State and Specialty Rules: Telehealth Licensing, Prescribing, Mental Health

This is engineering guidance, not legal advice. Confirm specifics with qualified counsel.

Why this matters

Block 2 has so far dealt with rules that are the same in Honolulu and Boston: HIPAA, BAAs, encryption. This article covers the rules that change at every state line — who may treat the patient, what may be prescribed over video, and which records carry extra protection. These rules decide your provider-hiring plan, your booking logic, your prescribing flow, and your data model, and breaking them is not a civil paperwork problem: practicing without a license is a crime in most states, and prescribing controlled substances outside the federal exceptions is a felony. If you are building or buying a telemedicine platform — especially in behavioral health, the largest telehealth vertical — this is the layer most likely to surprise you after launch. The good news: every rule in this article can be encoded as data your product checks before the visit happens, and this article shows what that looks like.

Five rulebooks, one video call

Start with the mental model. A single telemedicine visit — one patient, one clinician, thirty minutes of video — answers to five rulebooks at once, and each one attaches to a different thing.

The federal privacy floor, HIPAA, attaches to the data and is the same everywhere; we covered it in HIPAA in plain English. State licensing law attaches to the clinician's authority to practice, and it is set by the state where the patient sits during the call. Federal drug law — the Ryan Haight Act and the DEA's rules — attaches to the medication being prescribed, specifically to "controlled substances", the drug categories the US places on Schedules II through V because they carry abuse potential: opioids, ADHD stimulants, benzodiazepines, some sleep and anxiety medications. A fourth rulebook, 42 CFR Part 2, attaches to a category of record — substance-use-disorder treatment records — and follows those records wherever they flow. And a fifth layer, state mental-health and minors' law, attaches to the patient — their age, their condition, and who is allowed to consent and to read the chart.

Figure 1. Five rulebooks govern one video visit, and each attaches to a different thing: the data, the clinician, the drug, the record, the patient.

Why does this decomposition matter to a product team? Because it tells you what your software must know before a visit is allowed to happen: where the patient is, what authority the clinician holds there, whether a prescription with a DEA schedule might result, whether the record will be a Part 2 record, and how old the patient is. Hold that five-part question in mind; the rest of the article fills in each part, and the last section turns it into one eligibility function. If you want the one-page basics of healthcare compliance first, our compliance guide for healthcare apps covers them; this article is the deep state-rules layer.

Licensing: the law follows the patient

The rule nobody can route around

US clinicians are licensed by states, not by the federal government, and every state's medical practice act makes the same claim: care delivered to a patient physically present in our state is practice in our state, no matter where the clinician sits (HHS telehealth licensure guidance restates this plainly). A psychiatrist in Chicago seeing a patient on vacation in Phoenix is, in that moment, practicing in Arizona — and needs Arizona's permission to do it.

Two product consequences follow immediately. First, the patient's location is not a profile field, it is a per-visit clinical fact: the patient who registered in New York but joins today's call from a New Jersey summer house is a New Jersey visit, so well-built platforms ask "Where are you right now?" at check-in and record the answer alongside the visit. Second, the consequences of guessing wrong are severe. Unlicensed practice is a criminal offense in most states — California, for one, makes it punishable by up to a year in jail under Business and Professions Code §2052 — and malpractice insurance routinely excludes care delivered without a valid license, which means one mis-routed visit can be simultaneously a crime, an uninsured liability, and a board complaint in two states.

There is a quieter consequence for the roadmap: state law also decides how a visit may be conducted. Most states now let a clinician establish a patient relationship over live video, but the details differ — whether audio-only suffices, what counts as a prior exam for prescribing, and what must be in the telehealth consent. As of the Center for Connected Health Policy's Fall 2025 review, some 45 states plus DC and Puerto Rico require telehealth-specific informed consent in at least some setting, and the format varies from "verbal, documented" to Delaware's written-consent rule. Treat consent text and modality rules as per-state configuration, the same way our consent article treats recording consent.

Three legal paths across state lines

Path one is brute force: a full license in every state where patients sit. It always works, and for a handful of states it is the only option. The price is time and money — applications run weeks to months per board, and fees recur at renewal.

