Opioid regulation and prescription laws in the United States run on two tracks that overlap at every step. Federal law, built on the Controlled Substances Act of 1970, places most prescription opioids in Schedule II and sets the baseline rules for who can prescribe them, how prescriptions must be written and transmitted, how pharmacies dispense them, and how leftovers get destroyed. State law then layers on days-supply caps, mandatory database checks, and licensing rules that a prescriber has to follow on top of the federal floor.
Why Opioids Sit in Schedule II
The Controlled Substances Act, codified beginning at 21 U.S.C. § 801, gives the federal government authority to regulate any substance that poses a public health risk because of its potential for addiction.1Office of the Law Revision Counsel. 21 USC 801 – Congressional Findings and Declarations: Controlled Substances The Drug Enforcement Administration’s Diversion Control Division handles day-to-day enforcement.2Drug Enforcement Administration. Diversion Control Division
Under 21 U.S.C. § 812, drugs are sorted into five schedules. Schedule I is reserved for substances the government considers to have no accepted medical use. Schedules II through V contain medications that doctors can legally prescribe, with progressively less restriction as the schedule number increases.3Office of the Law Revision Counsel. 21 USC 812 – Schedules of Controlled Substances
Most powerful opioid painkillers land in Schedule II, including oxycodone, hydrocodone, fentanyl, and methadone when used for pain. That classification signals a high potential for abuse that can lead to severe psychological or physical dependence, and it triggers the strictest prescribing, dispensing, and record-keeping requirements in the system. Buprenorphine, used mainly for opioid use disorder treatment, sits one step down in Schedule III.
What a Prescriber Can Write
Days-Supply Caps for Acute Pain
A majority of states now limit how many days’ worth of opioids a doctor can prescribe for a new episode of acute pain. These caps typically range from three to seven days, depending on the jurisdiction. The goal is fewer leftover pills sitting in medicine cabinets. Ongoing pain management and chronic conditions are generally handled differently, with longer supplies available when documented medical need supports them.
No Refills, But Multiple Prescriptions Are Allowed
Federal regulations flatly prohibit refills on Schedule II prescriptions. A patient who needs ongoing therapy must get a new prescription for every fill. Doctors can, however, issue multiple prescriptions at one visit covering up to a 90-day supply. Each prescription after the first must include written instructions specifying the earliest date the pharmacy may fill it.4eCFR. 21 CFR 1306.12 – Refilling Prescriptions; Issuance of Multiple Prescriptions
Partial Fills
The Comprehensive Addiction and Recovery Act of 2016 added 21 U.S.C. § 829(f), which allows pharmacists to partially fill a Schedule II prescription when the patient or prescriber requests it.5Office of the Law Revision Counsel. 21 USC 829 – Prescriptions A patient recovering from minor surgery might ask for only a few days’ worth instead of the full quantity written. Any remaining portion must be dispensed within 30 days of the original prescription date, and the total across all partial fills cannot exceed the amount originally prescribed.6eCFR. 21 CFR 1306.13 – Partial Filling of Prescriptions
Dosage Thresholds and Naloxone
Prescribers measure opioid strength using Morphine Milligram Equivalents (MME), a standardized metric that allows comparison across different opioid medications. For years, the 2016 CDC guideline’s thresholds of 50 and 90 MME per day served as widely adopted benchmarks. The 2022 CDC Clinical Practice Guideline moved away from rigid numerical cutoffs, emphasizing instead that clinicians should prescribe the lowest effective dosage and carefully weigh individual benefits and risks before increasing.7Centers for Disease Control and Prevention. CDC Clinical Practice Guideline for Prescribing Opioids for Pain Many state laws and insurance policies still reference the older thresholds.
The FDA now requires opioid medication labels to recommend that prescribers discuss naloxone availability with all patients receiving opioid painkillers, and to consider prescribing the overdose-reversal drug to those at heightened risk. That includes patients also taking benzodiazepines, those with a history of opioid use disorder, or anyone who has previously experienced an overdose.8U.S. Food and Drug Administration. New Recommendations for Naloxone Several states go further and require a naloxone prescription outright when the opioid dosage exceeds a specified MME level.
How the Prescription Reaches the Pharmacy
Paper prescription pads are largely a thing of the past for controlled substances. The SUPPORT for Patients and Communities Act mandated that most controlled substance prescriptions under Medicare Part D be transmitted electronically, a requirement that took effect beginning in 2021.9Centers for Medicare & Medicaid Services. CMS Electronic Prescribing for Controlled Substances (EPCS) Program Many states have extended similar requirements to all controlled substance prescriptions, not just those paid by Medicare.
