DEA Number Lookup, Registration & Verification: 2026 FAQ

For many healthcare organizations and pharmacies, a DEA Registration Number is a critical, highly regulated provider identifier that, if not properly checked and monitored across an entire provider network, can carry significant compliance risk. Despite how common this identifier is, confusion persists around what it is, how to verify one at scale, and how the rules around it keep shifting: from the training now required to obtain one, to when it can support telehealth prescribing, to how the verification process has changed over the years. This guide answers the questions we hear most often from credentialing and compliance teams managing DEA verification across their provider populations.

‍

What Is the DEA Number?

‍

A DEA Registration Number is a unique identifier provided by the Drug Enforcement Agency to medical practitioners like pharmacists, nurse practitioners, doctors, dentists, etc… allowing them to prescribe, dispense and administer drugs defined to be Controlled Dangerous Substances (CDS). Similar to physicians, some states allow Nurse Practitioners (NPs) to prescribe, administer or dispense controlled substances.

‍

Who Requires a DEA Number?

‍

Under the Controlled Substances Act (CSA), any practitioner prescribing, dispensing or administering CDS must have a valid DEA number. However, a DEA Number is not needed if the provider only prescribes Non-Controlled Substance. It’s possible that a physician may operate under a hospital’s DEA number if and when operating within that specific entity.

‍

The MATE Act training requirement: Since June 27, 2023, getting or renewing a DEA registration requires more than paperwork. Under the Medication Access and Training Expansion (MATE) Act, nearly every DEA registrant (physicians, dentists, PAs, nurse practitioners, and pharmacists alike) must attest to having completed at least 8 hours of training on opioid and substance use disorder treatment. Veterinarians are exempt, and two other groups can satisfy the requirement without new coursework: practitioners who are already board-certified in addiction medicine or psychiatry, and recent graduates whose professional program already included 8+ qualifying hours within five years of the June 2023 effective date. Prior training, including the old DATA-Waived (X-waiver) buprenorphine course, also counts toward the total.

‍

This is a one-time obligation, not a recurring one. Once a practitioner has attested to the training, they don't need to repeat it at future renewals. For credentialing teams, that makes it a one-time verification checkpoint worth confirming at initial credentialing rather than something to re-check every renewal cycle.

‍

For teams tracking renewal cycles: DEA registrations run on a three-year cycle, currently carrying an $888 registration/renewal fee as of 2026. DEA sends electronic renewal reminders at 60, 45, 30, 15, and 5 days before expiration, making it worth confirming the registrant's email on file is current, since a missed reminder can mean a lapsed registration and an interrupted ability to prescribe.

‍

Can You Prescribe Controlled Substances via Telehealth?

‍

Yes, but the rules governing it are temporary, and they've been extended repeatedly rather than made permanent.

‍

Since the COVID-19 public health emergency, DEA and HHS have allowed practitioners to prescribe Schedule II–V controlled substances via telemedicine without first conducting an in-person evaluation, provided the encounter meets DEA guidance and applicable state law. That flexibility has now been extended four times. The current extension runs through December 31, 2026, giving regulators more time to finalize a permanent framework, including a proposed rule that would create dedicated "Special Registrations for Telemedicine" for practitioners and platforms that prescribe controlled substances primarily through virtual visits.

‍

A few distinctions worth knowing:

• Audio-video telehealth is permitted for new or existing patients across Schedule II–V substances under the current flexibility.
• Audio-only telehealth is more limited: it's allowed specifically for Schedule III–V medications approved for opioid use disorder treatment, such as buprenorphine.
• Buprenorphine has its own final rule (separate from the broader temporary extension) that specifically addresses prescribing via telemedicine.
• State law still applies on top of federal rules: some states impose additional requirements or restrictions on telehealth prescribing of controlled substances, so credentialing and compliance teams need to check both layers, not just the federal flexibility.

‍

This framework is temporary and could change again, so credentialing programs relying on telehealth prescribers need an active process to monitor for the permanent rule, not an assumption that today's flexibilities are settled policy. Practically, that means a provider's credentialing file for a telehealth-heavy role should capture more than just an active DEA number; it should reflect how they're authorized to prescribe via telemedicine (audio-video vs. audio-only, any state-specific telehealth registration, and whether a buprenorphine-specific pathway applies), since a provider can hold a fully valid DEA registration while still being out of compliance on the telehealth-specific layer.

‍‍

What Is the Purpose of the DEA Number?

‍

Under the CSA, the DEA number is required to be included on prescriptions or orders for any CDS. This is in an effort to limit the ordering of these drugs to only qualified practitioners while also transferring this responsibility to the practitioner (and therefore also their employer).

‍

The DEA Number is designed to have an impact in 3 key ways:

1. Tracking - DEA registration numbers help track where prescriptions and by whom controlled dangerous substances are being prescribed and administered.
2. Accountability - By tracking prescriptions of CDS, the DEA is able to drive accountability amongst both prescribing practitioners and the healthcare institution.
3. Control - Through greater accountability of both provider and institution, the Drug Enforcement Agency aims to maintain greater control of the abuse of controlled substances.

‍

Who Sets the Requirements for the DEA Number?

‍

While Federal law (CSA) requires the DEA number for controlled substances, it’s important to note the licensure and regulation specifically governing these medical professionals primarily occurs at the state level - with some states requiring additional Controlled Substance Registration in order to prescribe.

‍

Because DEA registration operates alongside (not instead of) state licensure and controlled substance registration requirements, verifying a provider's DEA number is really one piece of a broader license verification process.

