Telehealth Cross-State Licensing Compliance: The 2026 DEA and State Board Roadmap for Health Tech

Most health tech founders we talk to share the same assumption: once the app is built and HIPAA compliance is checked off, the platform can operate nationally. That assumption is wrong — and it can create existential legal exposure. Every state maintains its own medical licensing regime, its own telehealth practice rules, and its own prescribing standards. Layer on the federal controlled-substance prescribing requirements under the Ryan Haight Act, which the DEA has now extended through four temporary rulemaking cycles without finalizing permanent regulations, and you have a compliance landscape that no single platform feature can solve.

This is the practical roadmap for navigating telehealth cross-state licensing compliance in 2026: which states require full licensure versus telehealth registration, the controlled-substance prescribing trap that has already cost one telehealth company over $3.6 million in federal penalties, and how to scope your product launch geographically without painting yourself into a corner.

If you're also building mental health or wellness features, our deeper dive on mental health app data privacy beyond HIPAA covers the privacy side of this equation. And for the broader telehealth expansion checklist, see our earlier guide on telehealth multi-state compliance for digital health founders.

The False Promise of "Launch Nationally"

When you ship a telehealth platform, the technology is state-agnostic. The law is not. A provider licensed in Texas who treats a patient located in New York via video visit is generally practicing medicine in New York — meaning that provider needs New York authorization, Texas law doesn't follow the patient, and your platform's terms of service can't override either state's medical practice act.

The Federation of State Medical Boards (FSMB) maintains a state-by-state telemedicine policy chart that illustrates just how fragmented these requirements are. Some states require full and unrestricted licensure to deliver telehealth services to their residents. Others offer a limited telehealth registration or special-purpose license. A few have no specific telehealth registration pathway at all, which means the default rule — full licensure — applies. The Center for Connected Health Policy (CCHP) publishes a comprehensive fall 2025 state telehealth laws and reimbursement report that tracks these variations across all 50 states.

The practical takeaway: your product roadmap needs a state-by-state compliance matrix before you accept a single patient in a new jurisdiction. That matrix should track, at minimum, whether the state requires full licensure or offers a telehealth registration, whether the state recognizes the Interstate Medical Licensure Compact, what prescribing rules apply, and whether asynchronous (store-and-forward) telehealth is permitted.

State Licensing: Full Licensure vs. Telehealth Registration vs. Compacts

Full Licensure

Most states require a provider delivering telehealth services to a patient located in that state to hold a full, unrestricted medical license in that state. This is the default rule — and it's the most expensive and time-consuming path. A physician seeking licensure in a new state may face application fees, primary-source verification of credentials, background checks, and processing times that range from weeks to months.

Telehealth Registration and Special-Purpose Licenses

A growing number of states offer a streamlined telehealth registration or special-purpose license that allows out-of-state providers to deliver virtual care without obtaining full licensure. These registrations typically come with limitations — they may restrict the number of patients a provider can treat, limit the types of services covered, or require periodic renewal. The specific requirements vary widely, which is why a state-by-state matrix is essential rather than relying on a general assumption.

The Interstate Medical Licensure Compact (IMLC)

The Interstate Medical Licensure Compact (IMLC) is the most significant structural reform in cross-state medical licensing. As of 2025, the IMLC includes 41 states, the District of Columbia, and Guam. The compact doesn't create a single national license — instead, it streamlines the process of obtaining full licenses in multiple participating states through a unified application and credential verification system.

Here's what the IMLC does and doesn't do for health tech startups:

• Does: Reduce the time and cost for eligible physicians to obtain licenses in multiple compact states. The average processing time for a Letter of Qualification was 43 days in 2024, with an additional 20 days for license issuance.
• Doesn't: Eliminate the requirement for a separate license in each state. Your providers still need a license in every state where they treat patients.
• Doesn't: Cover all states. California, Oregon, Virginia, South Carolina, and Alaska are not IMLC members as of 2025.
• Doesn't: Apply to non-physician providers in the same way. Nurse practitioners and physician assistants are covered by separate compacts (the Nurse Licensure Compact and the PA compact), which have different member-state rosters.

For health tech startups, the IMLC is a tool — not a strategy. It can help you onboard providers in compact states faster, but it doesn't change the fundamental requirement that each provider must be licensed in the state where the patient is located at the time of the telehealth encounter.

