DEA Telemedicine Rule 2027: What It Means for Telehealth Ads

The DEA telemedicine rule in force today is temporary, apart from two final rules for opioid use disorder medicines and VA patients: it lets DEA-registered practitioners prescribe Schedule II to V controlled substances by telemedicine without an in-person evaluation when its conditions are met, and it is "effective January 1, 2026 through December 31, 2026" (90 FR 61301). The permanent rule DEA has drafted, the special registration final rule (RIN 1117-AB40), reached the White House Office of Management and Budget (OMB) on August 25, 2026, is listed as "Pending Review", and its text is not public (OIRA record; review list). Whatever it says, Curve Compliance keeps ad measurement for telehealth funnels HIPAA-safe: conversions go server-side with a fixed list of fields, PHI is removed before anything is sent to an ad platform, and Curve signs a BAA on every plan.

Book a call. Curve's team will walk through your telehealth funnel with you and show what each step sends to Meta and Google today. Book a call with Curve.

What ends on December 31, 2026

DEA's release on the fourth extension says DEA-registered practitioners "are permitted to remotely prescribe Schedule II-V controlled medications via audio-video telemedicine encounters, including Schedule III-V narcotic controlled medications approved by the Food and Drug Administration (FDA) for maintenance and withdrawal management treatment of opioid use disorder via audio-only telemedicine encounters" (DEA release). HHS says these flexibilities run "through December 31, 2026" (Telehealth.HHS.gov).

The rule text, 21 CFR 1307.41, says: "This section is in effect until the end of the day December 31, 2026." If nothing replaces it, the in-person requirement comes back, which DEA and HHS call the "telemedicine cliff" (90 FR 61301).

What the Ryan Haight Act requires

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 amended the Controlled Substances Act (DEA agenda entry). A prescription controlled substance may not "be delivered, distributed, or dispensed by means of the Internet without a valid prescription", and a valid prescription generally comes from "a practitioner who has conducted at least 1 in-person medical evaluation of the patient" (21 U.S.C. 829(e)).

The Act exempts seven kinds of "practice of telemedicine" (21 U.S.C. 802(54)). One covers a practitioner with "a special registration under section 831(h) of this title", the provision DEA's pending rulemaking (RIN 1117-AB40) lists among its legal authorities (Unified Agenda).

Final, proposed or pending: where each DEA rule stands

Rule	Status on October 26, 2026	What it covers	Source
Fourth temporary extension	Final, temporary; in effect through December 31, 2026	Schedule II to V by audio-video telemedicine; audio-only for opioid use disorder medicines	90 FR 61301; 21 CFR 1307.41
Expansion of Buprenorphine Treatment via Telemedicine Encounter	Final; effective December 31, 2025	Schedule III to V opioid use disorder medicines, including audio-only, with conditions	90 FR 6504; effective date; 21 CFR 1306.51
Continuity of Care via Telemedicine for Veterans Affairs Patients	Final; effective December 31, 2025	VA practitioners prescribing to VA patients	90 FR 6523; effective date; 21 CFR 1306.52
Special Registrations for Telemedicine	Proposed January 17, 2025; comments closed March 18, 2025	Three special registrations, one for telemedicine platforms	90 FR 6541
Special registration final rule (RIN 1117-AB40)	At OMB since 08/25/2026, "Pending Review"; agenda target "Final Action 11/00/2026"	Not public	OIRA record; review list; Unified Agenda

November is DEA's own agenda target, and OMB's record shows when the rule arrived, not when review ends. DEA's agenda says it "is currently reviewing the over 6,400 public comments" (Unified Agenda). On October 26, 2026, this was the only DEA telemedicine rule on OMB's review list (OIRA).

What the 2025 proposal said about telehealth platforms that advertise

The January 2025 proposal would "authorize three types of Special Registration": one for clinicians prescribing Schedule III to V, an advanced one for specialized clinicians covering Schedule II to V, and a Telemedicine Platform Registration for "covered online telemedicine platforms" (90 FR 6541). Special registrants would also "maintain a State Telemedicine Registration for every state in which a patient is treated by the special registrant, unless otherwise exempted".

