By the end of this chapter, you should be able to:
Distinguish the five schedules of controlled substances based on medical use and abuse potential
Apply the core requirements of the DEA Controlled Substances Act and 21 CFR to prescription handling
Identify valid DEA number formats and recognize common prescription validation issues
Differentiate between Schedule II, III, IV, and V prescription transfer, refill, and partial-fill rules
Explain the purpose and scope of the FDA drug labeling requirements and REMS programs
Summarize the key differences between USP <795> and USP <797> compounding standards
Recognize ISMP high-alert medication categories and their associated risks
Apply HIPAA Privacy Rule principles to pharmacy workflows, including minimum necessary use
1.1 The Controlled Substances Act and DEA Schedules
The foundation of federal controlled substance regulation is the DEA Controlled Substances Act (CSA), implemented through 21 CFR. The CSA classifies drugs into five schedules based on three factors: accepted medical use, relative abuse potential, and safety profile. The schedule determines every operational rule in the pharmacy, from storage to recordkeeping.
Schedule I (C-I): No currently accepted medical use in the United States. High abuse potential. Examples: heroin, LSD, marijuana (under federal law), peyote. These are never dispensed by a pharmacy.
Schedule II (C-II): Accepted medical use with severe abuse potential, leading to severe psychological or physical dependence. Examples: oxycodone, fentanyl, morphine, hydromorphone, amphetamine, methylphenidate, hydrocodone (as of the 2014 reclassification). C-II prescriptions may NOT be refilled. They must be presented in writing, electronically, or in limited emergency oral situations.
Schedule III (C-III): Moderate to low physical dependence potential, high psychological dependence potential. Examples: acetaminophen with codeine (Tylenol #3), buprenorphine, ketamine, testosterone. C-III prescriptions may be refilled up to five times within six months from the date written.
Schedule IV (C-IV): Lower abuse potential than C-III. Examples: alprazolam, lorazepam, zolpidem, tramadol, phentermine. Refill rules mirror C-III: five refills within six months.
Schedule V (C-V): Lowest abuse potential. Examples: cough preparations containing codeine (e.g., promethazine with codeine), diphenoxylate/atropine. Some C-V products may be sold without a prescription only if state law permits, the sale is made by a pharmacist, the quantity is limited, and records are kept. Most C-V products, however, are dispensed by prescription.
Exam Trap: Students confuse the refill rules. C-II = zero refills. C-III through C-V = five refills in six months. The "five refills in six months" rule does NOT apply to C-II, ever.
1.2 DEA Registration and the DEA Number
Every pharmacy and every prescriber who handles controlled substances must be registered with the DEA. The pharmacy's DEA registration number must appear on all controlled substance orders and records.
Prescriber DEA Number Format: Two letters, six digits, one check digit (e.g., AB1234563). The first letter is the registrant type (A = hospital/clinic, B = practitioner, C = mid-level, etc.). The second letter is the first letter of the prescriber's last name. The check digit is calculated as follows:
27.Add the first, third, and fifth digits.
28.Add the second, fourth, and sixth digits, then multiply that sum by 2.
29.Add the two results. The last digit of that total must equal the check digit.
Example: For AB1234563: (1 + 3 + 5) = 9. (2 + 4 + 6) = 12 × 2 = 24. 9 + 24 = 33. The last digit is 3, which matches the check digit. Valid.
Exam Trap: Students often forget the second letter must match the prescriber's last name. If the prescriber is "Dr. Smith," the DEA number must begin with a letter that corresponds to "S" (typically the first letter of the last name). A DEA number starting with "AB" for Dr. Smith is invalid.
Verification: Pharmacy technicians should verify DEA numbers when processing controlled substance prescriptions. A common red flag is a DEA number that fails the check digit calculation or a prescriber whose DEA number is not on file.
1.3 Prescription Requirements for Controlled Substances
Schedule II Prescriptions:
Must be written (paper or electronic) or communicated orally only in a true emergency.
Must contain: patient name, drug name, strength, dosage form, quantity, directions, prescriber's signature, and date written.
Paper prescriptions must be manually signed by the prescriber.
Electronic prescriptions must comply with DEA interim final rule for e-prescribing of controlled substances (EPCS).
No refills. A new prescription is required for each dispensing.
Partial fills are permitted only in specific situations: if the pharmacy cannot supply the full quantity, the partial fill must be noted, and the remainder must be dispensed within 72 hours. For terminally ill patients or LTCF residents, partial fills may be allowed for up to 60 days.
Schedule III–V Prescriptions:
May be communicated orally (telephone) by the prescriber or the prescriber's agent.
May be refilled up to five times within six months of the date written. After six months or five refills, a new prescription is required.
Partial fills are permitted, and the total quantity dispensed across all partials cannot exceed the prescribed quantity.
