Principles of Safe Opioid Prescribing: Creating a Bulletproof Practice

Image of a pharmacist holding a bottle of prescription opioid pills.

The Centers for Disease Control and Prevention (CDC) guidelines have harmed providers and patients. That line is written clearly and in bold in the June 16, 2020, AMA Paper Drafted by the Chief Medical Officer of the CDC.

The “standard” that was once touted by the federal government and state medical boards as the definitive “standard” for opioid prescribing is now under attack by its creators.

While this may be a great step for pain treatment advocates, it leaves the pain management community without a clear medical standard for which to adhere.

That’s why we’ve drafted the “Principles of Safe Opioid Prescribing.”

This medicolegal guide designed to be a resource for providers seeking to comply with federal laws related to controlled substance prescribing, and is made of three sections:

Through our experience and extensive research, the healthcare attorneys at Chapman Law Group have identified practical tips to increase your patient care and decrease your risk of government investigation or prosecution.

As a provider who prescribes controlled substances, you are justified in your fear of government intervention. However, by following a few easy steps and obtaining the right compliance advice, you can focus on the practice of medicine free from worry about the state medical board, malpractice suits, or federal prosecution.

Ronald W. Chapman II, J.D., LL.M., is a healthcare fraud defense attorney and a medicolegal expert in the area of opioid prescribing, DEA compliance, and healthcare compliance. He has delivered CME-approved lectures on safe opioid prescribing to institutions across the U.S. and has published works in healthcare periodicals regarding safe opioid prescribing. In addition, Chapman has defended hundreds of physicians and practices from healthcare fraud charges, DEA investigations, and federal indictment.

A pharmacist stocking their supply of opioid prescriptions.

The 2016 CDC guidelines and their misapplication by state boards and federal prosecutors rippled through the pain management community to cause one of the largest public health crises in modern history.

The confusion created by the overcriminalization of healthcare in this country has caused treatment to legitimate patients to be delayed, disorganized, inaccessible, and ineffective. Providers are forced to speed up treatment because of low reimbursement by insurance companies, while at the same time improve quality of care and documentation.

The impossible hurdles created by increased (and often confusing) standards of care for pain management have cause snap judgments to be made. These have resulted in hard dosing limits, rapid discharge of patients, undertreatment of dependence and addiction, and a dwindling number of pain management physicians in heavily targeted states like Michigan, Ohio, Texas, California, and Florida.

The hotly contested 2016 guidelines were quickly touted by federal prosecutors and boards as a “new standard of care.”

Among the disturbing prescriber habits created by the CDC guidelines:

  • Hard prescribing thresholds
  • Discharge instead of referral for addiction treatment
  • Refusal to prescribe adequate pain treatment for urgent or emergent care
  • Increased urine drug screen usage out of fear of scrutiny
  • Insurance denying pain therapies and alternative medications
  • Lack of support for co-occurring mental health disorders

It is not hard to find examples of American corporations, state boards, and prosecutors mis-applying the guidelines causing widespread undertreatment of pain:

  • Walmart created a policy that requires a 50MME or 7-day threshold for opioid prescribing.
  • CVS has a policy including a 7-day hard threshold for opioid prescribing.
  • OptumRx created a policy aligning with the CDC guidelines.
  • Walgreens created a policy that has yet to be disclosed, but it has resulted in the arbitrary refusal of opioid prescriptions.
  • Blue Cross Blue Shield has a 7-day hard threshold for prescribing.
  • Michigan enacted a law prohibiting the prescription of opioids for acute pain for more than 14 days.
  • More than 30 other states have passed laws restricting physician choice in prescribing opiates.
  • The U.S. Department of Justice (DOJ) created the Opioid Fraud and Abuse Detection Unit, which uses statistical data through the lens of the CDC guidelines to find “red flag” prescribing.

Then, in 2020, the AMA drafted its bold call for the CDC to modify the guidelines and reaffirm a need for individualized patient care for patients with pain.

While the CDC guidelines are being reconsidered, it will take significant time to walk back the damage created by the guidelines and impact change at the federal, state, and corporate levels. However, by following the tips in this guide and ensuring a compliant medical practice, you can increase your patient care and avoid, even eliminate the risk of government intervention.

