1. Testosterone is Schedule III — what follows from that

Testosterone and the other anabolic steroids sit in Schedule III of the Controlled Substances Act. That single classification pulls in a set of obligations that do not apply to, say, semaglutide:

A DEA registration for the prescriber, valid in the state where the patient is located. Electronic prescribing that meets the DEA’s EPCS rule, if you prescribe electronically. Record-keeping and inventory duties where the clinic dispenses in-house. State-level rules that are frequently stricter than federal, including PDMP checks and state EPCS mandates.

Compounded semaglutide and tirzepatide are not controlled substances, so a weight-management clinic can operate without touching most of this. A clinic doing both — which is now the norm — needs the controlled-substance machinery for one product line and not the other, in the same chart, on the same day.

2. The date that matters: December 31, 2026

Under the Ryan Haight Act, a prescriber generally must conduct an in-person medical evaluation before prescribing a controlled substance by telemedicine. That requirement was suspended during the COVID-19 public health emergency, and the suspension has been extended repeatedly since.

Current position. The DEA and HHS issued a fourth temporary extension of the telemedicine flexibilities, effective 1 January 2026 and running through 31 December 2026. For the whole of 2026, practitioners may prescribe Schedule II–V controlled substances via telemedicine without a prior in-person evaluation. The stated purpose of the extension is to give the DEA time to finalise permanent rules.

Two things follow for a TRT clinic. First, if your model depends on prescribing testosterone to patients you have never physically examined, that model currently rests on a temporary extension with a date on it. Second, the permanent rule has not landed, so nobody can tell you today what the landscape looks like in January 2027.

The reasonable planning posture is not panic and not complacency. It is: know which of your patients were started without an in-person evaluation, know what it would take to see them in person or refer them locally, and watch for the final rule rather than the next headline.

3. What EPCS actually requires

Electronic Prescribing of Controlled Substances is a specific DEA standard, and it is materially stricter than ordinary e-prescribing. The requirements fall into four groups.

Identity proofing

Each prescriber must be identity-proofed to a defined assurance level before being granted the ability to sign controlled prescriptions. This is a real verification process, not a checkbox in your EMR, and it takes time you should schedule rather than discover.

Two-factor authentication

Signing a controlled prescription requires two of three factors — something you know, something you have, something you are. In practice that means a password plus a hard token, an authenticator app, or a biometric. A password alone is never sufficient, and the second factor cannot be shared.

Certified software

The application used to sign must meet the DEA’s requirements and have been through third-party certification or audit. This is the part clinics cannot solve themselves — it is a property of the software you buy. Ask any EMR vendor directly whether their EPCS module is certified, and by whom.

Logical access control

Who may grant a prescriber EPCS rights, how that is recorded, and how it is revoked when someone leaves. The DEA expects this to be controlled and auditable, with at least two individuals involved in granting access in most configurations.

4. The state layer, which is where it gets complicated

Federal rules are the floor. States add to them, and for a telehealth clinic the state that matters is the one the patient is in, not the one the prescriber sits in.

Three things vary meaningfully by state and need checking per state you operate in: whether the state mandates electronic prescribing for controlled substances at all, whether a PDMP check is required before prescribing and how often, and whether the state requires its own controlled-substance registration in addition to the federal DEA number.

A clinic licensed in six states is running six versions of this analysis. That is not a reason to avoid multi-state practice — it is a reason to track it in a system rather than in somebody’s head, and to keep licence and registration expiry dates somewhere that will warn you before they lapse.

5. What to ask an EMR vendor

If you prescribe controlled substances, these questions separate systems that genuinely support you from systems that will make it your problem:

Is your EPCS certified, and by which auditor? — What does prescriber onboarding involve, and how long does identity proofing take in practice? — Which second factors do you support? — Do you check the DEA number and its state validity before allowing a signature, or only afterwards? — How do you track licence and registration expiry? — Is the controlled-substance log exportable if we are audited?

The last one is worth insisting on. A controlled-substance log you cannot export is a log you cannot produce, and the moment you need it is not the moment to discover that.

This is not legal advice. It is what we have learned building software for prescribing clinics, written down plainly because almost nobody publishes it. Fee schedules and federal rules change — every figure here was checked on 6 August 2026 and linked to its source. Confirm the live position with the regulator, the vendor, or your own counsel before you act on it.

6. Frequently asked questions

Is testosterone a controlled substance?

Yes. Testosterone and other anabolic steroids are Schedule III under the Controlled Substances Act, which brings DEA registration, EPCS, record-keeping and state-level requirements into scope.

Can I prescribe testosterone by telehealth without seeing the patient in person?

Through December 31, 2026, yes. The DEA and HHS issued a fourth temporary extension of the COVID-era telemedicine flexibilities, effective January 1, 2026, allowing Schedule II–V prescribing via telemedicine without a prior in-person evaluation. The permanent rule has not been finalised.

What happens after December 31, 2026?

Unknown as of August 2026. The extension exists to give the DEA time to finalise permanent regulations. Plan on the basis that the current flexibility is temporary, and watch for the final rule.

Is semaglutide or tirzepatide a controlled substance?

No. Neither is scheduled, so GLP-1 prescribing does not carry the EPCS and DEA obligations that testosterone does — though it carries its own compounding and payment complications.

What does EPCS identity proofing involve?

A verification of the individual prescriber to a defined assurance level before they can sign controlled prescriptions. It is a process with a lead time — schedule it during onboarding rather than discovering it on the first day you need to prescribe.

Does my EMR need to be certified for EPCS?

Yes. The application used to sign controlled prescriptions must meet the DEA requirements and have been through third-party certification or audit. Ask your vendor who certified theirs.

Which state’s rules apply in telehealth?

Generally the state where the patient is located. That governs licensure, PDMP obligations and any state controlled-substance registration — so a multi-state clinic runs the analysis once per state.