Registration with the federal authority and the state board, the schedules and what each one restricts, valid prescription requirements and the corresponding responsibility to refuse, electronic prescribing, prescription monitoring programs, security and recordkeeping, compounding limits, and diversion investigations.
Federal law requires a separate registration for each principal place of business where controlled substances are manufactured, distributed or dispensed, and a separate registration for each independent group of activities. A practitioner registration depends on state authority to dispense: when the state license ends, the federal authority it rests on ends with it. Registrations expire on assigned cycles and must be modified when the address or the schedules handled change.
Congress set five schedules and gave the Attorney General authority to add, remove or move substances after a scientific and medical evaluation. Each placement rests on findings about abuse potential, accepted medical use and the dependence a substance produces. The schedule then determines the ordering, prescribing, refill, storage and recordkeeping rules that apply, and a change in schedule changes all of them at once.
Schedule II prescriptions may not be refilled and their partial fills run on tight deadlines measured from the prescription or the first fill. Schedules III and IV permit up to five refills within six months of issue, and refill information may be transferred between pharmacies once unless they share a real-time database. Every partial fill and refill generates a record entry, and the total dispensed can never exceed the quantity prescribed.
An administrative inspection begins with a notice of inspection and a decision whether to consent; without consent a warrant is generally required, subject to stated exceptions. An order to show cause opens a case to deny, suspend or revoke a registration and must allow at least thirty days before appearance, with a hearing request and answer due in that period. Where imminent danger is found, the registration may be suspended immediately.
A registrant must notify the field division office in writing of the theft or significant loss of any controlled substance within one business day of discovering it, and must file a complete and accurate report through the agency's secure network application within forty-five days of discovery. Whether a loss is significant is a judgment the registrant makes first, guided by stated factors including quantity, substance, attribution to individuals and any pattern of losses.
The rule that makes a prescription effective also places a corresponding responsibility on the pharmacist who fills it. That duty is triggered by circumstances that would give a reasonable pharmacist cause for concern, and it is discharged only by resolving the concern before dispensing. Documenting a doubt and filling anyway does not satisfy it, and repeated failures are the usual factual basis for an action against a pharmacy's registration.
A registrant must provide effective controls against diversion, keep an initial and then a biennial inventory of all stocks on hand, and maintain complete and accurate records of every receipt and disposition. Records are kept at the registered location and available for inspection for at least two years. Schedule II records are maintained separately from all others, and Schedule III to V records must be readily retrievable.
Prescription monitoring programs are creatures of state law, so the substances covered, the reporting deadline and the query obligation vary. The common structure is stable: dispensers transmit defined data elements after each dispensing on a short deadline, prescribers must review a patient's history before an initial prescription and at stated intervals afterwards, and access to the data is restricted by statute to named categories of user with an audited trail.
Compounding by a licensed pharmacist or physician is exempt from new drug approval, adequate directions labeling and good manufacturing practice only if statutory conditions hold, including a prescription for an identified patient and limits on copying commercially available drugs. An outsourcing facility may compound without patient-specific prescriptions but must register, follow manufacturing practice rules and report adverse events.
An electronic controlled substance prescription is lawful only where the practitioner has been identity proofed, holds a credential issued to that individual, and signs using two of three authentication factors. The application must meet defined processing, transmission and audit requirements, and the receiving pharmacy application must meet its own. Records must be archived in the form received, and an audit trail must capture events that could indicate a security problem.
A prescription for a controlled substance is effective only when it is issued for a legitimate medical purpose by an individual practitioner acting in the usual course of professional practice. A document that fails that test is not a prescription within the meaning of the law, and the person who knowingly fills it is subject to the penalties that apply to unlawful distribution. Formal content requirements sit on top of that substantive test and cannot cure a failure of it.
