Compliance Requirements for the Ryan Haight Online Pharmacy Consumer Protection Act of 2008

According to the National Community Pharmacists Association (NCPA), the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 amends the federal Controlled Substance Act (CSA) and the Controlled Substance Import and Export Act. The Ryan Haight Act updates the laws to include provisions “to prevent illegal distribution and dispensing of controlled substances over the Internet.”  “The Drug Enforcement Administration (DEA) issued an interim final following passage of this new online pharmacy law.

The Ryan Haigh Act applies to Internet pharmacies (online pharmacies) that “may continue providing controlled substance prescriptions in federal Schedules III-V for legitimate medical purposes subject to certain registration reporting, and recordkeeping requirements.”

• Medical practitioners who prescribe controlled substances through online pharmacies must conduct at least one in-person medical evaluation.
• The Ryan Haight Act adds new federal and state criminal penalties for the unlawful distributions and dispensing of controlled substances.

Our skilled healthcare compliance lawyers can explain the provisions of this law and the compliance issues for pharmacies, pharmacists, and medical practitioners.

What do community pharmacies/pharmacists need to know about the Ryan Haight Online Pharmacy Consumer Protection Act of 2008?

According to the NCPA, most community pharmacists will not be required to “comply with the additional registration requirements for online pharmacies.” However, all community pharmacies “must determine whether the provisions apply to their business and ensure compliance with new DEA requirements.” Pharmacies must also understand the new Ryan Haight Act restrictions – for dispensing controlled substance prescriptions received through websites that medical practitioners who write prescriptions have access to.

What are the enhanced penalties for illegal sales of controlled substances?

The new maximum penalties are as follows:

• Schedule II prescriptions. No changes.
• “Schedule III: Maximum sentence for first offenders from 5 years to 10 years; ¬maximum
• sentence for second offenders from 10 years to 20 years.
• Schedule IV: Maximum sentence for first offenders from 3 years to 5 years¬; maximum
• sentence for second offenders from 6 years to 10 years.
• Schedule V: Maximum sentence for second offenders from 2 years to 6 years.”

What is an “online pharmacy?”

Online pharmacies are business entities in America or abroad that “knowingly or intentionally sell or offer to sell” controlled substances in federal schedules III-V over the Internet. These online pharmacies include:

• “Websites that sell or offer to sell any controlled substance prescription in the United States.
• Entities that pay pharmacies a fee to fill prescriptions from practitioners referred from the Internet.
• Pharmacies that knowingly or intentionally fill prescriptions for controlled substances issued to customers of a website.”

Are any entities excluded from the Ryan Haight Act definition of an online pharmacy?

The following entities may be excluded from the online pharmacy definition:

• “Pharmacies that fill or refill prescriptions in Schedules III-V transmitted via the Internet – upon implementation of DEA rules permitting electronic prescribing.
• Retail pharmacies operating properly registered automated dispensing systems at long-term care facilities.
• DEA-registered manufacturers or distributors that do not dispense controlled substances to unregistered individuals.
• Nonpharmacy practitioners who are registered under the DEA to dispense, administer, or prescribe controlled substances.
• Federal and Indian health care facilities.”

What are the Ryan Haight compliance requirements for online pharmacies?

Generally, the NCPA states that online pharmacies must meet the following compliance requirements:

• “Obtain modification of registration from DEA for all Internet business on or after April 13, 2009.”
• If an online pharmacy has not received the proper DEA registration modification, the pharmacy cannot deliver, dispense, or distribute controlled substances through the Internet – until the DEA registration modification is obtained.

Online pharmacies must also post certain declarations and disclaimers on their website – based on the DEA’s interim final rule or any subsequent final rules.

Online pharmacies must ensure that all disclosures, declarations, and information are included in the modification request.

If an online pharmacy has obtained the modified DEA registrations, then – if the pharmacy dispenses 100 or more controlled substance prescriptions or 5,000 total dosage units in a month – the pharmacy “must report on a monthly basis all controlled substances dispensed not just those dispensed via the Internet.” The reports will be submitted online.

What are the compliance requirements for pharmacies that do not meet the definition of online pharmacy?

Starting April 13, 2009, pharmacists were (and still are) required to determine whether controlled substance prescriptions are issued through the Internet. Pharmacists who have “actual” knowledge that a prescription was issued through an online pharmacy in violation of the Ryan Haight Act or “in light of all the facts surrounding the issuance of the prescription” have a duty not to fill the prescription.  Filling the prescription will be considered an “intentional violation of the Ryan Haight Act by both the pharmacy and the pharmacist” and both with be subject to criminal penalties.

Telemedicine psychiatry and the Ryan Haight Online Pharmacy Consumer Protection Act of 2008

According to the American Psychiatry Association (APA), on October 6, 2023, the DEA (Drug Enforcement Agency) and HHS (Department of Health and Human Services) announced that telemedicine flexibilities due to COVID-19 would continue so the DEA could review comments to two additional rule proposals.

The flexibilities extend until December 31, 2024. These flexibilities include:

• “Patients can be prescribed schedules II-V controlled substances without a prior in-person examination as clinically appropriate and within your normal scope of practice.”
• DEA registration in one state allows prescriptions of controlled substances in any state.

The APA states that the Ryan Haight Act requires that any practitioner who issues a prescription for a controlled substance should:

“Conduct an in-person medical evaluation (with certain specified exemptions) prior to prescribing controlled substances. Per the Act, the prescribing practitioner is required to have conducted one in-person medical evaluation with the patient and may prescribe via telemedicine thereafter.“

The APA states that “psychiatrists working in federal health care systems should be familiar with their organization’s policy around the telepsychiatric prescribing of controlled substances.”

Psychiatrists who prescribe controlled substances also need to understand the full range of federal, state, and organizational laws, and policies that govern online prescriptions and telehealth services.

Our skilled healthcare lawyers can explain whether the flexibilities discussed above for psychiatrists apply to your medical practice.

Pharmacists, pharmacies, and doctors who prescribe medicines need to understand the compliance issues that The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 requires. The law regulates online pharmacies. Pharmacists and pharmacies need to understand these regulations. That Act generally requires that medical practitioners who prescribe medicines through online pharmacies conduct an initial in-person examination of their patient. Flexibilities on this in-person examination, due to COVID-19, are likely to expire soon.