AI Governance for Telehealth Prescribing: DEA and State Rules

Two Regulatory Layers Govern AI-Assisted Prescribing

AI systems that touch prescribing decisions must satisfy two independent regulatory regimes at the same time. DEA rules under the Ryan Haight Act govern controlled-substance prescribing and generally require an in-person medical evaluation, or a recognized telemedicine exception, before a controlled substance can be prescribed. Separately, state licensure and remote-evaluation rules govern prescribing authority overall, and that authority is tied to the state where the patient is physically located at the time of the encounter.

The Compliance Surface at a Glance

State Licensure and Remote Evaluation Add a Second Compliance Layer

Because state medical boards license prescribers and set remote-evaluation requirements independently of federal DEA rules, an AI system must resolve jurisdiction before any prescribing-related action executes. In practice, this means evaluating patient location, the prescriber's licensure state, and whether an applicable DEA exception currently applies before a tool call is allowed to proceed.

Controlled-Substance Workflows Need a Separate Governance Path

Not all prescribing support carries the same regulatory triggers. General prescribing support, such as AI assistance with non-controlled medications, is governed primarily by state licensure and scope-of-practice rules. Controlled-substance prescribing carries the additional statutory triggers of the Ryan Haight framework: the in-person evaluation requirement, DEA exception status, and DEA registration schedule restrictions.

Because the compliance obligations differ materially between these two workflows, they should not share a single policy path. A governance design that treats all prescribing-adjacent AI actions identically will either over-restrict general prescribing support or under-govern controlled-substance actions. Policy sets should be split so that controlled-substance workflows route through the additional checks described above, while general prescribing support is governed by lighter-weight licensure and scope-of-practice validation.

DEA registration schedules also differ in restriction level, and permissioning logic needs to reflect that difference. A prescriber's DEA registration may authorize certain schedules but not others, and an AI system supporting that prescriber needs to enforce that boundary at the point of action, not rely on it being checked downstream.

Design for Rules That Keep Changing

Telemedicine prescribing flexibilities are not static. DEA has repeatedly extended, modified, and finalized rules governing remote prescribing of controlled substances, and states continue to update their own remote-evaluation and PDMP requirements. A governance platform needs to let policy rules be updated quickly as these requirements change, rather than requiring a rebuild of the underlying system.

Runtime Governance Controls

1. 1

   Agent identity

   Every AI action in a prescribing workflow is bound to a specific human prescriber's verified DEA registration and state license. The AI system itself is never granted independent prescribing authority.

2. 2

   Least-privilege permissioning

   AI actions that draft or suggest a prescription are separated from actions that transmit or finalize one. Finalizing a controlled-substance prescription requires explicit human authorization.

3. 3

   Jurisdiction-aware policy enforcement

   Before a prescribing-related tool call executes, the policy enforcement point evaluates patient location, the prescriber's licensure state, and whether an applicable DEA exception currently applies.

4. 4

   Tool-call auditing

   Each prescribing-adjacent action logs prescriber identity, patient jurisdiction, controlled-substance schedule, PDMP-check status, and whether the encounter met an in-person evaluation or a recognized telemedicine exception.