Florida Pain Clinic Guide to Controlled Substance Prescribing Logs and Privacy Laws

Florida pain clinics must keep clinical records complete, protect prescribing tools, report required patient counts, and safeguard medical information. Key requirements appear in Florida Statutes section 458.3265, Florida Statutes section 459.0137, and statutes governing chronic nonmalignant pain and medical-record confidentiality. Requirements can vary by clinic and practitioner type, so confirm which laws and rules apply to your practice.

What patient examinations and prescribing records must Florida pain clinics document?

At a registered pain-management clinic, a physician, physician assistant, or advanced practice registered nurse must perform a physical examination on the same day the physician prescribes a controlled substance. Before treatment begins, covered chronic nonmalignant pain care also requires a complete medical history and physical examination documented in the record. The examination should be proportionate to the diagnosis. Florida Statutes section 458.3265, section 459.0137, and section 456.44 set out these requirements.

For chronic nonmalignant pain, the medical record must document at least:

• The nature and intensity of the pain, current and past pain treatments, and underlying or coexisting conditions.
• The pain’s effect on physical and psychological function, prior medical records and diagnostic studies reviewed, and the patient’s history of alcohol or substance abuse.
• A recognized medical indication for controlled-substance use, the patient’s risk assessment for aberrant drug-related behavior, and ongoing monitoring under the prescriber’s written plan.
• An individualized treatment plan with objectives, planned evaluations or treatments, and consideration of other treatment modalities.

Prescribing records should also be accurate, current, complete, accessible, and available for review. The required record content includes diagnostic, therapeutic, and laboratory results; evaluations and consultations; treatment objectives; discussion of risks and benefits; treatments; and medications, including the date, type, dosage, and quantity prescribed. It must also include instructions and agreements, periodic reviews, drug-testing results, a copy of the patient’s government-issued photo identification, and a duplicate of a written controlled-substance prescription given to the patient. See Florida Statutes section 456.44.

When must a prescription exceed a 72-hour dose be explained in the medical record?

If a physician at a registered pain-management clinic prescribes more than a 72-hour dose of a controlled substance to treat chronic nonmalignant pain, the physician must document in the patient’s record the reason for prescribing that quantity. This applies to the covered pain-management clinic requirements in Florida Statutes section 458.3265 and section 459.0137.

This is a documentation trigger, not a blanket 72-hour maximum for chronic nonmalignant pain prescriptions. Separate prescription-supply provisions apply to opioids prescribed for acute pain; do not treat those rules as the same requirement. See Florida Statutes section 456.44.

How must clinics secure prescription blanks and report loss or software breaches?

A physician authorized to prescribe controlled substances at a registered pain-management clinic is responsible for maintaining control and security of the physician’s prescription blanks or electronic prescribing software used for controlled-substance pain medication. Written prescriptions must use counterfeit-resistant prescription blanks as required by Florida Statutes section 893.065.

The physician must notify the Florida Department of Health in writing within 24 hours after a prescription blank is stolen or lost, or after a breach of the electronic prescribing software used for pain medication. The 24-hour reporting requirement appears in section 458.3265 and section 459.0137. A potential breach involving protected health information may also trigger separate federal HIPAA breach-notification requirements; those are not replaced by the Florida report. See the U.S. Department of Health and Human Services’ HIPAA Breach Notification Rule guidance.

What quarterly controlled substance patient counts must clinics report?

The designated physician must report the following information in writing each quarter to the applicable board—the Board of Medicine or Board of Osteopathic Medicine—under Florida Statutes section 458.3265 or section 459.0137:

• The number of new and repeat patients seen and treated at the clinic who are prescribed controlled substances for chronic nonmalignant pain.
• The number of patients discharged because of drug abuse.
• The number of patients discharged because of drug diversion.
• The number of patients treated at the clinic whose domicile is outside Florida. The statutes define domicile as the patient’s fixed or permanent home to which the patient intends to return, even if temporarily living elsewhere.

How do Florida privacy laws govern medical record access and disclosure?

Florida Statutes section 456.057 generally requires a practitioner to provide a patient or the patient’s legal representative, upon request, copies of records relating to the examination or treatment in a timely manner and without delay for legal review. Medical records generally may not be furnished to other people, or the patient’s medical condition discussed with them, without the patient’s written authorization—subject to statutory exceptions. Examples include disclosure to providers involved in care and certain disclosures under a properly issued subpoena with required notice. See Florida Statutes section 456.057.

Records owners must develop and implement policies and procedures to protect medical-record confidentiality and security, train employees on those policies, and keep a record of third-party disclosures that includes the purpose of the request. The statute also restricts further disclosure by a recipient. For clinics subject to HIPAA, federal privacy and breach-notification requirements apply as well; the applicable duties depend on the circumstances. See the HHS HIPAA Breach Notification Rule guidance.

What information must the clinic’s on-site physician roster log contain?

For clinics governed by the Board of Osteopathic Medicine’s pain-clinic practice rule, the on-premises log must list the full name, presented legibly, and a corresponding sample signature and initials for every physician, anesthesiologist assistant, and physician assistant working in the clinic. See Florida Administrative Code Rule 64B15-14.0051.

Separately, statutes governing both medical and osteopathic pain-management clinics require a printed sign in a conspicuous, publicly viewable place in the waiting room. It must show the designated physician’s name and contact information and the names of all physicians practicing in the clinic. The clinic must also display a public sign with its name, hours, and street address. Each physician must notify the applicable board in writing within 10 calendar days after beginning or ending practice at the clinic. See section 458.3265 and section 459.0137.

In short, maintain complete examination and prescribing records, document the reason for a qualifying quantity above a 72-hour dose, secure prescribing tools, meet quarterly reporting duties, protect patient information, and keep required physician rosters and signs current.

FAQs

Must a clinician examine a patient on the day a controlled substance is prescribed at a Florida pain clinic?

Yes. At a registered pain-management clinic, a physician, physician assistant, or advanced practice registered nurse must perform a physical examination on the same day the physician prescribes a controlled substance. See Florida Statutes section 458.3265 and section 459.0137.

What details must controlled substance prescribing records include?

For covered chronic nonmalignant pain treatment, records include the relevant history and examination, pain and functional impact, prior treatments and diagnostic information, treatment objectives, risk-and-benefit discussion, medications with date, type, dosage, and quantity, agreements and instructions, periodic reviews, drug-testing results, patient identification, and a duplicate of any written controlled-substance prescription given to the patient. See Florida Statutes section 456.44.

How soon must a stolen prescription blank or prescribing software breach be reported?

The prescribing physician must notify the Florida Department of Health in writing within 24 hours after a prescription blank is stolen or lost, or after a breach of the electronic prescribing software used for pain medication. See Florida Statutes section 458.3265 and section 459.0137.

What information must appear in a pain clinic’s physician roster log?

Under the applicable osteopathic pain-clinic rule, the on-premises log must contain each covered practitioner’s legible full name and corresponding sample signature and initials. The clinic must also post the designated physician’s name and contact information and the names of all physicians practicing there. See Florida Administrative Code Rule 64B15-14.0051 and Florida Statutes section 458.3265.