Controlled Substances Compliance for DPC¶

Quick Summary: Prescribing controlled substances requires careful compliance with DEA regulations and state laws. DPC doesn't change these requirements—you're still bound by the same rules as any prescriber.

DEA Registration Basics¶

Getting Your DEA Number¶

Requirements: - Valid medical license in state of practice - Complete DEA Form 224 (new registration) - Fee: $888 for 3-year registration (21 CFR 1301.13(e))

Registration address: - Must match your practice location - Each location where you store, administer or dispense controlled substances needs its own registration; a second office in the same state used only for prescribing does not (21 CFR 1301.12(b)(3)) - Home address acceptable if practicing from home (some states restrict), but a registered location is a controlled premises that DEA may inspect

Schedule II-V authorization: - Standard registration covers all schedules - Mid-level practitioners may have restrictions

DEA Renewal¶

• Every 3 years
• Renew within the 60-day window before expiration (21 CFR 1301.13(b)); DEA sends reminders at 60, 45, 30, 15 and 5 days out
• There is no grace period: DEA allows reinstatement for one calendar month after expiration, but you may not prescribe while the registration is lapsed
• Online renewal available
• $888 renewal fee
• Attest to the one-time MATE Act training at your first new or renewal registration on or after 2023-06-27 (see Buprenorphine below)

Multiple Locations¶

When you need separate DEA numbers: - Different states require separate registrations - Same state, different addresses: a separate registration for each place you store, administer or dispense; none for a prescribing-only office (21 CFR 1301.12(b)(3)) - Telehealth across state lines: Complex—get legal advice, and see Telemedicine Prescribing below

Prescribing Requirements¶

Federal Requirements (All Schedules)¶

Every controlled substance prescription must have: - Patient full name and address - Drug name, strength, dosage form - Quantity prescribed - Directions for use - Number of refills (if applicable) - Date of issue - Prescriber name, address, DEA number - Prescriber signature

Schedule-Specific Rules¶

Schedule II (opioids, stimulants, etc.): - Written prescription required (or EPCS) - No refills allowed - Federal rule: up to three separate prescriptions issued on the same day, each dated and marked for sequential filling, for a total supply of up to 90 days (21 CFR 1306.12(b)); many states are stricter - Some states require separate prescriptions for each fill

Schedule III-IV: - Up to 5 refills allowed - Valid for 6 months from issue date - Phone prescriptions allowed (document carefully)

Schedule V: - Least restrictive - Some available OTC in certain states - Still requires DEA for prescribing

EPCS (Electronic Prescribing for Controlled Substances)¶

Federal requirement: Section 2003 of the SUPPORT Act (42 USC 1395w-104(e)(7)) requires controlled-substance prescriptions covered under Medicare Part D to be transmitted electronically, effective 2021. CMS began measuring compliance with prescriptions written from 2023-01-01: at least 70% of your Part D controlled-substance prescriptions must be electronic, and prescribers who write 100 or fewer such prescriptions a year get an automatic exception

State requirements: Many states now mandate EPCS

EMR requirements: - Must have been certified or audited by a DEA-approved third party under 21 CFR 1311.300; DEA does not certify software itself, so ask your vendor for the certification report - Two-factor authentication required - Identity proofing required - Most modern EMRs support EPCS

Bootstrap note: If your EMR doesn't support EPCS, written prescriptions are still valid in most situations, but check your state.

State PDMP Requirements¶

What is the PDMP?¶

Prescription Drug Monitoring Program—state database tracking controlled substance prescriptions.

Most states require: - Check PDMP before prescribing controlled substances - Frequency varies (some every prescription, some periodic) - Registration required

PDMP Best Practices¶

1. Check before every opioid prescription (regardless of requirement)
2. Document that you checked
3. Look for red flags:
4. Multiple prescribers
5. Multiple pharmacies
6. Escalating doses

7. Early refills

8. Address concerns directly with patient

Interstate PDMP¶

Many states participate in interstate data sharing (PMP InterConnect). Check if your state shares data with neighboring states.

Documentation Requirements¶

Chart Documentation (Every Controlled Prescription)¶

Document: - Indication/diagnosis - Treatment alternatives considered - Risk/benefit discussion - PDMP review (date and findings) - Treatment goals - Follow-up plan

Opioid-Specific Documentation¶

For chronic opioid therapy: - Pain assessment (location, severity, function) - Functional goals - Risk assessment (ORT, SOAPP, etc.) - Informed consent/agreement - Periodic reassessment

Treatment Agreements¶

Consider for chronic controlled substances: - Written agreements optional but recommended - Clear expectations (one prescriber, one pharmacy) - Drug testing policy - Refill procedures - Consequences of agreement violation

Storage and Security¶

If You Dispense Controlled Substances¶

Physical security: - DEA-registered location required - Substantially constructed locked cabinet or safe - Limited access (you and authorized staff only) - Separate from non-controlled medications (best practice; not a federal requirement)

Record keeping: - Separate controlled substance log - Inventory every 2 years (minimum) - Document all dispensing - Reconcile regularly - Keep records 2 years minimum

If You Keep Office Samples¶

Same security requirements apply to samples as dispensed medications.