For marketers, the platform definition matters most. It would cover an entity that connects patients and clinicians by audio-video "for the diagnosis and treatment of patients that may result in the prescription of controlled substances", is not a hospital, clinic, local in-person medical practice or insurance provider, and meets at least one of four tests. The first: "The entity explicitly promotes or advertises the prescribing of controlled substances through the platform." The others cover financial interests tied to prescriptions, influence over prescribing, and "control or custody of the prescriptions or medical records of patients who are prescribed controlled substances through the platform" (proposed rule). All of this is proposed. The final text is not public and may keep, change or drop any of it.

Which telehealth medicines are controlled substances

DEA's schedules in the eCFR place several medicines that telehealth programs prescribe in Schedules II to IV. The table lists schedules only; who may be prescribed what is a clinical and legal decision. TRT programs can find the intake side in TRT telehealth intake forms.

Substance	eCFR wording	Schedule	Section
Amphetamine, methylphenidate, lisdexamfetamine	Listed under "(d) Stimulants"	II	21 CFR 1308.12(d)
Ketamine	"Ketamine, its salts, isomers, and salts of isomers"	III	21 CFR 1308.13(c)
Testosterone	Anabolic steroids include "testosterone (17β-hydroxyandrost-4-en-3-one)"	III	21 CFR 1308.13(f); 1300.01
Buprenorphine	Listed under "(e) Narcotic drugs"	III	21 CFR 1308.13(e)
Phentermine	Listed under "(f) Stimulants"	IV	21 CFR 1308.14(f)

The Ryan Haight Act's rule on online advertising

The 2008 Act also added an advertising offense (21 U.S.C. 843, amendment notes). It is unlawful "to knowingly or intentionally use the Internet, or cause the Internet to be used, to advertise the sale of, or to offer to sell, distribute, or dispense, a controlled substance where such sale, distribution, or dispensing is not authorized by this subchapter or by the Controlled Substances Import and Export Act" (843(c)(2)(A)).

The offense does not reach material that "merely advocates the use of a controlled substance or includes pricing information without attempting to facilitate an actual transaction involving a controlled substance" (843(c)(2)(C)). Whether a given ad, landing page or funnel step crosses that line depends on the facts and on the final DEA rule, so talk to your counsel.

What Google requires of telemedicine advertisers

Platform rules sit on top of federal law. Google's Prescription drug services policy says: "Google restricts the promotion of services related to the online prescribing, dispensing, and sale of prescription drugs. Businesses subject to this policy include but aren't limited to online pharmacies and telemedicine providers." It adds: "Advertisers must be certified in order to serve ads for prescription drug services." For some certifications, advertisers "may need to obtain third-party accreditation first", "for example, from LegitScript, NABP, or G2" (Google Ads policy).

Curve's LegitScript certification guide covers that step. If an account is already flagged, see Google unauthorized pharmacy suspensions, Meta prescription drug rejections and Meta peptide and ketamine rejections. Pharmacies have their own page: Curve for online pharmacies.

Tracking a controlled-substance funnel without sending health data

DEA's rules govern prescribing; HIPAA's limits on tracking come from HHS. HHS says "The HIPAA Rules apply when the information that regulated entities collect through tracking technologies or disclose to tracking technology vendors includes protected health information (PHI)", and "Tracking technologies on a regulated entity's user-authenticated webpages generally have access to PHI", naming a telehealth platform as one such page (HHS bulletin). A June 20, 2024 court order vacated a different part, about IP addresses on public pages, as the HHS page notes (the bulletin, annotated). Cash-pay programs should start with does HIPAA apply to cash-pay telehealth.

An event named after a stimulant or testosterone program tells an ad platform what someone was looking for. Keep medicine names, screening answers and treatment pages out of what ad platforms receive, and count only eligible leads as conversions (eligibility screening in intake forms).

Dates to put in your Q4 plan

• August 25, 2026: OMB received the special registration final rule (OIRA record).
• November 2026: DEA's agenda target, "Final Action 11/00/2026" (Unified Agenda). A target, not a deadline.
• December 31, 2026: the fourth extension ends (21 CFR 1307.41).
• January 1, 2027: the first day after the current flexibilities end, unless DEA extends them again (90 FR 61301).

