There are generally three types of Internet pharmacies. One type is operated by legitimate pharmacies that require a valid prescription from a community prescriber before they dispense the medications. Generally, these are brick-and-mortar or mail-order pharmacies that have created websites where patients can request refills online and where prescribers can phone or fax new prescriptions or electronic prescriptions for patients. These pharmacies are generally legal and not the subject of concern for the purposes of this section.
The other two types of Internet pharmacies are often termed "rogue pharmacies." Under the more blatant type of rogue Internet pharmacy, the patient transmits a request for particular prescription medications and the Web business mails the drugs to the patient without a prescription. In the second type, patients also transmit requests for particular prescription medications. However, the patients are required to complete an online survey asking some basic questions such as weight, sex, if they have high blood pressure, and the like, or submit medical records for review. The survey or submitted records are electronically routed to a physician who has contracted with the Internet operation and usually resides in a different state from the patient. The physician reviews the survey and issues a prescription to a contracting pharmacy. The pharmacy often is a community state-licensed pharmacy in a different state from the prescriber. The pharmacy then dispenses and mails the prescription medication to the patient.
The FDA, DEA, state boards of pharmacy, and pharmacy organizations consider rogue pharmacy operations illegal because there is no valid physician-patient relationship because the physician never personally sees the patient. A prescription issued in such a situation, although perhaps facially valid, is not a legal prescription.
Unfortunately, it required the highly publicized overdose death of an 18-year-old Californian, who had ordered hydrocodone from an online pharmacy to treat his back pain, to trigger a federal law in 2008 to regulate these rogue pharmacies. The law, known as the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (P.L. 110-425), and the accompanying DEA regulations (74 Fed. Reg. 15596, April 6, 2009), amends the CSA to define a valid prescription as one that has been issued for a legitimate medical purpose by a practitioner who has conducted at least one in-person medical evaluation of the patient.
The Haight Act and regulations also provide, in part, that online pharmacies must:
Obtain a DEA modification of registration permitting it to operate.
Notify the DEA and state pharmacy boards of intent to dispense through the Internet 30 days before activity begins.
Display on the website a declaration of compliance with the law and regulations.
Complete information about the pharmacy, including its name and address as it appears on the DEA certificate, telephone number, email address, the name of the pharmacist in charge, professional degree, state of licensure, telephone number, and so on.
Include this statement on the website: "This online pharmacy will only dispense a controlled substance to a person who has a valid prescription issued for a legitimate medical purpose based upon a medical relationship with a prescribing practitioner. This includes at least one prior in-person medical evaluation or medical evaluation via telemedicine in accordance with applicable requirements of § 309."
Report on a monthly basis all controlled substances dispensed, if they dispense 100 or more controlled substance prescriptions or 5,000 total dosage units in a month.
The law imposes criminal penalties for any person who knowingly or intentionally violates the law. Unfortunately, the law applies only to controlled substances. Thus, it is left to the states to regulate these rogue pharmacies for dispensing noncontrolled substances. Although some states have enacted specific laws directed at Internet prescribing and dispensing, others must struggle with regulating the practice by applying more general laws and regulations that were enacted long before anyone anticipated the Internet. Any pharmacy invited to dispense prescriptions for an Internet business should be suspicious and seek legal advice. State boards of pharmacy have stepped up enforcement. For example, the California Board of Pharmacy from approximately 2009 to 2014 assessed $600 million in fines against pharmacies and pharmacists for dispensing invalid Internet prescriptions. (The section "Nonresident (Internet) Pharmacies" discusses this topic further, including state regulation of all prescription medications and NABP accreditation and pharmacy efforts.)
During the COVID-19 public health emergency (PHE) the DEA allowed initial controlled substance prescriptions to be issued based on a telemedicine visit without the in-person evaluation requirement under the Ryan Haight amendment to the CSA. The DEA also clarified during the PHE that if the prescriber previously conducted an in-person medical evaluation, the prescriber may issue controlled substance prescriptions for that patient via telemedicine, or any other means, regardless of public health emergency.
To bridge between the expiring PHE waivers in May of 2023 and post-PHE patient concerns, the DEA issued two proposed regulations in February of 2023 that would create two new limited options for telemedicine prescribing of controlled substances without a prior in-person exam (see 88 Fed. Reg. 12875; 88 Fed. Reg. 12890).
One option would allow a prescriber to issue an initial prescription for a controlled substance without conducting an in-person exam of the patient, but only if the medication is a non-narcotic Schedule III-V (or buprenorphine for the treatment of OUD), and the prescribed amount does not exceed 30 days. Then, before additional prescribing can occur, the patient must undergo an in-person exam. Another option for telemedicine prescribing of controlled substances without a prior in-person exam would include a referral process. This involves a patient having an initial in-person exam with a practitioner who then refers the patient to a second practitioner who would have a telemedicine exam of the patient. The second practitioner would be permitted to prescribe Schedule II-V controlled substances for the patient, including narcotics. Since the DEA rules regarding telemedicine prescribing of controlled substances were newly proposed at the time this text was last updated, one should verify the current standards surrounding the topic.