Got Your DEA Number: The Setup Order Before the First Prescription

What does the DEA number let you do by itself?

By itself, almost nothing. Federal rule 21 CFR 1306.03 lets a practitioner issue a controlled-substance prescription only when two things are both true: the state where you practice has authorized you to prescribe those schedules, and you hold a DEA registration or one of a short list of exemptions 1Ref 1Drug Enforcement Administration, Department of Justice (2024).§ 1306.03 Persons entitled to issue prescriptions..Who may issue a controlled-substance prescription: a practitioner authorized by the jurisdiction and either registered or exempted under 1301.22(c) and 1301.23 only; the agent-and-employee exemption in 1301.22(b) is not on that list.. The DEA number is the second half. The first half is your state license and whatever prescriptive authority your board attached to it.

DEA says as much in its own registration guidance. The registration rests on state authorization, and a registration issued on the strength of one state's license cannot authorize dispensing outside that state 2Ref 2U.S. Drug Enforcement Administration, Diversion Control Division (2026).Registration Q&A (Questions & Answers — Registration).That DEA registration rests on state authorization and a registration based on one state's license cannot authorize dispensing outside that state, and that a separate registration is required for each principal place of business.. So a nurse practitioner licensed in two states and prescribing in both is looking at a DEA registration per state, and a second office in the same state needs its own registration too, because DEA registers each principal place of business separately 2Ref 2U.S. Drug Enforcement Administration, Diversion Control Division (2026).Registration Q&A (Questions & Answers — Registration).That DEA registration rests on state authorization and a registration based on one state's license cannot authorize dispensing outside that state, and that a separate registration is required for each principal place of business..

Under 21 CFR 1301.13, no one may engage in an activity that requires registration until the application is granted and a Certificate of Registration has issued 3Ref 3U.S. Drug Enforcement Administration, Department of Justice (2026).21 CFR 1301.13 — Application for registration; time for application; expiration date; registration for independent activities; application forms, fees, contents and signature; coincident activities.Form 224 for a new practitioner registration and 224a for renewal, the $888 fee as of the eCFR's August 28, 2026 content, the three-year registration period, the rule that no registrable activity begins until the certificate issues, and the 60-day reregistration window.. That line is the one that matters to the reader who just got the approval email. The certificate is the milestone. An application in process, however far along, is not.

Everything after this point is state work, and this page can show only one state's rule in full. California is the worked example below because its statutes are the ones checked for this page; where the text says California, read it as the shape of a rule your state has written its own version of. Your board's site is where the same three questions get answered for you: whether there is a second license, what the monitoring program requires, and whether e-prescribing is mandatory.

Does your state require a second controlled-substance license?

It depends on the state, and DEA keeps the list. Its Practitioner's State License Requirements page sorts every jurisdiction into two columns: states where the professional license alone carries controlled-substance authority, and states that require a separate controlled-substance license on top of it 4Ref 4U.S. Drug Enforcement Administration, Diversion Control Division (2026).Practitioner's State License Requirements.DEA's two-column split of jurisdictions into one-license and second-controlled-substance-license states, and the placement of California, Florida, Georgia and Texas versus Alabama, Connecticut, Delaware, Illinois and Indiana as read on September 1, 2026.. On September 1, 2026, the table put California, Florida, Georgia and Texas in the one-license column, and Alabama, Connecticut, Delaware, Illinois and Indiana in the second-license column.

The page is undated and DEA revises it without notice, so treat that placement as a snapshot. The lookup takes a few minutes: find your state in the DEA table, then open your own board's licensing page and search it for the words controlled substance registration. If the board issues one, it is a state credential with its own application, its own fee and its own renewal cycle, and none of those figures appear on the DEA page. This page does not quote them either.

In a second-license state, confirm the state credential has issued and is current before the first prescription, whatever order the two applications went in. Then keep its renewal date beside the federal one. The two may run on different cycles, and the federal registration rests on the state authorization underneath it 2Ref 2U.S. Drug Enforcement Administration, Diversion Control Division (2026).Registration Q&A (Questions & Answers — Registration).That DEA registration rests on state authorization and a registration based on one state's license cannot authorize dispensing outside that state, and that a separate registration is required for each principal place of business..