Curve's October 2026 compliance news tracks this rule with other changes for health advertisers.

How Curve Compliance helps

If your intake changes after DEA publishes, for example a new state question or an in-person visit step, your ad measurement has to keep working. Curve Compliance replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns, such as condition names or emails in URLs, and strips PHI before data reaches an ad platform. Event Logs show what Curve sent and what each platform accepted.

Curve Forms hosts intake under the BAA Curve signs on every plan, with screening outcomes by age, a state answer or insurance; screened-out submissions send no conversion, and form answers are never sent to an ad platform. When a patient books in Calendly, Acuity, IntakeQ or another supported scheduler, Curve keeps the ad click attached, even for bookings made days later. Curve's team does the setup, typically live in about a week. See Curve for telemedicine providers and Curve for telehealth.

Sources, checked October 26, 2026: Federal Register 90 FR 61301, 90 FR 6541, 90 FR 6504, 90 FR 6523 and 90 FR 13410; DEA release; Telehealth.HHS.gov; OMB review list, RIN 1117-AB40 record and Unified Agenda; 21 U.S.C. 802, 829 and 843; 21 CFR 1300.01, 1306.51, 1306.52, 1307.41, 1308.12, 1308.13 and 1308.14; Google Ads Prescription drug services; HHS tracking bulletin.

Frequently Asked Questions

What happens to the DEA telemedicine rule after December 31, 2026?

The current flexibilities end with that day (21 CFR 1307.41), and the special registration final rule has been at OMB since August 25, 2026, its text not public (OIRA record; review list). If neither that rule nor another extension takes effect first, the in-person evaluation requirement applies again, subject to the Ryan Haight Act's listed exceptions and the buprenorphine and VA final rules (829(e); 802(54)).

Is the DEA special registration rule final?

Not yet. OMB received the final rule (RIN 1117-AB40) on August 25, 2026 and lists it as "Pending Review"; DEA's agenda target is "Final Action 11/00/2026", and the text is not public (OIRA record; review list; Unified Agenda).

Would telehealth platforms have to register with DEA?

The January 2025 proposal "proposed to require that certain Direct-to-Consumer (DTC) telemedicine platforms register with DEA when they engage in intermediary conduct integral to the provider-patient relationship" (Unified Agenda; 90 FR 6541). It is proposed, not final.

What is the Ryan Haight Act?

A 2008 law that amended the Controlled Substances Act so a prescription controlled substance generally cannot be dispensed "by means of the Internet without a valid prescription", which needs an in-person evaluation unless a listed telemedicine exception applies (21 U.S.C. 829(e); 802(54)). It also made unauthorized online advertising of controlled substances unlawful (843(c)(2)).

What does the Ryan Haight Act say about online advertising?

It bars using the Internet "to advertise the sale of, or to offer to sell, distribute, or dispense, a controlled substance" where that is not authorized. Material that only advocates use, without trying to facilitate a transaction, is outside the offense (21 U.S.C. 843(c)(2)).

Can a clinic advertise testosterone or ketamine telehealth online?

It depends on whether the sale is authorized and on platform approval. Both are Schedule III (21 CFR 1308.13), federal law bars online ads for unauthorized sales (843(c)(2)), and Google requires certification to "serve ads for prescription drug services" (Google Ads policy). Meta has its own rules (Meta ketamine rejections).

Do Medicare telehealth flexibilities also end on December 31, 2026?

No. Telehealth.HHS.gov says "Recent legislation authorized an extension of many of the Medicare telehealth flexibilities through December 31, 2027" (Telehealth.HHS.gov). The DEA flexibilities for prescribing controlled medications are a separate rule that ends December 31, 2026 (21 CFR 1307.41).

Does the DEA rule change HIPAA rules for ad tracking?

No DEA rule published so far changes HIPAA. The limits come from HHS: regulated entities "must ensure that all tracking technology vendors have signed a BAA and that there is an applicable permission prior to a disclosure of PHI" (HHS bulletin).

Talk to Curve Compliance

Book a call. Curve's team will map your controlled-substance funnel with you, from ad click to intake to booked visit, and set up server-side conversions that keep PHI away from Meta and Google, under the BAA Curve signs on every plan. Book a call with Curve.