Theft or Loss¶

Required: - Notify your DEA Field Division in writing within one business day of discovering the loss or theft, then file DEA Form 106 electronically within 45 days of discovery (21 CFR 1301.76(b), as amended at 88 FR 40712) - Report to local police - Report to state Board of Pharmacy - Document in your records

Prescribing Pitfalls to Avoid¶

Red Flags DEA Watches For¶

1. Excessive quantities - Far above standard dosing
2. Unusual combinations - "Holy trinity" (opioid + benzo + muscle relaxant)
3. Cash-only patients for controlled substances
4. No legitimate examination before prescribing
5. Ignoring PDMP data
6. No treatment plan or follow-up
7. Geographic anomalies - Patients traveling far for prescriptions

Legitimate Practice Protection¶

Document that you're prescribing: - For legitimate medical purpose - Within usual course of professional practice - Based on appropriate examination - With adequate follow-up

In other words: Practice good medicine and document it.

Special Situations¶

Buprenorphine (MAT for Opioid Use Disorder)¶

X-waiver eliminated (2023): - No longer need special waiver - Standard DEA allows MAT prescribing - Training is required, not optional: the MATE Act (Consolidated Appropriations Act, 2023, §1263) requires every DEA registrant except veterinarians to complete a one-time eight hours of training on treating and managing patients with opioid or other substance use disorders, attested at the first new or renewal registration on or after 2023-06-27 - 30-patient limit removed

Documentation: Same as other controlled substances, plus addiction-specific notes.

Stimulants (ADHD Medications)¶

Common issues: - Adult ADHD requires careful diagnosis - Rule out substance abuse - PDMP checks recommended - Diversion risk (monitor)

Benzodiazepines¶

High-risk medication: - Avoid with opioids when possible - Document tapering plan for chronic use - Consider alternatives - PDMP monitoring

Telemedicine Prescribing¶

Compliance Checklist¶

Before You Prescribe Any Controlled Substance¶

• Valid DEA registration at practice location
• Registered with state PDMP
• EMR supports EPCS (if required in your state)
• Understand state-specific requirements
• Treatment agreement template ready (for chronic therapy)

For Each Prescription¶

• Legitimate medical purpose documented
• PDMP checked (and documented)
• Risk/benefit discussed with patient
• Quantity appropriate
• Follow-up scheduled

Ongoing Compliance¶

• DEA renewal calendar reminder (every 3 years; renew within the 60 days before expiration)
• MATE Act eight-hour training completed and attested at renewal
• PDMP checked regularly
• Controlled substance inventory (if dispensing)
• CME on pain management/prescribing
• Stay current on regulatory changes

When to Consult Specialists¶

Consider referring to pain management or psychiatry: - Escalating doses needed - Multiple failed treatments - Concerning behaviors - Complex comorbidities - Your discomfort with situation

Shared care is appropriate - You don't have to do everything.

If Something Goes Wrong¶

DEA Investigation¶

If DEA contacts you: 1. Be cooperative but cautious 2. Contact healthcare attorney immediately 3. Don't volunteer information beyond questions asked 4. Provide requested records 5. Document all interactions

Patient Diversion Suspected¶

1. Do not accuse directly
2. Document concerning behaviors
3. Discuss with patient professionally
4. Discontinue prescribing if appropriate
5. Provide referral/resources if addiction suspected
6. Consider reporting to medical board if egregious

Prescribing Errors¶

1. Document the error
2. Correct if possible
3. Report to pharmacy
4. Learn from mistake
5. Consider consultation for complex cases

Bootstrap Approach to Compliance¶

You don't need expensive compliance systems to prescribe safely:

1. Know your patients - DPC relationships reduce risk
2. Document thoroughly - Standard EMR is sufficient
3. Check PDMP religiously - It's free
4. Prescribe conservatively - When in doubt, don't
5. Refer freely - Pain management exists for a reason
6. Stay educated - Free CME available

Cost of compliance: $888 DEA registration + your time. That's it.

Related Guides¶

• HIPAA Compliance Basics
• State-Specific Regulations (check your state)
• Telehealth Legal Considerations

Resources¶

• DEA Diversion Control: deadiversion.usdoj.gov
• State PDMP: Check your state Board of Pharmacy
• SAMHSA: Guidelines for MAT
• CDC: Opioid Prescribing Guidelines

Sources checked against primary law and agency guidance on 2026-09-22.

DPC doesn't exempt you from controlled substance regulations. The same rules apply whether you're in a large hospital system or a solo bootstrap practice. Know the rules, follow them, and document everything.