Path two is the interstate compact — an agreement among states to honor a shared licensing process, the way a single Schengen visa admits a traveler to many countries. Compacts are profession-specific, and the differences matter to your data model. The physicians' compact (IMLC) is an expedited application system: the doctor still ends up holding separate licenses in each chosen state, each with its own fee and renewal date. The nurses' compact (NLC) is a true multistate license: one license, many states. The psychologists' compact (PSYPACT) grants a single telehealth authorization — one credential that permits telepsychology into every member state. As of June 2026 the picture looks like this:

The strategic read: physician and psychologist coverage is broadly solvable today, counselor and social-worker coverage is solvable in this product cycle, and the gaps have names — California sits outside both the IMLC and PSYPACT, which is why "we cover 50 states" pitches so often quietly mean "49 plus a California hiring plan".

Path three is the out-of-state telehealth registration, a pathway a small group of states — Florida, Arizona, Vermont, Colorado, Delaware, and a few others — created specifically for telehealth. Florida's version is the model: an out-of-state clinician with a clean, active license registers with the Florida Department of Health (Fla. Stat. §456.47), keeps malpractice coverage that extends to Florida patients, names a registered agent in the state, and may then treat Floridians by telehealth — but may not open a Florida office or see anyone in person. Registration is dramatically cheaper and faster than licensure, at the cost of an in-person ceiling.

Beyond the three paths there are narrow per-state exceptions — peer-to-peer specialist consults, temporary follow-up with an established patient who is traveling, bordering-state arrangements — but they are inconsistent and fact-specific. Encode them per state with counsel sign-off, or do not rely on them at all.

Figure 2. The booking-time question, as a decision tree. If every branch fails, the visit must be re-routed to a clinician who passes — automatically.

The cost arithmetic, out loud

Licensing strategy is a budget line, so walk the math once (illustrative 2026 averages; each board sets its own fees). A full medical license costs roughly $150–$1,000 per state in application fees; call it $500 on average. One physician licensed in 20 states:

20 states × $500 ≈ $10,000 up front, plus renewals every 1–2 years.

A 25-physician medical group targeting the same 20 states: 25 × $10,000 = $250,000 before the first visit, plus an administrator to track 500 expiry dates. The IMLC compresses the time (days to weeks instead of months) but not the per-state fees — the commission charges $700 per expedited application round on top of each state's own license fee. That is why real platforms do not license everyone everywhere: they model patient demand by state, license a covering subset of clinicians per state, and let the routing engine do the rest.

That routing problem is bigger than it looks. A 40-clinician practice across 51 jurisdictions defines a 40 × 51 = 2,040-cell eligibility matrix; if the average clinician holds 3 licenses, only 120 cells — under 6% — are valid. Every booking must land in a valid cell, while the license behind it is unexpired. This is why "which provider can see this patient right now" is a database query, not a dropdown.

What licensing forces in the product

A license registry: clinician × jurisdiction × credential type (full license / compact privilege / registration) × status × expiry × verification date, refreshed against primary sources on a schedule. A location check-in step that records the patient's self-attested state per visit. A booking filter that only matches valid pairs — and a waiting-room and routing layer that re-routes when the first choice fails. And per-state consent and modality configuration, because the visit's legality depends on it. None of this is exotic engineering; all of it must exist on day one.

Prescribing: the Ryan Haight Act and the December 2026 cliff

Why an internet-pharmacy law governs your video call

In 2001, an 18-year-old Californian named Ryan Haight died of an overdose on painkillers he had bought from an online pharmacy after a "consultation" that consisted of a web form. The law that carries his name — the Ryan Haight Online Pharmacy Consumer Protection Act of 2008 — amended the federal Controlled Substances Act to require that, before prescribing any controlled substance, a clinician conduct at least one in-person medical evaluation of the patient (21 U.S.C. §829(e)).

The act allows prescribing without that in-person exam only when the encounter qualifies as "the practice of telemedicine" as defined in 21 U.S.C. §802(54) — and the statutory categories are narrow, hospital-shaped exceptions: the patient is physically at a DEA-registered clinic or hospital, another DEA-registered practitioner is physically with the patient, public-health emergencies, and a few similar cases. None of them fit a consumer telehealth app with a patient on a couch. Congress saw the gap and, in the SUPPORT Act of 2018, ordered the DEA to create a special registration — a permission slip letting vetted telemedicine prescribers skip the in-person exam (21 U.S.C. §831(h)) — by October 2019. The DEA missed that deadline, and the special registration spent the next six years as the most famous unwritten rule in telehealth.

