Yes, EMS agencies can register with the DEA, and under the new federal rule they must confirm their registration approach, lock down storage and vehicle controls, and tighten recordkeeping before the compliance window closes. Three actions matter most right now: confirm whether your agency registers directly or relies on hospital coverage, audit vehicle and stationhouse storage, and update your documentation to match the federal standard. State authorization and medical direction still govern who can administer these medications in the field.
TL;DR:
- State authorization and any required controlled substance registration must precede federal filing; applications submitted before eligibility is established may be returned or delayed.
- Hospital affiliated agencies may rely on the hospital’s registration only if its authorization and records cover ambulance operations, a condition to confirm with pharmacy staff.
- Each additional station or post storing controlled substances must be reported to the DEA within 30 days, including after location changes.
- Lock vehicles whenever they are unattended with medications aboard, but crews may carry doses during active patient response and must secure unused drugs afterward.
- Record every administered, wasted, or transferred dose with patient, drug, route, time, and personnel details; require a second witness for waste and inventory biennially.
Table of Contents
- Regulatory overview: PPAEMA and the DEA final rule that created the EMS registration category
- How to register: DEA forms, state prerequisites, and who should hold the registration
- Storage and vehicle rules: what secure storage looks like and when drugs may be carried
- Recordkeeping, inventories, and reporting: what to document and how long to keep it
- Transfers, restocking, and designated locations: how controlled substances move without creating gaps
- Compliance checklist and action timeline for EMS leaders
- Operational playbook: field-tested controls, common pitfalls, and audit readiness
- Why compliance here is an operational advantage, not just a regulatory burden
- How PSCG supports agencies through DEA registration and compliance
- FAQ
- Sources
Regulatory overview: PPAEMA and the DEA final rule that created the EMS registration category
The Protecting Patient Access to Emergency Medications Act of 2017 amended the Controlled Substances Act under 21 U.S.C. 823(k), directing the DEA to create a registration pathway specifically for EMS agencies rather than forcing them to fit into categories built for pharmacies and hospitals. That statutory directive finally became operational through the DEA’s final rule establishing a dedicated EMS registration category, along with new requirements for delivery, storage, and recordkeeping.
For agencies that have spent years working around rules never designed for ambulance operations, this closes a real gap. Before PPAEMA, many EMS systems depended entirely on a medical director’s or affiliated hospital’s registration to carry Schedule II through V medications, an arrangement that worked until it did not: a director’s departure, a hospital partnership ending, or a system expansion could leave an agency scrambling for legal authority to carry morphine, fentanyl, or midazolam.
The rule, now codified at 21 CFR 1301.20, gives agencies several structural options rather than a single mandate. Understanding these options is the first decision point for any EMS leader reading this.
- Single-state registration option: an EMS agency operating across multiple locations within one state may hold a single DEA registration covering its registered location plus any designated locations it notifies the DEA about.
- Hospital-registration option: EMS agencies affiliated with a hospital may continue operating under that hospital’s registration, provided the hospital’s authorization and the agency’s operational practices satisfy the rule’s delivery and recordkeeping standards.
- Independent EMS registration: agencies without a hospital relationship, or those that prefer direct control over their controlled substance program, can register as a standalone EMS agency using the new category created by the rule.
- Administration authority without on-scene medical director presence: where state law permits, personnel can administer controlled substances under standing orders or protocols without requiring the medical director to be physically present, a flexibility that matches how most EMS systems already operate clinically.
None of these options overrides state law. A state EMS office still determines who may carry and administer controlled substances, what certification levels apply, and what state-level controlled substance registration (CSR) is required before federal registration even becomes relevant. The Federal Register notice is explicit that the rule operates alongside, not in place of, state licensing and medical oversight structures, which is why the first practical question for any agency is not “how do we file with the DEA” but “what does our state require first.”
This sequencing, state authorization before federal registration, shapes everything that follows in this guide, from who signs the registration application to how vehicles get stocked after a call. Agencies that try to skip the state step and go straight to the DEA form typically find the application returned or delayed, since the DEA registration category assumes state-level eligibility has already been established.
