There is an existential threat facing digital health care delivery companies

Ryan Haight Act reform: a red herring for pure play digital health care delivery models

TL;DR…

Background…

Everyone’s favorite (kidding) pandemic drove major and rapid adoption (words that almost never go together in healthcare land) of telehealth for patients and clinicians alike across the system. As two physicians practicing in digital health, we can personally attest to the seismic shift that has occurred over the last 24 months:

https://www.mckinsey.com/industries/healthcare-systems-and-services/our-insights/telehealth-a-quarter-trillion-dollar-post-covid-19-reality

This happened mostly out of necessity, as confusing at times social distancing guidance and totally appropriate and reasonable anxieties around getting sick meant patients couldn’t always make it to their doctors’ offices. Clinical organizations struggled to keep their staff (both clinical and non-clinical) safe, particularly when PPE was scarce and before vaccines were available.

Quickly, however, the necessity to deliver care through telehealth platforms (both synchronously and asynchronously through a variety of modalities including video, audio, and text) uncovered an opportunity 💭. Why couldn’t virtual care delivery become the standard instead of just a temporary fallback?

The allure of building a digital-first (or even better, digital-only) care delivery model had always existed, given it could:

1. Reduce operating expenses by obviating the need for real estate and build-out costs 🏩

   • And also enable efficient business scaling - 📈 to investors’ ears

2. Increase patient access by removing barriers to care, by eliminating the necessity of geographic proximity for care delivery

3. Improve operational efficiency by enabling clinical capacity pooling and the flexible deployment of resources as demand ebbs and flows

What was different now was hard proof that patients and clinicians were willing and able to access and deliver care virtually. And perhaps more importantly, there was also increased flexibility from CMS and major payers to enable coverage and payment for clinical services delivered virtually. This led to a frenzy of activity, as passionate founding teams polished up their best pitch decks 🧑🏽‍💻 and investors rushed to find great companies to back in the virtual care delivery space (and a lot more real work *wink* went into spinning up and building those deck dreams into real companies).

The public health emergency (PHE) declared by HHS Secretary Alex Azar on January 31, 2020 put into place specific provisions that further enabled these digital-only care delivery businesses to exist. We’re not going to write about all the downstream regulatory impacts the PHE had (if you’re suffering from insomnia and want to read up on it, knock yourself out). We will focus on the two waivers that we find the most interesting, and have the most direct impact on this new crop of digital-only care delivery companies: a waiver of the Ryan Haight Act as well as waivers of specific Drug Enforcement Agency (DEA) regulations.

The Ryan Haight Act and DEA regulation…

The Ryan Haight Online Pharmacy Consumer Protection Act of 2008 (RHA) was passed by Congress and is enforced by the DEA. The act has multiple regulations focused on the actions surrounding the prescription of controlled substances 💊. The RHA regulation we’ll focus on here is the requirement that any practitioners prescribing a controlled substance conduct an in-person medical evaluation initially (without explicit in-person follow-up requirements) before prescribing a controlled substance. This was put in place to directly combat the unscrupulous practitioners who created online ‘pill mills’ in the late 90’s/early 2000’s, and came to be through fierce advocacy and lobbying. The act was named after Ryan Haight, an 18 year-old from Southern California, who died from a drug overdose in 2001 after he procured Vicodin over the internet. The RHA was a reasonable and needed piece of legislation at the height of the opioid epidemic and in an era before the full dawn of telemedicine.

The DEA has also had in place - for decades - rules and regulations around how clinicians must obtain a DEA registration number for each state in which they plan to prescribe controlled substances. The specific regulation we’ll focus on here is the tying of a physical location address to the DEA registration. Specifically, the DEA states that the registered address:

Must be the physical location of your principal place of business or professional practice where controlled substances are manufactured, distributed, imported, exported, or dispensed…

And the registrant agrees that this registered address may be searched or audited at any time by the DEA. Practically, this means that in order for Dr. Y to prescribe a controlled substance to a patient in state X, Dr. Y must have a DEA registration number in state X, and obtaining that registration requires Dr. Y have a physical location in state X (and note, a PO Box or rented office won’t meet that bar, but more on that later).

Our congresspeople were thinking ahead 😲; when RHA was enacted it included a provision that the DEA was mandated to issue a ‘special registration for telemedicine’ - which would presumably directly address the registered address issue and how to incorporate the needs of fully virtual models of delivering care. It may not surprise anyone that this never happened 🙊. And since then, multiple pieces of legislation and HHS guidance have directed the DEA to release these telemedicine provisions - fool me once…However, the PHE over the last 2 years led to the DEA waiving the enforcement of this requirement, meaning that  Dr. Y could get a DEA registration in state X (or any other state) without meeting the physical registered address requirement.

PHE opportunity…

So, now that you have the backstory of what RHA is, it should make sense why its waiver during the COVID-19 PHE created opportunities for digital-only care delivery models. There are specific specialties and disease states in medicine that rely on controlled substances as an important part of treatment; for example, stimulants in the treatment of ADHD, benzodiazepines and related medications in the treatment of anxiety and sleep disorders, partial opioid agonists in the treatment of opioid use disorder, or testosterone replacement therapy in the treatment of low-T. Please note there is a wide range of new businesses from fully evidence-backed and sorely needed to partially evidence-based with room for shady to fully unscrupulous practices amongst those four examples, in no particular order.