The waiver years, and where the rules stand mid-2026

When COVID-19 was declared a public-health emergency in March 2020, the in-person requirement was suspended under the act's emergency exception, and telehealth prescribing of controlled substances went mainstream: by 2024, more than 7 million controlled-medication prescriptions a year were being issued via telemedicine without a prior in-person visit (DEA/HHS, December 2025). Rather than let the suspension lapse, the DEA and HHS have extended it four times — most recently the Fourth Temporary Extension (Federal Register, December 31, 2025), which runs through December 31, 2026. Under it, any DEA-registered practitioner may prescribe Schedule II–V medications via real-time, two-way audio-video without ever having examined the patient in person, and certain opioid-use-disorder medications may be initiated by audio-only call.

Two pieces of the permanent framework did land in January 2025. The buprenorphine rule ("Expansion of Buprenorphine Treatment via Telemedicine Encounter", 90 FR 6504; effective after delay on December 31, 2025) permanently allows clinicians to initiate buprenorphine — the standard medication for opioid-use disorder, Schedule III — via telemedicine including audio-only, for an initial supply of up to six months, provided the clinician first checks the patient's state prescription drug monitoring program (PDMP) — the state-run database of a patient's controlled-substance fills — and documents it. A companion rule covered continuity of care for VA patients. Everything else remains temporary.

The permanent rule for everyone else exists only as the special registration proposal (NPRM, January 17, 2025): three registration tiers (Schedule III–V telemedicine prescribing; Schedule II for a narrow specialist list; a platform registration for telemedicine companies themselves), each layered with a State Telemedicine Registration for every state where the prescriber's patients sit, plus identity-verification, PDMP-check, and data-reporting duties, and volume limits on Schedule II prescribing. As of June 2026 it has not been finalized, which is exactly why the flexibilities were extended again. The DEA's scrutiny, meanwhile, is not theoretical: in June 2024 the Department of Justice criminally charged executives of a telehealth company over its ADHD-stimulant prescribing model (allegations, not yet adjudicated as of this writing).

Figure 3. Eighteen years of remote-prescribing law. Everything between March 2020 and December 2026 is temporary; the permanent rule is still a proposal.

Common mistake: betting the roadmap on the waiver. Teams design prescribing flows in 2026 assuming today's flexibility is permanent — no in-person linkage in the data model, no per-state DEA registration table, no PDMP integration. If the special registration lands anywhere near its proposed form, those teams rebuild their prescribing stack under deadline pressure; if the waiver simply lapses, their core feature switches off on January 1, 2027. The fix is the same rules-as-data pattern from our reimbursement article: the waiver's expiry is a configuration date, prescribing authority is a per-clinician-per-state row with an effective window, and the in-person-exam linkage is a nullable field you can make mandatory the day the rule changes.

What prescribing forces in the product

A schedule-aware prescribing flow: every medication carries its DEA schedule as data, checked before the e-prescription is created — non-controlled scripts go straight through, controlled ones route into the gated flow. A PDMP check step with a recorded timestamp and result, already mandatory for buprenorphine initiation and proposed as standard for everything else. A per-state DEA registration table per clinician, because baseline law (21 U.S.C. §822(e)) ties DEA registration to each state of practice, and the proposed framework adds per-state telemedicine registrations on top. An in-person-visit linkage field on the prescription record, dormant today, mandatory tomorrow. And the identity-proofing and two-factor mechanics of electronic prescribing of controlled substances, which our e-prescribing and EPCS article covers in depth.

Substance-use records: 42 CFR Part 2

Stricter than HIPAA, and now enforced like it

Since the 1970s, federal law has given one record category extra armor: records that identify a person as a patient of a federally assisted substance-use-disorder (SUD) treatment program. The regulation, 42 CFR Part 2, exists for a blunt reason — people avoid addiction treatment when they fear the record will reach an employer, a prosecutor, or a custody hearing. Part 2 therefore restricts disclosure more tightly than HIPAA: historically, almost every disclosure needed specific written consent, and Part 2 records generally cannot be used against the patient in legal proceedings without consent or a special court order.

