Pain Management Compliance: DEA Registration + PDMP Requirements

Pain management practices are regulated under the DEA's Controlled Substances Act framework at 21 USC § 801 et seq. and 21 CFR Parts 1300–1317, plus state Prescription Drug Monitoring Program (PDMP) statutes that mandate query and review before every controlled-substance prescription. Failure on either side — federal recordkeeping or state PDMP — drives the bulk of DEA pain-practice enforcement.

What the DEA actually requires for a pain practice

Every prescriber who issues, administers, or dispenses Schedule II–V medications must hold an active DEA registration matched to a specific practice location under 21 CFR § 1301.12. The registration is not transferable, expires every three years, and must list the schedules the practitioner is authorized to handle.

Federal prescription standards live at 21 CFR § 1306. Every controlled-substance prescription must include the patient's full name and address, the drug name, strength, dosage form, quantity, directions for use, and the prescriber's name, address, DEA number, and signature. Schedule II prescriptions cannot be refilled. Schedule III–V prescriptions can be refilled up to five times within six months. Schedule II must be issued either as a written paper prescription or via DEA-compliant Electronic Prescribing for Controlled Substances (EPCS).

The recordkeeping framework at 21 CFR Part 1304 requires every registrant to maintain a complete and accurate record of every controlled substance received, dispensed, and disposed. Schedule II inventory uses DEA Form 222 or the electronic equivalent (CSOS). Disposal uses Form 41. Loss or theft uses Form 106, filed within one business day of discovery under 21 CFR § 1301.76(b).

The PDMP layer

All 49 states plus DC operate a PDMP, and Missouri now runs a statewide PDMP launched in 2023 — established by SB 63 (2021) under the Missouri Joint Oversight Task Force on Prescription Drug Monitoring. The DEA links to the state PDMP map at deadiversion.usdoj.gov/pdmp. Query mandates vary by state but the pattern is consistent: query before the triggering controlled-substance prescription, document the review in the chart, and re-query at defined intervals for ongoing therapy.

State PDMP frameworks with the highest enforcement intensity:

• California CURES (Health & Safety Code § 11165.4) — query before the first prescription of any Schedule II–IV controlled substance and at least every six months thereafter while the course of treatment continues.
• New York I-STOP — query at every Schedule II–IV prescription. The strictest state interval.
• Texas (Tex. Health & Safety Code § 481.0764) — mandatory query before prescribing opioids, benzodiazepines, barbiturates, or carisoprodol (not every Schedule II–V).
• Florida E-FORCSE (Fla. Stat. § 893.055(7)(c)) — consultation required each time a Schedule II–V controlled substance is prescribed.

What pain practices most often miss is the documentation step. The query itself does not satisfy the rule — the rationale for the prescription, given what the query showed, must appear in the chart entry on the date of the prescription.

The documents you must maintain

A pain-practice compliance binder should produce on demand:

• Active DEA registration for every prescriber, matched to every location where controlled substances are stored
• State controlled-substance certificate or registration where state law adds a parallel layer (Florida, New York, others)
• PDMP query log per patient encounter, with the query screenshot or system attestation
• Patient pain-management agreement, signed and dated, for any course exceeding the state-mandated initial-prescription duration
• Urine drug screen results filed in the chart, with deviations from the expected profile noted
• DEA Form 222 (or CSOS equivalent), Form 41, and Form 106 records covering the inventory cycle
• Inventory reconciliation log on at least a monthly cadence; biennial inventory under 21 CFR § 1304.11 at minimum
• Provider DEA training records, where state-mandated (e.g., the federal MATE Act eight-hour controlled-substance training requirement under 21 USC § 823(l) for new and renewing DEA registrations)
• E-prescribing system attestations, including EPCS two-factor enrollment evidence per provider

How DEA audits actually work

The DEA opens an administrative inspection with a Notice of Inspection (Form DEA-82) under 21 USC § 880. The diversion investigators ask for the registration certificate, the biennial inventory, all Form 222 (or CSOS) records for a defined lookback, all prescription records, and the Form 106 file. They reconcile dispensed quantities against ordered quantities and look for unexplained variance.