The practical upshot: if your agency already operates under a hospital’s umbrella and that relationship is stable, the hospital-registration option may require the least structural change. If you are an independent, municipal, or third-service EMS agency, the single-state or independent registration path likely fits better, and it is worth reviewing how medical oversight responsibilities map onto whichever registration structure you choose, since the medical director’s role in authorizing administration protocols does not disappear just because the registration paperwork changes.
How to register: DEA forms, state prerequisites, and who should hold the registration
Getting from “we need to comply” to “we are registered and documented correctly” follows a sequence, and skipping steps tends to cost agencies time later rather than saving it.
- Confirm state eligibility first. Before touching a federal form, verify your state’s controlled substance registration requirements for EMS agencies. Missouri’s Department of Health, for example, lays out a sequence where state registration precedes federal DEA registration, including state fees and eligibility documentation that must be in hand before a federal application makes sense.
- Determine which registration category fits your agency. Decide whether your agency will register independently, operate under a hospital’s existing registration, or use the single-state option for multi-location systems. This decision should involve your medical director, legal counsel, and whoever currently manages your controlled substance program.
- Submit DEA Form 224 or 224A. Form 224 is the standard new-registration application; Form 224A applies to registration renewals. EMS agencies pursuing independent or single-state registration file through the DEA’s standard registration portal, listing the registered location and any locations they intend to designate.
- Identify designated locations at the time of application, where possible. Stationhouses, substations, or satellite posts that will store controlled substances separately from the primary registered address should be identified early, since each requires its own notification process described later in this guide.
- Establish ordering authority for Schedule II medications. Schedule II drugs like fentanyl and morphine require DEA Form 222 or the Controlled Substances Ordering System (CSOS) for electronic ordering. Whoever holds registration authority typically needs to execute a power of attorney authorizing specific personnel, often a pharmacy liaison, operations chief, or medical director designee, to sign for Schedule II orders on the registrant’s behalf.
Who actually holds the registration matters more than it might first appear. A hospital-based EMS agency operating entirely under its parent hospital’s license typically does not need a separate DEA number, provided the hospital’s existing registration and recordkeeping systems extend to cover ambulance operations, a point worth confirming directly with your hospital’s pharmacy and compliance teams rather than assuming coverage exists.
Independent, municipal, and third-service agencies, by contrast, generally need their own registration since no hospital registration exists to lean on. For these agencies, the question of who signs the application and holds day-to-day responsibility, the EMS chief, the medical director, or a designated compliance officer, should be settled in writing before the application goes in, since that person becomes the registrant of record for DEA purposes.
The power-of-attorney detail for Schedule II ordering trips up more agencies than any other step in this sequence. Missouri’s guidance specifically flags that CSOS and Form 222 authority does not automatically transfer with operational duties; a named individual must be formally authorized, and that authorization should be revisited any time personnel change. Build a standing process for updating this authorization rather than treating it as a one-time task.
Storage and vehicle rules: what secure storage looks like and when drugs may be carried
Once registration is settled, storage is where most of the rule’s operational weight lands, and where field experience with agencies has shown the most inconsistency.
The rule distinguishes between a registered location, typically your agency’s headquarters or primary base, and designated locations, which are additional stationhouses, substations, or posts where controlled substances are stored outside the primary address. Under 21 CFR 1301.20, agencies must notify the DEA of each designated location within 30 days, submitted through the DEA’s diversion control portal rather than as a paper amendment to the original registration.
Facility and vehicle storage standards follow familiar pharmacy-grade logic, adapted for ambulance operations:
- Stationhouse storage must use locked, substantially constructed cabinets or safes, not a drawer or unsecured cabinet that any on-duty staff member can open without accountability.
- Vehicles must be locked whenever controlled substances are aboard and the vehicle is unattended, whether parked at a post, a hospital bay, or overnight at quarters.
- On-person carrying is allowed during active response. Crew members may carry controlled substances on their person or in a jump bag while actively responding to and treating a patient, since requiring a return trip to a locked cabinet mid-call would be unworkable.
- Return to secure storage is required after the call closes. Once the response concludes, unused controlled substances must go back into a locked cabinet or vehicle safe, not remain in an open jump bag in the crew area.
- Restocking follows the same chain-of-custody standard as initial stocking, meaning the handoff from secure storage to jump bag and back must be documented, not assumed.