The security behind Electronic Prescribing for Controlled Substances (EPCS) is more rigorous than standard e-prescribing. Before a prescriber can send a single electronic order for a controlled substance, they must complete identity proofing through a federally approved credential service provider meeting NIST standards. Every time the prescriber signs a controlled substance prescription, two-factor authentication is required, drawing from at least two of three categories: something you know (a password), something you have (a physical security token), or something you are (a biometric like a fingerprint).10Drug Enforcement Administration. Electronic Prescriptions for Controlled Substances (EPCS) Q&A If a security incident occurs, the prescriber must report it to the DEA within one business day.
The Database Check Before Prescribing
Every state operates a Prescription Drug Monitoring Program (PDMP), an electronic database that tracks controlled substance prescriptions dispensed within its jurisdiction. These systems collect the patient’s name, the drug, the dosage, and the quantity dispensed for every controlled substance transaction. The majority of states require prescribers to check the PDMP before writing an opioid prescription, though the specific triggers vary. Some require a check for every controlled substance prescription; others require it only for initial prescriptions or when clinical suspicion arises.
Pharmacies must upload dispensing data to the PDMP, with most states requiring submission within one business day. A minority of states allow slightly longer windows.11PDMP Training and Technical Assistance Center. Overview of Prescription Drug Monitoring Programs The near-real-time nature of this data makes it possible to identify patients receiving overlapping prescriptions from multiple providers or pharmacies.
State PDMPs increasingly share data across jurisdictions, which limits the ability of patients to cross state lines to fill prescriptions their home-state system would flag. Law enforcement can typically access PDMP records under specific circumstances defined by state law, such as during an active investigation with proper authorization.
What Pharmacists Must Check Before Filling
A pharmacist is not just a gatekeeper who checks that the paperwork is in order. Under 21 C.F.R. § 1306.04, the pharmacist shares a “corresponding responsibility” with the prescriber to ensure that every controlled substance prescription was issued for a legitimate medical purpose. A pharmacist who fills a suspicious prescription without investigation faces the same penalties as the person who wrote it, including potential criminal prosecution and loss of their license.12eCFR. 21 CFR 1306.04 – Purpose of Issue of Prescription
No single red flag automatically invalidates a prescription, but each one calls for professional judgment before the pharmacist can proceed. Common warning signs include:
- Multiple patients arriving together with prescriptions for the same controlled substances from the same prescriber.
- Prescriptions for an opioid, a benzodiazepine, and a muscle relaxant filled together, a combination heavily associated with misuse.
- A patient insisting on paying cash for a controlled substance when they carry insurance that would normally cover it.
- A patient or prescriber located an unreasonable distance from the pharmacy with no clear explanation.
- Consistently running out of medication before the next fill date, or claiming lost prescriptions.
- Presenting multiple prescriptions but wanting only the controlled substance dispensed.
Many jurisdictions also require the pharmacist to record a government-issued ID number in the patient profile before dispensing a Schedule II substance. Pharmacists are generally required to offer patient counseling at the point of sale, covering proper use, storage, the risk of dependency, and the warning signs of respiratory depression.
Prescribing Opioids by Telemedicine
The Ryan Haight Online Pharmacy Consumer Protection Act normally requires at least one in-person medical evaluation before a prescriber can issue a controlled substance prescription by telemedicine. The rule exists to prevent pill mills from operating entirely online, and violating it carries the same penalties as any other unauthorized distribution of controlled substances.
Since the COVID-19 pandemic, the DEA has repeatedly extended temporary flexibilities that waive the in-person requirement. As of early 2026, the fourth temporary extension allows DEA-registered practitioners to prescribe Schedule II through V controlled substances by telemedicine without a prior in-person visit through December 31, 2026.13Federal Register. Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications The prescriber must still issue the prescription for a legitimate medical purpose, use a real-time audio-visual telecommunications system, and hold a valid DEA registration.
Practitioners prescribing across state lines face additional requirements. The Controlled Substances Act generally requires a separate DEA registration in each state where a patient is located at the time of prescribing, regardless of whether the visit happens in person or by video.14DEA Diversion Control Division. Telemedicine and State Regulation Exceptions exist for medical emergencies requiring immediate intervention and for certain VA practitioners treating veterans. Practitioners must also hold a valid medical license in the patient’s state.