Register with the state monitoring program, and learn its query rule

In California the DEA number itself starts the clock. Health and Safety Code section 11165.1 says a practitioner authorized to prescribe Schedule II through V controlled substances shall, upon receipt of a federal DEA registration, submit the department's application for access to CURES, the state's prescription drug monitoring program 5Ref 5California State Legislature (2026).California Health and Safety Code § 11165.1 (Division 10, Chapter 4, Article 1).California only: a practitioner authorized to prescribe Schedule II through V controlled substances must apply for CURES access upon receipt of a federal DEA registration, and the department may deny or suspend a subscriber, including where the DEA registration is suspended or revoked.. The same section lets the department deny or suspend a subscriber, including where the DEA registration is suspended or revoked.

Registration gets you access. The query rule governs what you do with it, and in California that rule is section 11165.4. Before prescribing a Schedule II, III or IV controlled substance to a patient for the first time, the prescriber consults that patient's CURES activity report covering the past 12 months, and consults it again at least once every six months for as long as the substance remains part of the treatment, subject to the exemptions listed in subdivision (c) 6Ref 6California State Legislature (2026).California Health and Safety Code § 11165.4 (Division 10, Chapter 4, Article 1).California only: the mandatory CURES consultation of the patient's 12-month history before a first Schedule II, III or IV prescription and at least every six months thereafter while the substance remains part of treatment, subject to the subdivision (c) exemptions.. Schedule V sits outside that section's mandatory query. For a behavioral-health prescriber starting a stimulant or a benzodiazepine, the first-visit query happens inside the visit, so the CURES login belongs on the machine you chart on.

Outside California, none of that carries over.

Each state writes its own monitoring statute: whether registration is required and when, whether a query is required before a first prescription, which schedules it covers, and how often a repeat check is due. The lookup is your board's site and your state's monitoring program page, searched for PDMP or the program's own name. Read the query rule before the first controlled-substance visit, and write its interval into the chart template so a repeat check, where your state requires one, does not depend on memory.

Set up electronic prescribing for controlled substances before you need it

Federally, e-prescribing controlled substances is permitted, not required. DEA's guidance on electronic prescriptions for controlled substances (EPCS) says its regulations allow a practitioner to sign these prescriptions electronically, provided three things are in place: identity proofing, a two-factor authentication credential issued only to the identity-confirmed individual, and an e-prescribing application that meets 21 CFR part 1311 7Ref 7U.S. Drug Enforcement Administration, Diversion Control Division (2026).Electronic Prescriptions for Controlled Substances (EPCS) — Questions & Answers.The federal position that DEA permits but does not mandate electronic prescribing of controlled substances, and the preconditions: identity proofing to NIST SP 800-63-1 Assurance Level 3 by an approved credential service provider or certification authority, a two-factor credential in the practitioner's sole possession, an application meeting 21 CFR part 1311, the two-person step for setting logical access controls, and the application's two-year prescription log.. Whether your state requires it is a separate question, answered on your board's site and your state pharmacy board's site.

The credential does not come from DEA. The practitioner applies to a federally approved credential service provider or certification authority, and that provider conducts identity proofing that meets NIST Special Publication 800-63-1 Assurance Level 3, in person or remotely 7Ref 7U.S. Drug Enforcement Administration, Diversion Control Division (2026).Electronic Prescriptions for Controlled Substances (EPCS) — Questions & Answers.The federal position that DEA permits but does not mandate electronic prescribing of controlled substances, and the preconditions: identity proofing to NIST SP 800-63-1 Assurance Level 3 by an approved credential service provider or certification authority, a two-factor credential in the practitioner's sole possession, an application meeting 21 CFR part 1311, the two-person step for setting logical access controls, and the application's two-year prescription log.. The result is a two-factor credential, often a hard token, that stays in the practitioner's sole possession; the knowledge factor is never shared with anyone.

