WHITE PAPER

Controlled Substance Compliance Requirements – How Pharmacy Software Solves Critical Issues

Explore PrimeRx
Schedule A Demo

Table of Contents

Issue Overview

Staying Compliant in a Shifting Landscape: What Pharmacists Need to Know About the HALT Fentanyl Act

Compliance requirements are an integral part of the pharmacist’s role in controlled substance dispensing. Pharmacists understand the importance of good compliance, which typically includes extensive recordkeeping and documentation requirements, coding protocols, and inventory controls, among other mandates. So it likely came as no surprise when, in July 2025, the HALT Fentanyl Act became law with several provisions for enhanced pharmacy compliance. 

The new law, officially called the “Halt All Lethal Trafficking of Fentanyl Act,” permanently classifies fentanyl as a Schedule I drug under the Controlled Substances Act and imposes strict penalties, including mandatory prison sentences, for individuals convicted of illegal possession, distribution, manufacture, or sale of fentanyl-type products. For pharmacies, notes analysis by Graff & McGovern law firm, the new law brings the need to “align procedures with stricter DEA regulations on dispensing and reporting,” along with “greater accountability” for responsible persons. 

Also in 2025 came a proposed rule from the U.S. Drug Enforcement Administration (DEA) regarding new registration procedures for prescribing and dispensing controlled substance prescriptions via telemedicine. If finalized, the new rule would further amend the Controlled Substances Act and impose additional compliance requirements on pharmacies. 

As these two 2025 examples make clear, controlled substance compliance requirements are very much a front burner issue. And they are subject to continual change. There are many reasons for this, foremost of which is the dramatic increases in opioid overdose deaths throughout the United States over the last 25 years, and the surge in illicit substances including fentanyl that have found their way into the nation’s drug supply chain. 

Consider, for example, that of the 105,000 Americans who died from drug overdoses during 2023, 80,000 of those deaths, or 76%, involved opioids. Or, that the number of people who died from an opioid overdose in 2023 was nearly 10 times the number during 1999. 

The battle against drug abuse is being fought on many fronts, with all health care professionals mobilized to play a part. For pharmacists though, the fight is especially personal. As the healthcare professionals who interact most frequently and directly with patients, pharmacists are “the last line of defense” in protecting patients. And when it comes to proper and safe dispensing of controlled substances, this means strict and thorough compliance with all state and federal mandates. 

However, as the above examples indicate, controlled substance compliance protocols are continually changing, requiring pharmacists to stay informed, and take steps to ensure full compliance. Fortunately, technology has kept pace with solutions that facilitate pharmacy compliance. The PrimeRx pharmacy management system, for example, offers extensive capabilities including automatic state registry reporting, prescriber validation, inventory controls, electronic prescribing, and extensive recordkeeping, among many other solutions. With PrimeRx, pharmacies no longer need to dedicate precious staff time to compiling data and producing reports, or preparing for DEA audits and inspections. Instead, those tasks are automated and performed seamlessly within PrimeRx, with required documentation accessible via just a few keystrokes.  

Following is an overview of controlled substance pharmacy requirements, along with an overview of PrimeRx solutions that help facilitate compliance.  

Controlled Substance Compliance – Pharmacy Requirements and Technology-Based Solutions

Federal initiatives to control the distribution, sale, and use of drugs date back more than 100 years when, after years of debate, the U.S. Congress enacted the 1914 Harrison Narcotic Act. That law, as described in A Century of American Narcotic Policy, “required anyone who sold or distributed narcotics – importers, manufacturers, wholesale and retail druggists, and physicians – to register with the government and pay a small tax.” In addition, entities were required to “make a detailed record of the transaction, open to government inspection.” 

Interestingly, many of these compliance protocols are still in use today, 111 years after passage of the Harrison Narcotic legislation. 

Over the years, additional laws were enacted to expand the types of drugs subject to regulation, strengthen penalties, and try different approaches to addressing the nation’s growing substance abuse problem. A turning point came in 1970, with passage of the Comprehensive Drug Abuse Prevention and Control Act. According to the Congressional Research Service, that law replaced what had become a patchwork of federal laws with a “unified framework of federal controlled substance regulation.” Title II of that law is known as the Controlled Substance Act and 55 years later, remains the cornerstone of current drug policy. 