It was now possible to build companies that either focused in on a specific disease-state (e.g., ADHD or opioid use disorder or low-T) or on a specific specialty (e.g., psychiatry) that would rely on being able to prescribe controlled substances virtually without performing an initial and subsequently annual in-person visit. These founders were always baking a not insignificant regulatory risk into their business models (knowingly or not), as with the expiration of the PHE, their virtual-only model might become noncompliant with the RHA overnight (note we’re currently on our 10th extension, most recently signed on July 15, and HHS has promised to give at least 60-days notice before it expires). Given this significant regulatory risk, the RHA has been a topic of hot discussion in various healthcare communities over the last two years, and particularly during the last 6 months.

Why this matters now…

However, we’d argue that it’s actually the waiver of the DEA registered address provisions that is far more important. While the RHA waiver allows the prescription of controlled substances without an in-person examination, the clinician still must have a DEA registration in both the originating state and the patient’s state to prescribe the medication. And the clinician could not obtain that registration in the patient’s state, in a fully virtual care delivery model, without the PHE waiver of the DEA’s registered address enforcement. So, the DEA returning to its pre-pandemic ‘draconian’ provision requiring an in-person registered location has FAR more reaching implications than the expiration of the RHA waiver. Without the DEA updating its regulations to be viable in a world where digital only care delivery models are reality, whether or not the RHA gets amended is a totally moot point 😱.

Let us explain why → many industrious practitioners and the companies they work for/with have found workarounds including PO boxes 📮, virtual addresses with physical mailrooms 📬, hourly rentals or even co-working spaces 💼. While it was believed that these workarounds might be in compliance with the DEA registered address regulation if/when it came back into effect, it is becoming increasingly clear, including from communications via the DEA itself, that these workarounds will not meet the letter of the law. That is, you won’t be able to use your corporate WeWork membership and its affiliated address and mailroom in state X to register your clinicians’ DEA registrations in state X. The DEA has started to crack-down on those workarounds and begin to enforce their provisions as written (it remains unclear why now - but it’s likely impacted by the increased regulatory scrutiny on digital health delivery models in general and digital mental health care in specific over the last two quarters).

The consequences…

This is critical for us all to understand. For example, take the energy around amending RHA to include exceptions to the in-person appointment requirement when prescribing buprenorphine to treat opioid use disorder (OUD), one of the most valiant uses of controlled substances out there. Given the amount of conversation and zeitgeist around the treatment of OUD, it is entirely possible that we will see meaningful work done here. However, in reality, its impact will be very limited (e.g., really only enabling a digital substance use disorder delivery company to expand care within the state it has a physical location in), and not unlock the scale of reaching folks across state lines, as their clinicians would still need to meet the DEA requirements of a physical location to get the DEA registration to allow for the prescription of controlled substances. For an example of how this could play out, see Bicycle’s Health admirable response to a state law requiring in-person visits for CS prescription; had the team decided not to undertake this action, hundreds of patients would have been left at risk of losing access to potentially lifesaving treatment for OUD.

So, you might conclude that if you’re providing virtual only care, the answer (or at least a feasible answer) is ‘don't’ prescribe controlled substances!’  If only it were that easy. For companies that have an in-network / insurance based component to their business, their practitioners must be credentialed by the payers they are in-network with. Currently, most payers in many states require every practitioner, even those without any plan to prescribe controlled substances, to have a valid DEA registration in the state they are planning to practice in as a prerequisite to being credentialed (and being reimbursed for clinical services rendered). This is partly as a means of identification - many payers, pharmacies, and PBMs use a clinician’s DEA as a secure means of verifying the identity of a prescribing clinician (for both controlled and non-controlled substances). It’s unclear when and how this practice started, and why these entities rely on the DEA to achieve this identity verification when this is the primary purpose of the NPI number. Interestingly, the DEA has actually discouraged the practice of payers and pharmacies using the DEA number as a means of identification (and even issued a policy statement in 1996 to this effect). So one might conclude that the DEA and payers might play the blame game with one another here.

As they say, money makes the world go round 🌎. If most payers won’t credential practitioners without a valid DEA registration, and the DEA won’t grant a registration without a bonafide physical location in the intended state of practice – goodbye 👋🏽 to virtual-only care companies that have any component of in-network business, unless they can quickly and economically open at least one physical office in each state they operate in. It is worth noting that presumably, D2C digital health care companies that are purely cash pay only and do not prescribe controlled substances may not be as impacted (or impacted at all) by the DEA regulations coming back into force.

What next…

So the million dollar question 💰 is: who can we convince to enact positive change faster: the DEA or payers (we wouldn’t hold our breath on either, unless you’re a freediver)? And the $64,000 question is: will this spawn a new crop of startups that help digital care delivery companies comply with DEA regulations by outsourcing full stack bonafide micro offices in all 50 states? Either way, we say there should be much more conversation within the healthcare community and through our various arms of influence around the DEA registration requirements.

The doctors’ questions for you:

1. How or why has the DEA registration question slipped under the radar of so many smart folks in digital health and healthcare regulatory affairs (ourselves included)?

2. With digital health innovation moving so quickly and the regulatory frameworks underpinning it lagging behind, how do we work more collaboratively with stakeholders to get regulations to catch up?

✌🏽 A + A

To read more about our vision for the Stack, check out our intro post here.

Feedback? Find us on Twitter: Amit & Arpan