The 2025 One‑Stop Guide to U.S. Prescription & Controlled‑Substance Rules
For prescribers navigating DEA, telemedicine, CMS/Medicare, private payers, and key state rules (MI, FL, CA, NY, IL).
Last updated: September 24, 2025. (This guide is informational, not legal advice.)

Why this guide?

If it feels like every agency—and every state—wrote its own verse to the prescribing songbook…that’s because they did. This is your consolidated, practical map. We’ll cover the federal backbone (DEA, Ryan Haight, EPCS), how Medicare (CMS) measures you, what commercial plans actually block at the counter, and the state‑level “gotchas,” with deep dives on Michigan, Florida, California, New York, and Illinois.

MME is a tool, not a law. It’s closer to a speedometer than a speed limit. Useful, but not a legal shield—and, used rigidly, it can hurt patients. (CDC 2022 says as much.) (CDC)

Contents

1. Federal rules (DEA & CSA essentials)

2. Telemedicine & the Ryan Haight Act (what you can do now)

3. CMS/Medicare: E‑prescribing & opioid safety edits

4. Private payers: what really triggers denials

5. National state trends: PDMP, day‑supply & MME rules

6. State deep dives: MI, FL, CA, NY, IL

7. Practical checklists (in‑person & telemedicine)

8. FAQs that save you callbacks

1) Federal framework: the DEA & CSA, in plain English

“Legitimate medical purpose” & “usual course”
Every controlled‑substance Rx must be for a legitimate medical purpose by a practitioner acting in the usual course of practice. Pharmacists share a “corresponding responsibility.” That phrase is not decorative—it’s enforceable.

What goes on the prescription (even when e‑prescribed)
Date, patient name/address, drug, strength, dosage form, quantity, directions, and prescriber name/address/DEA. (Yes, still true in 2025.)

EPCS (Electronic Prescriptions for Controlled Substances)

• DEA requires two‑factor authentication (two of: something you know, something you have, something you are) to sign CS prescriptions and to approve access controls. (eCFR)

• Mobile devices are fine if the DEA’s EPCS rules are met (often password + biometric when no hard token). (DEA Diversion Control Division)

• Since Sept. 1, 2023, DEA allows transfer of an electronic CS prescription (Schedules II–V) between retail pharmacies at the patient’s request. Handy when stock is out. (DEA)

Partial fills (Schedule II) — now crystal‑clear

• You may partially fill at the patient’s or prescriber’s request; remaining portions must be filled within 30 daysfrom the Rx date (72 hours if the original was an emergency oral Rx). Recordkeeping requirements apply.

2) Telemedicine & the Ryan Haight Act: what’s allowed, right now

Ryan Haight Act: If you haven’t done an in‑person exam, federal law restricts CS prescribing unless you fit a telemedicine exception. The “practice of telemedicine” is defined at 21 U.S.C. 802(54); the in‑person requirement lives at 21 U.S.C. 829(e). (Department of Consumer Affairs)

Where we stand today (Sept 2025):

• Flexibilities extended through Dec 31, 2025. DEA/HHS extended COVID‑era telemedicine CS flexibilities while they finish permanent rules. (IHPI)

• Buprenorphine via telemedicine: In 2025, DEA finalized a rule supporting telemedicine (including audio‑only) for buprenorphine for OUD; the rule’s effective date is tied to the same Dec 31, 2025 horizon while DEA coordinated timing. Keep an eye on the Federal Register notice consolidating these actions. (Federal Register)

• DEA’s broader telemedicine framework has been in flux since its 2023 proposals; the current, safe approach is to rely on the published extension and the final buprenorphine rule—and meet all state requirements, which still apply. (DEA)

Practical reading of the room: federal telemedicine rules are converging on access + safeguards, but until Jan 1, 2026, document your rationale, identity‑proof patients, use EPCS, and follow state telehealth prescribing rules (see Section 6). (IHPI)

