Urology Compliance: Controlled Substances + ASC + In-Office CLIA

Urology practices layer DEA registration and state PDMP rules for opioid post-procedure prescribing, ASC Conditions for Coverage at 42 CFR § 416 when the practice owns its ASC, CLIA certification at 42 CFR Part 493 for in-office urinalysis and culture, Stark in-office ancillary services exception requirements for in-office lab and imaging, and Medicare's LCD framework for BCG, lithotripsy, and prostate-specific procedures. The compliance perimeter is broader than the procedure menu suggests.

What CMS and the DEA actually require for a urology practice

For controlled-substance prescribing — post-procedure opioids, post-vasectomy analgesia, post-TURP and post-stone-treatment pain control — the prescriber must hold an active DEA registration matched to the practice location under 21 CFR § 1301.12. The federal MATE Act eight-hour training requirement at 21 USC § 823(l) applies to new and renewing DEA registrants. State PDMP query mandates layer on top — California CURES, New York I-STOP, Texas PMP Aware, Florida E-FORCSE — with query requirements specific to controlled-substance prescription patterns. Each state's interval varies; the documentation requirement is consistent: query before prescribing and memorialize the rationale in the chart.

For ASC-based urology — TURP, ureteroscopy, lithotripsy, prostate biopsy — the Conditions for Coverage at 42 CFR § 416.40 – 416.52 govern. The anesthesia program at 42 CFR § 416.42, the infection-control program, the medical staff credentialing, and the surgical services condition are the recurring inspection focus areas.

For in-office urinalysis, urine culture, and microscopy, CLIA at 42 CFR Part 493 requires a CLIA certificate matched to the complexity of testing performed. Waived testing (FDA-cleared dipstick urinalysis used per manufacturer instructions) requires a Certificate of Waiver. Microscopic urinalysis and any culture-based testing requires a Certificate of Compliance or Certificate of Accreditation depending on operational model, with qualified personnel under 42 CFR § 493.1351 and quality control under 42 CFR § 493.1256.

LCDs published by the MACs govern medical necessity for many urology services. BCG instillation, prostate biopsy, lithotripsy (ESWL, LWL), urodynamic studies, and prostate-specific procedures (HIFU, focal therapy where covered) each have a coverage policy. The urodynamic studies LCD has been a recurring MAC audit target for over a decade.

Stark physician self-referral at 42 CFR § 411 interacts with in-office urology imaging (ultrasound 76872, 76870, CT urography for stone work), in-office pathology (prostate biopsy specimens 88305-26 and -TC split), and IMRT for prostate cancer when the group owns a radiation oncology unit. The in-office ancillary services exception elements must be met for each.

The OIG has paid particular attention to urology IMRT arrangements over the last decade — the group-practice structure, the supervision pattern, and the centralized-building element of the exception have been examined in multiple OIG advisory opinions.

The documents you must maintain

A urology-practice compliance binder should produce on demand:

• Active DEA registration for every prescriber, matched to every location where controlled substances are stored, dispensed, or administered
• MATE Act eight-hour controlled-substance training records for every prescribing provider
• State PDMP query documentation log per controlled-substance prescription, with the rationale memorialized in the chart
• Patient pain-management agreement template for post-procedure opioid courses exceeding state-mandated initial-prescription duration
• ASC 855B enrollment file and Conditions for Coverage policy set (if applicable)
• Anesthesia services director designation and qualified-practitioner roster
• CLIA certificate (Waiver, Compliance, or Accreditation) matched to test complexity
• CLIA quality-control logs per device and per analyte, on the manufacturer's cadence
• CLIA personnel qualification records and competency assessment at six months and annually thereafter
• CLIA proficiency testing enrollment and results for non-waived testing
• In-office ancillary services exception self-attestation for in-office lab, imaging, and IMRT (where applicable)
• LCD documentation set for BCG, prostate biopsy, lithotripsy, urodynamic studies, and other LCD-affected services
• Modifier 25 documentation set tied to same-day E/M with procedure billing
• BCG handling and disposal documentation (BCG is a biohazard requiring specific waste protocols)
• Cystoscope reprocessing log with high-level disinfection competency
• Prostate biopsy specimen tracking from collection through pathology read with chain-of-custody
• Patient consent template for cystoscopy, prostate biopsy, and other procedures with documented risks discussion
• Incident-to billing self-attestation for any mid-level services billed under the physician's NPI
• Workers' comp authorization process for occupational urologic injuries (where applicable)

In urology audits we have responded to, the most common LCD documentation finding is for urodynamic studies — the chart shows the symptom complaint but does not document the specific clinical question the study was designed to answer or the integration of results into a treatment decision.

