Part 2 state-law PDMP trigger

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Current rule checkpoint

Live 42 CFR 2.36 makes the PDMP pathway conditional on applicable state law requiring the report. The federal text does not create a uniform national list of covered drugs, professionals, events, fields, or deadlines. It also independently requires section 2.31 patient consent before reporting.

Use the operative state source

Current 42 CFR 2.36 does not define one national reporting trigger. Link the controlling statute, regulation, board rule, agency instruction, or incorporated technical specification. Record source hierarchy, effective dates, role, event, product, location, deadline, and change notice.

Avoid geographic shortcuts

The relevant jurisdiction can depend on facts such as where prescribing or dispensing occurs, the professional or facility license, program location, patient location, or state PDMP rule. Use counsel and the responsible authority to resolve the actual trigger.

Hold the consent gate

A state mandate does not erase the § 2.31 consent requirement built into § 2.36. Configure the workflow to surface conflicts, pause automated release, preserve both authorities, and route the decision to privacy and legal owners.

Build a primary-source rule record

For each jurisdiction, preserve the operative statute, regulation, board rule, agency guidance, data-submission manual, schema, effective dates, amendments, and source hierarchy. Identify the issuing authority and official change channel. Link summaries and vendor materials only as secondary aids.

Record which source controls when a bulletin, manual, and codified text differ. Route unresolved conflicts to the responsible authority and experienced counsel.

Resolve jurisdiction and role

Document program site, prescribing or dispensing location, professional and facility licenses, patient location when relevant, controlled-substance registration, delivery method, and event date. Analyze which state rule applies and whether the sender's actual role is covered.

Do not copy a configuration from a neighboring state or another location in the same organization. Telehealth, mail dispensing, interstate practice, centralized pharmacy services, and shared systems can change the facts.

Translate the rule into testable conditions

Configure covered SUD medications, prescribing versus dispensing events, quantities and days' supply, patient and professional identifiers, exceptions, deadlines, correction methods, destination, and acknowledgment rules. Store the legal and technical version used for each decision.

Use effective-dated rules so delayed documentation, corrected events, and backfills are evaluated against the right period. Test boundary dates, exemptions, canceled orders, partial fills, reversals, downtime, and rejected messages.

Keep the Part 2 consent dependency

Require valid section 2.31 consent before the report leaves. Display missing, expired, deficient, revoked, or mismatched consent as a separate hold reason. A state-law mandate is necessary for section 2.36, but it does not erase the express federal consent condition.

Define a rapid escalation path for conflicts and patient questions. Preserve the facts, sources, decision, qualified reviewers, and whether another authority or remedy applies.

Monitor rule and production change

Assign owners to review state legislative, regulatory, board, PDMP, and technical notices. Assess every change for program roles, medications, fields, timing, consent language, vendors, training, interfaces, and historical reporting. Test before the effective date and verify production afterward.

Audit required, exempt, blocked, late, rejected, corrected, and downtime events. Compare source requirements with system logic and actual payloads rather than reviewing policy alone.

Maintain a short decision table for frontline teams that points to the controlled rule record without replacing it. Show the event, role, medication, jurisdiction, deadline, consent hold, and escalation owner in plain language. When a source changes, preserve the prior table, effective date, training completion, configuration deployment, and a sample of post-change reports. That history lets an auditor reproduce why the same event was treated differently before and after an amendment.

Example

Twelve state-rule configurations are audited. Nine preserve the current primary source, covered role, event, jurisdiction, fields, deadline, consent dependency, and change owner; three cite vendor summaries. Trigger evidence is complete for 9 of 12 configurations.

State-trigger checklist

• retain current primary legal and technical sources with hierarchy and dates;
• resolve jurisdiction, site, professional role, event, product, and exception;
• translate each condition into versioned, tested system logic;
• keep section 2.31 consent as an independent pre-transmission gate;
• monitor source changes and validate policy, training, interfaces, and production; and
• audit required, exempt, blocked, late, rejected, corrected, and downtime events.

The trigger is an effective-dated legal conclusion about a specific event. It should be reproducible from both source law and production evidence.