Guide

Buprenorphine after the X-waiver: what remains required

Summary

After the X-waiver ended in 2023, any clinician with Schedule III prescribing authority and a current DEA registration may prescribe buprenorphine for opioid use disorder — no waiver, no patient caps. What remains is a one-time training attestation tied to your DEA registration, your state controlled-substance license and PDMP check, an appropriate assessment and diagnosis, and the ordinary telehealth and confidentiality rules. As of July 2026, confirm the current DEA telemedicine flexibility before starting a patient without an in-person visit.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

What buprenorphine prescribing requires now

Since the Consolidated Appropriations Act, 2023 eliminated the DATA-2000 X-waiver, prescribing buprenorphine for opioid use disorder no longer requires a special waiver or an X on your DEA number, and the old patient caps are gone 1. Any practitioner with Schedule III prescribing authority and a current DEA registration may prescribe it. What replaced the waiver is lighter but real: a one-time training attestation, and all the controlled-substance obligations that already applied 2.

In practice, the change means a solo psychiatrist, PMHNP, or primary care clinician can offer office-based opioid treatment without building a separate program. The requirements that remain are the ones any controlled-substance prescriber carries — a valid DEA registration, a state controlled-substance license where your state issues one, PDMP checks, sound assessment and documentation, and confidentiality rules — plus the single new training attestation described below. None of it recreates the waiver's caseload limits.

The one-time training attestation

The one requirement that is genuinely new applies to almost every DEA registrant, not just buprenorphine prescribers: a one-time attestation of eight hours of training on treating and managing patients with substance use disorders, satisfied at your next DEA registration or renewal 1. Prior board certification or qualifying training can count, and once you attest you do not repeat it. It is a checkbox on the DEA application, not a waiver to obtain 2.

This training requirement — created by the MATE Act — is often confused with the vanished X-waiver, but it is a separate, lighter thing: it does not cap patients, does not require a special registration, and is not specific to buprenorphine. If you have already attested at a prior renewal, you are done. Keep a record of what satisfied the attestation with your credentialing file, since payers and auditors may ask how your DEA registration meets the current training expectation.

Still required: DEA registration, state licensure, EPCS, and the PDMP check

The controlled-substance basics did not change. You need a current individual DEA registration in the state where you prescribe, plus a separate state controlled-substance registration — a state CSR — wherever your state requires one on top of the federal license 2. Most states also require electronic prescribing of controlled substances, so your e-prescribing setup must support EPCS with its identity-proofing and two-factor requirements. And query the PDMP as your state directs 3.

Each of these has its own setup path. A DEA registration is obtained or renewed through the DEA Diversion Control Division; a state CSR runs through your state's board or pharmacy agency; EPCS requires an identity-proofed credential and a two-factor token before you can transmit controlled-substance prescriptions electronically. Build the pdmp checks into your workflow so they happen every time your state requires it, and document that they happened — the query, the date, and what it showed.

Assessment, diagnosis, and level of care

The clinical requirements are where medical necessity is built. Diagnose opioid use disorder on documented criteria, assess severity and the appropriate level of care, and record the reasoning — many payers and states reference the ASAM Criteria as the standard multidimensional framework for level-of-care decisions 4. Office-based buprenorphine is one level on that continuum; document why it fits this patient rather than a more or less intensive setting.

Office-based treatment is not the same as an opioid treatment program. The otp boundary matters: methadone for opioid use disorder is dispensed only through federally certified opioid treatment programs, while buprenorphine can be prescribed in a general office setting. If a patient needs a level of structure your solo practice cannot provide, document the referral. Build the record — diagnosis, severity, level-of-care rationale, and treatment plan — so a payer's medical-necessity review finds a decision, not just a prescription.

Confidentiality: are you a Part 2 program?

Prescribing buprenorphine can pull your records under 42 CFR Part 2, the federal confidentiality rule for substance use disorder treatment records, which is stricter than HIPAA on consent and redisclosure 5. Part 2 applies to programs that are federally assisted and hold themselves out as providing SUD diagnosis, treatment, or referral — a status a solo clinician can meet or not depending on how the practice is structured and funded. Determine which rule governs your chart before a records request forces the question.

The 2024 Part 2 final rule aligned much of the framework with HIPAA — permitting a single patient consent for future uses and disclosures for treatment, payment, and health care operations, and matching the enforcement and breach-notification structure — with a compliance date now in effect 6. If Part 2 applies to you, use consent forms that meet its requirements and honor its redisclosure limits. If it does not, HIPAA governs, but the heightened sensitivity of SUD records is a good reason to treat them carefully either way.

Prescribing buprenorphine by telehealth

Telehealth initiation of buprenorphine depends on a federal rule that has been repeatedly extended rather than settled, so it carries an as-of date. As of July 2026, DEA and SAMHSA have extended the flexibility that allows a clinician to start buprenorphine for opioid use disorder by audio-video, and in some cases audio-only, telemedicine without a prior in-person examination 2. Because this is a temporary flexibility under active rulemaking, confirm its current status and expiration on the DEA Diversion Control site before you rely on it.

