DEA enforcement against pain practices intensified through 2025 and into 2026. The practices that survive scrutiny share one thing: a prescribing program that was documented, consistent, and already running before the auditor arrived.
Key Takeaways
- Every state now operates a PDMP, and most impose mandatory prescriber registration and pre-prescribing query requirements. Requirements vary substantially by state and continue to change – check your state medical board and pharmacy board for current rules.
- DEA enforcement actions against pain practitioners have included revocations, 20-year bars from DEA registration, and criminal referrals. The common thread is a pattern of prescribing that could not be supported by clinical documentation.
- A defensible prescribing program requires written policies, consistent patient agreements, documented risk stratification, PDMP query records, and regular chart audits – before a complaint, not in response to one.
- Federal telemedicine prescribing flexibilities for controlled substances have been extended through 2026 under a temporary rule, but the underlying in-person prescribing requirements for Schedule II substances remain in effect absent a qualifying exception.
Pain management sits at the intersection of two of the most heavily scrutinized areas in federal healthcare enforcement: controlled substance prescribing and procedure billing. The DEA, the HHS Office of Inspector General, and U.S. Attorneys’ offices have all treated the specialty as a priority enforcement area for more than a decade, and the trend has not softened. A pain management physician with an active DEA registration and an active opioid prescribing practice is, in the eyes of federal enforcement, a higher-risk registrant than almost any other prescriber category. That is not a reason to stop prescribing. It is a reason to operate a prescribing program that can be defended in writing before anyone asks.
The enforcement record through 2025 and 2026 is not ambiguous about what draws scrutiny. OIG and DOJ enforcement actions against pain practices have included settlements in the tens of millions of dollars for urine drug testing fraud and false claims, criminal prosecutions for prescribing outside the course of professional practice, and DEA actions including 20-year bars from registration for practitioners found to have prescribed opioids unlawfully. In most cases, the core problem was not that the practitioner was uninformed about the law. It was that prescribing patterns existed in the absence of consistent documentation, risk assessment, and program structure – leaving no record that could distinguish legitimate pain management from what prosecutors characterized as pill-mill operation.
This article addresses the business and compliance program structure. It is not clinical guidance. Clinical decisions belong to the treating physician and their clinical judgment, and state law governing controlled substance prescribing varies substantially and changes. Consult counsel and your state medical board for requirements specific to your practice. With that said: compliance program design is a management function, and most pain practices underinvest in it relative to the risk it is managing.
DEA Registration and Basic Requirements
Every practitioner who prescribes, dispenses, or administers controlled substances must hold a current DEA registration at each registered location. DEA registration is Schedule-specific, and a registrant’s authority is limited to the Schedules listed. Maintaining a current registration means renewing before expiration, notifying DEA of address changes, and understanding what constitutes a change in registration status in your state. Many practitioners treat DEA registration as a license renewal administrative task rather than as an active compliance obligation. It is both.
The DEA’s authority to revoke, suspend, or impose conditions on a registration is broad and does not require a criminal conviction. Administrative proceedings based on prescribing patterns, record-keeping deficiencies, or failure to maintain effective controls against diversion can result in registration action independently of any criminal matter. Practices that have not reviewed their DEA obligations against the current Code of Federal Regulations, specifically 21 CFR Part 1301 through 1307, in the past two years should do so – or have counsel do so on their behalf.
PDMP: What the Requirement Actually Is in Your State
Every state now operates a Prescription Drug Monitoring Program. Beyond that basic fact, the specifics are highly variable and rapidly changing. Some states require prescribers to register with the PDMP as a condition of controlled substance prescribing authority. Some require a query before every Schedule II prescription. Some require a query before every controlled substance prescription, or before the first prescription for a new patient, or before any opioid prescription regardless of schedule. The interval requirements, the documentation requirements for query results, and the mandatory interoperability with neighboring states’ PDMPs all vary.
The right practice response is not to assume you know what your state requires. Pull the current statute and the current board guidance – from the state medical board, the state pharmacy board, and the state controlled substance regulatory body, because they do not always say the same thing – and confirm your workflow against the current text. Many practices built a PDMP workflow based on requirements that were in effect two or three years ago and have not revisited it since. If a DEA or state investigation reaches your practice, your PDMP query records are among the first things reviewed. An inconsistent query record – queries missing, queries performed after the prescription was written, queries performed by someone other than the prescribing physician without documented authority – will be read as a program deficiency regardless of how good your clinical judgment was on each case.
The PDMP query is not the compliance program. It is one documented step inside a compliance program. Practices that check the box on queries and call that their opioid compliance program have built a partial defense at best.