Following is an overview of that law, along with other relevant statutes including the Drug Supply Chain and Security Act (DSCA), that directly affect pharmacies. 

Controlled Substance Act

The Controlled Substances Act (CSA) was enacted by the U.S. Congress in 1970 and signed into law by President Richard Nixon. Among its many provisions, the law establishes federal requirements regarding both illicit and lawful controlled substances and authorizes the Drug Enforcement Agency (DEA) to enforce those requirements. 

The law divides drugs and other materials considered to be controlled substances into five “schedules.” According to the DEA, a controlled substance is placed in its respective schedule based on whether it has an accepted medical use, and its relative abuse potential and likelihood of causing dependence. A brief overview includes: 

  • Schedule I Controlled Substances: Schedule I substances have a high potential for abuse, and have no currently accepted medical use in treatment in the U.S. Examples cited by DEA include heroin, LSD, marijuana and ecstasy. In July 2025, fentanyl was classified as a Schedule I drug. 
  • Schedule II Controlled Substances: Schedule II substances have a high potential for abuse which may lead to severe psychological or physical dependence. Examples include morphine, opium, oxycodone, cocaine and amphetamine. 
  • Schedule III Controlled Substances. Schedule III substances have a potential for abuse less than substances in Schedules I or II, and abuse may lead to moderate or low physical dependence or high psychological dependence. Examples of Schedule III narcotics include Vicodin and Tylenol with codeine. Also included are buprenorphine products used to treat opioid addiction. 
  • Schedule IV Controlled Substances: Schedule IV substances have a low potential for abuse relative to substances in Schedule III. Examples of brand name Schedule IV substances include Darvon, Xanax, Klonopin, Valium, Ativan and Restoril. 
  • Schedule V Controlled Substances: Schedule V substances have a low potential for abuse relative to substances listed in Schedule IV and consist primarily of preparations containing limited quantities of certain narcotics. Schedule V examples include cough preparations such as Robitussin AC and Phenergan with Codeine. 

 Every pharmacy that “handles” controlled substances must be registered with the DEA and maintain strict accounting for all controlled substance transactions.  

The DEA maintains a “Pharmacist’s Manual” that details the pharmacy’s role in ensuring compliance with CSA provisions. The Manual was most recently updated in 2022. According to Pharmacy Audit Assistance Service (PAAS) National, required forms must now be completed and submitted online. Paper copies of forms including new pharmacy registrations, and pharmacy license renewals, will no longer be accepted. 

Other pharmacy-specific provisions of the law include significant recordkeeping requirements for “each controlled substance purchased, received, stored, distributed, dispensed, or otherwise disposed of.” These records include receipts, invoices, inventory records, dispensing records (prescriptions, Schedule V logbooks), and distribution records (returns to vendors, sales to other registrants, and records of transfers to other pharmacies). 

Other pharmacy-specific provisions of the law include significant recordkeeping requirements for “each controlled substance purchased, received, stored, distributed, dispensed, or otherwise disposed of.” These records include receipts, invoices, inventory records, dispensing records (prescriptions, Schedule V logbooks), and distribution records (returns to vendors, sales to other registrants, and records of transfers to other pharmacies). 

Pharmacies must also meet requirements for storing prescription records. All prescription records must be readily retrievable for DEA inspections. Electronic records must be maintained for two years “in an application that meets the requirements of the Controlled Substances Act.”  

Partial Filling Schedule II Controlled Substances.

Partial Filling Schedule II Controlled Substances. The Controlled Substances Act was modified in 2016 with passage of the Comprehensive Addiction and Recovery Act (CARA). According to the Federal Register, CARA includes a provision that allows “for the partial filling of prescriptions for schedule II controlled substances under certain conditions.” Those conditions include: 

  • Partial filling must not be prohibited by State law. 
  • The prescription must be written and filled in accordance with the Controlled Substances Act. 
  • The cumulative quantity dispensed from all partial fills must not exceed the total quantity prescribed. 
  • The remaining portion of a partially filled prescription must be filled within 30 days of the written date of the prescription. For emergency oral prescriptions, the remaining portion must be filled within 72 hours (3 days).  