Do not assume the flexibility is permanent, and do not read a proposed rule as if it were final — the requirements for prescribing controlled substances by telehealth have been in motion since the pandemic-era waivers began winding down. Where the flexibility applies, still meet the ordinary standard of care: a real evaluation, a documented diagnosis, and an in-person plan when clinically indicated. Your telehealth platform must be a HIPAA-compliant arrangement under a business associate agreement, now that the COVID-era enforcement discretion has ended 7.

Overdose prevention, naloxone, and continuity of care

Round out the plan with harm-reduction and continuity. Offer or prescribe naloxone and document the overdose-prevention counseling — how to recognize an overdose and what to do after an overdose — as a routine part of opioid use disorder care 1. Record the patient's supports and the plan for missed visits, because an interruption in buprenorphine can precipitate relapse. As a solo prescriber, arrange coverage so a patient is not left without access when you are away.

Continuity is a real solo vulnerability in office-based opioid treatment: a patient stabilized on buprenorphine needs reliable access to refills and monitoring. Build a cross-coverage arrangement with a colleague who can prescribe in your absence, keep the treatment agreement and PDMP consent current, and give patients a clear path for urgent needs. Documenting this continuity plan is both good care and a defensible record if a gap ever leads to a bad outcome.

Common questions

No. The Consolidated Appropriations Act, 2023 eliminated the DATA-2000 X-waiver. Any clinician with Schedule III prescribing authority and a current DEA registration can prescribe buprenorphine for opioid use disorder, with no patient caps and no special registration. What replaced it is a one-time training attestation tied to your DEA registration, plus the controlled-substance obligations that already applied.

It is a one-time attestation of eight hours of training on treating patients with substance use disorders, satisfied at your next DEA registration or renewal. It applies to nearly all DEA registrants, not only buprenorphine prescribers, and prior qualifying training or board certification can count. Once you attest, you do not repeat it. It does not cap patients or require a waiver.

As of July 2026, federal telemedicine flexibilities extended by DEA and SAMHSA allow starting buprenorphine for opioid use disorder by telehealth, in some cases audio-only, without a prior in-person visit. Because this is a temporary flexibility under active rulemaking, confirm its current status before you rely on it, and still meet the ordinary standard of care and HIPAA-compliant platform requirements.

Not automatically. 42 CFR Part 2 applies to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral — a status that depends on how your practice is structured and funded. Determine whether it governs your records before a request forces the question, and use consent forms that meet its requirements if it applies.

Yes. You need a current DEA registration and, where your state requires it, a separate state controlled-substance registration. Most states mandate a PDMP check before controlled-substance prescribing and require electronic prescribing with EPCS. These obligations are unchanged by the X-waiver's elimination, so confirm your state's specific timing and licensure rules and build the checks into your workflow.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

  1. 1.Substance Abuse and Mental Health Services Administration (2026). Buprenorphine. SAMHSA. link ✓That the X-waiver was eliminated in 2023 and any clinician with Schedule III authority and current DEA registration may prescribe buprenorphine for OUD, subject to the one-time training attestation.
  2. 2.Drug Enforcement Administration (2026). Diversion Control Division. U.S. Drug Enforcement Administration. link ✓DEA registration, EPCS, and the telemedicine flexibility for controlled-substance prescribing that remain in force for buprenorphine.
  3. 3.PDMP Training and Technical Assistance Center (2026). Prescription Drug Monitoring Program Training and Technical Assistance Center. PDMP TTAC (Brandeis University, BJA-funded). link ✓That most states mandate a PDMP check before controlled-substance prescribing, with the timing set by the state program.
  4. 4.American Society of Addiction Medicine (2023). The ASAM Criteria. American Society of Addiction Medicine. link ✓The ASAM Criteria as the standard multidimensional framework for documenting level-of-care and medical necessity in SUD treatment.
  5. 5.Office of the Federal Register (2026). 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records. eCFR. link ✓Whether a buprenorphine practice is a federally assisted SUD program bound by 42 CFR Part 2's stricter consent and redisclosure rules.
  6. 6.Substance Abuse and Mental Health Services Administration (2024). Confidentiality of Substance Use Disorder (SUD) Patient Records. Federal Register. link ✓The 2024 Part 2 final rule aligning consent, enforcement, and breach notification with HIPAA, with a compliance date now in effect.
  7. 7.HHS Office for Civil Rights (2026). HIPAA and Telehealth. U.S. Department of Health and Human Services. linkThat telehealth must run on a HIPAA-compliant arrangement under a business associate agreement now that the COVID-era enforcement discretion has ended.

https://www.gale.care/for-providers/bhp-buprenorphine-post-xwaiver · 7 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers

Findability, by specialty

How practices like yours get found in local search and AI answers — the honest playbook, per specialty.

SEO for private practices · SEO for AI search / answer engines (all verticals)