Prescription drug monitoring programs: what mandated checking has and has not been shown to do

1 The question, and the short answer

A prescription drug monitoring program (PDMP) is a state database of dispensed controlled-substance prescriptions that prescribers and pharmacists can query for a patient's history. Early programs left the query to the prescriber's discretion, and few providers participated.¹ States responded by requiring the check. The requirement is now also federal for Medicaid: since 1 October 2021, every state Medicaid program has had to require participating prescribers to check a PDMP before prescribing a Schedule II controlled substance to an enrollee.² The 2022 CDC opioid guideline recommends PDMP review when opioids are started and periodically during long-term therapy.³

A mandate to check is an intervention, judged by what it changes. Three outcomes recur in the literature: prescribing, multiple-provider episodes (“doctor shopping”) and overdose. The evidence on each differs in quality and, in places, in direction.

Mandates reliably increase use of the database, though compliance at the moment of prescribing falls well short of what statutes require. Must-access laws reduce prescribing volume and multiple-provider episodes, and part of the reduction falls on patients the check was not designed to catch. The overdose evidence is mixed, and several studies associate mandates or other PDMP policies with more heroin or synthetic-opioid deaths as the prescription supply contracted. The algorithmic risk scores now attached to many PDMP reports are prediction models whose published validation is thin. Section 3 states Tennessee's requirement exactly; a free online copy of its rules still shows a superseded version.

2 A mandate is a design, not a single policy

“Mandatory PDMP” covers laws that differ in who must check, what triggers the check, which drugs are covered, how often it repeats, which patients are exempt and whether a delegate may run the query. The differences matter. Buchmueller and Carey, using Medicare Part D data, found that must-access PDMPs significantly reduced measures of misuse, PDMPs without such provisions had no effect, and effects were stronger where providers had to check under broad circumstances rather than only when suspicious.¹ Strickler and colleagues, studying the mandates Kentucky, Ohio and West Virginia adopted between 2010 and 2015, suggested that variation in the laws themselves may explain why effects varied across the three states.⁴

The federal floor is 42 U.S.C. § 1396w-3a, added by § 5042 of the SUPPORT for Patients and Communities Act (Pub. L. 115-271, 24 October 2018).² From 1 October 2021 a state must require covered Medicaid providers, or their designees, to check an enrollee's prescription drug history in a qualified PDMP before prescribing a Schedule II controlled substance, in a timing, manner and form the state specifies; a state may extend the requirement to Schedules III and IV. The history checked must cover at least the most recent 12 months. Patients receiving hospice or palliative care or treatment for cancer, residents of long-term care facilities, and others a state designates are excluded. A provider who cannot complete the check after a good-faith effort must document the effort and the reason.

The CDC guideline states the clinical version. Its Recommendation 9 reads that when prescribing initial opioid therapy for acute, subacute or chronic pain, and periodically during opioid therapy for chronic pain, clinicians should review the patient's history of controlled substance prescriptions using state PDMP data “to determine whether the patient is receiving opioid dosages or combinations that put the patient at high risk for overdose.”³ It is graded recommendation category B, defined as individual decision-making needed, with evidence type 4: clinical experience and observations, observational studies with important limitations, or randomized trials with several major limitations. State mandates are laws, not randomizable treatments, and the evidence on them that follows is quasi-experimental or observational throughout.

3 What Tennessee requires, exactly

Tennessee's PDMP is the Controlled Substance Monitoring Database (CSMD). The check requirement is statutory: Tenn. Code Ann. § 53-10-310(e), part of the Tennessee Prescription Safety Act of 2016 as amended in 2018, read here in the text published in the 2025 Code.⁵ Unless exempted, a healthcare practitioner must check the CSMD before prescribing a covered controlled substance to a human patient at three points: at the beginning of a new episode of treatment; before each new prescription for the first 90 days of a new episode; and “at least every six (6) months when that prescribed controlled substance remains part of the treatment.” A new episode of treatment is a prescription for a controlled substance that the same practitioner has not prescribed within the previous 6 months. A delegate may run the check on the practitioner's behalf.

Covered drugs “include, but are not limited to, all opioids and benzodiazepines,” and the commissioner of health may add other Schedule II–V substances. By rule effective 26 January 2022 the commissioner added Schedule II amphetamines.⁶ Three exceptions apply: a patient receiving hospice care; a quantity no greater than a single three-day treatment period with no refill; and a drug for direct administration during inpatient or residential treatment in a licensed hospital or nursing home. Dispensers must check the first time a patient is dispensed a controlled substance at that practice site and at least every 6 months after. A practitioner who is aware or reasonably certain that a person is seeking Schedule II–V drugs for fraudulent, illegal or medically inappropriate purposes has a professional responsibility to check.

