Part 2 applicable-state PDMP recipient

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.36 permits the qualifying report to the applicable state prescription drug monitoring program. Determining that recipient requires an effective state-law and event analysis. The section also requires prior consent under section 2.31, so the verified recipient and any intermediary must be evaluated against the signed designation.

Resolve jurisdiction from the facts

Current 42 CFR 2.36 refers to the applicable state PDMP. Record program, prescriber or dispenser, professional and facility licenses, event location, patient location when relevant, state source, reciprocity or hub path, reviewer, and decision date.

Authenticate the destination

Verify the official PDMP, production endpoint, certificate or credentials, submitter account, routing intermediary, environment, acknowledgment format, support contact, and change notice. A vendor label or old URL is insufficient destination evidence.

Keep recipient and consent aligned

The consent must satisfy 42 CFR 2.31 and support the recipient designation used. If interstate routing, a data hub, or an intermediary changes who receives the record, document the chain and obtain qualified review before release.

Resolve the applicable jurisdiction

Document the program site, prescriber or dispenser, professional and facility licenses, prescribing or dispensing location, patient location when relevant, delivery facts, controlled-substance registration, event date, and state sources. Determine which state rule requires the report and why its PDMP is the applicable destination.

Use qualified review for telehealth, centralized prescribing, mail dispensing, border locations, mobile services, and interstate practice. Geographic proximity alone does not decide jurisdiction.

Identify the official destination

Preserve the PDMP's official name, responsible authority, production endpoint, certificate, account, submitter role, environment, schema, acknowledgment method, support contact, change notice, and effective dates. Separate production from test, training, public lookup, and vendor portals.

Validate official details through primary state sources. An old URL, copied configuration, product label, or successful network connection is not enough.

Trace hubs and intermediaries

Map every clearinghouse, switch, integration vendor, health information exchange, shared service, and interstate hub that receives or can access the message. Record its role, route, transformation, storage, logs, retransmission, contracts, and security controls. Determine whether the chain changes the recipient designation or applicable duties.

Match the complete path to section 2.31 consent and the state requirement. Hold release if a newly introduced intermediary falls outside the supported analysis.

Authenticate and test the route

Use managed credentials, certificates, endpoint allowlists, mutual authentication where required, role limits, environment separation, change approval, and monitoring. Test patient and submitter identifiers, payload version, acknowledgments, rejection codes, duplicate handling, correction, reversal, and downtime.

Protect credentials and prevent a multistate interface from routing according to default or patient address when the approved jurisdiction logic uses different facts.

Reconcile destinations and changes

For each report, link jurisdiction decision, PDMP, intermediary, consent, event, payload, transmission, response, and correction. Investigate no acknowledgment, unexpected destination, hub fan-out, certificate rollover, account reassignment, and state transitions. Preserve prior configurations for historical review.

Audit every active state route and disabled or pending configuration. Review after legal, agency, platform, schema, vendor, merger, license, location, and service changes.

Prepare for route failure

Document how staff recognize a wrong environment, expired certificate, unavailable hub, duplicate acknowledgment, cross-state misroute, or accepted message with invalid content. Define immediate containment, state-authority contact, vendor escalation, patient and event reconciliation, correction or reversal, and evidence preservation. Keep the downtime method, later backfill, and consent check under the same jurisdiction decision.

Use an independently reviewed inventory showing each site, professional role, event type, state, PDMP, intermediary, credentials owner, consent mapping, last test, and next review. Reconcile that inventory against production traffic. An unused configuration can still pose risk if credentials remain active, while an undocumented route may be carrying reports outside the approved state analysis.

Example

Fourteen destination configurations are tested. Eleven preserve jurisdiction analysis, official PDMP identity, endpoint, account, environment, consent mapping, route test, acknowledgment, and owner; three copy another state's setup. Readiness is 11 of 14 configurations.

Applicable-PDMP checklist

• resolve jurisdiction from program, professional, event, location, and license facts;
• verify the official state PDMP, authority, endpoint, account, and environment;
• map hubs, switches, vendors, storage, transformations, and downstream delivery;
• match the recipient chain to state law and section 2.31 consent;
• test authentication, routing, acknowledgment, rejection, correction, and downtime; and
• audit production, disabled, changed, interstate, and historical configurations.

The applicable recipient is a legal and technical conclusion. Both the state analysis and the live route must point to the same destination.