Is testosterone a controlled substance?

Yes. Testosterone and other anabolic steroids are Schedule III controlled substances under the federal Controlled Substances Act. That means prescribing testosterone requires an active DEA registration, triggers federal and state recordkeeping obligations, and is subject to state prescription drug monitoring program rules and any state limits on quantity, refills, or telemedicine prescribing. Some states impose stricter requirements than federal law.

Do I need a separate DEA registration for each state where I prescribe TRT?

Generally yes. DEA registration is state-specific: a practitioner needs a registration for each state in which they maintain a principal place of business or professional practice where controlled substances are prescribed, administered, or dispensed. Multi-state telehealth TRT practices commonly hold several registrations, each tied to a valid license in that state. Because DEA has offered limited exceptions and interpretations over time, confirm your specific arrangement with DEA and your counsel rather than relying on a general rule.

Do I have to check the PDMP before prescribing testosterone?

It depends on the state. Nearly every state operates a prescription drug monitoring program, but mandatory-check rules differ: some require a check before every controlled-substance prescription, some only for opioids or benzodiazepines, some at defined intervals for ongoing therapy, and some only above a duration or dosage threshold. For a multi-state TRT practice the practical answer is to maintain a per-state matrix of when a check is required, who may perform it, and how the check is documented.

What records should a TRT clinic keep for an audit?

At minimum: the diagnostic basis for therapy including baseline labs, the informed consent the patient signed and its version, the prescriber's license and DEA registration valid on the date of each prescription, PDMP checks where required, monitoring labs on the protocol's cadence with the values reviewed, dose changes with the clinical reason, and — where a supervising or collaborating physician is involved — evidence that the supervision relationship was active on that date. The goal is that every prescription can be reconstructed years later from the record alone.

Home / Guides / TRT compliance checklist

Operations guide · updated July 2026

TRT compliance checklist: DEA, PDMP, and multi-state prescribing

Q: Can testosterone be prescribed via telemedicine without an in-person visit?

This is the single most volatile area of TRT compliance. The federal Ryan Haight Act generally requires an in-person medical evaluation before prescribing a controlled substance by means of the internet, subject to specific exceptions, and DEA has repeatedly extended and revised telemedicine flexibilities through rulemaking. State telemedicine and controlled-substance rules add a second layer that is sometimes stricter. Verify the current federal position directly with DEA and the current state position with each state medical board before building a telehealth-only TRT workflow, and re-verify on a schedule.

By the CareOS team · Updated July 27, 2026. This is an operational checklist, not legal advice. Controlled-substance rules change often and vary by state — verify every item with your own counsel, your state boards, and DEA before you rely on it.

Short answer: testosterone is a Schedule III controlled substance, so a TRT practice carries four stacked obligations on every prescription: an active license in the state where the patient is physically located, a DEA registration valid for the state you're prescribing from, whatever PDMP check that state mandates, and compliance with federal and state telemedicine rules for controlled substances. Multi-state practices fail on the seams between those four — an expired registration, a state whose PDMP rule changed, a supervision agreement that lapsed. The fix is to hold eligibility as data and check it before the prescription, not after the audit.

1. Licensure: where the patient is, not where you are

The controlling rule for telehealth is the patient's physical location at the time of the encounter. A practice serving eight states needs a prescriber licensed in each of those eight states — and needs to know, at booking time, which state the patient will be in.

Maintain a per-provider, per-state licensure record with expiration dates and renewal owners.
Capture the patient's state at booking and at the start of the visit, not just in the demographic record — patients travel.
Decide in advance what happens when a patient books from a state you don't cover. Blocking the booking is cleaner than cancelling the visit.
Track interstate compacts separately if you use them; a compact privilege is not the same object as a full license and can have different scope.

2. DEA registration: state-specific, and the most common gap

Prescribing testosterone requires an active DEA registration. Registration is tied to a state and to a valid license in that state, so a multi-state telehealth practice typically holds several — this is the item that most often silently expires in a growing clinic.