The Ryan Haight Act and the DEA Telemedicine Prescribing Trap

If your platform involves prescribing controlled substances — and many mental health, pain management, and addiction treatment platforms do — the Ryan Haight Act creates a separate and particularly dangerous layer of compliance risk.

What the Ryan Haight Act Requires

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 requires that a provider conduct an in-person medical evaluation of a patient before prescribing a controlled substance via telemedicine. The Act was designed to combat online pill mills, and it created a narrow "telemedicine" exception that requires real-time, two-way audio-visual communication — but only after an in-person evaluation has already occurred.

The COVID-19 Flexibilities — and Four Extensions

When the COVID-19 public health emergency was declared in March 2020, the DEA invoked emergency flexibilities that allowed providers to prescribe Schedule II–V controlled substances via telemedicine without a prior in-person evaluation. Those flexibilities were supposed to end with the public health emergency in May 2023.

They didn't. The DEA has now issued four temporary extensions, most recently extending the flexibilities through December 31, 2026. The Federal Register notice for the fourth extension was published on December 31, 2025.

Here's what the current flexibilities allow:

• Prescribing Schedule II–V controlled substances via interactive audio-video telemedicine for new or existing patients without a prior in-person evaluation.
• Audio-only telehealth for Schedule III–V narcotic medications approved for opioid use disorder treatment, without an in-person requirement.

Why the Extensions Are a Double-Edged Sword

On one hand, the extensions preserve the ability to prescribe controlled substances via telemedicine — which is critical for platforms offering mental health and addiction treatment services. On the other hand, the regulatory limbo creates profound planning uncertainty. The DEA has stated that each extension is intended to give the agency time to finalize permanent rules, but the rulemaking process has stalled.

In January 2025, the Biden administration's DEA released a proposed rule that would establish three special registrations for telemedicine prescribing of controlled substances. The proposed rule included detailed requirements for prescription drug monitoring program (PDMP) checks, identity verification, clinician credentialing, data reporting, and record retention. The Trump administration has not moved forward with finalizing the proposed rule, and the DEA's most recent extension suggests that permanent regulations may not arrive before the current flexibilities expire on December 31, 2026.

For health tech startups, this means you should build your platform to comply with the most restrictive plausible final rule — not the current flexibilities. If the flexibilities expire without a replacement rule, the Ryan Haight Act's in-person evaluation requirement snaps back into effect overnight. That would mean any patient who hasn't had an in-person evaluation cannot receive controlled-substance prescriptions via telemedicine. Platforms that have built their entire business model on the flexibilities without a contingency plan face a cliff.

The Cerebral Enforcement Case: What Happens When You Get It Wrong

The consequences of telehealth prescribing noncompliance aren't theoretical. In November 2024, the U.S. Attorney's Office for the Eastern District of New York announced that Cerebral, Inc. — a major online mental health platform — had entered into a non-prosecution agreement and agreed to pay over $3.6 million in connection with business practices that encouraged the unauthorized distribution of controlled substances from 2019 to 2022.

The DOJ's investigation revealed that Cerebral had implemented internal metrics designed to increase the rate at which providers prescribed medications — including Schedule II stimulants like Adderall — after initial telehealth visits. The company set a target of prescribing medication to 95% of patients who enrolled in a medication management plan after their first 30-minute visit, implemented bonus structures tied to prescribing rates, and reviewed individual providers' prescribing performance against these metrics. None of these targets were based on medical or scientific benchmarks, and Cerebral did not consult its clinical advisory board before implementing them.

The DOJ and DEA characterized Cerebral's conduct as exploitation of telemedicine flexibilities for profit. As DEA Administrator Anne Milgram stated: "Cerebral's exploitation of telemedicine flexibilities deceived patients who were legitimately seeking medical care, putting them at risk in exchange for profit."

Cerebral also faced a separate FTC enforcement action in 2024 for sharing sensitive patient data with third-party advertising platforms without adequate consent. The lesson for health tech startups is twofold: (1) your platform's clinical protocols and incentive structures are subject to federal scrutiny, and (2) prescribing compliance and data privacy are not separable concerns. If you're building a platform that handles both, our guide to negotiating HIPAA business associate agreements with digital health vendors covers the data side.

