Contact Lens Rule
The FTC is publishing a final rule to implement amendments to the Contact Lens Rule. These amendments require that prescribing eye care practitioners obtain a confirmation of prescription release from patients after releasing a contact lens prescription and maintain each such acknowledgment for a period of not less than three years. The Commission is permitting prescribers to comply with automatic prescription release via electronic delivery in certain circumstances. Further, these amendments specify a time period for prescribers to respond to requests for prescriptions; clarify and institute additional requirements for automated telephone verification messages; more precisely delineate what constitutes unlawful alteration of a prescription; and require that sellers provide a method for, and notice of the method for, patient prescription presentation.
What this rule actually says
The Contact Lens Rule requires eye care practitioners (optometrists, ophthalmologists) to get written confirmation from patients when releasing their contact lens prescription, and keep that confirmation for 3 years. It also sets timelines for responding to prescription requests and regulates how prescriptions can be verified or altered.
Who it applies to
- If building for eye care practitioners: You're directly affected if the product helps optometrists or ophthalmologists manage prescriptions, verify patient identity, or handle prescription releases.
- If building a contact lens seller or marketplace: You're affected if you sell contact lenses directly to consumers and need to accept or verify patient prescriptions.
- If you're an AI medical scribe, hiring assistant, or support chatbot: This almost certainly doesn't apply. The rule is narrowly about contact lens prescriptions, not general medical documentation, recruitment, or customer support.
- Geography: U.S. only (FTC jurisdiction).
- Data scope in: Contact lens prescriptions and patient confirmations of prescription release.
- Data scope out: General medical records, non-prescription eye care info, or AI training data unrelated to prescription handling.
What founders need to do
- Audit your product scope (2-3 hours): Does your AI tool actually touch contact lens prescription workflows? If not, you're done. If yes, continue.
- Implement confirmation tracking (3-5 days): If your product releases prescriptions, build a system to capture written (or electronic) patient confirmation before release happens. This must be audit-ready.
- Add 3-year record retention (1-2 days): Ensure your database or document system automatically retains prescription confirmations for 36 months. Include automated deletion after that period to avoid bloat.
- Set response timelines (1-2 days): If practitioners use your tool to respond to patient prescription requests, bake in a timer to flag requests that haven't been answered within the required window.
- Document your compliance approach (2-3 hours ongoing): Keep a simple record of how you handle prescription release, confirmation, and retention. If the FTC ever asks, this shows good faith.
Bottom line
Monitor if you touch contact lens prescriptions; ignore if you don't — and most indie AI founders building medical scribes, hiring tools, or support chatbots won't.