Treatment for Opioid Use Disorder
Methadone Through Opioid Treatment Programs
Methadone for addiction treatment follows completely different rules than methadone for pain. When used to treat opioid use disorder, methadone can only be dispensed through federally certified Opioid Treatment Programs (OTPs). These clinics must be accredited and comply with the standards in 42 CFR Part 8.15eCFR. 42 CFR 8.12 – Federal Opioid Use Disorder Treatment Standards A patient’s first-day methadone dose generally cannot exceed 50 milligrams unless the treating practitioner documents a clinical reason for going higher, such as a verified transfer from another program at a higher dose. Methadone for OUD must be administered or dispensed in oral form only.
Buprenorphine After the X-Waiver
Until 2023, prescribers who wanted to treat opioid use disorder with buprenorphine needed a special waiver (commonly called an X-waiver) and were subject to caps on how many patients they could treat. The Mainstreaming Addiction Treatment Act, part of the Consolidated Appropriations Act of 2023, eliminated that framework.16Substance Abuse and Mental Health Services Administration. Waiver Elimination (MAT Act) Any practitioner with a standard DEA registration who is authorized by their state to prescribe Schedule III medications can now prescribe buprenorphine for opioid use disorder with no patient caps and no separate waiver.
Confidentiality of Treatment Records
Patient records from substance use disorder treatment programs receive an extra layer of federal privacy protection under 42 CFR Part 2, beyond what HIPAA provides. These rules restrict when treatment records can be disclosed and generally require patient consent before information can be shared, even with other healthcare providers.17Substance Abuse and Mental Health Services Administration. Statutes, Regulations, and Guidelines
Getting Rid of Leftover Opioids
Federal regulations under 21 CFR Part 1317 give patients three authorized ways to get rid of unused Schedule II through V medications.18eCFR. 21 CFR Part 1317 – Disposal
- Law enforcement take-back events, where at least one officer maintains control of the collected substances from the moment of collection through secure destruction.
- Mail-back programs, in which authorized collectors or law enforcement provide prepaid, preaddressed envelopes. The packaging must be nondescript, tamper-evident, and water-resistant, and patients do not have to provide any personal information.
- Permanent collection receptacles at retail pharmacies with on-site pharmacies, hospitals, and law enforcement offices. These bins must be securely fastened to a permanent structure and designed so that contents can be added but not removed.
Registration and Training for Prescribers
No one can legally prescribe, administer, or dispense controlled substances without a DEA registration. The application results in a unique DEA number tied to the practitioner, and the current fee is $888 for a three-year registration cycle.19eCFR. 21 CFR Part 1301 – Registration of Manufacturers, Distributors, and Dispensers of Controlled Substances Hospitals, retail pharmacies, and teaching institutions each register separately for their dispensing activities.
Since June 2023, every practitioner applying for a new or renewed DEA registration must attest to completing at least eight hours of training on treating opioid and other substance use disorders. This requirement comes from the MATE Act, part of the Consolidated Appropriations Act of 2023.20Drug Enforcement Administration. Opioid Use Disorder – MATE Act Q&A Alternatives to the eight-hour course include board certification in addiction medicine or addiction psychiatry, or recent graduation from a medical program that included an equivalent substance use disorder curriculum.21Substance Abuse and Mental Health Services Administration. Training Requirements (MATE Act) Resources
Registrants must maintain records of every controlled substance received, dispensed, or distributed for at least two years and make them available for DEA inspection on demand.22eCFR. 21 CFR Part 1304 – Records and Reports of Registrants When a registrant discovers that controlled substances have been stolen or significantly lost, the rules impose a two-step reporting obligation: a written preliminary notification to the local DEA field office within one business day, followed by a complete DEA Form 106 through the DEA’s secure system within 45 calendar days.23eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners What counts as a “significant” loss is left to the registrant’s judgment, based on factors like the quantity missing relative to the type of business, which substances disappeared, and whether a pattern of losses exists.
Penalties for Getting It Wrong
Federal penalties for violating the Controlled Substances Act are severe. Under 21 U.S.C. § 841, distributing a controlled substance when death or serious bodily injury results carries a mandatory minimum sentence of twenty years in prison, with a maximum of life.24Office of the Law Revision Counsel. 21 USC 841 – Prohibited Acts A
Even without criminal intent, administrative violations carry steep civil fines. Under 21 U.S.C. § 842, the general civil penalty for violating controlled substance regulations is up to $25,000 per violation. Opioid manufacturers or distributors who fail to report suspicious orders or maintain effective controls against diversion face penalties of up to $100,000 per violation.25Office of the Law Revision Counsel. 21 USC 842 – Prohibited Acts B Alongside the fines, the DEA can suspend or revoke a practitioner’s registration, which ends the ability to prescribe controlled substances entirely.