MAT Act (good news for access): The X‑waiver is gone. Any prescriber with a DEA registration and Schedule III authority may prescribe buprenorphine for OUD, subject to state law and training requirements. (SAMHSA)

3) CMS / Medicare Part D: what Medicare expects

EPCS compliance (Part D):

• CMS measures prescribers annually; you must e‑prescribe ≥70% of your Schedule II–V Part D CS prescriptions, after exceptions. CMS began compliance measurement with the 2023 year. (CMS has a prescriber portal for status & waivers.) (Centers for Medicare & Medicaid Services)

• The mandate stems from the SUPPORT Act; it applies to prescribers (not pharmacies). (Centers for Medicare & Medicaid Services)

Opioid safety edits at the point of sale (POS):
Part D sponsors must implement opioid safety edits (with clinical exceptions such as hospice/cancer). CMS updates the submission instructions; edits commonly address opioid‑naïve initial fills, high daily dose, duplicate therapy, and dangerous combinations. (The specific thresholds are plan‑set.) (Centers for Medicare & Medicaid Services)

Standards: Part D eRx transactions must follow CMS‑adopted NCPDP standards (SCRIPT etc.). (Centers for Medicare & Medicaid Services)

4) Private payers (commercial & MA‑PD): how utilization management actually bites

Insurers aren’t shy about adding their own brakes. Expect combinations of: initial‑fill day limits for opioid‑naïve patients (often 7 days), MME‑based edits, prior auth for long‑acting opioids, duplicate therapy & early refill edits.Examples:

• CVS Caremark: opioid programs with quantity limits/prior auth & safety edits at POS.

• Express Scripts (Cigna): “Advanced Opioid Management” with clinical edits and care alerts.

• Optum Rx (United): opioid safety program with MME/duplicate checks and targeted prior auth.

Translation: If your patient gets stopped at the counter, it’s often a plan edit, not a law. Your fix is documentation + plan exception/PA, not arguing with the pharmacist about statutes.

5) Fifty‑state trendlines (quick survey)

• PDMPs & mandatory checks: Virtually all states operate PDMPs; most require prescribers to check before certain CS Rxs. Requirements & frequency vary. (HHS.gov)

• Initial day‑supply limits for acute pain: Many states cap initial opioid prescriptions for acute pain (often 3–7 days). Florida (3 days, 7 with exception); Michigan (7); New York (7). Some states use MME caps or triggers (e.g., Rhode Island caps acute outpatient adults at 30 MME/day for up to 20 doses). Your state may differ. (Online Sunshine)

• Naloxone co‑prescribing mandates are expanding; examples include California AB 2760 and New York S2966A(see state sections). (Medical Board of California)

6) State deep‑dives

Michigan (MI)

Key rules at a glance

• Acute pain limit: No more than a 7‑day supply of an opioid within a 7‑day period (began July 1, 2018). (Michigan Legislature)

• PDMP (MAPS): Prescribers must register and check MAPS before prescribing/dispensing a CS in a quantity exceeding a 3‑day supply (with limited exceptions). (Higher Logic Download)

• Telehealth: Michigan’s Public Health Code allows boards to set when a bona fide relationship isn’t required for prescribing Schedules II–V (and sets telehealth consent/record rules in general). Use caution and document the relationship & exam. (Michigan Legislature)

Practical tips (MI): Build a MA(P)S habit: query before you write >3‑day CS Rxs, and re‑check if therapy persists. Include opioid risks counseling in your note (Michigan reinforced counseling/informed consent alongside MAPS). (Michigan State Medical Society)

Florida (FL)

Key rules at a glance

• Acute pain limit (HB 21, 2018): 3‑day limit for Schedule II opioids; may extend to 7 days if you (1) document the exception and (2) write “ACUTE PAIN EXCEPTION” on the Rx with clinical justification. Chronic non‑malignant pain is handled under separate standards. (Online Sunshine)