Holding the credential is not enough to sign, and this is where a practice of one gets stuck. The e-prescribing application's logical access controls have to be set, and DEA's guidance says setting them requires two people: one to nominate who may sign, and a DEA registrant to execute the access list with their two-factor credential 7Ref 7U.S. Drug Enforcement Administration, Diversion Control Division (2026).Electronic Prescriptions for Controlled Substances (EPCS) — Questions & Answers.The federal position that DEA permits but does not mandate electronic prescribing of controlled substances, and the preconditions: identity proofing to NIST SP 800-63-1 Assurance Level 3 by an approved credential service provider or certification authority, a two-factor credential in the practitioner's sole possession, an application meeting 21 CFR part 1311, the two-person step for setting logical access controls, and the application's two-year prescription log.. Ask the vendor, before you buy, how its enrollment handles that with a single prescriber in the building. The same guidance describes a two-year prescription log kept by the application 7Ref 7U.S. Drug Enforcement Administration, Diversion Control Division (2026).Electronic Prescriptions for Controlled Substances (EPCS) — Questions & Answers.The federal position that DEA permits but does not mandate electronic prescribing of controlled substances, and the preconditions: identity proofing to NIST SP 800-63-1 Assurance Level 3 by an approved credential service provider or certification authority, a two-factor credential in the practitioner's sole possession, an application meeting 21 CFR part 1311, the two-person step for setting logical access controls, and the application's two-year prescription log..

The credential and the application it signs in have to work together, which is why the software purchase and the credential belong in the same week. Surescripts, one of the e-prescribing networks, says on its own product page that participants complete a certification process against current NCPDP transaction standards before joining 8Ref 8Surescripts (2026).E-Prescribing.Surescripts' own statement, attributed in text, that participants complete a certification process against current NCPDP transaction standards before joining its network.. So the question for a vendor is whether its controlled-substance module is certified on the network it uses, and whether the credential you obtain will work inside that module. Where the e-prescribing module falls among the EHR, the clearinghouse and the rest is covered in the stack in order.

What goes on the prescription, and whose number carries it

Your name, your address and your DEA registration number, on every controlled-substance prescription you write. That is 21 CFR 1306.05, which lists what must appear on the script 9Ref 9Drug Enforcement Administration, Department of Justice (2024).§ 1306.05 Manner of issuance of prescriptions..What must appear on a controlled-substance prescription, including the practitioner's name, address and registration number, and the rule that an agent may prepare the prescription for the practitioner's signature.. The number is the accountability line on the page, because 21 CFR 1306.04 puts the responsibility for a legitimate medical purpose on the prescribing practitioner, with a corresponding responsibility on the pharmacist who fills it 10Ref 10Drug Enforcement Administration, Department of Justice (2024).§ 1306.04 Purpose of issue of prescription..The legitimate-medical-purpose requirement and where the responsibility sits: on the prescribing practitioner, with a corresponding responsibility on the dispensing pharmacist..

The same section lets an agent prepare the prescription for the practitioner's signature 9Ref 9Drug Enforcement Administration, Department of Justice (2024).§ 1306.05 Manner of issuance of prescriptions..What must appear on a controlled-substance prescription, including the practitioner's name, address and registration number, and the rule that an agent may prepare the prescription for the practitioner's signature.. Preparing is clerical. Signing is the act the registration number stands behind, and the number on the signed script is the signer's own.

This is where a nurse practitioner who spent years in a collaborative arrangement sometimes trips. Section 1306.03 names who may issue a controlled-substance prescription: a practitioner authorized by the jurisdiction and either registered, or exempted under sections 1301.22(c) and 1301.23 only 1Ref 1Drug Enforcement Administration, Department of Justice (2024).§ 1306.03 Persons entitled to issue prescriptions..Who may issue a controlled-substance prescription: a practitioner authorized by the jurisdiction and either registered or exempted under 1301.22(c) and 1301.23 only; the agent-and-employee exemption in 1301.22(b) is not on that list.. The agent-and-employee exemption in 1301.22(b) is not on that list. The arrangement to retire on the day your own certificate issues is prescribing under a collaborator's DEA number, and with your own registration in hand there is no reason to keep reaching for one.

