Tessic Health

Can a white-label telehealth brand prescribe controlled substances?

Yes, as long as the prescribing is done by licensed providers who hold DEA registrations for the states where their patients are, using software that meets the DEA's rules for EPCS (electronic prescribing of controlled substances), which require identity-proofed prescribers and two-factor signing on every controlled prescription. The brand itself never holds the DEA registration and never makes the prescribing decision: it owns the business, and a clinician-owned practice owns the medicine. States add their own rules, most often a required check of the prescription drug monitoring program (PDMP) before prescribing. Federal rules currently allow telehealth prescribing of controlled medications without a prior in-person visit through December 31, 2026, while the DEA finalizes a permanent special registration, so any controlled-substance program should be built to adapt. On Tessic Health, eRx, EPCS, and controlled-substance coverage are built in, with PDMP checks enforced inside the prescribing workflow and providers licensed in all 50 states.

Reviewed September 11, 2026 · 7 min read

In short

  • Controlled prescriptions come from DEA-registered providers, never from the brand.
  • EPCS software requires identity proofing and two-factor signing on each controlled prescription.
  • Many states require a PDMP check before prescribing, and some require their own registration.
  • Telehealth prescribing without an in-person visit is allowed through December 31, 2026.
  • The DEA's permanent special registration rule is forecast for November 2026.
On this page
  1. Which telehealth medications are controlled
  2. Who holds what
  3. Adding a controlled-substance program
  4. How EPCS works
  5. The in-person rule and the 2026 deadline
  6. Where controlled-substance programs go wrong
  7. What the brand owns in a controlled-substance program
  8. Common questions

Which telehealth medications are controlled

The DEA sorts controlled substances into five schedules by their potential for abuse, from Schedule I (no accepted medical use) to Schedule V (the lowest potential). Telehealth brands mostly meet Schedules II through IV. ADHD stimulants such as amphetamine and methylphenidate are Schedule II, the most tightly regulated drugs that can be prescribed. Testosterone, ketamine, and buprenorphine are Schedule III. Phentermine, modafinil, and benzodiazepines such as alprazolam are Schedule IV.

Many of the largest telehealth categories are not controlled at all. GLP-1 medications such as semaglutide and tirzepatide, erectile dysfunction medications, finasteride and minoxidil for hair loss, and estradiol and progesterone are ordinary prescriptions. A brand's first question is which of its treatments fall under the DEA, because only those carry the rules below.

Start here

Do I need a medical license to start a telehealth company?

No. Licensed clinicians own the medical practice and the founder's company owns the business. Here is exactly who needs which license, and how the two companies fit together.

Read the guide

Who holds what

Every controlled-substance requirement attaches to a clinician, a pharmacy, or the practice. None of them attaches to the brand.

RequirementWho holds itOn Tessic Health
DEA registrationEach prescriber, for every state they prescribe intoHeld by the prescribing providers; the brand never holds one
State controlled-substance registrationEach prescriber, in states that require oneHeld by the prescribing providers where a state requires it
EPCS identity proofing and two-factor signingEach prescriber, through certified softwareBuilt in: identity-proofed prescribers and two-factor signing on every controlled prescription
PDMP checkThe prescriber, before prescribing, where the state requires itEnforced inside the prescribing workflow
Dispensing registrationThe pharmacy, which needs its own DEA registration and state licensesContracted pharmacy with controlled-substance coverage
Prescription recordsThe practice and the pharmacy, kept as federal rules requirePrescription records retained to federal requirements

Adding a controlled-substance program

The legal structure comes first, as for any prescription category; Do I need a medical license? covers it. Then:

  1. Name the drugs and schedules

    List every controlled medication the program might use and its schedule. Schedule II drugs carry the tightest rules and the closest scrutiny.

  2. Confirm registrations in every state

    Map each prescriber's DEA and state registrations against the states the brand sells into, and close the gaps before launch.

  3. Turn on EPCS and PDMP checks

    Identity-proof every prescriber, set up two-factor signing, and put the PDMP check inside the workflow wherever a state requires it.

  4. Arrange dispensing

    Confirm the pharmacy's DEA registration, its state licenses, and its willingness to fill controlled prescriptions from telehealth providers.

  5. Write the protocol and monitoring plan

    Set eligibility, dose limits, follow-up intervals, labs, and refill rules, and decide in advance what triggers a stop.

  6. Plan for the rule change

    Keep an in-person pathway ready in case the special registration, or an end to the current flexibilities, requires one.

How EPCS works

EPCS is the DEA's framework for sending a controlled-substance prescription electronically instead of on paper. Before a provider can use it, the provider's identity is verified to a set standard (identity proofing), and the provider receives a credential for signing. Each controlled prescription is then signed with two-factor authentication, such as a password plus a hardware token or a code on a separate device, so no one else can sign in the provider's name.