Pro Tip: Treat every vehicle cabinet like a pharmacy drug safe: assign one accountable person per shift to confirm the lock and the count at shift change, not just at the start of the week.
Virginia’s EMS medication policy guidance offers a useful operational detail here: agencies that reconcile vehicle logs within 24 hours of a response, rather than batching reconciliation weekly, catch discrepancies while the crew’s memory of the call is still sharp, which matters when a count is off by a single dose and nobody can say with confidence why.
The 30-day notification window for designated locations is not a formality to file away and forget. If your agency adds a new substation, consolidates two posts into one, or changes where controlled substances physically live, that notification needs to go out promptly, and your internal change-management process, whoever approves new facilities or vehicle assignments, should include a trigger to loop in whoever manages your DEA compliance filings.
Recordkeeping, inventories, and reporting: what to document and how long to keep it
If storage is where the rule’s physical requirements land, recordkeeping is where its legal weight lands, and it is the area where enforcement has been least forgiving.
Under 21 CFR 1304.27, EMS agencies must maintain detailed records for every dose administered, wasted, or transferred. At minimum, your documentation for each dose needs to capture:
- Patient identifier tied to the specific encounter where the medication was used.
- Drug name, strength, and dose administered, recorded precisely rather than approximated.
- Route of administration (IV, IM, IN, or other).
- Date and time of administration, matched to the patient care report.
- Administering personnel’s name and credential, identifying exactly who gave the medication.
- Witness signature for any wasted or destroyed quantity, since partial doses and unused portions require a second person to confirm disposal.
- Transfer documentation whenever controlled substances move between registered and designated locations, including who released the medication and who received it.
Beyond per-dose records, the rule requires a biennial inventory, a full physical count and reconciliation of all controlled substances on hand, conducted every two years at minimum, with many agencies choosing an annual cadence as a stronger internal control. Retention periods for these records generally run at least two years from the date of the record, consistent with standard DEA recordkeeping practice, though agencies should confirm the specific retention schedule that applies to their registration type.
DEA enforcement in 2026 shows that incomplete transfer and inventory records carry real financial consequences for registrants, reinforcing why precision here matters beyond passing an internal audit. A DEA press release from May 2026 described a civil penalty settlement tied to allegations of controlled substance recordkeeping violations, including improperly maintained Form 222s and inventories, a case outside EMS specifically but illustrative of how closely the DEA scrutinizes transfer and inventory documentation regardless of registrant type.
When something goes wrong, speed matters. If a loss, theft, or significant unexplained discrepancy occurs, agencies should:
- Secure the scene and remaining inventory immediately to prevent further loss.
- Notify the registered agency’s compliance officer or medical director the same day the discrepancy is identified.
- File the required DEA theft or loss report (DEA Form 106) promptly rather than waiting for an internal investigation to conclude first.
- Document the internal investigation findings and corrective action taken, since this record becomes part of your compliance history.
- Contact the DEA’s registration support resources if questions arise about reporting thresholds or required forms, rather than guessing at the correct process.
A reconciliation gap that gets documented, investigated, and corrected within days looks very different to a DEA auditor than one that surfaces only because an external audit found it months later. Building that reflexive, same-day reporting habit into your operations is worth more than any policy binder sitting on a shelf. For agencies building out a broader framework, our guide on what EMS compliance means in 2026 walks through how recordkeeping fits into a wider compliance program.
Transfers, restocking, and designated locations: how controlled substances move without creating gaps
Every time a controlled substance moves, whether from a hospital pharmacy back into an ambulance, or from a central supply point out to a substation, that movement needs to be both permissible under the rule and documented clearly enough to survive an audit.
21 CFR 1307.14 addresses hospital-to-EMS restocking directly, allowing hospitals to deliver replacement controlled substances to EMS designated locations after a crew uses medication treating a patient, provided both parties document the exchange properly. This is the mechanism that lets a crew drop off a patient, hand over the used vial or syringe, and receive a replacement dose without a separate pharmacy visit or formal distribution transaction.
For this restocking relationship to hold up under review, both sides need matching paperwork:
- The hospital’s record should show what was dispensed, to whom (the EMS agency, by registration or designated location), and when.