If your platform serves an addiction-medicine clinic, a methadone program, or an SUD telehealth vertical, Part 2 reaches you. The program itself is the regulated "Part 2 program"; your platform typically receives Part 2 records as a qualified service organization — Part 2's cousin of the business associate — under a qualified service organization agreement (QSOA) that sits alongside your BAA inventory. The session recording of an SUD consult, the appointment metadata showing a patient attends a buprenorphine clinic, the intake forms — all of it is Part 2-protected the moment it identifies the patient as an SUD patient.

What the 2024 final rule changed — compliance was due February 16, 2026

The 2024 final rule (89 FR 12472, February 16, 2024), required by the CARES Act, pulled Part 2 into alignment with HIPAA — and its compliance deadline, February 16, 2026, has now passed, so this is current law, not a coming change. The headline changes: a patient may now sign a single consent covering all future uses and disclosures for treatment, payment, and operations (the old regime demanded a new consent per disclosure); once disclosed under that TPO consent to a HIPAA-covered recipient, records may be redisclosed under HIPAA's rules; HIPAA's breach-notification rule now applies to Part 2 records; penalties are aligned with HIPAA's civil and criminal scheme; and a new category of SUD counseling notes mirrors HIPAA's psychotherapy-notes protection, requiring its own specific consent. The bar on using records against patients in proceedings stays. HHS's Office for Civil Rights opened a Part 2 enforcement program on February 13, 2026 and accepts complaints for conduct from February 16, 2026 — the era of Part 2 as an unenforced nicety is over.

What Part 2 forces in the product

Record-category tagging at the data-model level: a Part 2 flag that travels with the record — including session recordings — and drives different sharing behavior, because an EHR sync that happily ships SUD notes to a general-medicine context is a violation, not a feature. A consent registry that stores the signed TPO consent, supports revocation, and gates every disclosure path. The notice that must accompany disclosures (Part 2's redisclosure statement), generated automatically. A QSOA inventory next to your BAAs. And your breach pipeline extended to Part 2 records, feeding the same audit-logging spine the rest of the platform uses. Segmenting one record category cleanly is vastly cheaper at design time than retrofitting it after your first SUD-clinic customer signs.

Mental health and minors: the heightened layer

Behavioral health is where telemedicine stuck hardest — it is the highest-volume telehealth specialty in the US — and it carries its own rule set on top of everything above. (The full product playbook is in our mental-health telemedicine article; here is the regulatory layer.)

Psychotherapy notes are HIPAA's most-protected record: a therapist's process notes kept separate from the medical record may not be disclosed — even for treatment — without the patient's specific authorization (45 CFR §164.508(a)(2)). The product translation is architectural: a separate notes store, excluded by default from EHR sync, patient export, and proxy access. State mental-health data statutes go further than HIPAA for mental-health categories — Washington's My Health My Data Act, with its private right of action, is the loudest example — and our de-identification and analytics article maps that landscape. On the payment side, Medicare made audio-only behavioral telehealth permanent, and the in-person-visit precondition for tele-mental-health is deferred to January 1, 2028 — dates and mechanics in the reimbursement article.

Minors are the sharpest edge. Who consents to a 15-year-old's therapy session — and who may read the chart afterward — is pure state law, and the spread is wide: California lets minors 12 and older consent to outpatient mental-health care (Family Code §6924), Maryland lowered its mental-health consent age to 12 in 2021, other states draw the line at 14 or 16, and a 2022 study in Pediatrics counted 19 states with no explicit minor-consent statute for outpatient mental health at all. HIPAA then follows state law: when a minor lawfully consented to the care, the minor — not the parent — generally controls the privacy rights for that record (45 CFR §164.502(g)(3)).

For a product, that means: an age gate at intake that selects the state-correct consent flow; parental-proxy accounts with scoped, state-aware access — a parent may legitimately see scheduling and billing while being walled off from the visit record; proxy access that changes at defined ages rather than persisting by default; and adolescent-confidentiality flags that survive every sync and export path, because the federal information-blocking rule pushes records toward patients while state confidentiality law walls specific records off from parents — both at once, and your data model has to honor both. Duty-to-warn and mandatory-reporting rules also vary by state; surface them to clinicians as per-state policy guidance rather than automating them. The identity side — who is in the room, guardianship, interpreter roles — is covered in roles, identity, and consent.