The software must meet the DEA's requirements in 21 CFR Part 1311, and the pharmacy's system must be able to receive and process the prescription. Many states now require electronic prescribing for controlled substances, so for a telehealth clinic whose patients never walk in, paper is rarely an option anyway.

The in-person rule and the 2026 deadline

The Ryan Haight Act, the federal law on online prescribing, requires an in-person medical evaluation before a controlled substance is prescribed over the internet, with narrow exceptions. Since the pandemic, temporary DEA and HHS rules have set that requirement aside for telehealth. The fourth extension runs through December 31, 2026.

The DEA's long-term plan is a special registration for telemedicine. Its final rule entered review at the White House Office of Management and Budget on August 25, 2026, and the Justice Department's forecast expects publication in November 2026. The final terms, including any added limits on Schedule II drugs or on where providers and patients are located, will not be known until it is published.

A controlled-substance program should plan for three outcomes: another extension, a special registration with new paperwork, or a return of the in-person requirement for some prescribing. Track each patient's state, keep a path to an in-person exam, and keep prescribing records clean enough to support any new registration.

Where controlled-substance programs go wrong

Controlled substances draw the most serious enforcement in telehealth. The failures follow a pattern:

  • Business pressure on prescribing, such as approval targets, fast-track intake for paying customers, or growth plans built on prescription volume. Federal prosecutors have charged telehealth executives over stimulant prescribing at scale.
  • Advertising a controlled drug by name. Ad platforms limit prescription drug ads to certified advertisers, and a campaign that sells the drug instead of the evaluation draws regulators' attention too.
  • Skipped or unrecorded PDMP checks, usually because the check lives outside the prescribing software.
  • Treating the rules as national. States add their own registrations, prescribing limits, and PDMP requirements, and a program built for one state breaks in the next.
  • Assuming any pharmacy will fill. Many pharmacies decline controlled prescriptions from telehealth providers they do not know, so dispensing has to be arranged before launch.
  • Letting the business side hold clinical controls. The medical license guide explains why prescribing decisions must sit with the clinician-owned practice.

What the brand owns in a controlled-substance program

The brand owns the offer, the price, the patient experience, and the marketing. The practice owns the evaluation, the prescription, and the records. Keep that split visible in how the company runs, and controlled substances become one more category the clinic offers. For category rules, see how to start a TRT or hormone practice; for the patient data involved, see HIPAA for brand owners; for everything else that must be ready, see what you need before your first patient.

COMMON QUESTIONS

What founders ask next.

Does my brand need its own DEA registration?
No. DEA registrations belong to practitioners and pharmacies. The providers who prescribe hold registrations for the states they prescribe into, and the pharmacy holds its own. The brand's company, the management services organization (MSO), owns the business and never prescribes. See Do I need a medical license?.
Can a telehealth brand offer testosterone?
Yes. Testosterone is Schedule III, so it needs DEA-registered prescribers, EPCS, and PDMP checks where states require them, plus labs before and during treatment. Through December 31, 2026, no in-person visit is required first. How to start a TRT or hormone practice covers the launch.
Can a telehealth brand prescribe stimulants like Adderall?
Under the current flexibilities, a DEA-registered prescriber may prescribe a Schedule II stimulant by telehealth after a proper evaluation. It is also the most closely watched category in telehealth: federal prosecutors have charged executives over stimulant prescribing, and many pharmacies decline these prescriptions. Tessic Health covers controlled substances where clinically appropriate, and the prescribing decision always belongs to the provider.
What is EPCS?
EPCS stands for electronic prescribing of controlled substances. It is the DEA's set of rules for sending a controlled prescription electronically: the prescriber's identity is verified, each prescription is signed with two-factor authentication, and the software meets the DEA's requirements. Tessic Health has EPCS built in.
What happens after December 31, 2026?
One of three things: the DEA's special registration for telemedicine takes effect, the flexibilities are extended again, or the in-person requirement returns for some prescribing. The final special registration rule is forecast for November 2026. A program with an in-person pathway and clean records can adapt to any of the three.
Will every pharmacy fill a telehealth controlled prescription?
No. Pharmacists share responsibility for making sure a controlled prescription is legitimate, and many decline prescriptions from telehealth providers they do not know. A controlled-substance program needs a pharmacy that has agreed to fill its prescriptions before launch. On Tessic Health, the contracted pharmacy network includes controlled-substance coverage.

KEEP READING

The next questions on the list.

All guides

SOURCES

Reviewed September 11, 2026. Tessic Health guides are general information for founders, not legal advice. Laws, agency guidance, and ad platform policies change; confirm the specifics for your business with health-care counsel. Tessic Health claims restate what tessichealth.com publishes on its pricing, platform, and security pages.