- The agency’s record should show what was received, which crew or vehicle it was assigned to, and the corresponding patient encounter that triggered the restock.
- Internal transfers between an agency’s own registered location and its designated locations, for example, moving stock from headquarters out to a substation, require the same sending and receiving documentation, even though no external party is involved.
- A 72-hour notification window can apply to vehicle receipts in certain circumstances, meaning agencies should not treat a vehicle restock as informal just because it happens quickly between shifts.
A transfer form, whether paper or digital, should capture the date and time of transfer, the specific medication and quantity, the sending and receiving locations, and signatures or verified identifiers from both the person releasing and the person accepting the medication. Agencies moving toward digital documentation for this kind of exchange sometimes look at secure electronic signature and audit-trail tools, such as the workflow and identity-verification features described by BeeSign, to replace paper logs with a verifiable digital chain of custody, particularly useful when a hospital and an EMS agency need to exchange signed records across separate systems.
Treat every restocking event as a mini-audit trail rather than a routine handoff. The agencies that struggle during DEA review are rarely the ones with sophisticated systems. They are the ones where a restock happened verbally between a nurse and a paramedic with nothing written down until someone remembered to log it hours later.
Compliance checklist and action timeline for EMS leaders
Translating all of the above into a sequence your team can actually execute matters more than understanding each rule in isolation. Here is a practical timeline.
Immediate priorities, 0 to 30 days:
- Confirm your registration approach: independent registration, single-state registration, or continued reliance on a hospital’s registration.
- Launch a security audit of every location and vehicle where controlled substances are stored, checking locks, cabinet construction, and access logs.
- Assemble a complete roster of personnel currently authorized to handle controlled substances, cross-checked against current certifications and employment status.
Short-term priorities, 30 to 90 days:
- Submit DEA Form 224 or 224A if your agency is pursuing independent or single-state registration.
- File the 30-day designated-location notifications for every stationhouse or substation storing controlled substances outside your primary registered address.
- Roll out revised documentation logs that capture every required field under 21 CFR 1304.27, and establish your biennial (or annual) inventory process with a named owner.
- Train every authorized staff member on the updated storage, transfer, and documentation procedures, with signed completion records kept on file.
A few supporting items make this timeline easier to execute rather than harder:
- Build a one-page quick-reference card for crews summarizing what must be documented at the point of care, since a laminated card in the jump bag beats a 40-page policy manual nobody reads mid-call.
- Assign a single compliance owner, not a committee, responsible for tracking registration status, designated-location notifications, and inventory deadlines.
- Set calendar reminders tied to your inventory cadence and registration renewal dates well before they come due, since DEA renewal lapses create gaps in legal authority to carry these medications.
Nevada’s state EMS program issued a memo following the final rule that lays out a similar sequence for its agencies, registration confirmation, security checks, documentation updates, and the 30-day designated-location notice, and it is worth checking whether your own state EMS office has issued comparable guidance, since state-specific deadlines or fee requirements may run alongside the federal timeline. Agencies looking to formalize this process into a broader operational framework may also find it useful to review how operational risk reduction strategies apply across storage, staffing, and documentation together rather than as separate projects.
Operational playbook: field-tested controls, common pitfalls, and audit readiness
The gap between a compliant policy on paper and a compliant operation in practice almost always comes down to a handful of recurring controls, or the lack of them.
The strongest programs maintain a real-time authorized-personnel roster, updated the moment someone is hired, certified, transferred, or separated, rather than an annual list that drifts out of date within weeks. They enforce a consistent two-person witness requirement for any wasted or destroyed medication, no exceptions for a busy shift or a short-staffed night. And they audit vehicle cabinets on a rolling schedule, not just during a scheduled inspection week, so a missing seal or an unlocked cabinet gets caught within days rather than months.
The pitfalls we see most often are predictable:
- Inconsistent witness practice, where disposal documentation looks solid for most shifts but has gaps on nights when only one qualified person was on duty.
- Departed personnel left on the authorized roster, a gap that shows up almost every time we review an agency’s access controls after a staffing change.
- Weak reconciliation habits, where counts are checked at the start of a shift but never cross-verified against the previous shift’s documented usage.
Pro Tip: Run your controlled substance audit the same way you would run a billing audit: sample a handful of records monthly rather than waiting for the full inventory cycle to surface a problem.