Transfers:
C-II prescriptions may NOT be transferred between pharmacies. The patient must obtain a new prescription.
C-III through C-V prescriptions may be transferred ONCE between pharmacies, but only if the transferring pharmacy has not already transferred the prescription. The transfer must be communicated between two licensed pharmacists, and both pharmacies must record the transfer on the prescription document.
Exam Trap: Students often think C-II prescriptions can be transferred once, like C-III–V. They cannot. Also, students confuse the emergency oral C-II rule: the prescriber must provide a written prescription to the pharmacy within 7 days, and the written prescription must note "Authorization for Emergency Dispensing."
1.4 Recordkeeping and Inventory
The CSA and 21 CFR require pharmacies to maintain accurate, complete, and readily retrievable records for controlled substances.
Inventory: A biennial (every two years) inventory of all controlled substances is required. The inventory must be conducted on the day the pharmacy opens, or every two years thereafter. It must list each controlled substance by name, strength, dosage form, and quantity in each schedule.
Dispensing Records: For each controlled substance dispensed, the pharmacy must record: patient name, prescriber name, drug name, strength, dosage form, quantity, date dispensed, and the initials of the dispensing pharmacist.
Ordering: Controlled substances must be ordered using DEA Form 222 (for C-I and C-II) or via a controlled substance ordering system for C-III through C-V. C-II orders cannot be filled by a supplier unless the pharmacy provides a DEA Form 222. The form is triplicate: one copy for the supplier, one for the DEA, one for the pharmacy.
Security: C-II drugs must be stored in a securely locked, substantially constructed cabinet. C-III through C-V must be stored in a locked area, but may be dispersed throughout the pharmacy stock if they are not readily accessible to the public.
Diversion: Any theft or significant loss of controlled substances must be reported to the DEA using DEA Form 106. The pharmacy must also maintain a log of all controlled substance prescriptions dispensed, which is subject to DEA inspection.
1.5 FDA Drug Labeling and REMS
The FDA drug labeling requirements govern what appears on the prescription container label and the professional labeling (package insert). The pharmacy label must include:
Pharmacy name and address
Prescription number
Patient name
Drug name and strength
Directions for use
Prescriber name
Date of dispensing
Refill information (if any)
Beyond-use date (if applicable)
REM S (Risk Evaluation and Mitigation Strategies): Some drugs have FDA-mandated REMS programs that require specific dispensing safeguards. Examples include:
Clozapine (Clozaril): Requires monitoring of white blood cell counts before dispensing. The pharmacy must verify the patient's absolute neutrophil count (ANC) is within acceptable range.
Isotretinoin (Accutane): Requires enrollment in iPLEDGE. The pharmacy must verify the patient has a valid iPLEDGE number and that the prescription is within the 7-day dispensing window.
Thalidomide: Requires prescriber and patient registration in the STEPS program.
Opioid analgesics: Some extended-release/long-acting opioids have REMS requiring prescriber education and patient counseling.
Exam Trap: Students confuse REMS with general drug warnings. REMS are legally enforceable. Dispensing a REMS drug without verifying the required elements is a violation of federal law, not just a clinical error.
1.6 USP Compounding Standards: <795> and <797>
The USP <795> standard covers non-sterile compounding. The USP <797> standard covers sterile compounding. Both are enforceable by state boards of pharmacy and, in some cases, by the FDA.
USP <795> (Non-Sterile Compounding):
Applies to ointments, creams, capsules, suspensions, and other non-sterile preparations.
Requires a beyond-use date (BUD) based on the water activity and the type of preparation.
Non-aqueous preparations (e.g., ointments) may have a BUD of up to 6 months if stored properly.
Aqueous preparations (e.g., suspensions) have a BUD of no more than 14 days when stored at controlled room temperature, or 35 days if refrigerated (unless stability data supports longer).
Requires the use of a calibrated balance, proper documentation, and a clean compounding area.
USP <797> (Sterile Compounding):
Applies to IV admixtures, eye drops, and other sterile preparations.
Requires a primary engineering control (PEC) such as a laminar airflow workbench (LAFW) or a biological safety cabinet (BSC).
Requires a buffer room or cleanroom suite with controlled air quality.
Assigns risk levels: Immediate-Use (no more than 1 hour), Low-Risk, Medium-Risk, and High-Risk.
Low-risk preparations have a BUD of 48 hours at room temperature or 14 days refrigerated (if prepared in an ISO Class 5 environment).
High-risk preparations have a BUD of 24 hours at room temperature or 3 days refrigerated.
Requires garbing (gown, gloves, mask, hair cover) and hand hygiene before compounding.
Exam Trap: Students confuse the BUDs. Non-sterile aqueous = 14 days. Sterile low-risk refrigerated = 14 days. Sterile high-risk refrigerated = 3 days. Memorize the context: "795 is non-sterile, 797 is sterile."