 

Drug Enforcement Administration

The agency also reasoned that partial filling would “help to reduce the risk that the patient might develop physical dependence or an addiction,” or that a member of the household might gain access to the drugs. 

In announcing the new rule, the DEA explained that partial filling could reduce prescription drug costs for patients who do not need to continue on drug therapy. The agency also reasoned that partial filling would “help to reduce the risk that the patient might develop physical dependence or an addiction,” or that a member of the household might gain access to the drugs. 

The partial filling regulation took effect in August 2023. 

The partial filling regulation imposes several new compliance requirements on pharmacists. According to the DEA, those responsibilities include: 

  • The quantity dispensed must be notated on the face of a written prescription, in the written record of an emergency oral prescription, or in the record of an electronic prescription. 
  • When the prescription has been received electronically, the quantity dispensed, date dispensed, and name of the dispenser must be linked to the record of the electronic prescription. 
  • Pharmacies have the option to fulfill recordkeeping requirements for paper or emergency oral prescriptions using the pharmacy’s electronic recordkeeping system. 

PrimeRx Compliance Capabilities

PrimeRx helps pharmacies seamlessly track and document controlled substances as required by these federal statutes. System capabilities include: 

  • Record and document management. All prescriptions are safely stored within PrimeRx and easily accessible. This includes prescriptions that are received electronically, as well as those that arrive via hard copy or fax. Paper prescriptions are seamlessly digitized and added to a patient’s record. The system also stores all transaction records, including prescription details and patient payment information.  
  • Account management. Extensive records can be maintained for each patient. This includes the ability to record notes and updates following a patient interaction. 
  • Prescriber validation. Before a pharmacy can process a prescription for a controlled substance, the pharmacist must first validate the prescriber’s DEA authority. PrimeRx integrates with the Prescriber Validation Service (PVS) to seamlessly perform this credential check as a routine part of filling a controlled substance prescription. PVS provides real-time access to prescriber National Provider Identification (NPI) and DEA credentials, as well as state licensing information and authorization activity.  
  • Inventory management. PrimeRx helps pharmacies manage their controlled substance inventory holdings, as required by the Controlled Substances Act as well as the Drug Supply Chain Security Act (DSCSA). This includes the ability to track each medication based on unique elements including drug lot/expiration numbers, GTIN numbers, NDCs, and serial numbers. PrimeRx also supports the DSCSA requirement that all product identifiers be accessible in 2D barcode format. [See below for more information about the DSCSA.] 
  • Records/Reports. Users can generate reports based on specific needs, including sales by particular drug, fast/slow sellers, daily/weekly/monthly/annual sales, expired medications, rejected claims, prescriptions left in bins, controlled substances, overall inventory levels, and many other possibilities. 
  • Partial Fill Compliance. PrimeRx allows pharmacies to execute partial fill requests and satisfy all compliance requirements. When a pharmacist enters a prescription for a Class II medication, but with a dispensing quantity that is less than the order quantity, PrimeRx will prompt the user for required information. The user will be asked to identify the authorizing party as well as the reason for the partial fill, in accordance with DEA requirements. 

Declining reimbursements. Pharmacies – independent pharmacies in particular — are especially vulnerable to PBM control over drug reimbursement rates. When a pharmacy enters into a contract with a PBM, a reimbursement rate is agreed upon for brand drugs, generics and specialty pharmaceuticals. As reported by Forbes, the reimbursement rate for brand and specialty drugs is usually based on a straightforward formula (average wholesale price less some percentage, plus a dispensing fee). But the reimbursement rate for generics is more complicated 6 and is based on a fixed amount called the “maximum allowable cost (MAC). The MAC is the maximum amount that a plan will pay for a specific drug. However, the PBM can adjust the MAC without notifying the pharmacy, often resulting in reimbursement rates that do not cover purchase prices for the affected drugs.