Three further provisions shape enforcement. Under subsection (d) an authorized user is not subject to a suit for civil damages for failing to register in, report to or check the database, or for reasonable reliance on it; subsection (f) instead lets each licensing board set procedures and penalties. Subsection (a) requires every practice site where controlled substances are prescribed or dispensed to provide electronic access to the database whenever a practitioner is providing care; under subsection (c) a violation carries a civil penalty of up to $100 per day, imposed only for a continued pattern or practice of not providing access. Subsection (g) provides that a practitioner or delegate is not in violation while the database is suspended or not operational, or when the internet is unavailable.

A superseded rule is still in circulation. Board of Pharmacy rule 1140-11-.07, in its 2013 form, required a prescriber to check at the start of treatment and then “at least annually,” and exempted quantities up to a single seven-day treatment period. The Board deleted rules 1140-11-.05 through .07 by amendments effective 26 January 2022.⁷ The Legal Information Institute's online copy of the Tennessee regulations still displays the 2013 text. An account of Tennessee law that describes an annual check or a seven-day exemption is reading superseded text; the Department of Health's program page states the statute's schedule.⁸

The department lists data-sharing agreements with 32 states, among them Georgia, Alabama, Kentucky, North Carolina and Virginia, and one-way sharing with the Military Health System's program.⁸ Its 2025 report to the General Assembly names PMP InterConnect and RxCheck as the exchange routes.⁹ Integration into an electronic record runs through Bamboo Health's PMP Gateway; the department stated that it would cover the integration licensing fees through 31 December 2025, and its page, read in September 2026, gave no later date.⁸

4 Mandates move checking, but less than the statutes imply

Robinson and colleagues reviewed 53 US studies of whether providers use PDMP data, 46 of which reported on use. The pooled proportion who had ever used it was 0.57 (95% CI 0.48 to 0.66), and the recurring barriers were time and administrative burden, low perceived value of the data, and poor system usability.¹⁰ “Ever used” is a low bar. It says nothing about use at each prescription.

Mandates raise the rate. Strickler and colleagues found that mandatory-use laws in Kentucky, Ohio and West Virginia increased prescriber registration and PDMP use relative to control states.⁴ Tennessee's figures, without a counterfactual, point the same way: patient queries rose 31% from 2023 to 2024, and Gateway integrations in production rose 44.3%.⁹

Compliance at the moment of prescribing is another matter. Hoppe and colleagues linked electronic health record and PDMP data for 35,461 opioid-naive adults prescribed an opioid between May 2018 and May 2019 in one large academic-affiliated Colorado health system, under a law that limited first prescriptions to a 7-day supply and required PDMP review before a second.¹¹ Of the 9,423 patients who received a second prescription, 13.1% had a documented PDMP review. Review was not associated with reduced chronic opioid use or health care visits, and it was more common among patients with worse outcomes, which the authors suggest reflects potential confounding by patient complexity. A statute that requires a check does not establish that the check happens, and a check that is not recorded cannot be counted.

5 Prescribing falls, and not only for the patients the check targets

The strongest evidence comes from designs exploiting staggered adoption across states. Beyond Buchmueller and Carey's Part D result,¹ Meinhofer, using cross-state data from 2000 to 2013, found that neither PDMP implementation nor direct access had a significant effect, but found evidence suggesting that required PDMP use reduced prescription opioid quantities by 9% and stimulant quantities by 11%.¹² Dowell and colleagues, using national prescription audit and mortality data for 2006 to 2013, found that mandated provider review combined with pain clinic laws reduced opioid amounts prescribed by 8%; the estimate is for the two policies together.¹³ Strickler found decreases in the multiple-provider episode rate, opioid prescribing, overlapping opioid prescriptions and overlapping opioid–benzodiazepine prescriptions in Kentucky and Ohio, with magnitudes varying among the mandate states.⁴

Lee and colleagues, using claims from 23 million commercially insured patients for 2007 to 2018, found mandatory PDMPs associated with decreases in the proportions of patients taking opioids (−0.729%; 95% CI −1.011% to −0.447%), with overlapping opioid claims, with daily doses above 90 morphine milligram equivalents and engaged in drug seeking; the authors label the design cross-sectional.¹⁴