The prescription is one place your credentials appear in a fixed form. Your advertising is another, and the license number and supervised-by disclosures a state requires there are a separate rule on the same board site.

Telemedicine prescribing rests on a rule that expires December 31, 2026

As of September 1, 2026, a DEA-registered practitioner can prescribe Schedule II through V controlled substances by telemedicine to a patient never examined in person, under the COVID-19 flexibilities in 21 CFR 1307.41 and 42 CFR 12.1. That authority comes from the fourth temporary extension, published in the Federal Register on December 31, 2025, effective January 1, 2026 through December 31, 2026 11Ref 11Drug Enforcement Administration, U.S. Department of Justice; Substance Abuse and Mental Health Services Administration, U.S. Department of Health and Human Services (2025).Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications.The as-of anchor for telemedicine prescribing of Schedule II through V controlled substances to a patient never evaluated in person: the fourth temporary extension, effective January 1, 2026 through December 31, 2026, amending only 21 CFR 1307.41 and 42 CFR 12.1, with the special registration rule still a proposal that had drawn more than 6,475 comments.. It is the fourth extension, and it is temporary.

The permanent replacement is still a proposal. The extension notice records that DEA's special registration rule for telemedicine was still a proposed rulemaking, with more than 6,475 comments received, and that the temporary rule amends only the two sections named above 11Ref 11Drug Enforcement Administration, U.S. Department of Justice; Substance Abuse and Mental Health Services Administration, U.S. Department of Health and Human Services (2025).Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications.The as-of anchor for telemedicine prescribing of Schedule II through V controlled substances to a patient never evaluated in person: the fourth temporary extension, effective January 1, 2026 through December 31, 2026, amending only 21 CFR 1307.41 and 42 CFR 12.1, with the special registration rule still a proposal that had drawn more than 6,475 comments.. You cannot prescribe under a proposed rule. Nothing on this page assumes the proposal's contents, and neither should an intake workflow.

For a solo behavioral-health practice built on video visits, that date is a business fact. Write it on the calendar now, check docket DEA-407 in the fourth quarter, and decide in advance what the practice offers telemedicine-only controlled-substance patients if the flexibility ends: an in-person evaluation, a referral, or a transition plan made with each patient. Your state may add its own conditions on telehealth prescribing, and that is the same board-site lookup as everything else here.

The federal paperwork you already did, and the calendar it started

The MATE Act training is already behind you. Since June 27, 2023, DEA Form 224 has carried a one-time attestation that the applicant completed eight hours of training on treating and managing patients with opioid or other substance use disorders, checked at the first new or renewal application on or after that date 12Ref 12U.S. Drug Enforcement Administration, Diversion Control Division (2023).Opioid Use Disorder – MATE Act Q&A.The one-time eight-hour training attestation on Form 224 or 224a at the first new or renewal application on or after June 27, 2023, that DEA does not collect the certificate but the practitioner should retain the record, the advanced-practice-nursing graduate pathway, that prior DATA-Waiver training counts, and the absence of a federal buprenorphine patient cap after the Consolidated Appropriations Act of 2023.. DEA does not collect the certificate. Keep the record anyway, in the same folder as the registration; the guidance says to retain it.

Two details in that guidance matter to nurse practitioners specifically. Advanced-practice nursing graduates have their own pathway to satisfying the requirement, and any DATA-Waiver training completed before the waiver was eliminated counts toward the eight hours 12Ref 12U.S. Drug Enforcement Administration, Diversion Control Division (2023).Opioid Use Disorder – MATE Act Q&A.The one-time eight-hour training attestation on Form 224 or 224a at the first new or renewal application on or after June 27, 2023, that DEA does not collect the certificate but the practitioner should retain the record, the advanced-practice-nursing graduate pathway, that prior DATA-Waiver training counts, and the absence of a federal buprenorphine patient cap after the Consolidated Appropriations Act of 2023.. The same guidance confirms that, after the Consolidated Appropriations Act of 2023, there is no federal patient cap on buprenorphine prescribing 12Ref 12U.S. Drug Enforcement Administration, Diversion Control Division (2023).Opioid Use Disorder – MATE Act Q&A.The one-time eight-hour training attestation on Form 224 or 224a at the first new or renewal application on or after June 27, 2023, that DEA does not collect the certificate but the practitioner should retain the record, the advanced-practice-nursing graduate pathway, that prior DATA-Waiver training counts, and the absence of a federal buprenorphine patient cap after the Consolidated Appropriations Act of 2023.. Your state's rules on nurse practitioner prescribing still sit on top of that.