The patchwork as data: one eligibility function

Pull the layers together and the engineering answer is one sentence: every rule in this article is a row in a table, and every visit and prescription is a query against those tables. The five-part question from Figure 1 becomes a function your platform evaluates before anything clinical happens:

eligible?(clinician, patient_state, service, drug_schedule, patient_age, record_category)
  ├─ license_registry:   clinician × patient_state × credential × expiry
  ├─ modality_rules:     patient_state × service × consent_form
  ├─ prescribing_rules:  drug_schedule × clinician DEA registrations × waiver window
  ├─ part2_rules:        record_category × consent on file × QSOA
  └─ minor_rules:        patient_age × patient_state × consent + proxy scope

Each table is effective-dated, because every input changes on a legislative or regulatory calendar: compacts add states, the DEA waiver has an expiry, Part 2 had a compliance date, consent ages move. The team that ships this as configuration reviews a quarterly rules diff; the team that hard-codes it ships emergency releases every December. The same pattern, applied to billing, closed the reimbursement article — this is its licensing-and-prescribing twin.

Figure 4. The patchwork as data. Five effective-dated rule tables feed three gates: booking, e-prescription, and record handling.

A final comparison to anchor the licensing decision:

Where Fora Soft fits in

Since 2005 we have built telemedicine, video-conferencing, streaming, e-learning, and surveillance products — 239+ shipped projects — and the licensing-and-prescribing layer is where our compliance and real-time-video experience meet. In practice that means we design the license registry and state-aware routing into the booking flow from day one, build prescribing flows that are schedule-aware with PDMP and EPCS integration points, and segment Part 2 and adolescent records at the data-model level so the platform can serve SUD and behavioral-health verticals without a retrofit. We do not give legal advice — your counsel owns the rule interpretations; we make sure the product can enforce whatever counsel decides, state by state, as configuration rather than code.

What to read next

• Reimbursement and the rules that shape the product — the payment-side calendar this article's rules-as-data pattern comes from.
• Mental and behavioral health telemedicine — the full product playbook for the heightened layer.
• e-Prescribing and EPCS — the identity-proofing and two-factor mechanics behind controlled-substance scripts.

Call to action

• Talk to a telemedicine engineer — book a 30-minute scoping call to talk through your ryan haight act remote prescribing plan.
• See our case studies — 250+ shipped projects across video streaming, WebRTC, OTT, telemedicine, e-learning, surveillance, and AR/VR.
• Download the State & Specialty Rules Launch Checklist — One page: per-state licensing checks (registry, location capture, routing), Ryan Haight / DEA prescribing checks with the December 31, 2026 expiry, 42 CFR Part 2 segmentation checks, and the mental-health & minors consent block, plus a….