A healthcare lawyer discussing how to keep the Department of Justice out of practices to a doctor

The best way to ensure that employee errors, misconduct, billing mistakes, or controlled substance diversion avoid scrutiny from the federal government is to establish a compliance program, designed to spot and correct deficiencies before the government becomes aware.

The DOJ and U.S. Department of Health and Human Services Officer of Inspector General (OIG) affirm that even if the program fails to spot a deficiency, having a sincere culture of compliance and a well-designed program can eliminate or significantly reduce culpability and therefore the risk of fines, and prosecution.

In 2000, the OIG issued guidance saying that practices billing Medicare and Medicaid are “strongly encouraged” to have a compliance program. In 2020 the DOJ issued guidance designed to instruct businesses on what the DOJ considers when assessing businesses and individuals for civil enforcement and prosecution.

But although medical practices are required to have a compliance program, most don’t.

An effective compliance program is a proactive measure. It can reduce fines and penalties resulting from healthcare fraud investigations and prosecutions by reducing the practice’s culpability. By creating a compliance program, you will set your practice apart from 90% of medical practices.

First, it’s important to know what a compliance program actually is and isn’t.

A compliance program is not:

    • A cookie-cutter manual purchased from an organization.
    • A thought process existing in the mind of the owner or partners of the practice.
    • A completely outsourced and delegated audit program.
    • Reliance on a medical biller or untrained support staff for federal guidance.
    • A program borrowed from another organization.

A compliance program is:

    • A well-designed program.
    • Well-resourced.
    • Applied in good faith.
    • Something that honestly assesses the risks of non-compliance.
    • A method of implementing controls to avoid risks.
    • A protocol that monitors compliance through all levels of the practice.
    • A system that fully investigates errors.
    • Updated frequently.

What Laws Does a Compliance Program Cover?

A healthcare compliance program should cover the following regulations:

    • HIPAA
    • HITECH
    • False Claims Act
    • Stark Laws
    • Anti-Kickback Statute
    • Healthcare fraud
    • State requirements
    • Medicare Exclusion Statute

Who Should Develop the Compliance Program?

A compliance program should be developed by an internal compliance officer in conjunction with legal counsel, so that the specific needs of the practice can be assessed and the risks of non-compliance, prosecution, and healthcare fraud can be addressed. The plan should be updated with the advice of legal counsel regularly as federal and state guidelines change.

A doctor reading the list of the 7 elements of health care compliance on a laptop.

What are the Seven Elements of a Compliance Program?

The basic elements of an effective compliance program, as put forward by the DOJ, are:

    1. Written policies and procedures and standards of conduct
    2. The establishment of a compliance officer
    3. Training and education tailored to risks of the organization
    4. Establishing a culture of communication about compliance
    5. Enforcement of policies and procedures through discipline
    6. Monitoring and auditing
    7. A prompt response to corrective action

In addition to the basic elements of an effective compliance program put forward by the DOJ, an effective healthcare compliance program for even small practices should have the following elements, in order to ensure proper controlled substance compliance and healthcare fraud prevention:

    • Employee background checks
    • Employee exclusion review
    • Employee training and certification program
    • Routine code and chart auditing
    • A requirement to report improper billing practices
    • Specific education on healthcare fraud prevention
    • A controlled substance policy and procedure
    • Specific standards of conduct pertaining to patient care
    • A HIPAA compliance policy
    • An Anti-Kickback policy
    • A False Claims Act policy
    • Whistleblower hotline or email address
    • An audit plan deterring fraud and abuse

How to Create a Compliance Program

Step 1: Select a Compliance Officer

Creating a compliance program requires specific knowledge of the practice, risks of non-compliance, and operational needs of the practice. The compliance plan begins with designation of the compliance officer.

For a large organization, this should be someone whose full-time position is that of a dedicated compliance officer; for a smaller organization, this can be someone who also performs another job. However, the compliance officer should be separate from the person who performs day-to-day billing tasks, in order to provide oversight over those who interact with insurance companies and CMS.

Step 2: Assess Risks

You and your counsel must perform a risk assessment. Note that risks vary by practice; for example, if you are an interventional pain management practice, your risks will be much different than a family practice. This risk assessment should be documented in your compliance plan. Your risk assessment will drive future compliance objectives such as your audit and investigation plan.

