A prescription for a controlled substance may be issued only by an individual practitioner who is (1) authorized to prescribe controlled substances in the state in which he or she is licensed to practice and (2) registered or exempt from registration under the CSA (21 C.F.R. § 1306.03).

The definition of individual practitioners includes physicians, dentists, veterinarians, and others authorized in their appropriate jurisdiction to dispense controlled substances. The term also includes those individuals the regulations call mid-level practitioners (e.g., nurse practitioners, nurse midwives, physician assistants, pharmacists). In some states, these individuals are authorized to prescribe controlled substances. (Note: No state grants pharmacists true general prescriptive authority because pharmacists must be dependent on collaborative practice agreements.) Pharmacists in those states must know state law to determine which nurse practitioners and physician assistants can prescribe controlled substances and the scope of their prescriptive authority. Some states grant these practitioners the authority to prescribe only certain controlled drugs or only certain classes of controlled substances. Some states grant authority only in institutional settings and under protocol. Some states have other restrictions and some states have none.

Although only an individual practitioner can issue a controlled substance prescription, an employee or agent of the individual practitioner may communicate it to a pharmacist (21 C.F.R. § 1306.03(b)). Furthermore, a secretary or agent may prepare the prescription for the individual practitioner's signature (21 C.F.R. § 1306.05(f)).

An individual practitioner may not delegate his or her prescriptive authority to an agent unless that agent has been granted prescriptive authority under state law. In practice, pharmacists who call for refill authorization often find it difficult to determine if the individual practitioner has actually authorized the refill. Some situations are obvious, such as when the pharmacist calls for authorization and the office nurse, without hesitation, indicates the refill is permitted. Most likely, the nurse has not communicated with the prescriber, and the pharmacist has a duty to ascertain who is really authorizing the refill. Most situations are not so obvious, however. When the prescriber's agent calls the pharmacist back several minutes later to authorize the refill, for example, the pharmacist can usually assume that the individual practitioner has indeed authorized the refill. The same would apply to voicemail and fax responses from the prescriber's office.

When confronted with a suspicious controlled substance prescription, as occasionally happens, a pharmacist may try to determine whether the prescription is fraudulent by checking the Drug Enforcement Administration (DEA) registration number of the prescriber when the number is not known to the pharmacist. A DEA registration number is a nine-character number consisting of two alphabet letters followed by seven digits. Initially, registration numbers for practitioners registered as dispensers began with the letter A. After all registration numbers starting with A had been assigned, the DEA started new dispenser registration numbers with the letter B. Ultimately, all B numbers were exhausted and new practitioner registrants then received a number starting with the letter F. The DEA also began using the letter G, including for Department of Defense personal service contractors. Registration numbers for mid-level practitioners begin with an M. Distributor registration numbers begin with a P or an R; once the R numbers are exhausted, a new initial letter will be chosen.

The second letter in the registration number is usually, but not always, the first letter of the registrant's last name. If the registrant is a business and the business name begins with a number, the second space contains a number. The next six positions represent a computer-generated number unique to each registrant. The last and ninth position is a computer-calculated check digit and a key to verifying the number.

To check the validity of a DEA registration number, a pharmacist:

1. Adds the first, third, and fifth digits

2. Adds the sum of the second, fourth, and sixth digits, multiplied by 2, to the first sum

3. Determines if the right-most digit of this sum corresponds with the ninth check digit

For example, to check the validity of hypothetical registration number AN1257218 for Dr. Bill Nash, a pharmacist adds the first, third, and fifth digits:

Next, the second, fourth, and sixth digits are added and multiplied by 2:

The sum of 20 and 8 equals 28.

The right-most digit, 8, corresponds to the ninth digit of the registration number. Thus the number could be valid.

In reality, many forgers are familiar with the procedure to verify a DEA registration number and can invent a number that would be plausible. Therefore, pharmacists cannot rely on this check alone to determine the validity of a controlled substance prescription. Previously, as an alternative to verifying a DEA registration, the DEA provided a list of active and retired DEA registrants to the National Technical Information Service (NTIS), a component of the U.S. Department of Commerce. This database of DEA registrants was available from NTIS until 2020. However, since 2020, the DEA took over the management of the database, which is currently available to DEA registrants on the DEA website (https://apps.deadiversion.usdoj.gov/webforms2/spring/validationLogin?execution=e1s1).