Psychiatry Compliance: Controlled Substances + 42 CFR Part 2 + Telepsychiatry

Psychiatry practices operate under DEA controlled-substance rules at 21 CFR Parts 1300-1317, 42 CFR Part 2 substance-use disorder confidentiality for any practice that meets the Part 2 program definition, HIPAA at 45 CFR Part 164, and the DEA/HHS fourth temporary telemedicine extension running through December 31, 2026 that continues the pandemic-era flexibility while a permanent rule remains unfinished. Compliance turns on prescribing documentation, PMP queries, Part 2 consent management, and chart-time discipline for psychotherapy add-on codes.

What the regulators actually require for psychiatry

DEA registration is required for any prescriber issuing Schedule II-V controlled substances. The registration must match the practice location where the prescriber administers, dispenses, or stores controlled substances. Under 21 CFR § 1301.12(b)(3), a registrant does not need a separate DEA registration for an in-state office used only to prescribe controlled substances — provided no controlled substances are administered, dispensed, or stored there. A practice that administers buprenorphine, dispenses samples, or maintains on-site stock at a second location needs a second registration for that location, even within the same state. Crossing state lines triggers a separate registration regardless. Inventory and recordkeeping requirements at 21 CFR § 1304 apply at any location where the practice maintains an on-site controlled-substance inventory.

Electronic prescribing of controlled substances (EPCS) is required in most states under Medicare Part D (since 2021) and state-specific mandates. Two-factor authentication enrollment must be on file for every prescriber.

Every state operates a prescription drug monitoring program (PDMP). Most states require a query before initial controlled-substance prescription and at defined intervals for ongoing therapy. New York's I-STOP (PHL § 3343-a) and California's CURES are among the more stringent — both require electronic checking and have penalty provisions for non-compliance.

42 CFR Part 2 governs the confidentiality of substance-use-disorder patient records held by federally assisted programs. The 2024 final rule aligning Part 2 more closely with HIPAA introduced a single-consent option for treatment, payment, and healthcare operations disclosures but preserved heightened patient consent requirements for redisclosure and law-enforcement access. The threshold question is whether the practice is a "Part 2 program" as defined at 42 CFR § 2.11 — a program or individual that holds itself out as providing SUD diagnosis, treatment, or referral and receives federal assistance.

The operative DEA telemedicine authority is the DEA/HHS fourth temporary extension, announced January 2, 2026 and running through December 31, 2026. It continues the pandemic-era flexibility allowing Schedule II-V controlled-substance prescribing via telemedicine without a prior in-person evaluation when the extension's conditions are met. Buprenorphine for OUD has separate, broader continuing flexibility. The DEA's long-promised final telemedicine rule and the proposed special-registration framework have not yet replaced the temporary-extension regime, and the operational risk is that the extension expires and a final rule does not arrive in time.

For E/M and psychotherapy coding, CMS Pub. 100-04 Chapter 12 § 30.6 (E/M services) and § 30.6.15 (psychotherapy services) define documentation expectations. The 2021 E/M overhaul moved outpatient codes to medical decision-making or total time; the psychotherapy add-on codes (90833, 90836, 90838) require time documented separately from the E/M time.

The documents you must maintain

The psychiatry compliance binder should hold:

• DEA registration for every prescriber, matched to each location where controlled substances are administered, dispensed, or stored (a separate registration is not required at an in-state office used solely for prescribing under 21 CFR § 1301.12(b)(3)), with renewal alerts at 60 days
• State controlled-substance registration where state law requires (most states do)
• PDMP query documentation in the chart for every controlled-substance prescription where state law requires; PDMP query log for audit reconstruction
• EPCS two-factor enrollment evidence for every prescriber and the third-party identity-proofing record
• Controlled-substance inventory log if the practice maintains in-office samples — receipt, administration, waste with two-signature witness, monthly reconciliation, annual physical inventory
• DEA Form 222 records for Schedule II ordering if applicable
• 42 CFR Part 2 consent forms if the practice is a Part 2 program — including the single-consent form aligned with the 2024 final rule
• Part 2 designation memo documenting whether the practice has determined it is or is not a Part 2 program, the analysis under § 2.11, and the review date
• Telepsychiatry policy covering platform selection (BAA, end-to-end encryption), patient identity and location verification, emergency-protocol documentation per patient location, and licensure verification across state lines
• Psychotherapy time-tracking in every chart note — total time, time spent on the E/M component, time spent on the psychotherapy add-on, and exclusion of any overlap
• Diagnosis-supported medical necessity for every psychotherapy session, including the connection to the treatment plan goals
• Patient agreement for controlled-substance prescribing (commonly called a controlled-substance agreement) for ongoing therapy with Schedule II stimulants, benzodiazepines, and similar agents

What psychiatry practices most often miss is the PDMP query documentation. The query happened — the screenshot is in a folder somewhere — but the chart does not reflect the query date, the prescriber's review, and the clinical decision. The state board and the DEA will look at the chart, not the folder.

How audits actually work in psychiatry

DEA inspections of practitioner offices are typically triggered by a complaint, a state-board referral, a pharmacy-level dispensing pattern, or a routine cycle. The inspector reviews the registration, the inventory (if any), the prescription records, and the controlled-substance recordkeeping. Discrepancies between inventory and dispensing records, missing DEA Form 41 disposal records, and missing two-witness waste signatures are the most common findings.