Smith and colleagues' 2023 systematic review counted 56 experimental and quasi-experimental studies published from 2016 to 2023.¹⁵ Of 32 evaluating more comprehensive PDMP legislation, 29 found overall opioid volume fell and 3 found no change; of those evaluating less comprehensive legislation, 7 found decreases and 8 found no change; all 6 evaluating mandated use found fewer risky prescriptions. This is vote counting, not pooled effect sizes: it reports direction without magnitude. Wilson and colleagues' 2019 review is the contrast. Across 24 studies with data from 1993 to 2014, largely before comprehensive mandates, they found no evidence of an association between monitoring programs and decreased prescribing or dispensing overall, and only limited, inconsistent evidence of reductions in Schedule II opioid prescribing and dispensing and in multiple-provider use.¹⁶ The databases existed in both periods. What changed was the obligation to look.

Who absorbs the reduction deserves more attention than it receives. Buchmueller, Carey and Meille compared Kentucky, whose 2012 law they describe as the first comprehensive state policy requiring providers to access patients' opioid histories, with Indiana, using every prescription filled in both states.¹⁸ A significant share of low-volume providers stopped prescribing opioids altogether, though this accounted for a small share of the fall in total volume. The main margin of response was prescribing to fewer patients. Providers disproportionately stopped treating patients whose histories showed multiple providers, but there were also economically meaningful reductions for patients without multiple providers and for single-use acute patients. A mandate works partly as information and partly as general deterrent, and the second channel does not distinguish the patient the law was written for from anyone else.

6 On overdose, the evidence is mixed and the supply moved

Fink and colleagues' systematic review found 17 eligible studies.¹⁹ Low-strength evidence from 10 of them suggested that fatal overdoses fell with PDMP implementation, and the program features associated with fewer deaths included mandatory provider review, provider authorization to access the data, frequency of reports and monitoring of nonscheduled drugs. Three of six studies found heroin overdoses increased after implementation, and the authors judged the evidence that PDMPs either increase or decrease nonfatal or fatal overdoses largely insufficient. Rhodes and colleagues, reviewing 22 studies covering 49 PDMPs, found limited evidence of overall associations between PDMPs and reductions in opioid-related consequences.²⁰ Puac-Polanco and colleagues, restricting outcomes to prescription opioids, found reduced mortality in 4 of 8 studies in the deaths domain, while reporting that mandatory access provisions were associated with reductions across domains including mortality.²¹

The picture changes when studies look past prescription opioids. Dowell's combination of mandates and pain clinic laws reduced prescription opioid overdose death rates by 12%, with relatively large but statistically insignificant reductions in heroin overdose deaths.¹³ Meinhofer found prescription opioid and benzodiazepine deaths fell by 9% and 13% after required use, with weak evidence that illegal-drug deaths rose.¹² Kim, in a difference-in-differences analysis, found strong evidence that must-access PDMPs increased heroin death rates: two years after implementation, 0.9 more heroin deaths per 100,000 per half-year relative to control states, which in the author's reading offsets any reduction in prescription opioid deaths.¹⁷ Mallatt, studying PDMPs and pill mill laws, found evidence that state policies caused increases in rates of heroin possession and dealers, similar in magnitude to the effects of the OxyContin reformulation.²² Lee found mandatory PDMPs associated with fewer deaths from natural opioids (−518.5 per 300 million people; 95% CI −728.5 to −308.5) and methadone, while PDMP access policies were associated with more deaths from synthetic opioids (380.3 per 300 million; 95% CI 149.6 to 610.8).¹⁴

Tennessee's figures show why the question is now harder. Between 2017 and 2024, morphine milligram equivalents dispensed to Tennessee patients fell 54.2%, and the number of patients meeting the department's definition of potential doctor and pharmacy shopping, five or more prescribers and five or more dispensers within 90 days, fell 79%.⁹ In 2023 fentanyl was involved in 2,720 deaths, 75% of the state's drug overdose deaths, and 22% of overdose decedents had a controlled substance dispensed within 60 days of death. The database sees what pharmacies dispense. For nearly four in five of those who died, it held no controlled-substance dispensing record in the preceding 60 days.

7 A risk score is a model and owes a model's evidence

Many PDMP reports now carry algorithmic scores. One is NarxCare, a proprietary platform that Oliva describes as producing three-digit scores from 000 to 999 that purport to assess risk of misuse, diversion and overdose.²³ Oliva argues that its proxies likely produce artificially inflated scores for marginalized patients, including women, racial minorities, and poor and rural patients, and that the FDA has authority to regulate PDMP risk-scoring software as a medical device and should exercise it. It is a legal-policy argument, not an empirical finding, but it names what an evaluation would have to test.