• PDMP (E‑FORCSE): Consult before prescribing any Schedule II–V CS to patients 16+ (with enumerated care‑setting exceptions). Delegation is allowed. Document the check. (Florida Department of Health)

• Telehealth (456.47): No Schedule II CS by telehealth, except: psychiatric disorders; inpatient hospital; hospice; nursing home residents. (Schedules III–V follow federal + state standards of care.) (Online Sunshine)

Practical tips (FL): Put a templated block in your note for HB 21 (you’ll use it often), and ensure the PDMP check is visible in the chart for every CS. (Online Sunshine)

California (CA)

Key rules at a glance

• PDMP (CURES): Consult CURES no earlier than 24 hours (or prior business day) before first prescribing a Schedule II–IV CS and at least every 4 months while it remains in the treatment plan. (Program now encompasses Schedules II–V). (Justia Law)

• Naloxone co‑prescribing (AB 2760): Offer naloxone (and provide overdose education) when risk factors exist—e.g., dosage ≥90 MME/day or opioid + benzodiazepine. (Medical Board of California)

• Telemedicine / exam standard: You must have an appropriate exam and indication; telehealth can satisfy the exam if you meet the standard of care (CA BPC § 2242). (Medical Board of California)

Practical tips (CA): Add a CURES‑checked line to your CS template (initial + every 4 months). If dose creeps toward ≥90 MME—or there’s a benzo on board—document that you offered naloxone and provided counseling. (Justia Law)

New York (NY)

Key rules at a glance

• E‑prescribing: Mandatory for all prescriptions (controlled & non‑controlled) since March 27, 2016. (New York State Department of Health)

• PDMP (I‑STOP): Consult PMP within 24 hours before prescribing any controlled substance; document the lookup (or why an exception applied). (Legal Information Institute)

• Acute pain limit: Initial opioid prescription for acute pain is limited to 7 days. (New York State Department of Health)

• Naloxone co‑prescribing: With a patient’s first opioid Rx each year, co‑prescribe naloxone if risk factors apply(e.g., ≥90 MME/day, sedative‑hypnotic use, SUD history). Effective 2022. (New York State Assembly)

• Telemedicine: NYSDOH finalized rules in 2025 aligning CS telemedicine prescribing with federal allowances. Translation: what DEA permits, NY will accommodate—plus any state‑specific guardrails. (Local: NY - New York County New York)

Practical tips (NY): Build I‑STOP checks into your workflow (the “within 24 hours” rule is strict). For first‑of‑year opioid scripts, screen for risk and co‑prescribe naloxone when triggered. (Legal Information Institute)

Illinois (IL)

Key rules at a glance

• PDMP (ILPMP): Prescribers must register and document an attempt to check ILPMP before an initial Schedule II opioid prescription (with oncology/palliative and short‑supply exceptions). (Illinois General Assembly)

• Day‑supply/MME cap: Illinois does not impose a uniform 3‑ or 7‑day acute pain cap akin to Florida or Michigan; oversight focuses on PDMP checks and clinical standards (plans may still apply edits). (Illinois General Assembly)

• Telehealth: The Telehealth Act permits practice via telehealth consistent with scope/standard of care; prescribers must also comply with general medical practice statutes (e.g., licensure). (Illinois General Assembly)

Practical tips (IL): The legal hurdle is the first‑fill PDMP check; the operational hurdle is plan edits (see Section 4). Keep ILPMP lookup proof in the note. (Illinois General Assembly)

7) Practical checklists you can paste into your SOPs

A) Before any controlled‑substance prescription

• Confirm indication & exam meet standard of care; document risk–benefit. (Required everywhere; explicit in CA.) (Medical Board of California)

• PDMP check per your state rule (see above). Keep the result or audit trail in the chart. (Legal Information Institute)

• EPCS + 2FA: sign electronically with compliant software; ensure access controls. (eCFR)

