Federal Laws That Shape Access to Psychiatric Care: Ryan Haight & Olmstead
Two landmark federal actions — one governing how we prescribe, one governing where care is delivered — that quietly define the boundaries of psychiatric practice
Most clinicians learn psychiatric law through the cases that get taught in residency — Tarasoff, Wyatt, Rennie, Sell. But two of the federal actions that most directly shape everyday access to psychiatric care rarely make the syllabus. The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 governs how we may prescribe controlled substances — the buprenorphine we start for opioid use disorder, the stimulants we prescribe for ADHD, the benzodiazepines and Z-drugs — especially over telemedicine. Olmstead v. L.C. (1999) governs where care is delivered, establishing that people with mental illness and disability have a civil right to be served in the community rather than needlessly confined in institutions. One is a prescribing statute born from a teenager's death; the other is a Supreme Court decision born from two women stuck in a state hospital. Together they draw the outer edges of what "access to care" means in American psychiatry. This chapter walks through the story behind each, the mechanics clinicians actually need, and the current (2026) regulatory landscape.
Where this chapter fits: This is a deep dive on two specific federal actions. For the full set of federal mental-health statutes — from the 1946 National Mental Health Act through Medicaid's IMD exclusion, the ADA, the parity laws, and 988 — see the hub chapter Federal Mental Health Statutes.
Part I — The Ryan Haight Act: Prescribing in the Age of Telemedicine
The story behind the law
Ryan Haight was an eighteen-year-old honor student and athlete from La Mesa, California. On February 12, 2001, he died from an overdose of narcotic painkillers — hydrocodone (Vicodin) among them — that he had purchased over the internet. He had no legitimate need for the medication and had never been examined by the physician who authorized it. A doctor he never met wrote the prescription based on an online questionnaire, and an internet pharmacy filled and shipped it to his bedroom. His mother, Francine Haight, later testified before Congress that her son "died from a prescription that was written by a doctor he never saw, for drugs he did not need." The case became the emblem of a then-new danger: rogue online pharmacies that dispensed controlled substances with no meaningful physician-patient relationship.
After years of advocacy, Congress passed the act named in Ryan's memory. It was signed into law in October 2008 and took effect in April 2009, amending the federal Controlled Substances Act (CSA).
Ryan Haight Online Pharmacy Consumer Protection Act of 2008
What it did: The act made it a federal requirement that a controlled substance prescription be issued "for a legitimate medical purpose by a practitioner acting in the usual course of professional practice" — and, critically, that the practitioner must have conducted at least one in-person medical evaluation of the patient before prescribing a controlled substance by means of the internet (which the DEA reads to include telemedicine). It also imposed registration, disclosure, and reporting requirements on online pharmacies, and it stiffened penalties for illegal internet distribution.
The "in-person evaluation" requirement is the provision that reaches into ordinary telepsychiatry. Once a practitioner has completed a qualifying in-person exam, the statute does not dictate how often further in-person visits must occur — subsequent controlled-substance prescribing by telemedicine is permitted. The friction is entirely at the front door: the first controlled-substance prescription generally requires that the patient has been seen in person, unless one of the statute's narrow exceptions applies.
The seven exceptions: the "practice of telemedicine"
Recognizing that a rigid in-person mandate would block legitimate remote care, Congress defined seven circumstances that count as the "practice of telemedicine" and therefore satisfy the CSA without a prior in-person exam. A clinician prescribing a controlled substance by telemedicine must generally fit into one of these:
The statutory telemedicine exceptions (21 U.S.C. § 802(54))
1. Treatment in a hospital or clinic — the patient is physically located in a DEA-registered hospital or clinic when the telemedicine encounter occurs.
2. In the physical presence of a DEA-registered practitioner — the patient is being treated by, and in the presence of, another DEA-registered practitioner.
3. Indian Health Service / tribal — the practitioner is an IHS or tribal-organization practitioner.
4. Public health emergency — during a PHE declared by the Secretary of HHS, under conditions the Secretary and DEA set (the exception that carried COVID-era telehealth).
5. Special registration for telemedicine — the practitioner has obtained a special DEA registration created for telemedicine.
6. Department of Veterans Affairs — VA practitioners during a medical emergency, under VA rules.
7. Other circumstances specified by regulation — a catch-all reserved to the Attorney General/DEA.
Two of these exceptions have dominated the last several years of psychiatric practice: the public health emergency exception (which was activated for COVID-19) and the never-fully-built special registration exception.
