DEA compliance is one of those areas where "we have always done it this way" can get you into serious trouble. The regulatory landscape around controlled substances continues to evolve, and the stakes - criminal liability, loss of your DEA registration, pharmacy closure - are as high as they get. This month we are breaking down what has changed, what is coming, and what you should be doing right now.
Regulatory Update: DEA Tightens PDMP Integration Requirements
Prescription Drug Monitoring Programs have been mandatory in every state for years, but DEA is now looking more closely at whether pharmacies are actually using them as intended - not just checking the box. Recent enforcement actions have cited pharmacies for filling controlled substance prescriptions without querying the PDMP when required, or for failing to act on red flags revealed by PDMP data.
Most states require a PDMP check before dispensing Schedule II through IV controlled substances, though the specific triggers vary. Some states require a check on every fill, while others only require checks for new patients or new prescriptions. Know your state requirements, and if you are operating in multiple states, know the requirements for each one.
Document your PDMP queries. Your pharmacy management system may log these automatically, but verify that the logs are complete and retrievable. If DEA or your state board asks to see proof that you checked the PDMP before filling a specific prescription, you need to be able to produce it.
Compliance Deep Dive: Corresponding Responsibility in Practice
The concept of corresponding responsibility is at the heart of DEA compliance for pharmacists, and it is the area where we see the most confusion. Under 21 CFR 1306.04, a pharmacist has a corresponding responsibility (along with the prescriber) to ensure that a controlled substance prescription is issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice.
What does this look like in practice? It means you cannot simply fill every controlled substance prescription that comes across your counter without exercising professional judgment. Red flags that require further investigation include - but are not limited to - prescriptions from geographically distant prescribers, multiple controlled substance prescriptions from the same prescriber for the same patient, early refill requests, cash payment when the patient has insurance, and combinations of drugs commonly associated with diversion (the "holy trinity" of an opioid, a benzodiazepine, and a muscle relaxant).
When you identify a red flag, you must investigate before dispensing. Call the prescriber, check the PDMP, review the patient profile, and document your findings. If you are satisfied that the prescription is legitimate, document why and fill it. If you are not satisfied, you have the right - and the obligation - to refuse to fill it. Document that decision too.
The key is documentation. Every red flag identified, every investigation conducted, and every clinical decision made should be recorded in the patient profile. "I felt uncomfortable but filled it anyway" is not a defensible position. Neither is "I did not notice anything unusual" when PDMP data shows the patient is filling controlled substances at five other pharmacies.
HIPAA Intersection: PDMP Data and Patient Privacy
PDMP data creates an interesting intersection between DEA compliance and HIPAA. While PDMP queries are permitted under HIPAA for treatment and healthcare operations purposes, the data you receive from a PDMP check is sensitive and should be treated accordingly.
Do not discuss a patient's PDMP results in an area where other patients or staff without a need to know can overhear. Store PDMP printouts (if you print them) in a secure location and shred them when no longer needed. If you share PDMP information with a prescriber as part of a corresponding responsibility investigation, document the disclosure and limit the information to what is necessary for the clinical decision.
Practical Guide: Controlled Substance Inventory Requirements
Your DEA biennial inventory is not just a box-checking exercise - it is a legal document. Here is what DEA requires and what we recommend.
The biennial inventory must be conducted every two years from the date of your initial inventory. You choose the date, but once established, the two-year cycle runs from that date. The inventory must include the name, dosage form, and strength of every controlled substance on hand, along with the quantity. For Schedule II substances, you must perform an exact count. For Schedule III through V, an estimated count is permitted unless the container holds more than 1,000 dosage units, in which case an exact count is required.
Beyond the biennial, you also need a new inventory whenever there is a change in pharmacist-in-charge, when your pharmacy first opens, and when it permanently closes. If you experience a theft or significant loss, conduct an additional inventory immediately and file a DEA 106 form.
We recommend going beyond the minimum. Conduct a full controlled substance inventory quarterly, not just biennially. This makes it much easier to identify discrepancies early and demonstrates a culture of compliance if you are ever investigated. Keep all inventory records for at least two years - though we recommend five years, since that aligns with most state record retention requirements.
Quick Hits
- Verify your PDMP query process is documented and logs are retrievable
- Review your corresponding responsibility policy with all pharmacists on staff
- Confirm your biennial inventory date and schedule the next one if it is overdue
- Audit your red flag documentation process for controlled substance prescriptions
- Check that PDMP printouts and data are stored and disposed of securely
- Ensure all pharmacists understand their state-specific PDMP query requirements
Stay compliant. Stay ahead. - The Rxperts Team