New York State and Federal Law: Which one applies?
For digital health clinicians and industry stakeholders, particularly in psychiatry, the future of telehealth prescribing is still in a state of flux. While New York’s intentions with regard to its State standards are now clear, which way the federal rules will end up is unknown.
On May 21, 2025, the New York Department of Health adopted new controlled substances regulations applicable to the prescribing of controlled substances via telehealth[1]. The regulations were adopted in an attempt to align State law with ever-evolving federal standards in an area that is seeing increasing change as a result of COVID-19. These regulations pose an interesting preemption dilemma, by creating an exception for any conduct that is compliant with federal law. The current federal law, relying on extended temporary waivers, is less restrictive than the State rules. Therefore, although the State rules are currently in effect, the legal standard remains unchanged, subject to a final decision regarding a new federal rule by the federal Drug Enforcement Administration (DEA) at the end of this year.
New York’s new rules closely mirror the elements of a proposed federal rule that was first introduced in 2023 and subsequently stalled due to diverging industry comments and policy considerations. If the DEA succeeds in passing its proposed changes at the end of 2025, the State will have succeeded in harmonizing its standard with the federal standard. However, after three rounds of extended waivers, it remains to be seen whether a new federal standard will come to fruition and whether the New York rules will be implemented.
Evolution of Controlled Substance Prescribing Laws
The federal Ryan Haight Online Pharmacy Consumer Protection Act of 2008, enforced by the DEA, was passed to regulate the prescribing of controlled substances by means of the internet. The law is applicable nationwide and prohibits the prescribing of controlled substances without the conducting of at least one in-person medical evaluation, except in certain limited circumstances. In 2020, due to the COVID-19 public health emergency, the DEA granted a temporary exception to prevent lapses in care. New flexibilities allowed practitioners to prescribe schedule II-V controlled medications via audio-video encounters (and certain narcotics for treatment of opioid use disorder via audio-only encounters), so long as the prescriptions otherwise complied with applicable guidance. In 2023, the DEA proposed two new rulemaking initiatives aimed at making permanent some of the flexibilities for public health and access purposes, while maintaining effective controls against narcotics abuse and mismanagement. The proposed rules received significant comment from the public, including requests for various changes to the proposed permanent standards. In an effort to manage the influx of input on this issue and work on revising the rules, the DEA has now extended the initial temporary waiver twice. The current waiver is currently scheduled to expire on December 24, 2025, after which, if the DEA does not extend the waiver once more, or pass permanent rules, the standards will revert back to the current laws under the Ryan Haight Act, thus tightening the requirements for electronic prescription of controlled substances without an in-person evaluation.
Proposed Federal Rules
The proposed federal standards under consideration by the DEA for implementation in 2026 focus only on telemedicine scenarios that involve prescribing controlled substances to patients whom the practitioner has never examined in-person. The proposed rule includes the following elements:
- Medical providers will be authorized to prescribe Schedule III-V controlled substances to patients without ever having an in-person medical evaluation, subject to compliance with all other applicable rules, if there is a legitimate need or significant burden, as further described in the proposed regulations.
- Certain advanced medical providers (such as psychiatrists, hospice care physicians, palliative care physicians, physicians rendering treatment at long term care facilities, pediatricians, and neurologists, including certain mid-level practitioners) will be further authorized to prescribe Schedule II-V controlled substances when a higher tier of medical circumstances apply.
- Telemedicine platforms that are involved in medication prescriptions will be required to register with the DEA.
- Prescribing providers and telemedicine platforms will need DEA-issued state Telemedicine registrations in every state in which a patient receiving a prescription resides.
- A national prescription drug management program will be established to provide pharmacists and medical providers with visibility of a patient’s prescribed medication history.
The DEA also asked for public comment on the following issues:
- Whether medical providers must be physically located in the same state as the patient when prescribing Schedule II controlled substances.
- Whether medical providers must limit their telemedicine prescriptions for Schedule II controlled substances to fewer than 50% of all of such provider’s prescriptions for Schedule II controlled substances.
- Whether a minor’s parent or guardian must be present during the prescription process for minors.