‍

What's the difference between a DEA number and a state controlled substance license number? A DEA number is a federal registration issued by the Drug Enforcement Administration. Many states separately require their own controlled substance registration or license, issued by a state board, on top of the federal DEA number; the two are not interchangeable, and both may need independent verification.

‍

Can a DEA number be used across multiple practice locations? Generally, no. Federal regulation requires a separate DEA registration for each principal place of business or professional practice where controlled substances are manufactured, distributed, dispensed, or administered. There's a specific, narrower exception: a practitioner registered at one location who also sees patients at another location within the same state doesn't need a separate registration for that second location, as long as they only prescribe there and don't administer, dispense, or store controlled substances on site. The moment a secondary location involves administering or storing controlled substances, its own registration is required. For credentialing teams managing multi-state or multi-site provider networks, this means DEA verification often can't be a one-time, one-number check per provider; it needs ongoing monitoring across every registered location that provider practices from.

‍

DEA vs. NPI Number?

‍

Since DEA Numbers are unique identifiers, insurance companies and pharmacies can often use the number as provider identification - though it’s important to note that it is different than an National Provider Identifier (NPI) number. An initial, yet obvious difference between the two unique identifiers is the issuing agency. The NPI is issued by CMS, while the DEA Number comes from, well...the DEA.

 
‍
The NPI Number, specifically used for Medicare & Medicaid billing, can also be used to identify and track a much broader set of transactions a provider may perform, while the DEA Number is a requirement specifically for prescribing and administering controlled substances.

‍

Similar to how all squares are rectangles, but not all rectangles are squares - All providers with a DEA Number will have an NPI, but not all providers with an NPI will have a DEA number.

‍

How Has DEA Number Verification Changed?

‍

The DEA's own online lookup tool works differently than it used to. Since February 2024, the Registrant Validation Toolset has required multi-factor authentication, meaning a simple name-and-number search no longer returns results. To use it, the credentialer typically needs to coordinate with the provider to receive and enter an emailed access token within a limited window, which has introduced real delays into primary source verification workflows and has been cited as a compliance gap during NCQA, AAAHC, and other accreditation surveys when documentation doesn't clearly show the registration was verified directly against DEA's system. See Verifiable's breakdown of NCQA's PSV requirements for the documentation standard surveyors are actually checking against.

‍

Organizations verifying DEA registrations at any scale generally have three options:

1. Use the public Registrant Validation Toolset directly, coordinating the emailed token with each provider: workable for occasional lookups, but slow at volume.
2. Apply for Registrant Datasets Access (RDA) directly with the DEA, a formal application that DEA reviews and either approves or denies, granting broader ongoing access than the token-based toolset.
3. Work with a verification partner that already holds RDA access (Delegated Credentialing), which removes the per-lookup coordination step entirely and typically documents the verification with a timestamp and source URL: the level of detail accreditation surveyors are now looking for.

‍

It's also worth knowing what the DEA's own tool won't tell you: it confirms whether a registration is currently active or inactive, but it doesn't surface disciplinary history. A provider who previously surrendered a registration during an investigation and later obtained a new one will simply show as "active," with no visible context. Organizations that need the fuller regulatory picture, including exclusions and state board actions, typically need to pair DEA verification with other primary source checks rather than treating it as a standalone answer.

‍

What is a DEA number lookup by NPI, and does it work? Some verification tools allow searching by National Provider Identifier (NPI) as an alternative to searching by name or DEA number directly, which can be useful when the DEA number itself isn't on hand. Results still reflect the same underlying DEA registration data, so the same active/inactive limitations described above still apply.

‍

How do you actually perform a DEA number lookup? For a single, one-off check, the process is manageable. For a credentialing team verifying providers across a growing network, it's a different story, and this is exactly where the friction described above compounds:

If you're a DEA registrant looking up another registrant:

1. Go to DEA's Registrant Validation Toolset login page.
2. Log in using information from your own registration certificate: your DEA number, Application Control Number, or Web Tracking Number.
3. Complete multi-factor authentication: a token is sent to the email address on file for your registration, which you'll need to retrieve and enter within the allotted time.
4. Search for the registrant you're verifying by DEA number and/or name.
5. Review the result: it will confirm active/inactive status, but as noted above, it won't surface disciplinary history.

‍

If your organization doesn't hold its own DEA registration, direct login isn't an option. Access to the Registrant Validation Toolset and Registrant Datasets Access is restricted to DEA registrants. In that case, the two paths are applying for Registrant Datasets Access directly, or working with a verification partner that already holds it.

‍

Multiply those five steps, and the back-and-forth of coordinating an emailed token with each individual provider, across a credentialing file of hundreds or thousands of providers, and the manual process becomes the bottleneck rather than the exception. Verifiable closes this exact gap: DEA is one of Verifiable's direct primary source integrations, alongside CAQH, NPDB, NPI, state licensing boards, and sanctions/exclusions lists, powered by CredAgent, so verification runs as part of an automated PSV workflow instead of a one-by-one manual lookup. Each verification produces a timestamped, source-URL-backed record as it happens, the kind of audit-ready documentation NCQA surveyors expect rather than something reconstructed after the fact. See Verifiable's CVO services for how this fits into a fully outsourced verification workflow, or the Buyer's Guide if you're comparing outsourced vs. in-house verification approaches.

‍

Conclusion

‍

DEA registration is no longer a "check it once and move on" credential. Between the MATE Act training requirement, evolving telehealth prescribing rules, and a verification process that now requires multi-factor authentication or approved database access, staying compliant takes ongoing attention rather than a one-time lookup. That's the same principle behind Verifiable's approach to provider data more broadly: continuous monitoring for expirations, sanctions, and license status, not a point-in-time PSV that goes stale the moment circumstances change.

‍

‍