PBM under-reimbursements is a front burner issue for most pharmacies. For many, declining reimbursements have had an existential effect, with NCPA reporting independent pharmacy closures at a rate of roughly one per day. Additional examples include:

• The New York Times found that with regard to the blood thinner Eliquis, pharmacists located in different states reported reimbursements as much as $100 less than what it cost them to purchase the medication from a wholesaler. The Times research also noted that “PBMs sometimes pay their own pharmacies more than what they pay local drugstores for the same medications.”

• Research by the Oregon State Pharmacy Association determined that roughly 75% of claims examined “were insufficient to cover the pharmacy labor and drug costs.”

• Research by the New York City Pharmacists Society found almost 90% of local independent pharmacies said they had “been forced to turn away patients” due to sub-par reimbursement rates.

• More than half of pharmacy owners are losing money on over 60% of the Part D prescriptions they fill, according to NCPA.

Drug Supply Chain Security Act (DSCSA)

The Drug Supply Chain Security Act (DSCSA) establishes a single, nationwide electronic process to verify the safety of prescription medications, share data, and report instances of suspect or illegitimate drugs. The new process, called a “track-and-trace-system,” replaces what had become a patchwork of state reporting requirements, and a series of disconnected, siloed technology systems. 

The law was enacted in 2013 and established a timeline for specific deliverables and benchmarks. The law’s final provisions, which require traceability at the unit level, took effect in late 2024. 

The DSCSA includes several provisions that directly affect pharmacists, who of course have a critical role in the nation’s drug supply chain. A topline listing of pharmacy-specific provisions as provided by the Food and Drug Administration (FDA) includes: 

  • Confirm the entities you do business with are licensed and registered. 
  • Receive, store and provide product tracing information. 
  • Investigate and properly handle suspect and illegitimate drugs. 

PrimeRx facilitates full compliance with DSCSA requirements.  Core PrimeRx capabilities and supplemented through direct integration with third-party technology provider InfiniTrak, an industry leader in developing DSCSA-specific track-and-trace solutions. 

Key InfiniTrak capabilities include: 

  • EPCIS-ready. The solution supports the DSCSA-mandated Electronic Product Code Information Services (EPCIS) data protocol. This avoids having to maintain access points with each wholesaler, supplier, etc. 
  • Easy capture of transaction data elements including drug lot/expiration numbers, GTIN numbers, NDCs, and serial numbers. 
  • Real-time verification of trading partner licensing authority. 
  • Workflows that support the identification and verification of suspicious products, product quarantines, and guidance for notifying the Food and Drug Administration. 
  • Ability to search for products by date, supplier, description, NDC, invoice number, lot, status, and type. 
  • Ability to coordinate global location numbers (GLN) for interoperability. 
  • Ability to store – and easily access – DSCSA compliance reviews and inspection documentation as needed. 

PrimeRx Compliance Capabilities

White tablets spilling from a pill bottle on a blue background.
  • 2D Barcodes: The DSCSA requires all product identifiers to be available in 2D format. PrimeRx supports this requirement and allows users to capture data elements that include: 
    • Drug Lot 
    • Expiration Date 
    • Serial Numbers 
    • Global Trade Item Number (GTIN) 
    • National Drug Code. 
  • Recordkeeping. PrimeRx offers extensive recordkeeping capabilities that allow pharmacy managers to efficiently store documentation and information about all aspects of pharmacy operations. Pharmacies can easily satisfy DSCSA requirements that records be maintained for a minimum of six years. 
  • Report generation.  In addition to storing this information, PrimeRx allows the pharmacy manager to generate detailed reports on a wide range of patient, inventory and operations topics. This includes reports to satisfy FDA information requests regarding specific transactions, or drug investigations. Should a pharmacy determine that a drug is illegitimate, PrimeRx can facilitate compliance with all FDA reporting requirements. 
  • Compounding. Compound medications are included in DSCSA track-and-trace requirements. PrimeRx facilitates compliance with capabilities that include the ability to identify the lot number for each ingredient used in a medication. Pharmacies can also trace all medications tied to a particular lot and provide required transaction details. 
Schedule A Demo

Electronic Prescription Processing

Electronic prescribing of controlled substances (EPCS) is legal in all 50 U.S. states. And according to the 2024 Surescripts Annual Impact Report, more than 310 million prescriptions for controlled substances were issued electronically during 2024. This represents a dramatic increase from the 45 million controlled substance electronic prescriptions issued during 2016, which represented just 11 percent of total volume.