Medicare Telehealth Flexibilities: The September 2025 Expiration

Separate from the DEA controlled-substance flexibilities, Medicare telehealth waivers also expired. The Centers for Medicare & Medicaid Services (CMS) telehealth flexibilities that had been in place since the COVID-19 public health emergency — including the ability to provide telehealth services to patients in their homes and the expansion of eligible practitioners — expired on September 30, 2025.

According to the National Consortium of Telehealth Resource Centers, the expiration created an abrupt 41-day gap in telehealth coverage that the DEA itself cited as evidence of the negative impact a "telemedicine cliff" has on patient access. This Medicare telehealth expiration affects reimbursement — not the legality of providing the service itself — but it has direct implications for health tech startups whose revenue model depends on Medicare reimbursement for telehealth visits.

If your platform serves Medicare beneficiaries, you need to understand which flexibilities have expired and which have been made permanent through legislation. For example, the removal of geographic restrictions for mental health telehealth services was made permanent under prior legislation, but the broader telehealth flexibilities (including expanded originating sites and eligible practitioner types) were not.

Asynchronous vs. Synchronous Telehealth: State-by-State Variations

Another compliance dimension that health tech founders frequently underestimate is the distinction between synchronous (real-time audio-video) and asynchronous (store-and-forward) telehealth. States differ significantly in how they treat each modality:

• Licensure: Some states permit asynchronous telehealth under a telehealth registration while requiring full licensure for synchronous visits, or vice versa.
• Prescribing: Many states prohibit prescribing based solely on an asynchronous encounter, even for non-controlled substances. The DEA's current flexibilities require interactive audio-video for controlled-substance prescribing (with a limited audio-only exception for opioid use disorder treatment).
• Informed consent: States may require different consent procedures for asynchronous versus synchronous telehealth.
• Reimbursement: Medicaid programs vary in whether they cover asynchronous telehealth, and private payer parity laws often distinguish between modalities.

If your platform includes asynchronous features — such as AI-assisted intake, questionnaire-based prescribing, or store-and-forward dermatology — you need to verify that each state in which you operate permits that modality for the specific clinical service your platform delivers.

How to Scope Your Product Launch Geographically

Given this regulatory complexity, we recommend a phased geographic launch strategy rather than a national rollout:

1. Start with one or two states where your clinical leadership is already licensed and where the regulatory environment is favorable. Texas, for example, has a relatively well-developed telehealth framework and participates in the IMLC.
2. Build a state-by-state compliance matrix before expanding. Track licensure requirements, telehealth registration availability, prescribing rules (especially for controlled substances), asynchronous telehealth restrictions, informed consent requirements, and Medicaid reimbursement policies.
3. Use the IMLC strategically to accelerate provider licensing in compact states, but remember that non-compact states (California, Oregon, Virginia, and others) will require traditional full licensure.
4. Separate controlled-substance prescribing from your core platform until the DEA finalizes permanent rules. If your platform's prescribing features depend on the COVID-19 flexibilities, build a contingency plan for the Ryan Haight Act's in-person evaluation requirement snapping back into effect.
5. Conduct a compliance audit before each state expansion — not after. Investors are increasingly requiring telehealth compliance diligence before funding rounds, and an enforcement action or DOJ investigation can derail a raise overnight.

Actionable Next Steps

1. Map your current provider footprint. Document which states each provider on your platform is licensed in, and cross-reference against the states where you're currently accepting patients. Any mismatch is an immediate compliance gap.
2. Build a state compliance matrix. Use the FSMB's telemedicine policies chart and CCHP's fall 2025 state report as starting points, but verify current requirements directly with each state medical board before launching in a new jurisdiction.
3. Audit your prescribing workflows. If your platform enables controlled-substance prescribing, verify that your clinical protocols don't create the kind of prescribing-rate incentives that triggered the Cerebral enforcement action. Document clinical decision-making independence for every provider.
4. Plan for the DEA telemedicine cliff. Build a product contingency for December 31, 2026 — the date the current DEA flexibilities expire. If no permanent rule is in place by then, your platform needs to be able to enforce the Ryan Haight Act's in-person evaluation requirement or restrict controlled-substance prescribing accordingly.
5. Engage telehealth compliance counsel early. The cost of a compliance audit before launch is a fraction of the cost of a DOJ investigation after launch. If you're raising a funding round, expect investors to ask about your telehealth compliance posture — and have documentation ready.