of a telemedicine encounter.  For example, the added section would make clear that telemedicine may only be used to issue a prescription if that prescription is issued pursuant to a telemedicine encounter and is issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice; prohibits practitioners from using telemedicine to prescribe controlled medications while that practitioner is located outside the United States; and only authorizes practitioners to use telemedicine to prescribe non-narcotic controlled substances in schedules III-V.

Despite the survival of these narrow, but significant regulatory flexibilities in the Ryan Haight Act, when it comes to telemedicine, practitioners should not forget compliance with the state and other federal laws. Some states may prohibit the prescribing of controlled substances via telemedicine, some allow it with restrictions (e.g., only for treatment of psychiatric disorders, or prohibit the use for treatment of chronic nonmalignant pain, etc.), whereas other states broadly allow it. Regardless of the language of state law, whether the exam is conducted in-person or via the practice of telemedicine, a prescription for a controlled substance must always be issued for a legitimate medical purpose by a practitioner acting in the usual course of his or her professional practice.

As for the Ryan Haight Act, its aim remains the protection of consumers from the risks associated with obtaining controlled substances from unregulated online sources, including the potential for diversion, misuse, and abuse of prescription drugs. By imposing stricter regulations on internet pharmacies and practitioners, the Act seeks to ensure that prescriptions for controlled substances are issued responsibly and in accordance with established medical standards.

‍

Endnotes:

1. The seven categories are: (1) Treatment in a hospital or clinic; (2) Treatment in the physical presence of a DEA-registered practitioner; (3) Treatment by Indian Health Service or Tribal practitioners; (4) Treatment during a public health emergency as declared by the Secretary of Health and Human Services; (5) Treatment by a practitioner who has obtained a “special registration”; (6) Treatment by Department of Veterans Affairs practitioners during a medical emergency; and (7) Other circumstances specified by regulation. 21 CFR 1300.04(i)(1)-(7).
2. 21 U.S.C. 802(54)(A)-(G).
3. 88 FR 12875 - Telemedicine Prescribing of Controlled Substances When the Practitioner and the Patient Have Not Had a Prior In-Person Medical Evaluation.
4. 88 FR 69879 - Second Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications.
5. See above, 88 FR 12875.
6. 42 CFR 410.78(a)(3).
7. The Proposed Rule amends part 1306 by adding § 1306.05(i).
8. The Proposed Rule amends part 1306 by adding § 1306.31.