The published validation is thin. McElfresh and colleagues, writing from Stanford and the Department of Veterans Affairs, identified three public studies of the NarxCare overdose risk score, drawn from small cohorts in Ohio, Indiana and Michigan.²⁴ Those studies found the score somewhat predictive of opioid-related outcomes and comparable with simpler red-flag methods. They report that no subgroup analysis of the score exists, although its predictive utility may vary with demographics, insurance status and access to care, and that it has never been clinically evaluated, for instance for effects on overdose rates or mortality. They also note that the vendor's materials describe the score as intended for raising awareness while its user guides recommend specific prescriber actions.

One independent validation shows what has been measured. Cochran and colleagues compared the platform's Narcotic Score with the WHO Alcohol, Smoking and Substance Involvement Screening Test in 1,464 patients at 19 pharmacies of a national chain in Ohio and Indiana, from November 2019 to October 2020.²⁵ Agreement was fair: area under the curve of at least 0.70 and kappa 0.35. Of all patients, 17.2% were rated at elevated risk by the score but low risk by the screening test, and 13.4% the reverse. The study was funded by the National Institute on Drug Abuse; the vendor, Appriss Health, supplied the scores and took no part in design, conduct or analysis. It establishes concurrent agreement with a self-report screen. It does not establish that the score predicts overdose, or that acting on it helps.

Buonora and colleagues argue that FDA guidance appears to support treating the tool as a medical device, that its data elements have not been made public for external validation, and that no published study had examined the relationship between Narx Scores and relevant clinical outcomes; they describe patients with cancer flagged for doctor and pharmacy shopping.²⁶ A score of this kind is a clinical prediction model. It owes its users what any such model does: published discrimination and calibration on the population where it is used, performance by subgroup, external validation and evidence that acting on it improves outcomes. By those standards the public record is incomplete.

8 What a record needs if the check is to mean anything

These findings translate into properties, not features.

1. The check is an event, not an attestation. It should record the time, who ran it, which states' data returned and the prescription it preceded. The Colorado health system's 13.1% is as much a documentation rate as a checking rate;¹¹ an unrecorded check is indistinguishable from none.
2. The schedule is computable. Tennessee's requirement is a function of the practitioner's own 6-month lookback, a 90-day window, a 6-month interval, a drug list and three exceptions.^5,6 A system holding the prescribing history can say when a check is due instead of prompting on every prescription.
3. An outage is a fact to record. Tennessee excuses non-compliance while the database is down,⁵ and the Medicaid statute requires documenting a failed good-faith attempt.² Both assume the attempt left evidence.
4. Show the history, not only the score. The score is an incompletely validated model;^24,25 the dispensing history beneath it is data. Turning a score into a hard stop makes the least-evidenced element of the report the decision.
5. Coverage must be visible. Interstate data depend on agreements between programs;⁸ a report should say which states answered, so that an empty result is not read as a clean one.
6. Query counts measure compliance, not effect. The check exists to find dosages or combinations that put a patient at high risk,³ and the Kentucky evidence shows reductions also fall on patients without multiple providers.¹⁸ What follows the check is the outcome to measure.

9 What survives

Six statements are supported. Mandates increase use of the PDMP, though compliance at the prescription remains incomplete.^4,10,11 Must-access mandates reduce opioid prescribing and risky-prescribing measures, and broad triggers outperform suspicion-based ones.^1,12,15 The reduction is not confined to patients using multiple prescribers.¹⁸ Overdose effects are mixed, with several studies finding more heroin or synthetic-opioid deaths, or more heroin activity.^{14,17,19,21,22} The CDC's PDMP recommendation rests on evidence type 4.³ And no published clinical evaluation shows that proprietary PDMP risk scores improve outcomes.^24,26

What would settle the open question is not another count of queries. It is evaluation built for the fentanyl era: studies that follow the patients whose prescriptions changed after a check, measure all overdose rather than prescription-opioid deaths alone, and separate a mandate's information effect from its deterrent effect. For risk scores the requirement is ordinary: publish the model's performance where it is used, by subgroup, and test whether acting on it helps. Until then a mandated check is best described as the evidence describes it: a reliable lever on prescribing, and an unproven one on death.