Here are examples of potential risks:

    • Drug diversion by employees
    • Drug diversion by patients
    • False claims of fraudulent billing
    • Workplace harassment
    • HIPAA/data privacy breach
    • Hiring an excluded individual

Some risks have a high probability of occurring, such as drug diversion of a potential patient or the risk that an item or service is improperly coded. Other risks have a low probability of occurring, such as hiring an excluded individual.

After we list our risks, we must organize them by placing risks that have a high severity and high probability at the top of the list, and putting risks with a low probability and a low severity at the bottom.

Understanding the compliance risks that a practice faces and their probability and severity will drive future decisions about how to address the risks and how to create controls that reduce the probability and severity of a risk.

Step 3: Create Policies and Procedures Addressing Risks

Whether you’re a Fortune 500 company or a two-physician general practice, any organization speaks through its policies and procedures. If you have policies and procedures, but you’re not adhering to them, that’s worse than not having them at all: it tells the government that your practice has the knowledge and capability of being compliant, and it simply chooses not to be.

The best policies and procedures are practical and aligned with your operational goals. If too many policies and procedures are in place, your staff will never follow them; at the same time, if you don’t have enough, you find yourself exposed to compliance risks.

Your policies and procedures need to be kept at the forefront of the organizational mind, referred to often, and adherence to them must be enforced. In addition, your policies must be frequently updated; that way, they remain aligned with compliance risks.

Follow these steps to ensure your policies and procedures are acceptable:

    • They are designed by the organization and its counsel.
    • They are comprehensive to cover all operational risks.
    • They are accessible to the staff, counsel, and regulators.
    • They are integrated at all levels of the medical practice.

Step 4: Train Staff on Policies and Procedures and Compliance Risks

Even small medical practices are required to ensure that their employees have the required training and certification to conduct their jobs. Documentation of training should be kept in employee files in order to produce to regulators if the need arises. Copies of certificates of required CME, degrees and licenses, and courses attended are valuable in proving that the practice takes seriously the need for compliance training.

In addition, medical practice employees should receive annual healthcare fraud and controlled substance compliance training specifically designed to address the risks of healthcare fraud, overprescribing, overdose, and diversion.

Step 5: Set Up a Confidential Reporting Structure and Investigation Process

Whether by way of a confidential email address or hotline, every business can easily set up a confidential reporting medium, so that any employee has the ability to freely and anonymously raise a compliance concern.

The False Claims Act rewards employees who file claims against their employers for healthcare fraud, incentivizing employees to withhold information pertaining to non-compliance and anonymously report to the DOJ. However, establishing a confidential reporting structure and mandating that employees report suspected non-compliance and fraudulent conduct will ensure that any whistleblower who failed to follow policy will not be highly regarded in the eyes of government regulators.

Management must review complaints reported through this process, and formally document and investigate the resolution of complaints. Some complaints may require a small investigation, requiring only a few questions that could result in case closure, while others may require significant investigation by outside counsel.

Investigations must be properly scoped and sourced by qualified personnel. For instance, let’s say an employee complains that a code being used is the improper code, but she felt pressured to continue to bill a certain code. An investigation should be conducted by outside counsel to determine whether that specific code is appropriate, and, if it is not, the entity should seek advice on how to handle the insurance overpayment.

Burying your head in the sand is no longer a viable strategy for healthcare practices. The government has been very successful in prosecuting non-compliance and seeking damages up to three times the value of the overpayment should the government be required to investigate the matter. On the other hand, if the practice reports the overpayment and reverses claims, damage to the company may be much less.

Step 6: A Prompt Response to Corrective Action

Private and governmental third-party payors are within their rights to conduct audits and investigations of healthcare providers. After all, they are the ones paying out claims under their conditions of payment.

When these payors commence an audit, survey, or investigation, and they conclude that some aspects of that healthcare practice are not in compliance with healthcare laws, rules, and regulations, they may require that the entity create and implement a corrective action plan (CAP). A CAP assures that conditions-of-payment violations and/or illegal conduct don’t continue.

With a CAP in place and every staff member following it, your practice can identify problem areas and fix them before they become serious, systemic problems — and, more importantly, To convince the government regulator or private carrier that the entity is serious about identifying problem areas and correcting them.