A rolling audit checklist that works in practice typically covers roster accuracy, cabinet and vehicle lock verification, documentation completeness for a sample of recent administrations, and confirmation that the most recent designated-location notifications match what the DEA portal shows on file. Paired with a short recurring training module, rather than a single annual session, this kind of checklist turns compliance from a once-a-year scramble into a habit your team barely notices.
Why compliance here is an operational advantage, not just a regulatory burden
I think the agencies that treat this rule as a box to check are missing the bigger point. Every control in this rule, the locked cabinet, the witnessed disposal, the real-time roster, exists because a missing dose of fentanyl or midazolam is not an administrative inconvenience. It is a patient safety risk and, left unaddressed, a diversion risk that can end a career or a program.
Robust controls do something else too: they protect continuity. An agency with clean records and a documented chain of custody can absorb a DEA audit, a personnel change, or a leadership transition without its controlled substance program grinding to a halt. One with sloppy habits is one bad week away from a registration problem that pulls crews off the road.
Getting this right is not about fearing an inspector. It is about building a system your own team can trust, shift after shift, call after call. Agencies working through registration decisions or tightening these controls may seek consultation to understand what that looks like for their specific operation.
— Mike
How PSCG supports agencies through DEA registration and compliance
We work alongside EMS agencies navigating exactly this kind of regulatory transition, and DEA compliance rarely sits in isolation from the rest of your operation. Our Operational Risk Reduction service helps agencies build the storage, roster, and audit controls described throughout this guide into a system your team can sustain, not just a policy binder for inspection day.
Depending on where your agency stands, an engagement with us might produce a revised controlled substance policy aligned to the new DEA requirements, a training program your staff can complete and document, or a remote or on-site audit that tells you exactly where your current practices stand against the federal standard. We also support the broader strategy work that often surrounds a registration decision, from municipal EMS strategy to system design choices that affect where and how controlled substances get stocked.
If you want a second set of eyes on your registration approach or your current storage and documentation practices, visit Thepscgroup or reach out through our contact page to start that conversation.
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What are the new DEA regulations for EMS ambulances?
The DEA’s final rule implementing PPAEMA creates a dedicated EMS registration category, letting agencies register independently, rely on a hospital’s registration, or use a single-state registration covering multiple locations. It also sets specific storage, vehicle-locking, and recordkeeping requirements that ambulance operations must follow.
What are the new DEA regulations for controlled substances in 2026?
For EMS specifically, the 2026 final rule requires agencies to notify the DEA within 30 days of any designated location storing controlled substances outside the primary registered address, as described in 21 CFR 1301.20. It also strengthens recordkeeping standards under 21 CFR 1304.27, requiring detailed documentation for every dose administered, wasted, or transferred.
What drugs can you administer as an EMT?
The specific controlled substances an EMT or paramedic can administer depend on state scope-of-practice rules and the agency’s medical director protocols, not on the DEA registration itself. The DEA rule governs how an agency legally acquires, stores, and documents these medications; state EMS offices and medical direction determine who is clinically authorized to give them.
What is the DEA 5% rule?
The question likely refers to a different DEA threshold used in other registrant contexts, and current guidance for EMS agencies does not define a “5% rule” as part of the PPAEMA final rule. Agencies with questions about specific numeric thresholds should check directly with their state EMS office or DEA registration support, since definitions vary by registrant type and no EMS-specific 5% threshold appears in the final rule text.
Do hospital-based EMS agencies need their own DEA registration?
Not necessarily. A hospital-affiliated EMS agency can often operate under the hospital’s existing registration, provided the hospital’s authorization and documentation practices extend to cover ambulance storage and administration, which is worth confirming directly with hospital pharmacy and compliance staff rather than assuming coverage automatically applies.
Sources
- Registering Emergency Medical Services Agencies Under the Protecting Patient Access to Emergency Medications Act of 2017
- eCFR :: 21 CFR 1301.20 Registration for emergency medical services agencies
- Edmond doctor pays $110,000 to settle civil penalty claims stemming from allegations of controlled substance recordkeeping violations
- DEA Final Rule on EMS Controlled Substance Registration – Nevada EMS Program memo