• If Schedule II and partial fill is appropriate, document who requested it (patient/prescriber) and ensure any remaining quantity is dispensed within 30 days (72 hours for an emergency oral Rx). (Legal Information Institute)

• Consider naloxone when state law or risk profile suggests it (e.g., ≥90 MME/day or opioid + benzo in CA/NY). Provide brief overdose education; document the offer. (Medical Board of California)

B) Telemedicine‑specific

• Verify federal telemedicine status (Ryan Haight extension through Dec 31, 2025; buprenorphine rule in effect) andthe state telehealth rule (e.g., Florida’s Schedule II limitations). (IHPI)

• Use a platform/workflow that captures patient ID, consent, exam components, and EPCS.

• If prescribing buprenorphine for OUD: No X‑waiver needed, but check any state nuances and ensure Schedule III authority & required training. (SAMHSA)

C) Medicare Part D patients

• Aim for ≥70% EPCS rate on Part D CS prescriptions each year (after CMS exceptions). Check your CMS EPCS portal status if needed. (Centers for Medicare & Medicaid Services)

• Anticipate plan safety edits: initial opioid fills for naïve patients, high daily dose flags, duplicate therapy, and risky combos. Exemptions (hospice, cancer) exist but must be coded correctly. (Centers for Medicare & Medicaid Services)

8) FAQs (fast answers you can give to patients & pharmacists)

Is there a single federal MME cap?
No. CDC’s 2022 guideline warns against rigid thresholds; plans and some states use MMEs for edits or triggers, but they are not universal limits. Document individualized care. (CDC)

Can I e‑prescribe controlled substances from my phone?
Yes—if your software is DEA‑compliant and you use two‑factor (e.g., biometric + password). (DEA Diversion Control Division)

Can my patient move an EPCS prescription to another pharmacy?
Yes. Since Sept. 1, 2023, electronic CS prescriptions can be transferred between retail pharmacies at the patient’s request. (DEA)

What about Schedule II partial fills?
They’re permitted; for patient/prescriber‑requested partials, all fills must be completed within 30 days of the Rx date (different timing for emergency oral). Chart it. (Legal Information Institute)

Telemedicine for buprenorphine?
DEA finalized telemedicine allowances for buprenorphine; the federal extension of telemedicine flexibilities runs through Dec 31, 2025 while rules roll in. Still follow state rules. (Federal Register)

A few forward‑looking cautions

• DEA telemedicine rules beyond buprenorphine are still being finalized; the temporary extension holds through Dec 31, 2025. Plan to update SOPs Q1 2026. (IHPI)

• CMS opioid edits and Part D EPCS compliance targets are alive and evolving (annual memos). If you see more rejections in January, it’s not personal—it’s the new plan year. (Centers for Medicare & Medicaid Services)

• State naloxone‑co‑prescribing mandates keep spreading. Don’t treat CA/NY as outliers; they’re often bellwethers. (Network for Public Health Law)

Source notes (selected, high‑value)

• DEA: Purpose & corresponding responsibility; issuance; partial fills; EPCS; EPCS transfer. (Legal Information Institute)

• Telemedicine: Ryan Haight & telemedicine definition; federal extensions & buprenorphine rule. (Department of Consumer Affairs)

• CMS: EPCS program & FAQs; opioid safety edits resources. (Centers for Medicare & Medicaid Services)

• Private payer examples: CVS Caremark, Express Scripts, Optum Rx opioid programs.

• CDC Guideline (2022): caution against rigid MMEs. (CDC)

• MI: acute limit; MAPS obligations. (Michigan Legislature)

• FL: HB 21 limits; PDMP consult; telehealth restrictions. (Online Sunshine)

• CA: CURES mandate; AB 2760 naloxone; exam standard. (Justia Law)

• NY: eRx; PDMP; 7‑day acute limit; naloxone co‑Rx; 2025 telemedicine alignment. (New York State Department of Health)

• IL: ILPMP initial‑fill check; Telehealth Act. (Illinois General Assembly)