What we see drive enforcement on pain practices, in order:

1. Inventory variance the practice cannot reconcile. The investigator counts what is on the shelf, compares to the receipt-minus-dispense math from Form 222 and prescription records, and asks where the gap went. A practice without disposal documentation under Form 41 has no answer.
2. Prescription records that fail the 21 CFR § 1306.04 "legitimate medical purpose" standard. Missing chart notes, missing PDMP queries, missing exam findings supporting the dose.
3. EPCS gaps. A Schedule II prescription issued on a paper pad in a state with electronic-prescribing mandates (NY, ME, others) is itself a violation.
4. Pattern signals in ARCOS, the DEA's wholesaler-purchase reporting database. A practice purchasing volumes inconsistent with the patient panel will get a letter.
5. Pharmacy refusals. A pharmacy that refuses to fill a prescription under its corresponding-responsibility duty often reports the prescriber to the DEA.

The DEA can revoke registration administratively under 21 USC § 824 for any of the listed grounds, including conviction, false statements on the registration application, or "such other conduct which may threaten the public health and safety." Most pain-practice enforcement ends in a memorandum of agreement, a civil settlement, or voluntary surrender — not criminal prosecution. The cases that reach prosecution involve documented quantification of diverted volume and pattern evidence of pill-mill operation.

Common gaps unique to pain practices

The patterns we see most often in pain-practice audit defense work:

• PDMP queried but the review is not memorialized. A bare timestamp does not show what the prescriber considered.
• Pain-management agreements expired or never re-signed at the annual interval the practice itself defined in the agreement.
• Urine drug screen results in the chart with no documented response to inconsistent results.
• Sample inventory (sales-rep samples, sample injectables) untracked. DEA treats samples as inventory.
• Mid-level prescribers without their own DEA registration writing under the physician's number. This is itself a violation, even if state scope-of-practice permits the prescription.
• MATE Act training not on file for new or renewing DEA registrants under the 21 USC § 823(l) eight-hour requirement.
• EPCS two-factor enrollment lost when staff turn over.

Maintenance cadence

The cadence we recommend for a steady-state pain practice:

• Daily: Document PDMP query and clinical rationale in every controlled-substance prescribing encounter.
• Weekly: Reconcile in-office controlled-substance inventory against administration and waste logs.
• Monthly: Inventory reconciliation against Form 222 receipts; review pattern reports for any unusual prescribing.
• Quarterly: Sample-audit charts for PDMP-query documentation and pain-management-agreement currency. Re-verify DEA registration status for every prescriber.
• Biennially: Full inventory under 21 CFR § 1304.11(c). The biennial inventory is the document the DEA asks for first.
• At credentialing and re-credentialing: Confirm DEA registration status, state controlled-substance registration, MATE Act training, EPCS enrollment, and any state-required CME on chronic-pain management.

State preemption to watch

Pain-practice rules vary materially by state. The biggest divergences in 2026:

• California: CURES query before the first Schedule II–IV prescription and at least every six months thereafter (Health & Safety Code § 11165.4); mandatory e-prescribing for all controlled substances since January 2022; specific labeling rules for opioid prescriptions exceeding defined thresholds.
• New York: I-STOP requires PDMP query at every Schedule II–IV prescription, EPCS mandatory since March 2016, and limits on initial opioid prescriptions to a 7-day supply for acute pain.
• Texas: PDMP query before prescribing opioids, benzodiazepines, barbiturates, or carisoprodol (Tex. Health & Safety Code § 481.0764); chronic-pain prescribing rules under the Texas Medical Board with specific documentation expectations; the Texas Pain Management Clinic Registration requirement for clinics meeting the volume criteria under Tex. Occ. Code § 168.
• Florida: E-FORCSE consultation each time a Schedule II–V prescription is written (Fla. Stat. § 893.055(7)(c)); pain-clinic registration under Florida Statute § 458.3265 for clinics meeting the definition; mandatory e-prescribing for Schedule II.
• Ohio: OARRS query before initial Schedule II prescription and every 90 days; opioid-prescribing rules under the State Medical Board with hard duration caps.

Any pain practice operating across state lines should maintain a state-by-state matrix, not assume federal compliance is enough.

How d3rx fits

The d3rx compliance binder produces a pain-practice section that names the DEA forms (222, 41, 106), the state PDMP query log, the patient pain-management agreement template, and the chart-audit checklist tied to 21 CFR § 1306.04. It is a source-grounded administrative documentation aid. See the compliance binder overview or the audit defense surface for how the pain-practice section fits the broader binder.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.