How audits actually work in urology

MAC TPE audits in urology routinely target:

1. Urodynamic studies medical necessity. LCDs require documentation of the clinical question, prior conservative treatment, and the role of the study in the treatment plan.
2. BCG instillation documentation. The diagnosis specificity (non-muscle-invasive bladder cancer with risk stratification), the maintenance schedule, and the consent.
3. Prostate biopsy frequency and indications. PSA elevation, abnormal DRE, prior atypical findings — the indication must be documented.
4. Modifier 25 on same-day E/M with cystoscopy or biopsy. Separately identifiable E/M documentation is the recurring finding.
5. Lithotripsy medical necessity and modality choice. The stone characterization, the prior conservative therapy, the rationale for ESWL vs URS.

RAC audits review prior payments with extrapolation. Urodynamic studies, BCG instillation, and IMRT for prostate cancer have all appeared on RAC issue lists in recent years.

UPIC audits often target self-referral patterns. The pattern that draws UPIC attention: high-volume in-office IMRT or in-office pathology coupled with documentation gaps in the Stark in-office ancillary services exception elements.

ASC inspections follow the Conditions for Coverage. Infection control (especially for prostate biopsy and stone procedures where instrumentation passes through colonized tissue), anesthesia, and medical staff credentialing are the recurring focus areas.

CLIA inspections by CMS or its deemed accreditor (COLA, The Joint Commission, CAP) examine personnel qualification, quality control, proficiency testing, and competency assessment. A CLIA inspection finding can put the certificate at risk and shut down in-office testing on a short timeline.

What urology practices most often miss in CLIA inspections is the personnel competency documentation at six months and annually. The general qualification is on file but the competency assessment specific to the device and the test menu is not.

Common gaps unique to urology

• Microscopic urinalysis run under a Certificate of Waiver. Microscopy is generally moderate complexity; the certificate must match.
• BCG instillation without contemporaneous consent documentation.
• Urodynamic studies documented as "completed" without the clinical-question and integration documentation the LCD requires.
• Prostate biopsy specimens with chain-of-custody gaps between collection and pathology read.
• Cystoscope reprocessing time gaps between procedure end and reprocessing start.
• Modifier 25 use on same-day E/M with cystoscopy without separately identifiable documentation.
• Incident-to billing for a new patient or a new problem (which fails the established-plan-of-care element).
• IMRT for prostate cancer with self-referral patterns and Stark in-office ancillary services exception documentation gaps.
• MATE Act training not on file for new or renewing DEA registrants.
• Post-procedure opioid prescriptions exceeding state-mandated initial-duration limits without documented rationale.

Maintenance cadence

• Daily: PDMP query and clinical rationale documentation for every controlled-substance prescription; cystoscope reprocessing log; in-office lab QC per analyte; ASC controlled-substance reconciliation
• Weekly: ASC infection-control round and sterilization log review; in-office lab proficiency testing tracker review
• Monthly: CLIA QC and proficiency-test review; CLIA personnel competency check; urodynamic studies LCD documentation audit
• Quarterly: ASC governance meeting; Stark in-office ancillary services exception self-attestation; modifier 25 documentation audit; BCG instillation chart audit
• Annually: CLIA certificate renewal; ASC accreditation reaccreditation planning at 180 days; DEA registration renewal tracking for every prescriber; MATE Act training verification; HIPAA risk analysis; MIPS/IRIS-equivalent measure selection for urology (AUA Quality Registry)
• At every staff onboard: DEA training; CLIA personnel competency assessment at hire and at six months; cystoscope reprocessing competency; HIPAA training

State preemption to watch

California — CDPH licensing for ASCs under H&S Code §1248; CURES mandatory query for every controlled-substance prescription; mandatory e-prescribing for all controlled substances since January 2022; CMIA layered on every disclosure; specific labeling for opioid prescriptions exceeding defined thresholds.

Texas — DSHS ASC licensure under 25 TAC Chapter 135; HB 300 layered; Texas Medical Board rules on chronic-pain prescribing apply when urology issues prolonged opioid courses.

New York — Article 28 Department of Health for ASC licensure; I-STOP PDMP query at every Schedule II–IV prescription; EPCS mandatory since March 2016; Office-Based Surgery accreditation requirements under PHL § 230-d for office surgery beyond local anesthesia.

Florida — ASC licensure under Chapter 395, F.S.; F.A.C. 59A-5 ASC rules; E-FORCSE query at first prescription and every 90 days; pain-clinic registration if the practice's prescribing volume crosses Florida's threshold definitions.

How d3rx fits

The d3rx specialty compliance binder maintains the urology module: DEA registration tracker per prescriber and per location, MATE Act training tracker, state PDMP query workflow, ASC enrollment file and Conditions for Coverage policy set, CLIA certificate tracker per test complexity, CLIA personnel competency log, LCD-tied documentation templates for urodynamic studies and BCG, the prostate biopsy chain-of-custody workflow, Stark in-office ancillary services exception self-attestation, and the modifier 25 documentation prompt set. It is a source-grounded administrative documentation aid. See the compliance binder overview or the audit defense surface for how the urology module integrates with the broader binder.

D3rx compliance guides are administrative documentation aids. They do not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.