The practitioner registration on Form 224 cost $888 as the fee stood in the eCFR on August 28, 2026, and the registration runs three years; the fee is set by rulemaking and can change 3Ref 3U.S. Drug Enforcement Administration, Department of Justice (2026).21 CFR 1301.13 — Application for registration; time for application; expiration date; registration for independent activities; application forms, fees, contents and signature; coincident activities.Form 224 for a new practitioner registration and 224a for renewal, the $888 fee as of the eCFR's August 28, 2026 content, the three-year registration period, the rule that no registrable activity begins until the certificate issues, and the 60-day reregistration window.. Renewal is on Form 224a, and 21 CFR 1301.13 opens the reregistration window 60 days before expiration 3Ref 3U.S. Drug Enforcement Administration, Department of Justice (2026).21 CFR 1301.13 — Application for registration; time for application; expiration date; registration for independent activities; application forms, fees, contents and signature; coincident activities.Form 224 for a new practitioner registration and 224a for renewal, the $888 fee as of the eCFR's August 28, 2026 content, the three-year registration period, the rule that no registrable activity begins until the certificate issues, and the 60-day reregistration window.. Put the expiration date, the 60-day mark, the state license renewal and any state controlled-substance license renewal on one calendar.

A second location changes the count. DEA registers each principal place of business separately 2Ref 2U.S. Drug Enforcement Administration, Diversion Control Division (2026).Registration Q&A (Questions & Answers — Registration).That DEA registration rests on state authorization and a registration based on one state's license cannot authorize dispensing outside that state, and that a separate registration is required for each principal place of business., so a second office means another Form 224 and another fee 3Ref 3U.S. Drug Enforcement Administration, Department of Justice (2026).21 CFR 1301.13 — Application for registration; time for application; expiration date; registration for independent activities; application forms, fees, contents and signature; coincident activities.Form 224 for a new practitioner registration and 224a for renewal, the $888 fee as of the eCFR's August 28, 2026 content, the three-year registration period, the rule that no registrable activity begins until the certificate issues, and the 60-day reregistration window.. Where these dates sit against everything else that waits on something in the first ninety days of practice is its own page.

The order, on one page

The setup runs from the state inward. Confirm the state credentials first, then the state monitoring program, then the e-prescribing credential and the application it is bound to, then the calendar. The sequence below assumes the DEA certificate has issued; each step names where the answer for your state lives, and none of it substitutes for reading your own board's page.

1. Confirm the certificate has issued and that the schedules on it match the schedules your state authorized. No registrable activity begins before that. 2. Find your state in DEA's two-column state license table. If it sits in the second-license column, confirm the state controlled-substance credential is in hand and current. 3. Register with your state's prescription monitoring program (in California, on receipt of the DEA registration) and read its query rule before the first controlled-substance visit. 4. Obtain the EPCS credential from a federally approved credential service provider, then have the application's access controls set. Ask the vendor how the two-person step works with one prescriber. 5. Check your state for an e-prescribing mandate and for any conditions on telehealth prescribing. 6. If any patient will be prescribed a controlled substance by telemedicine without an in-person evaluation, calendar December 31, 2026 and check docket DEA-407 before it. 7. File the MATE Act training record with the registration, and calendar the federal expiration and its 60-day window beside the state renewals. 8. Many practices also tell their malpractice carrier and their e-prescribing vendor that controlled-substance prescribing has started. That is a convention rather than a rule; the carrier's policy language is the place to check whether it asks.

Every state-specific answer on this page came from one of three places: DEA's state license table, a state's health and safety code, and a board's own site. Those three are the lookup for your state too.