A CAP has six stages:

    1. Identification: What is the problem/discrepancy you’re trying to correct?
    2. Evaluation: What are the things that led to the problem/discrepancy, and how do they impact the healthcare practice overall?
    3. Root Cause Analysis: What really caused the problem/discrepancy? This requires working backward from its outcome and analyzing each variable in the process.
    4. Action Plan: What are the specific steps needed to come up with a solution?
    5. Implementation: When the plan is ready to go, what training, retraining, and re-education will be utilized?
    6. Follow-Up: What are you doing to ensure all processes are conducted in a compliant manner?
A doctor administering a vaccine to a patient.

Patients in pain who rely on opioids for analgesia and improved function deserve access to safe and effective medication; to deprive them of optimal pain relief certainly does them harm.1

Regulatory and governmental agencies and private insurance companies are closely scrutinizing data related to the prescribing habits of medical practitioners, particularly with medications such as oxycodone, fentanyl, hydrocodone and carisoprodol, among others.2 

The agencies look at several factors when reviewing the data to determine whether some amount of action against the practitioner is necessary. These include:

    • Whether a practitioner is writing large numbers of opioid prescriptions;
    • Whether there are groups of people who come in together to obtain prescriptions;
    • Whether the patient is paying cash; and
    • The morphine milligram equivalency of the medication being prescribed.

Based on these data alone, an agency may initiate an investigation or issue a complaint against a practitioner, his/her license, or Drug Enforcement Administration (DEA) registration.

Agencies are increasingly taking the stance that there is the presumption of: “If it wasn’t documented, it didn’t happen.” Although this is an invalid legal presumption to make, it is increasingly becoming the mantra among agencies and the premise for investigations and actions against practitioners.3

The best way for practitioners to defend themselves against such a complicated — and costly — action is to document that the minimum standard of care was satisfied. There is no standard of care mandated by federal law for medical professionals to follow when prescribing opioids.4 The standard of care to apply is defined largely by state law; sometimes aspects are statutorily defined,5 and some are defined by case law.

To the extent federal law plays a part in developing guidance, it requires a prescription for a controlled substance, including opioids, to “be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice.”6

The guidelines in this article, if followed, can assist a medical practitioner in demonstrating that the minimum standard of care was satisfied. The recommendations described in this document are an amalgamation based on the various authoritative guidelines.7-9 

Ultimately, the decision to engage in treatment with opioids is appropriately left to the sound judgment of the practitioner. However, by following and documenting the information discussed below, a practitioner is better positioned to demonstrate that the course of treatment was appropriate and justified.

Initial Assessment

When beginning treatment for chronic pain, an evaluation needs to be conducted to document that the patient has one or more medical conditions indicating that the use of opioids is medically necessary.

Such an evaluation must include an assessment of the patient’s pain and should include documentation detailing the onset of the pain, location of the pain, duration of the patient’s pain, character of the pain, what aggravates the patient’s pain, what relieves the patient’s pain, and the timing of the pain (i.e., morning, afternoon, evening). There should be a discussion as to past treatments and/or medications and the success rates of those medications.

An opioid risk tool should be utilized to assess the patient’s personal and family history of alcohol or substance abuse, and to evaluate the patient’s risk for substance abuse. The opioid risk tool should be included in the patient’s medical records.

Part of the evaluation must be the development of a treatment plan and treatment goals. Some examples of goals include decreasing pain and increasing function, improving pain-associated effects (sleeping issues, depression, anxiety, etc.), screen for treatment side effects, and avoiding unnecessary or excessive medication.

The development of a treatment plan and goals should be completed as early in the process as possible. It needs to be clearly stated and individualized to the patient, such that the patient understands and supports the course of therapy. This plan needs to be updated throughout the course of treatment, so that it continues to be appropriate and realistic.

A treatment plan may require the consultation of, or referral to, other providers, such as addiction specialists or mental health providers. Where appropriate, a treatment plan should include non-drug therapy, such as physical therapy or chiropractic treatment.

There is more skepticism surrounding when opioid therapy should be the sole mode of treatment. If there are justifiable reasons why opioid therapy is the only treatment — such as cost, other treatments having failed, or this really is the best way to treat the pain — they should be documented in the record and supported with additional documentation.