How the Ryan Haight Act shaped COVID-19 telemedicine
When HHS declared a public health emergency for COVID-19 in early 2020, the DEA activated the PHE telemedicine exception. For the duration of the emergency, DEA-registered practitioners could prescribe schedule II–V controlled substances via telemedicine without a prior in-person evaluation, provided the prescription was for a legitimate medical purpose in the usual course of practice, the encounter used real-time audio-video (with audio-only permitted for buprenorphine), and the clinician complied with applicable state law.
The clinical consequences were enormous. Telepsychiatry expanded overnight. Patients could initiate treatment for anxiety, ADHD, and — perhaps most consequentially — opioid use disorder without leaving home. Studies during the pandemic associated the buprenorphine telehealth flexibilities with increased treatment initiation and retention and, in several analyses, reduced overdose risk. For the first time, the Ryan Haight in-person requirement was effectively suspended for a mass population, and the field got a natural experiment in what fully remote controlled-substance care looks like.
The "telehealth cliff" and the string of extensions
The COVID-19 public health emergency ended on May 11, 2023. Under a literal reading of the statute, the PHE exception would have evaporated with it, snapping millions of patients back to the in-person requirement overnight. Rather than allow that cliff, the DEA and HHS issued a series of temporary extensions of the COVID-era telemedicine flexibilities while they worked on permanent rules:
- Feb 2001Ryan Haight dies of an overdose from drugs bought online with no exam.
- Oct 2008 → Apr 2009Ryan Haight Act signed; takes effect, adding the in-person requirement to the CSA.
- 2018SUPPORT Act orders the DEA to build a special telemedicine registration within one year. It does not.
- Mar 2020COVID-19 PHE declared; DEA activates the PHE telemedicine exception — remote controlled-substance prescribing without a prior in-person exam.
- May 11, 2023COVID-19 PHE ends. DEA + HHS issue temporary extensions rather than let flexibilities lapse.
- Jan 17, 2025DEA/HHS publish final rules on telemedicine buprenorphine and VA continuity of care (effective Dec 31, 2025).
- Dec 31, 2025DEA issues the fourth temporary extension of COVID-era flexibilities — now running through December 31, 2026.
As of 2026, the practical situation is this: through the fourth temporary extension, DEA-registered practitioners may still prescribe schedule II–V controlled substances via audio-video telemedicine without a prior in-person exam through the end of 2026, and audio-only encounters remain permitted for schedule III–V narcotics used to treat opioid use disorder. These flexibilities are extensions, not a settled permanent framework — which is exactly why they matter to clinicians building long-term treatment relationships.
Suboxone (buprenorphine) prescribing
Buprenorphine is where the Ryan Haight Act intersects most directly with the overdose crisis, and it is the one area that now has a permanent telemedicine rule. On January 17, 2025, the DEA and HHS published "Expansion of Buprenorphine Treatment via Telemedicine Encounter," which took effect December 31, 2025.
What the buprenorphine telemedicine rule allows
- A practitioner may prescribe buprenorphine for opioid use disorder via telemedicine — including audio-only — without a prior in-person exam.
- The telemedicine pathway covers an initial six-month supply of buprenorphine, which may be split across several prescriptions.
- Before prescribing, the practitioner must review the state PDMP for the state where the patient is located (controlled-substance history for the prior year, or the full available period if shorter).
- After the six-month period, continued prescribing requires an in-person evaluation or qualification under one of the seven Ryan Haight exceptions.
Practical notes & cautions
- If PDMP data cannot be obtained despite documented attempts, the rule permits successive 7-day supplies up to the six-month limit.
- The permanent rule is stricter than the temporary extension (mandatory PDMP check, verification requirements). Practitioners still covered by the temporary extension through 2026 may continue under its more lenient terms.
- State law still governs independently — some states impose additional telehealth, examination, or licensure requirements.
- The X-waiver is gone (eliminated by the Consolidated Appropriations Act, 2023), so a DEA registration plus the telemedicine rules — not a special waiver — is what governs buprenorphine prescribing.