1.7 ISMP High-Alert Medications
The ISMP (Institute for Safe Medication Practices) publishes a list of high-alert medications that bear a heightened risk of causing significant patient harm when used in error. These are not necessarily controlled substances; they are drugs with narrow therapeutic indices or high potency.
Key high-alert categories include:
Opioids (especially concentrated oral liquids, transdermal patches, and IV formulations)
Insulin (all formulations)
Anticoagulants (warfarin, heparin, enoxaparin, direct oral anticoagulants)
Methotrexate (oral, for non-oncologic use — a classic error is daily dosing instead of weekly)
Digoxin
Benzodiazepines (IV)
Exam Trap: Students often think high-alert means controlled. Insulin is not a controlled substance, but it is a high-alert medication. Methotrexate is not a controlled substance, but a daily instead of weekly dose is a common fatal error.
Risk Reduction: Pharmacies should use independent double-checks, tall-man lettering (e.g., "DOPamine" vs. "DOBUTamine"), and standardized order sets for high-alert medications.
1.8 HIPAA Privacy Rule
The HIPAA Privacy Rule protects patient protected health information (PHI). In the pharmacy, PHI includes the patient's name, address, prescription records, and any information that could identify the patient.
Key Requirements:
Minimum Necessary: Pharmacy staff should access only the PHI needed to perform their job function. A technician does not need to review a patient's full medical record to fill a prescription.
Notice of Privacy Practices: Pharmacies must provide patients with a notice explaining how their PHI is used and disclosed.
Patient Access: Patients have the right to request a copy of their pharmacy records.
Incidental Disclosures: Reasonable safeguards must be in place (e.g., not shouting a patient's name across the pharmacy, using a privacy screen at the counter).
Business Associates: Pharmacies must have agreements with vendors (e.g., software providers, delivery services) that handle PHI.
Permitted Disclosures Without Authorization:
To the patient themselves
For treatment, payment, or healthcare operations (e.g., calling a prescriber to clarify a prescription)
To law enforcement in specific circumstances (e.g., suspected diversion of controlled substances)
To family members or caregivers if the patient is present and does not object
Exam Trap: Students often think HIPAA prohibits ALL communication with family members. If the patient is present and does not object, a pharmacist may discuss the prescription with a family member. If the patient is not present, the pharmacist must use professional judgment.
1.9 Common Exam Traps
128.q.d. vs. q.i.d.: q.d. = once daily (every day). q.i.d. = four times daily. A misplaced "i" changes the dose fourfold. The Institute for Safe Medication Practices recommends writing "daily" instead of q.d. to avoid error.
129.DEA Schedule Confusion: Hydrocodone combination products are C-II (since 2014), not C-III. Tramadol is C-IV, not C-III. Buprenorphine is C-III, not C-II.
130.Refill Rules: C-II = no refills. C-III–V = five refills in six months. Students often apply the six-month rule to C-II or allow unlimited refills for C-V.
131.Metric Conversions: 1 gram = 1000 mg = 1,000,000 mcg. 1 liter = 1000 mL. 1 teaspoon = 5 mL. 1 tablespoon = 15 mL. A common error is converting 0.5 g to 50 mg (incorrect; it is 500 mg).
132.Days' Supply Calculations: For insulin, U-100 means 100 units per mL. A 10 mL vial contains 1000 units. If a patient uses 40 units daily, a 10 mL vial lasts 25 days (1000 ÷ 40). Students often forget to multiply the concentration by the volume.
133.DEA Number Check Digit: Students forget to multiply the second sum by 2. The formula is: (d1 + d3 + d5) + 2 × (d2 + d4 + d6) = total. The last digit of the total must equal the check digit.
134.Partial Fills: Students think C-II partial fills are never allowed. They are allowed in emergencies or when the pharmacy cannot supply the full quantity, but the remainder must be dispensed within 72 hours.
135.Transfer Rules: C-II cannot be transferred. C-III–V can be transferred once. Students often reverse these rules.
136.BUD Confusion: Non-sterile aqueous (USP <795>) = 14 days. Sterile low-risk refrigerated (USP <797>) = 14 days. Sterile high-risk refrigerated = 3 days. Students mix up which standard applies.
137.REM S vs. General Warnings: REMS is legally binding. A pharmacy that dispenses clozapine without verifying the ANC is violating federal law.
1.10 Summary
Federal pharmacy law is built on the DEA Controlled Substances Act and 21 CFR for controlled substances, FDA labeling and REMS for drug safety, USP <795>/<797> for compounding, ISMP recommendations for high-alert medications, and the HIPAA Privacy Rule for patient information. The PTCE will test your ability to apply these rules to realistic scenarios. Master the schedules, the refill rules, the DEA number validation, and the BUD tables. These are the highest-yield topics in this chapter.