If a patient reports that physical therapy has been attempted and was unsuccessful, a physician should obtain those records, review them, and include them in the patient’s medical file. If, due to a patient’s age and/or condition, physical therapy or interventional procedures would be inappropriate, that also should be documented.

The treatment plan should include an end strategy for treatment. An end strategy should consider whether:

    • The underlying pain has improved or resolved;
    • Intolerable side effects are present;
    • There has been inadequate pain relief;
    • The recommended treatment has failed to improve the patient’s quality of life;
    • The patient has failed to adhere to a treatment agreement; or
    • The patient has presented serious aberrant behavior.
A doctor and a healthcare attorney in a meeting.

Informed Consent

Before prescribing opioids for the treatment of chronic pain, a practitioner should obtain an informed consent agreement and a treatment agreement.

An informed consent agreement should address the following:

    • The limited evidence regarding the benefits of opioid.
    • The potential risks and benefits of opioid treatment, including the risk for addiction, abuse, and misuse.
    • The potential side effects, including respiratory depression, cognitive impairment, or impaired motor skills.
    • The risk for a potentially fatal overdose because of accidental exposure.
    • The potential for interactions with other medications and/or alcohol.
    • For women who are pregnant or of childbearing age, the risks for neonatal exposure to opioids, including the risk for neonatal withdrawal.
    • The practitioner’s prescribing policies and expectations, such as the amount he/she is willing to prescribe and appropriate directions for use, early refills, or violations of the treatment agreement.
    • The reasons as to why opioid treatment may be changed or discontinued.

A treatment agreement should cover:

    • The treatment goals.
    • The patient’s responsibility in taking the medication safely, responsibly, and as directed.
    • Secure storage and safe disposal of opioids.
    • The expectation that the patient will obtain opioids only from one provider or a small group of approved providers, and that they be filled by one pharmacy.
    • The requirement that patients report whether they receive opioids from another prescriber, such as a primary care physician or emergency services provider, or changes to or deviates from the reported pharmacy, such as traveling or moving.
    • The patient’s agreement to screening and monitoring checks, such as random urine drug screens and/or pill counts.
    • How the practitioner plans to cover unforeseen problems or prescribe refills when the practitioner is unavailable.

The informed consent should be signed by the patient, and the treatment agreement should be signed by both parties. One copy of each should be kept in the patient’s file, and one copy should be provided to the patient. 

The treatment agreement should be adhered to by both parties; should a practitioner decide to continue treatment despite a violation of the agreement, the justification for continued treatment should be documented in the record and a new treatment agreement obtained.

Both documents should be updated regularly, at a minimum of once a year or if the treatment program were to change.

Initiating and Monitoring Treatment

Once a decision has been made to initiate opioid treatment, it should start as a therapeutic trial for a defined period of time, not to exceed 30 days. It should be clearly explained to the patient that the trial will be carefully monitored to assess the benefits and harm that may occur, and to evaluate the level of and change in pain, function and quality of life.

The patient will need to visit the practice more frequently for evaluation during the trial period. The patient should be started on the lowest dosage possible, particularly those patients without an established tolerance. The trial period should start with a short-acting opioid before switching to a long-acting/extended-release medication. Should a practitioner believe that higher dosages or a long-acting/extended-release medication would be medically necessary, clear documentation of the reasons for that decision is needed.

Throughout treatment, practitioners need to monitor the patient’s compliance regularly and proactively with the treatment plan. Such compliance checks can include random pill counts, random drug screens, and regular checks of the state prescription drug monitoring program (PDMP).

Some states have laws, regulations, or guidance on how often a practitioner must check the PDMP system. In Delaware, for example, a PDMP and drug screen need to be obtained at least every six months.10 In Michigan, a practitioner must check the PDMP reporting system anytime he or she prescribes or dispenses more than a three-day supply of controlled substances.11

More frequent checks may be necessary for a variety of reasons: a patient also being prescribed a benzodiazepine and/or muscle relaxer concurrently with an opioid; the patient being assessed as having a high risk for substance abuse or misuse; or the patient exhibiting “red flags,” such as aberrant or diversionary behavior. It is necessary to document that a compliance check was performed and the result of it.

