DEA Recordkeeping for Buprenorphine at MAT Clinics

Since the Consolidated Appropriations Act of 2023 eliminated the DATA-Waiver requirement, any practitioner holding a standard DEA registration with Schedule III authority may prescribe buprenorphine for opioid use disorder. What that change did not eliminate is DEA recordkeeping for buprenorphine. If anything, removing the waiver gatekeeper shifted the compliance burden squarely onto program-level records, and diversion control investigators have taken notice. Program administrators and compliance officers at MAT clinics, office-based opioid treatment settings, and residential programs with induction protocols should treat their controlled-substance records as an audit-ready file set, not a back-office formality.

What DEA Recordkeeping for Buprenorphine Requires at a MAT Clinic

The recordkeeping obligations flow from 21 CFR Part 1304, which applies to every registrant that dispenses or administers controlled substances. Four record categories carry the most audit exposure in behavioral health settings:

• Initial and biennial inventory (21 CFR § 1304.11). A complete, dated inventory of all controlled substances on hand, taken at the opening of business or the close of business on the inventory date. The biennial inventory is due every two years from the date of the last one, not on a calendar-year schedule, which is where programs most often drift.
• Receipt records. DEA Form 222 or CSOS electronic orders for Schedule II, and invoices or packing slips for Schedule III through V including buprenorphine products. These must be readily retrievable.
• Dispensing and administration records. Date, patient identifier, drug name and strength, quantity, and the identity of the person administering or dispensing. In a clinic administering observed induction doses, this is a daily log, not a monthly summary.
• Loss and theft reporting (21 CFR § 1301.76). DEA Form 106 for significant losses, filed upon discovery, with notification to the local field division.

The operative standard across all of these is that Schedule III-V records must be readily retrievable, which regulators interpret functionally: if an investigator asks for six months of buprenorphine administration records and staff cannot produce them within the visit, the record is not readily retrievable regardless of whether it exists somewhere.

Where the Post-MAT Act Gap Usually Sits

Under the waiver regime, patient census limits created a natural forcing function; programs tracked buprenorphine patients carefully because exceeding a cap had immediate consequences. With caps gone, many programs quietly retired the tracking mechanism without replacing it.

The Drug Enforcement Administration continues to publish registrant guidance and diversion control resources; operators should review the current material at DEA Diversion Control rather than relying on institutional memory from the waiver era. Separately, the Substance Abuse and Mental Health Services Administration maintains current guidance on medications for opioid use disorder that intersects with the 42 CFR Part 8 rules governing opioid treatment programs.

Three gaps recur in our compliance reviews. First, the eight-hour requirement for training attestation under the MAT Act applies at DEA registration and renewal, and programs frequently cannot produce the attestation documentation for individual prescribers. Second, biennial inventory dates slip because nobody owns the calendar item. Third, programs that added buprenorphine administration to a residential detox unit never updated the registrant location list, meaning the drug is being administered at an address not covered by the registration.

Reconciling the Perpetual Log Against Physical Count

DEA does not require a perpetual inventory for Schedule III-V substances, but operating without one makes an audit far harder to survive. A defensible workflow looks like this:

Maintain a running log recording every receipt, administration, waste, and return, with a computed running balance. Conduct a physical count on a fixed cadence, weekly is common in higher-volume MAT settings, and reconcile the count against the computed balance. Document every variance, however small, along with the investigation and resolution. A record showing eleven investigated variances over a year, each closed with a documented cause, reads as a functioning control system. A record showing zero variances across thousands of doses reads as a log nobody actually maintains.

Waste documentation deserves specific attention. Partial doses and refused doses require two-witness documentation with both signatures and the disposal method. Sublingual film that a patient declines mid-administration is a genuine waste event and needs the same treatment as any other.

How These Records Intersect With Accreditation and State Licensing

Controlled-substance records rarely stay inside a DEA silo. Joint Commission and CARF surveyors both examine medication management, and state licensing agencies typically incorporate DEA compliance by reference. A finding in one forum often generates parallel exposure in the others. Programs preparing for a survey should pull controlled-substance records into the same evidence binder as the rest of their medication management documentation; our licensing and accreditation consulting team routinely finds that this is the last document set anyone thinks to organize.

If your program is preparing for an accreditation cycle, the medication management standards reviewed during a Joint Commission accreditation survey and during a CARF accreditation survey both assume that storage, access control, count reconciliation, and disposal are documented as a system rather than as isolated practices.

An Operator-Level Audit-Readiness Checklist

Work through the following before an investigator does. Each item should have a named owner and a review cadence recorded in your compliance calendar:

• Current DEA registration certificate on file for every location where buprenorphine is administered or dispensed, with expiration tracked.
• MAT Act training attestation documentation retained for every prescribing practitioner.
• Biennial inventory completed on schedule, dated, signed, and retained for at least two years.
• Perpetual log reconciled to physical count on a documented cadence, with variance investigations closed in writing.
• Two-witness waste documentation for every partial or refused dose.
• Storage security appropriate to the setting, with documented access control and a current key or code holder list.
• DEA Form 106 procedure written, with a named responsible party and a defined discovery-to-filing timeline.
• Employee screening and reporting procedures for suspected diversion, with documented training completion.
• State prescription drug monitoring program query documented at the intervals your state requires.

Programs that hold this checklist as a living document rather than a one-time project tend to move through a diversion investigation as a records review instead of an enforcement matter. Ongoing oversight is also what a fractional compliance officer engagement is designed to provide when a program does not have the internal bandwidth to own it.

Retention Periods and Where the Records Should Physically Live

Federal law sets a two-year minimum retention period for controlled-substance records under 21 CFR § 1304.04, but two years is almost never the operative number for a behavioral health program. State pharmacy boards and state licensing agencies frequently impose longer periods, five years is common, and clinical record retention rules layered on top can extend the practical requirement further. Where requirements conflict, the longest applicable period governs. Programs should document which rule they are following and why, so that a shorter federal citation is never mistaken for permission to purge.

Location matters as much as duration. Records must be maintained at the registered location to which they pertain, separately from other business records, and available for inspection. A multi-site operator that centralizes all controlled-substance logs at a corporate office has created a compliance problem even if the records are impeccable, because the records are not at the registered location where the drug was administered. Electronic records satisfy the requirement provided each site can produce its own records on demand and the system maintains an audit trail that prevents retroactive alteration.

That last point is where general-purpose electronic health records sometimes fall short. If a nurse can edit yesterday’s administration entry without the system preserving the original value, the timestamp, and the identity of the editor, the log will not withstand scrutiny. Ask your vendor to demonstrate the immutable audit trail rather than accepting a general assurance of compliance, and retain the vendor documentation as part of your evidence file.

Where to Start If Your Records Are Behind

If a review of the checklist above surfaces gaps, address them in order of enforcement exposure: registration scope and location coverage first, then inventory and reconciliation, then waste and diversion procedures. Document the remediation as you go, including the date the gap was identified. A contemporaneous record of self-identified correction is materially more defensible than a gap discovered by an investigator.

Our team supports operators through DEA readiness reviews alongside broader behavioral health compliance services. To discuss a records review for your program, call 888-458-6619 or reach us through the contact page.

This article is general regulatory information for behavioral health operators and is not legal advice. Consult qualified healthcare counsel regarding your program’s specific DEA registration, state law obligations, and controlled-substance policies.