- Other issues relating to patient identification and prescription reporting.
Notably, the DEA did previously pass two related final rules that are currently in effect: one that expands buprenorphine treatment for opioid use disorders via audio-only encounters, subject to certain rules, and one that expands care provided by Veterans Affairs practitioners, so that veterans have continuity of care across geographic locations. However, the rules broadly applying to other treatments and to most practitioners are still pending.
New York’s Regulations
If federal law changes to the extent that a New York practitioner may comply with it while also falling under purview of any less restrictive part of the State law (which may occur in the event that the DEA’s proposed rules as currently contemplated do go into effect), the recently adopted New York regulations will require the following, subject to certain other applicable rules and standards:
- Practitioners must generally conduct an in-person medical evaluation before prescribing a controlled substance. However, there are some exceptions that permit prescribing in the absence of an in-person evaluation in specific circumstances.
- A remote prescription may be permitted if a consulting or referring practitioner has conducted an in-person evaluation for the condition within the previous 12 months.
- A remote prescription may be permitted by a covering practitioner on a temporary basis if the practitioner has sufficient access to and can communicate with the initial prescriber.
- In emergency situations involving a new condition, remote prescribing is permitted if certain safeguards are followed.
However, the New York regulations specifically permit practitioners to take actions that comply with federal laws, which will permit the regulations to conform to and work together with any future changes to or adoption of the anticipated DEA rules.
General Telehealth Considerations
Importantly, while the specific issue of controlled substance prescriptions to remote patients is not yet settled, there are numerous other laws and standards that are in effect and applicable to all practitioners operating within the umbrella of telehealth.
For example, HIPAA compliance with respect to the access, disclosure, and use of protected health information over digital platforms is required of covered entities (as that term is used under HIPAA). Practitioners must abide by state professional misconduct laws governing standards of care, some of which may speak to standards of telemedicine. These rules may require practitioners to maintain records of certain specific of the interaction, and to require a signed disclosure from patients consenting to treatment via telemedicine. Additionally, health insurance payors, including federal and state programs and private third-party insurers, often have requirements about the types of telehealth activities that are eligible for coverage, and how such care must be rendered. Many states and insurers also have rules about the locations in which a practitioner or patient must physically be located, and what types of technology and communications systems are permitted. Many states also require practitioners to be licensed in the state in which care is received by the patient. All practitioners, especially those who practice in more than one state (including adjacent states) and those who accept Medicare and Medicaid-covered services are advised to consider all of these obligations, regardless of whether they prescribe controlled substances.
Healthcare industry participants with interests in New York, including technology companies and practitioners who routinely prescribe controlled substances, should remain vigilant of the tenuous standard of law in this area as they make decisions about how to provide patient services, and whether to invest in or form new business ventures built on models that may be affected by these rules.
We continually monitor these rules and other regulatory updates in the healthcare industry. Should you need the assistance of experienced counsel to assist you in evaluating your compliance with healthcare regulations, do not hesitate to contact Chaya Rosenbaum at (516) 294-5414 or [email protected].
Weiss Zarett Brofman Sonnenklar & Levy, P.C. is a Long Island law firm providing a wide array of legal services to the members of the health care industry, including corporate and transactional matters, civil and administrative litigation, healthcare regulatory issues, bankruptcy and creditors’ rights, and commercial real estate transactions.
ATTORNEY ADVERTISING: PRIOR RESULTS DO NOT GUARANTEE FUTURE OUTCOMES.
[1] The terms telemedicine, telehealth, and telecare, while often used interchangeably, do have different legal definitions. Telehealth is the broader term, encompassing a wide variety of remote patient care services by various healthcare parties, while telemedicine is defined by the FCC as the use of telecommunications technologies in furtherance of the delivery of medical services by treating clinicians (see https://www.fcc.gov/general/telehealth-telemedicine-and-telecare-whats-what). Telemedicine is the terms used throughout the DEA rules discussed in this article. However, we aim this advice at all parties involved in the telehealth industry as a whole, such as telehealth companies that work with clinicians, which may be affected by this changing area of law. New York’s definitions of these terms can be found in Article 29-G of the Public Health Law.