Building a Documented Prescribing Program
A defensible prescribing program has several components, all of which need to exist in writing and be consistently applied. Written policies for patient selection, risk stratification, treatment agreements, and what triggers re-evaluation or discontinuation. A standard patient agreement that patients sign, that explains expectations on testing, prescribing from a single prescriber, prescription loss and early refill policy, and what constitutes cause for discontinuation. A risk assessment tool – the ORT, DIRE, or a validated equivalent – administered at intake and at defined intervals, with results documented and linked to prescribing decisions. A PDMP query workflow that specifies who queries, when, how the results are documented, and what queries in the patient’s history trigger escalation. And a defined process for handling patients who present with aberrant drug-related behavior – one that is applied consistently, documented regardless of outcome, and reviewed periodically by the practice’s compliance function.
None of this is exotic. The specialty societies, including ASIPP, have published prescribing guidelines that outline program components. The question for most practices is not whether they know these elements exist. It is whether they have been reduced to written policies, whether staff have been trained on them, and whether a chart audit would show consistent application. A prescribing program that lives in the physicians’ heads is not a compliance program. It is a set of good intentions that provides no institutional defense when an individual prescribing decision is questioned.
Chart Audits and Ongoing Monitoring
Internal auditing is the mechanism that converts a written program into an operating program. A quarterly sample of controlled substance prescribing charts – reviewed against the written policies, the PDMP query record, the treatment agreement, the risk assessment documentation, and the clinical justification – will surface gaps before they become patterns. When gaps are found, they get corrected and the correction is documented. That record of self-correction and improvement is a meaningful compliance program artifact that has value in any subsequent regulatory review.
The audit does not require a law firm or a compliance officer. It requires a protocol, a qualified reviewer – typically a physician or a well-trained compliance coordinator – and a documentation process. If your practice does not currently have a chart audit schedule for controlled substance prescribing, establishing one is the highest-return compliance investment available to most pain practices.
From the Field
A two-physician pain management practice in the South had experienced a DEA inspection that resulted in a letter citing record-keeping deficiencies in the controlled substance log. No formal action was taken, but the physicians recognized they had no written policies, no documented patient agreement program, and inconsistent PDMP query records. Rather than hand the practice a compliance binder, our fractional COO engagement built the written policies collaboratively with the physicians, trained the clinical coordinator on the PDMP query workflow and documentation protocol, created a standard patient agreement template and implemented it for all new patients and controlled substance renewals, and established a quarterly chart audit schedule. A year after the inspection letter, the practice completed a voluntary mock audit using the same framework. Every chart reviewed passed on all criteria. The physicians described the outcome not as regulatory protection but as a practice they felt they could defend to anyone who asked.
The Role of Outside Help
Controlled substance compliance is an area where both consulting and fractional executive engagement have clear roles, and where the stakes argue for being thoughtful about which you buy. A consultant with healthcare compliance expertise can audit your current program, produce a gap analysis, and design the written program components. If your practice has a clinical director or administrator who can implement the resulting policies, train staff, and establish the audit cadence, that is often sufficient and is the more economical choice for many practices. We will say so when that is the situation.
Practices that lack the internal capacity to implement and sustain a compliance program benefit from having someone work inside the practice to build the workflow, train the staff on execution rather than just the policy, and establish the monitoring cadence before stepping back. Note that “fractional executive” is an unregulated label; some firms use it to describe arrangements that are, in practice, consulting with a retainer. The test is whether the person will work inside your systems with your staff. What neither consulting nor fractional engagement can substitute for is counsel review of your specific state requirements. Use a business operator to build and run the program. Use an attorney to make sure it is designed against the right legal requirements.
Sources
- HHS Office of Inspector General, Combating the Opioid Epidemic — https://oig.hhs.gov/reports/featured/combating-the-opioid-epidemic/
- DEA / HHS, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications (Federal Register) — https://www.federalregister.gov/documents/2025/12/31/2025-24123/fourth-temporary-extension-of-covid-19-telemedicine-flexibilities-for-prescription-of-controlled
- U.S. Department of Justice, Pain Management Clinics Settle Medicare Civil Fraud Claims — https://www.justice.gov/usao-edva/pr/pain-management-clinics-settle-medicare-civil-fraud-claims
- CMS, Calendar Year 2026 Medicare Physician Fee Schedule Final Rule (CMS-1832-F) — https://www.cms.gov/newsroom/fact-sheets/calendar-year-cy-2026-medicare-physician-fee-schedule-final-rule-cms-1832-f
More in the Pain Management Series
- Where You Perform the Procedure Is Almost As Important As What You Bill — the site-of-service decision that drives more revenue per procedure than almost any other choice an interventional practice makes.
- Prior Authorization Is Not Going Away. Build the System That Handles It. — the prior authorization process that determines whether your scheduled procedures get paid.
- Ancillary Services Can Strengthen Your Practice – or Sink It — the ancillary service line decisions that add revenue when designed correctly and create liability when they are not.
- A Full Schedule Is Not a Productive Schedule. Design the Difference. — the staffing and scheduling design that separates a productive procedure-based practice from a busy one.