Arkansas Controlled Substance Prescription Requirements

Arkansas controlled substance prescription requirements center on one core rule: prescriptions for drugs in Schedules II through VI must be sent electronically, with a $250 civil penalty for each violation. On top of that, prescribers have to follow schedule-specific refill limits, check the state Prescription Drug Monitoring Program before writing opioids and first-time benzodiazepines, meet DEA security standards for electronic prescribing, and, if they treat Medicare patients, satisfy a separate federal threshold from CMS.

Who Must E-Prescribe and What It Covers

Under Arkansas Code § 5-64-308, every prescription for a controlled substance in Schedule II through Schedule VI must be transmitted electronically unless an exception applies.¹ Most states stop at the federal five schedules, but Arkansas adds a sixth that covers marijuana, tetrahydrocannabinols, salvia divinorum, and several classes of synthetic cannabinoids.² Prescriptions for those substances are pulled into the electronic mandate as well.

When Paper, Oral, or Fax Is Still Allowed

The statute keeps room for written, oral, and faxed prescriptions in specific situations:

Veterinary prescribers are fully exempt.¹
Prescriptions filled at a pharmacy located outside Arkansas may use a non-electronic method.
Prescriptions the FDA requires to include information that electronic systems cannot capture may use an alternative format.
Standing orders, approved drug therapy protocols, collaborative drug management orders, and prescriptions issued during a public health emergency do not need to go through an electronic system.
Controlled substances prescribed under a research protocol are exempt.
When e-prescribing is temporarily unavailable because of a technology or electrical failure, prescribers may revert to written, oral, or faxed methods.

Refill and Validity Rules by Schedule

Schedule II

A Schedule II substance cannot be dispensed without a practitioner’s prescription, and it must comply with federal law. Schedule II prescriptions carry no refills under either federal or Arkansas law.³

Schedules III and IV

A prescription for a Schedule III or IV drug expires six months from the date it was issued. Within that window it may be refilled up to five times. After five refills or six months, whichever comes first, the prescriber must write a new prescription.³

Schedule V

Schedule V substances may only be distributed or dispensed for a medical purpose. The statute does not spell out refill numbers the way it does for III and IV, but a documented clinical reason must exist for every dispensing event.³

PDMP Checks Before Prescribing

You have to query the Prescription Drug Monitoring Program every time you prescribe a Schedule II or III opioid, and the first time you prescribe a benzodiazepine to a patient.⁴ Licensed oncologists run on a different cycle, checking at the initial malignant diagnosis and every three months while treatment continues.

The check requirement drops away in several clinical settings:

Controlled substances given immediately before, during, or after surgery in a healthcare facility.
Medications administered at the scene of an emergency, in a ground or air ambulance, or in an intensive care unit.
Prescriptions for hospice or palliative care patients.
Residents in a licensed nursing home facility.
Times when the PDMP is inaccessible because of a technological or electrical failure.⁴

DEA Security Setup for Electronic Prescribing

Meeting the state mandate also means meeting DEA rules for electronic prescriptions of controlled substances. Both the prescribing application and the pharmacy application have to be certified against DEA security standards before controlled substance prescriptions can move electronically.⁵

Before you can sign electronic controlled substance prescriptions, you have to complete identity proofing through a federally approved credential service provider or certification authority at NIST Special Publication 800-63 Assurance Level 3. In-person and remote proofing are both acceptable. Inside a hospital or other institutional setting, a designated person verifies the prescriber’s government-issued photo ID and confirms state licensure and DEA registration before issuing a credential.⁵

Every prescription is signed with two-factor authentication that combines two of the following: something you know (a password or PIN), something you have (a hard token kept separately from the prescribing computer), or something you are (a biometric such as a fingerprint). You keep sole possession of the hard token. You cannot share credentials or let anyone else sign prescriptions on your behalf.⁵

An Extra Layer for Medicare Part D Prescribers

If you write controlled substance prescriptions for Medicare Part D patients, CMS expects at least 70% of your qualifying Schedule II through V Part D prescriptions to be sent electronically.⁶ The program applies to any prescriber who issued Part D controlled substance prescriptions during the measurement year, whether or not they formally participate in Medicare.

CMS pulls the numbers straight from Part D claims data, so there is nothing to submit. Long-term care beneficiary prescriptions are excluded from the calculation until January 1, 2028. Prescribers who write 100 or fewer qualifying prescriptions during the measurement year, and those located in a disaster or emergency area as determined by CMS, receive automatic exceptions. Prescribers who cannot hit the 70% threshold for reasons outside their control may apply for a waiver through the CMS EPCS Prescriber Portal in the fall after the measurement year. Non-compliance can be flagged in CMS fraud, waste, and abuse assessments, which can lead to law enforcement referrals or revocation of billing privileges if evidence of fraud is present.⁷

Recordkeeping

Federal law requires every DEA registrant to keep controlled substance records for at least two years from the date of the inventory or record. That covers purchasing records, shipping documents, inventories, usage logs, and disposal paperwork.⁸ Electronic prescriptions create their own audit trail, but the two-year floor still applies to the underlying records. Anything copied during a DEA inspection has to be kept for an additional two years from the date of copying.

Penalties for Non-Compliance

A prescriber who skips electronic prescribing without a qualifying exception faces a $250 civil penalty per violation, imposed by the prescriber’s licensing board.¹ The statute states that this penalty is “in addition to other penalties available under this chapter,” so licensing boards keep their existing disciplinary authority over prescribing violations and can layer additional sanctions on top.

Per-violation penalties add up fast. A practice sending even a few dozen non-electronic prescriptions a month without an exception can rack up thousands of dollars in fines. For prescribers who also treat Medicare Part D patients, missing the CMS 70% threshold opens a second door: fraud and abuse review at the federal level.⁷

1
Justia. Arkansas Code 5-64-308 – Prescriptions – Mandatory Electronic Prescribing
2
Justia. Arkansas Code 5-64-215 – Substances in Schedule VI
3
Justia. Arkansas Code 5-64-308 – Prescriptions
4
Arkansas Department of Health. Rules Pertaining to Arkansas Prescription Drug Monitoring Program
5
DEA Diversion Control Division. Electronic Prescriptions for Controlled Substances (EPCS) Q&A
6
CMS.gov. CMS EPCS Program Requirement At-A-Glance
7
CMS.gov. CMS Electronic Prescribing for Controlled Substances (EPCS) Program
8
eCFR. 21 CFR 1304.04 – Maintenance of Records and Inventories