A practitioner must monitor the patient’s progress in treatment and toward meeting the treatment goals. If a patient is not making progress toward the treatment goals, a modification should be considered. Furthermore, the presence of aberrant or diversionary behavior requires reconsideration of the treatment plan and may necessitate discharging a patient from treatment.

If a practitioner determines that discontinuance of opioid therapy is required, the practitioner should design a safe tapering regimen and determine other appropriate treatment modalities. For a patient who may be exhibiting signs of dependence or addiction, consultation or referral to an addiction specialist or mental health provider should be considered.

Red Flags and Diversion Behavior

There is no exhaustive list of behaviors that might be considered red flags. However, it is important for a practitioner to recognize such behaviors and to document them in the medical record, as well as what actions have been taken, including discontinuance of opioid treatment or discharging the patient.

Examples of aberrant behaviors include, but are not limited to:

    • Unauthorized self-escalation
    • Inconsistent or abnormal results from a urine drug screen
    • Obtaining opioids from more than one prescriber
    • Utilizing more than one pharmacy
    • Unauthorized or repeated ER visits
    • Concurrent use of alcohol, illegal narcotics or other prescription medication
    • Resisting changes to a treatment plan
    • Resisting nonopioid treatment options
    • Requesting early refills or refills instead of an appointment
    • Prior discharge from another practice
    • Violating the treatment agreement
    • Arrest for drug-related crimes
    • Requesting refills due to lost or stolen prescriptions
    • A history of overdoses
    • Seeing a practitioner far from the patient’s home or receiving medication from a pharmacy that is far from a patient’s home or the practice

The presence of aberrant behaviors must be documented in the record, as well as what actions the clinician is taking. A clinician should document that he/she spoke with the patient regarding the behavior, and the essentials of that conversation should be documented. For instance, if a physician notes that a patient received medication from another provider, he/she should ask the patient why this occurred and document the response.

The presence of red flags does not necessarily require discontinuance of opioid therapy or discharging the patient. Urine drug screens, particularly point-of-care urine drug screens, often can be inaccurate or create false positives. However, by documenting, the practitioner is demonstrating that he/she recognized the aberrant behavior and the reasoning for continuing treatment.

    1. Fishman, Scott F., Responsible Opioid Prescribing: A Physician’s Guide, 2nd ed., Washington, D.C.: Waterford Life Sciences; 2014.
    2. Department of Health and Human Services, Office of Inspector General, Combatting the Opioid Epidemic. Accessed October 2, 2018.
    3. 82 Federal Register 14944 (2017).
    4. Gonzales v Oregon, 546 U.S. 243, 274 (2006).
    5. S. 456.44(3).
    6. 21 C.F.R. § 1306.04(a).
    7. Federation of State Medical Boards. Guidelines for the Chronic Use of Opioid Analgesics. April 2017. Accessed October 2, 2018.
    8. Webster LR, Dove B. Avoiding Opioid Abuse While Managing Pain – A Guide for Practitioners. Forest Lake, MN: Sunrise River Press; 2007.
    9. Pennsylvania Medical Society. Pennsylvania Guidelines on the Use of Opioids to Treat Chronic Noncancer Pain. 2014.
    10. Delaware Prescription Opioid Guidelines for Health Care Providers. Updated February 6, 2017. Accessed October 2, 2018.
    11. MCL § 333.7303a(4)-(5)

If You Have Concerns Over Safe Opioid Practice, Let the National Healthcare Defense Attorneys at Chapman Law Group Help

The health care defense attorneys at Chapman Law Group represent pain management specialists, physicians, chiropractors, and other specialty health practitioners across the U.S. We work out of four national and healthcare defense law office locations:

Contact us today to learn more about what we can do to defend your practice and your livelihood. 

Need an Attorney? Contact us now!
or Call us at: 1 (877) 234-5911

"*" indicates required fields

This field is for validation purposes and should be left unchanged.

Got A Question?

Contact me now to schedule a consultation.

Other Practice Areas​


Related Case Results

Related Blog Posts

Got A Question?

Contact me now to schedule a consultation.
Chapman Law Group Favicon

This website uses cookies to ensure you get the best experience on our website.

Send this to a friend