Stimulant prescribing
Stimulants for ADHD sit in the most exposed position, because methylphenidate and the amphetamines are schedule II — the tightest controlled category, with the highest diversion concern. Unlike buprenorphine, there is currently no permanent telemedicine rule that lets a clinician start a schedule II stimulant on a never-seen-in-person patient. Remote stimulant initiation is possible today only because the temporary extension keeps the COVID-era flexibility alive — and that extension is scheduled to expire at the end of 2026.
The DEA's 2023 proposed rule would have treated schedule II medications far more restrictively than buprenorphine — for example, requiring an in-person visit after only a short initial telemedicine supply, or barring remote initiation of schedule II drugs altogether. That proposal drew record-breaking public comment (much of it from clinicians and ADHD patients) and was not finalized in that form. A proposed framework for a special registration for telemedicine has also been floated but not implemented. The upshot for prescribers:
Positive outcomes of the Ryan Haight framework
- Curtailed rogue online pharmacies dispensing controlled substances with no physician relationship.
- Anchored controlled-substance prescribing to a genuine clinical evaluation and legitimate medical purpose.
- Created a defined structure (the seven exceptions) that later allowed rapid, lawful expansion of telehealth during COVID.
- The buprenorphine rule now provides a durable, evidence-aligned pathway for tele-MOUD.
Negative or unresolved consequences
- The special-registration pathway went unbuilt for over a decade, leaving no permanent route for legitimate telemedicine prescribing.
- Reliance on temporary extensions creates recurring "cliff" anxiety for patients and prescribers.
- Schedule II (stimulant) access remains legally precarious and geographically uneven.
- Compliance complexity — layered federal rules plus 50 state regimes — falls heavily on individual clinicians.
Part II — Olmstead v. L.C.: The Right to Care in the Community
The story behind the case
Lois Curtis and Elaine Wilson were two women in Georgia with intellectual disability and co-occurring mental illness (Curtis carried a diagnosis of schizophrenia; Wilson of a personality disorder and intellectual disability). Both had been voluntarily admitted to the psychiatric unit of Georgia Regional Hospital in Atlanta. Both were repeatedly evaluated by the state's own clinicians, who agreed they could be appropriately served in a community-based program. Yet they remained confined in the institution for years — not because they needed to be hospitalized, but because Georgia had not made community placements available. Lois Curtis, in particular, called Atlanta Legal Aid again and again asking for help getting out.
Their attorney, Sue Jamieson of Atlanta Legal Aid, sued the state under Title II of the Americans with Disabilities Act (ADA), arguing that keeping people confined when treatment professionals had cleared them for community living was itself a form of discrimination. The case — captioned for Tommy Olmstead, then Georgia's commissioner of human resources — reached the U.S. Supreme Court.
Olmstead v. L.C., 527 U.S. 581 (1999)
The holding: In a decision authored by Justice Ruth Bader Ginsburg, the Court held that the unjustified segregation of people with disabilities in institutions is a form of discrimination prohibited by Title II of the ADA. Public entities must provide services "in the most integrated setting appropriate to the needs" of the person — the so-called integration mandate (rooted in the ADA's implementing regulation, 28 C.F.R. § 35.130(d)).
Ginsburg's opinion articulated why institutionalization can be discriminatory even when the care itself is adequate. First, "institutional placement of persons who can handle and benefit from community settings perpetuates unwarranted assumptions that persons so isolated are incapable or unworthy of participating in community life." Second, "confinement in an institution severely diminishes the everyday life activities of individuals, including family relations, social contacts, work options, economic independence, educational advancement, and cultural enrichment." Segregation, in other words, carries its own harm.
The three-part standard
The Court did not order that every institution be emptied. It set a balanced test. A public entity must provide community-based services when all three conditions are met:
When community placement is required (the Olmstead test)
1. The state's own treatment professionals determine that community-based placement is appropriate for the individual;
2. The affected individual does not oppose community-based treatment; and
3. The placement can be reasonably accommodated, taking into account the resources available to the state and the needs of others with disabilities the state serves.
The third prong is where states may raise the "fundamental alteration" defense. A state is not required to instantly deinstitutionalize regardless of cost. But the Court set a meaningful bar: to prevail, a state must demonstrate a comprehensive, effectively working plan for placing qualified people in less restrictive settings, along with a waiting list that moves at a reasonable pace not controlled by the state's desire to keep its institutions full. A frozen waiting list is not a defense.