CMS and MAC audits of psychiatry practices most often target the psychotherapy add-on codes. The documentation must support the time and the medical necessity. A pattern of billing 90837 for a substantial majority of sessions, when the typical psychiatry caseload distributes across 90833, 90836, and 90838, draws scrutiny. The RAC and TPE letters request the chart, the time documentation, and the psychotherapy-distinct-from-E/M support.

OCR investigations of psychiatry practices typically begin with a patient complaint about portal access, EOB confidentiality, or release of records to a third party (employer, court). 42 CFR Part 2 redisclosure violations attract heavier penalties than HIPAA violations and can trigger criminal exposure under 42 USC § 290dd-2 for knowing violations.

State medical board investigations typically follow a patient complaint, a pharmacist concern, or an adverse-event referral. Boards investigate the prescribing pattern, the PDMP query record, the treatment agreement, and the chart documentation. In several states, the board will pull the prescriber's PDMP record directly and compare it to chart-documented decisions.

What psychiatry practices most often miss is the chart consent-revocation documentation under Part 2. A patient who consented to disclosure to a primary care provider may revoke later; if subsequent disclosures occur after the revocation, both Part 2 and HIPAA are violated. The chart must show the revocation date and the disclosure-stop confirmation.

Common gaps unique to psychiatry

In psychiatry audits and DEA inspections we have responded to, the recurring patterns:

• PDMP query in the EHR but not in the patient chart — the query screenshot is in the practice's administrative folder; the chart note does not reflect the query.
• EPCS configured but two-factor enrollment evidence missing — for an audit, the third-party identity-proofing record must be on file.
• Telepsychiatry across state lines without licensure verification — a patient who moved to another state continues treatment via telehealth; the prescriber is not licensed in the patient's new state.
• Controlled-substance treatment agreement on file but no documented annual renewal — patient agreements expire and need refresh on the practice's defined cadence.
• Psychotherapy time billed concurrently with E/M time — the add-on code requires time additional to and not concurrent with the E/M.
• 90837 billed for nearly every session without time documentation supporting the duration over 90834.
• Part 2 consent missing or scoped too narrowly — the consent must specify the recipient, the purpose, and the amount and kind of information disclosed.
• No documented analysis of whether the practice is a Part 2 program — without the analysis, the practice cannot defend the position either way.
• In-office buprenorphine or stimulant inventory without monthly reconciliation — DEA expects monthly reconciliation against receipts and administration logs.

Maintenance cadence

• Daily: PDMP query in chart for every controlled-substance prescription where state law requires; psychotherapy time documentation
• Weekly: controlled-substance inventory reconciliation if on-site samples are maintained
• Monthly: review of psychotherapy code distribution per provider (90832/90834/90837/90838); controlled-substance treatment agreement renewals; tele-licensure status for any patients receiving care across state lines
• Quarterly: chart sample audit (10-15 charts per provider) for documentation-to-billing fit and Part 2 consent management
• Annually: DEA and state controlled-substance registration renewal tracking; Part 2 program-status reanalysis; EPCS two-factor enrollment recheck; HIPAA risk analysis; telepsychiatry policy refresh against the current DEA temporary extension or any successor final rule
• On every staff onboard: PDMP query training; EPCS enrollment if prescribing; Part 2 consent training if applicable; telepsychiatry policy training

State preemption: where state law adds materially

California — CURES query required under Cal. Health & Safety Code § 11165.4 at the first prescription of any Schedule II–IV controlled substance and at least every six months thereafter for ongoing therapy. Business and Professions Code § 2242.1 governs telehealth prescribing standards. CMIA at Civil Code §§ 56-56.37 layers on top of Part 2 for SUD records.

Texas — Texas Medical Board Rule 174 governs telemedicine prescribing. PMP query required under Health and Safety Code § 481.0764 for Schedule II opioids and certain other controlled substances. Texas Health and Safety Code Chapter 611 governs mental health records confidentiality independently of HIPAA and Part 2.

New York — I-STOP under Public Health Law § 3343-a requires PMP check for every controlled-substance prescription; mandatory e-prescribing under PHL § 281 (electronic prescribing of all medications, with limited exceptions). New York Mental Hygiene Law § 33.13 governs mental-health record confidentiality.

Florida — E-FORCSE PMP check required under F.S. § 893.055 before Schedule II and most Schedule III prescriptions. Florida Statute § 456.44 governs controlled-substance prescribing for chronic non-malignant pain. Florida Statute § 394.4615 governs mental-health record confidentiality and intersects with Part 2 for substance-use treatment.

How d3rx fits

The d3rx specialty compliance binder maintains the psychiatry module: DEA registration tracker, PDMP query log, Part 2 program-status analysis and consent inventory, telepsychiatry policy, EPCS two-factor evidence file, controlled-substance treatment agreement tracker, and psychotherapy time-tracking template. It is a source-grounded administrative documentation aid. It does not certify compliance, provide legal advice, or replace counsel. See compliance binder for the binder structure or audit defense for DEA/state-board response support.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.