Record each registration's number, state, schedules authorized, and expiration date as structured data — not as a PDF in a folder.
Alert on renewal well before expiry; a lapsed registration invalidates prescriptions written after it lapsed.
Confirm your specific multi-state arrangement with DEA. Exceptions and interpretations exist and they don't generalize well from one practice to another.
Where state-level controlled-substance registration is also required, track it as a separate credential with its own expiry.

3. PDMP: know the rule per state, not in general

Nearly every state runs a prescription drug monitoring program, but the mandatory-check rules diverge sharply. Some states require a check before every controlled-substance prescription; others limit mandates to opioids and benzodiazepines; others require checks at intervals for ongoing therapy or above a duration threshold.

Build a per-state matrix: is a check required for Schedule III, at what trigger, who may run it, and how it must be documented.
Record the check as an event attached to the prescription — date, who ran it, what was found — so it can be reconstructed at audit.
Re-verify the matrix on a schedule. PDMP mandates are amended frequently and quietly.

4. Telemedicine rules for Schedule III: verify, don't assume

This is the most volatile area in TRT operations. The federal Ryan Haight Act generally requires an in-person medical evaluation before prescribing a controlled substance by means of the internet, subject to specific exceptions, and DEA has repeatedly extended and revised telemedicine flexibilities through rulemaking. State telemedicine rules stack on top and are sometimes stricter than federal law.

Confirm the current federal position directly with DEA — not from a summary, ours included — before designing a telehealth-only TRT intake.
Confirm each state's telemedicine and controlled-substance rules with that state's medical board, including any requirement for a prior in-person exam, a physical exam standard, or an established relationship.
Put a re-verification date on the calendar. A workflow that was compliant when you built it can drift out of compliance without anyone touching it.
Document which pathway each prescription relied on, so a later rule change doesn't leave you unable to explain past decisions.

5. Supervision and collaboration, where applicable

Where NPs or PAs prescribe, the supervising or collaborating physician relationship is itself a compliance object with a state-specific definition, and its lapse is as disqualifying as a lapsed license.

Record the agreement, its state, its scope, the parties, and its effective dates.
Alert on gaps — including the gap created when the supervising physician's own license or registration lapses.
Keep evidence that the relationship was active on the date of each prescription, not merely that it exists today. See scope of practice in the chart and governance as a dashboard.

6. Consent and patient-facing documentation

Use a written, versioned informed consent specific to testosterone therapy, covering expected benefits, known risks, fertility implications, monitoring requirements, and the consequences of stopping.
Store which version the patient signed and when — "the consent" is not one document over a multi-year therapy.
Re-consent on material protocol changes, and record the clinical reason for the change alongside it.

7. Monitoring on a cadence you can prove

Compliance and good medicine converge here. A defensible TRT program shows baseline diagnostics, monitoring labs drawn on the protocol's cadence, values actually reviewed by the prescriber, and dose changes tied to those values.

Attach the monitoring schedule to the protocol so overdue labs surface as work, not as an audit finding.
Record the review, not just the result — an unreviewed lab in the chart is worse than no lab.
Keep dose history immutable, with the reason for each change.

The seam problem — and what to do about it

Every item above is manageable alone. What breaks multi-state TRT practices is the seam: the credential matrix lives in a spreadsheet, the prescribing happens in the EHR, and nothing connects them, so the check is a habit rather than a control. The alternative is to hold licensure, DEA registrations, PDMP rules, and supervision agreements as structured data and evaluate them before the booking and the prescription — so an ineligible action is blocked, and every allowed action leaves an audit trail explaining why it was allowed.

That's the model CareOS is built on: eligibility as data, checked at the moment of the action. See CareOS for hormone & TRT clinics for how protocol titration, monitoring labs, and eligibility gating work together, or practice operations for the credentialing pipeline behind it.

Regulatory summary current as of July 2026 and deliberately general. Nothing here is legal advice or a substitute for your counsel, your state boards, or DEA. If you spot an error, email support@careos.help and we'll correct it.