References

1. Ryan Haight Online Pharmacy Consumer Protection Act of 2008, Pub. L. 110-425; in-person medical evaluation requirement codified at 21 U.S.C. §829(e); "practice of telemedicine" defined at 21 U.S.C. §802(54); special registration at 21 U.S.C. §831(h) (as amended by SUPPORT Act §3232, Pub. L. 115-271, 2018). https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section829&num=0&edition=prelim (Tier 1)
2. DEA & HHS, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, Federal Register, December 31, 2025 (doc 2025-24123) — flexibilities through December 31, 2026; Schedule II–V via audio-video; OUD medications via audio-only. https://www.federalregister.gov/documents/2025/12/31/2025-24123/fourth-temporary-extension-of-covid-19-telemedicine-flexibilities-for-prescription-of-controlled (Tier 1)
3. DEA & HHS, Expansion of Buprenorphine Treatment via Telemedicine Encounter, final rule, 90 FR 6504 (January 17, 2025); effective date delayed to December 31, 2025 (90 FR 13384, March 24, 2025) — audio-only initiation, PDMP check, six-month initial supply. https://www.federalregister.gov/documents/2025/01/17/2025-01049/expansion-of-buprenorphine-treatment-via-telemedicine-encounter (Tier 1)
4. DEA, Special Registrations for Telemedicine and Limited State Telemedicine Registrations, NPRM, 90 FR 6541 (January 17, 2025) — three registration tiers, state telemedicine registrations, PDMP and identity-verification duties; not finalized as of 2026-06-11. https://www.federalregister.gov/documents/2025/01/17/2025-01050/special-registrations-for-telemedicine-and-limited-state-telemedicine-registrations (Tier 1)
5. DEA press release, DEA Extends Telemedicine Flexibilities to Ensure Continued Access to Care, December 31, 2025 — 7M+ telemedicine controlled-medication prescriptions in 2024; rationale for the fourth extension. https://www.dea.gov/press-releases/2025/12/31/dea-extends-telemedicine-flexibilities-ensure-continued-access-care (Tier 2)
6. HHS/SAMHSA & OCR, Confidentiality of Substance Use Disorder (SUD) Patient Records, final rule, 89 FR 12472 (February 16, 2024) — single TPO consent, HIPAA-aligned redisclosure, breach notification, penalties, SUD counseling notes; compliance date February 16, 2026. With HHS fact sheet. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html (Tier 1)
7. HHS Office for Civil Rights, Part 2 civil enforcement program announcement, February 13, 2026 — complaints accepted for conduct from February 16, 2026. https://www.hhs.gov/hipaa/part-2/index.html (Tier 1)
8. HIPAA Privacy Rule: psychotherapy-notes authorization requirement, 45 CFR §164.508(a)(2); personal representatives and minors, 45 CFR §164.502(g)(3). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164 (Tier 1)
9. HHS, Licensing across state lines, Telehealth.HHS.gov — the patient-location rule and pathway overview. https://telehealth.hhs.gov/licensure/licensing-across-state-lines (Tier 2 — agency guidance)
10. Interstate Medical Licensure Compact Commission — participation (43 member states + DC + Guam; Alaska HB110 passed May 20, 2026, to join as the 44th state) and snapshot statistics as of April 30, 2026 (209,669 licenses; 60,526 physicians). https://imlcc.com/ (Tier 1 — compact commission)
11. PSYPACT Commission, participating-jurisdictions map — 40 states + DC + CNMI effective; Montana enacted, effective date pending; California, Oregon, Alaska among non-members (read 2026-06-11). https://psypact.gov/page/psypactmap (Tier 1 — compact commission)
12. Counseling Compact Commission and Georgia Secretary of State — privileges to practice rolling out 2025–26; Georgia live June 2, 2026. https://counselingcompact.gov/ (Tier 1 — compact commission); Social Work Licensure Compact (34 states enacted; not yet issuing) https://swcompact.org/ (Tier 1)
13. Florida Department of Health, Out-of-State Telehealth Provider Registration (Fla. Stat. §456.47) — registration conditions: active clean license, malpractice coverage, registered agent, no in-person services in Florida. https://flhealthsource.gov/telehealth/ (Tier 1 — state authority)
14. Center for Connected Health Policy (CCHP), Cross-State Licensing and Consent Requirements policy trackers, Fall 2025 edition — consent required in ~45 states + DC + PR; per-state modality and exception detail. https://www.cchpca.org/topic/cross-state-licensing-professional-requirements/ (Tier 5 — institutional tracker)
15. California Business & Professions Code §2052 (unlicensed practice; criminal penalties); California Family Code §6924 (minor consent to outpatient mental-health treatment at 12+). https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=2052 (Tier 1 — state statute)
16. Pathak, P. R., & Chou, A., et al., State-by-State Variability in Adolescent Privacy Laws, Pediatrics 149(6), 2022 — 19 states with no explicit minor-consent statute for outpatient mental health. https://publications.aap.org/pediatrics/article/149/6/e2021053458/187003 (Tier 5 — peer-reviewed)
17. CMS, Telehealth FAQ (updated February 26, 2026) — tele-mental-health in-person requirement deferred to January 1, 2028; audio-only behavioral telehealth permanent. https://www.cms.gov/files/document/telehealth-faq-updated-02-26-2026.pdf (Tier 1)
18. US Department of Justice, press release, June 2024 — criminal charges against executives of a telehealth company over controlled-substance (ADHD stimulant) prescribing practices; allegations pending adjudication. https://www.justice.gov/opa/pr/justice-department-charges-founderceo-and-clinical-president-digital-health-company (Tier 2 — agency announcement)

Where lower-tier trackers (CCHP, compact guides) disagreed with a statute or commission page, the statute or commission page was followed — e.g., compact membership counts were taken from the IMLC and PSYPACT commissions' own pages rather than third-party "compact state" listicles, several of which were a legislative season out of date.