E-prescribing is an important tool in the war against opioid addiction, as it provides a safe and secure workflow process for prescribing potentially dangerous drugs. Among its many benefits, electronic transmission reduces instances of prescription theft, forgery and diversion, while simultaneously creating an electronic “paper trail” that can help identify patients potentially at risk of over-use, and prescribers who generate a high number of controlled substance prescriptions.

Success in electronic prescribing is contingent on utilization at both the prescriber and pharmacy levels. With regard to pharmacies, SureScripts reports more than 96 percent of pharmacies are prepared to process controlled substance e-prescriptions, but just 83 percent of prescribers.

Surescripts also notes that 35 states have enacted legislation to mandate the use of e-prescribing for “all prescriptions, all controlled substance prescriptions, or a subset of controlled substance prescriptions, typically those for opioids.” At the federal level, the SUPPORT for Patients and Communities Act mandates the use of EPCS for all controlled substances under Medicare Part D.

Pharmacies are required to register with the Drug Enforcement Administration and successfully pass a compliance audit as a condition of participating in EPCS. Once DEA approval is attained, a pharmacy is eligible to enroll in Surescripts EPCS services.

Pharmacies can integrate directly with the Surescripts EPCS solution from within the PrimeRx operating system. This allows a pharmacy to process electronic prescriptions without having to toggle between multiple screens or systems. Prescriptions automatically enter the pharmacy dispensing workflow, with all patient and pharmacy records seamlessly updated.

State Compliance – Prescription Drug Monitoring Programs (PDMPs)

Prescription Drug Monitoring Programs (PDMPs) were initially developed in 2003 as a way to electronically collect data on controlled substance (Schedules II-IV) prescribing and dispensing. As described by Pharmacy Times, pharmacies provide data on prescriptions dispensed, along with information including the name of the prescribing physician and their DEA number, the date the prescription was written, and where and when the prescription was dispensed.

Health-care providers including physicians, nurses and pharmacists may access those statewide databases for a range of purposes including patient monitoring, research, and in some instances, law enforcement. Pharmacists, for example, can identify patients engaged in “doctor shopping,” whereby prescriptions are obtained from multiple physicians, track use of medications that precede a patient’s relationship with a particular pharmacy, and detect possible fraud.

Every state maintains a PDMP that requires pharmacies to submit regular – in some cases daily – reports about controlled substance prescription activity. Even if a pharmacy fills no prescriptions for a controlled substance, a zero-submission form may still be required.

Pharmacies are required to provide data on prescriptions dispensed including the name of the prescribing physician and their DEA number, the date the prescription was written, and where and when the prescription was dispensed.

To ensure consistency across each state’s PDMP, national standards were issued in 2024, which now serve as the foundation of each state’s prescription drug monitoring system. PrimeRx automates the PDMP reporting process, allowing pharmacies to seamlessly comply with this important requirement. The system automatically prompts a pharmacist to provide PDMP-required data each time a prescription is filled for a controlled substance. The pharmacist responds to the prompts, usually by choosing the correct information from

a drop-down menu. Once all information is provided, the report is saved and transmitted to the appropriate state agency.

Conclusion

As this overview makes clear, pharmacists have an integral role in ensuring the safe and legitimate distribution of controlled substances. This includes accurate, thorough, and timely compliance with all federal and state requirements. But technology-based solutions can help! By relying on technology to perform these critical – yet time consuming – tasks, pharmacists can have peace of mind that compliance obligations have been met, while freeing up time to spend on other pertinent pharmacy tasks.

Explore PrimeRx
Schedule A Demo

Talk to an Expert!

With PrimeRx, pharmacy workflow tasks can be automated, leaving more time for pharmacists to engage with patients and focus on other pharmacy matters.

Schedule a Demo

References