How Olmstead reshaped care — and the buildout of community services
Olmstead became the legal engine of modern deinstitutionalization and, just as importantly, of the construction of the community system that deinstitutionalization requires to succeed. The shift in long-term services and supports (LTSS) has been dramatic.
The measurable shift
- In 1999, roughly 27% of Medicaid LTSS spending went to home- and community-based services (HCBS) and 73% to institutions. By 2020 that had reversed to about 63% HCBS / 38% institutional.
- All 50 states now operate Medicaid HCBS waiver programs (§1915(c) and related authorities) — more than 250 nationwide.
- The Money Follows the Person demonstration has helped transition tens of thousands of people out of institutions.
What states built (and psychiatry uses)
- Assertive Community Treatment (ACT) teams and intensive case management.
- Supportive/permanent supportive housing and Housing First models.
- Crisis services — mobile crisis, crisis stabilization units, and the 988 Suicide & Crisis Lifeline infrastructure.
- Supported employment, peer support, and community mental health center capacity.
Enforcement has been a major driver. The U.S. Department of Justice has pursued statewide Olmstead settlements and lawsuits obligating states to expand community capacity — Georgia's own settlement, and agreements in states such as Virginia, North Carolina, and Mississippi, among others. Olmstead is also read to protect people at serious risk of institutionalization, not only those already confined — which extends its reach to discharge planning, nursing-facility diversion, and jail/ED boarding.
Where Olmstead's promise falls short
Twenty-five years on, the gaps are as instructive as the gains — especially for psychiatry.
Structural problems persist. HCBS remains an optional Medicaid benefit while institutional care is mandatory — a financing asymmetry that quietly favors facilities. Most states maintain long HCBS waiting lists. Workforce shortages mean that even funded services can go undelivered. And when community capacity is inadequate, patients reappear in the settings Olmstead was meant to reduce: emergency-department boarding, repeated hospitalization, homelessness, and — increasingly — jails and prisons, sometimes described as "transinstitutionalization" or institutionalization by another name.
Positive outcomes of Olmstead
- Established a civil right to community integration for people with mental illness and disability.
- Reversed the balance of Medicaid LTSS spending toward community-based care.
- Drove the buildout of ACT, supportive housing, and crisis systems clinicians rely on.
- Gave advocates and DOJ an enforceable tool to expand state capacity.
Negative or unresolved consequences
- Community services were sometimes cut before adequate alternatives existed, contributing to homelessness and criminalization.
- Mental health has lagged other disability groups in benefiting from the shift.
- Waiting lists and the optional status of HCBS blunt the mandate.
- Enforcement is uneven and depends on litigation and political will.
Part III — Why these two laws belong in the same chapter
The Ryan Haight Act and Olmstead look unrelated — one is a prescribing statute, the other a civil-rights decision — but they are two halves of the same question: how does a person with a psychiatric or substance use disorder actually reach the care they need? Olmstead answers the "where": care should be delivered in the community, in the most integrated setting appropriate, not defaulted into an institution. Ryan Haight answers the "how": the medications that make community treatment possible — buprenorphine for opioid use disorder, stimulants for ADHD, and others — can be prescribed remotely, but only within a framework designed to prevent the abuse that killed Ryan Haight.
The two intersect most vividly in tele-MOUD. Telemedicine buprenorphine is, in effect, an Olmstead tool: it delivers evidence-based treatment to people in their own communities, including rural and underserved areas that have no local prescriber, reducing the pull toward higher-acuity, more restrictive settings. That is also the deep tension running through both laws — the balance between expanding access and guarding against harm (diversion, inadequate evaluation, unsafe discharge). Neither law resolves that tension permanently; both leave clinicians to manage it, case by case.
What clinicians should take away
For prescribers, the Ryan Haight framework means: know whether your telemedicine encounter fits an exception, use the PDMP, understand that the buprenorphine telemedicine pathway is now permanent while schedule II stimulant flexibility is not, and build treatment plans that can withstand the expiration of a temporary extension. For anyone doing discharge planning, disposition, or systems work, Olmstead means: document when a patient can be served in the community, treat unnecessary institutionalization as a legal as well as clinical problem, and recognize that the integration mandate is a lever for building — and demanding — the community services our patients need.
Both laws reward the same clinical habits: careful documentation, honest assessment of what a patient actually needs, and attention to the settings and safeguards around care rather than the prescription or the hospital bed alone. They are, in the end, about the same thing — meeting patients where they are.