The Criminalization of Pain: The Risks of Prescribing Controlled Substances

V. Risk Areas Faced by Pain Physicians and Practices:

In a perfect world, law enforcement would be able to readily distinguish between criminal prescribing practices and the proper treatment of patients with chronic pain. Prosecutors would reserve prosecution for cases involving unlawful diversion and drug dealing while making it clear that an individualized opioid treatment regimen, including high-dose or long-term opioid treatment (when clinically justified), is not illegal. Law enforcement should treat documentation as evidence of a prescriber’s medical reasoning, not as a trap for technical noncompliance. Finally, the government should discourage the abandonment of pain patients, require transition plans when pain clinics close, and ensure that pharmacies do not overreach.

Pain physicians and pain management practices are likely to remain under law enforcement’s scrutiny for the foreseeable future. Therefore, it is imperative that they review their operational practices, medical-necessity assessments, coding, billing, and prescribing practices. The regulatory risk areas faced by pain physicians and practices are outlined below:

A. Interventional Pain Procedure Risks. Interventional pain procedures are a primary driver of practice revenue and a major focus of audits by the Department of Health and Human Services, the Office of Inspector General (OIG), and CMS program integrity contractors. Regulators frequently target procedures performed without adequate conservative therapy or beyond established frequency limits. Specific procedures regularly audited by CMS program integrity contractors and the OIG include:

• Epidural Steroid Injections (ESIs). Epidural steroid injections are among the most common interventional procedures performed by pain management physicians, yet they are also among the most heavily scrutinized areas of Medicare Part B billing. Because of their high volume and the potential for overuse, the OIG and CMS Medicare Administrative Contractors (MACs) have implemented strict coverage limitations and aggressive audit programs to recover improper payments. The OIG has repeatedly targeted spinal pain management procedures, dedicating an entire series of Work Plan projects to auditing Medicare payments for facet joint injections, epidural steroid injections, and the anesthesia administered during these procedures.^[15]
  In March 2023, the OIG published a comprehensive audit report detailing improper Medicare payments for epidural steroid injection sessions. The OIG found that Medicare improperly paid $3.6 million for 80,419 sessions that exceeded the strict coverage limitations set forth in the applicable Local Coverage Determinations (LCDs).^[16] The OIG concluded that neither CMS nor the MACs had adequate oversight mechanisms to prevent or detect payments for sessions exceeding the allowed frequency limits. Consequently, the OIG recommended that CMS direct the MACs to recover the $3.6 million in improper payments and notify the physicians involved so they could exercise reasonable diligence to identify, report, and return any overpayments under the 60-day rule.^[17]
  The OIG's scrutiny extends beyond the injections themselves to the ancillary services billed alongside them. In July 2025, the OIG released a report examining Medicare payments for anesthesia administered during spinal pain management procedures, including ESIs. CMS guidelines state that moderate or deep sedation, general anesthesia, or monitored anesthesia care (MAC) is usually unnecessary for these procedures and is rarely indicated, except in exceptional cases that must be clearly documented. However, the OIG audit found that Medicare Part B paid physicians $45.7 million for anesthesia administered during selected spinal pain management procedures that were at risk for noncompliance. The OIG estimated that if CMS oversight had prevented these at-risk payments, Medicare could have saved $17.7 million over a 28-month period, as medical records frequently failed to document the rare circumstances required to justify the anesthesia.^[18]
  For pain management practices, these audits underscore a critical compliance reality. High-volume interventional procedures, such as epidural steroid injections, are actively monitored by CMS program integrity contractors and the OIG using data analytics. Pain practices and physicians that routinely exceed rolling 12-month frequency limits, bypass conservative therapy prerequisites, or routinely bill for concurrent anesthesia without highly individualized documentation may face significant regulatory exposure and financial liability.
• Facet Joint Injections. Facet joint injections, including diagnostic medial branch blocks, intraarticular injections, and radiofrequency ablations, are critical tools for managing chronic axial spinal pain. However, their high utilization and prior history of medically unnecessary billing have made them an ongoing target for the OIG and CMS program integrity contractors.
  As with epidural steroid injections, facet joint injections and radiofrequency ablations are subject to strict LCD frequency limits (e.g., a maximum number of diagnostic or therapeutic sessions per region per year). A critical risk area is performing a radiofrequency ablation without a documented, successful diagnostic block (e.g., failing to document the required percentage of pain relief from the block before proceeding to ablation). Radiofrequency ablation involves the thermal destruction of the facet joint medial branch nerves. These procedures are considered medically reasonable and necessary only if the patient has first undergone at least two diagnostic medial branch blocks. Each diagnostic block must provide at least 80 percent sustained relief of the primary (index) pain. Performing a radiofrequency ablation without documenting this 80 percent relief from the dual diagnostic blocks is a direct violation of the LCD and renders the radiofrequency ablation claim subject to denial and recoupment. Furthermore, repeat radiofrequency ablation procedures at the same anatomic site are limited to a maximum of two sessions per rolling 12-month period and require documentation of at least 50 percent improvement in pain for at least six months following the initial radiofrequency ablation procedure.^[19]
  The OIG has aggressively audited facet joint injections, repeatedly finding that Medicare has paid millions of dollars for procedures that violated strict LCD requirements. In a comprehensive audit published in March 2023, the OIG reviewed Medicare Part B payments for spinal facet-joint injections and found that Medicare improperly paid physicians for injections that did not comply with Medicare requirements and guidance. It is also worth noting that fraudulent facet joint billing has been the focus of a criminal prosecution in Texas.^[20]
• Spinal Cord Stimulation. Spinal cord stimulation procedures are an advanced, high-cost interventional therapy for chronic intractable pain. Because these procedures can involve significant surgical risk and substantial Medicare reimbursement, CMS has imposed strict documentation requirements. One component of spinal cord stimulation pain management compliance risk is the failure to properly separate and authorize the trial phase from the permanent implant or proceeding to permanent implantation without documenting the required therapeutic success during the trial phase. ^[21]
  Because of the high cost of these procedures, CMS has designated spinal cord neurostimulation as an approved complex review topic for Recovery Audit Contractors (RACs). Medical records are routinely reviewed after payment to confirm that the two-stage process was followed and that the required pain relief was achieved and documented before the permanent system was surgically implanted.^[22]
  In recent years, the OIG has identified systemic improper billing practices involving neurostimulator devices. The term “neurostimulator” refers to a general category of implantable devices that includes spinal cord, deep brain, and vagus nerve stimulator devices. ^[23] Providers performing spinal cord stimulation procedures must ensure that all medical necessity, documentation, coding, and billing requirements have been met.
• Trigger Point Injections. Trigger point injections are commonly used in pain management to treat myofascial pain syndrome, but they are highly susceptible to coding errors, overutilization, and subsequent regulatory enforcement. CMS program integrity contractors, the OIG, and the DOJ have increasingly targeted claims for trigger point injections, focusing on improper billing practices and a lack of medical necessity.Risks include billing per muscle rather than per session (e.g., CPT® Code 20552 is designated for injections of one or two muscles, while CPT® Code 20553 is designated for injections of three or more muscles).^[24] Providers must ensure that the codes billed are based on the number of muscle groups injected per session, not the number of individual needle insertions.
  In the event of an audit, law enforcement and government contractors will review the medical record to determine whether the documentation shows that the administered injections were medically necessary. CMS requires that the documentation clearly identify the evaluation process used to diagnose the trigger point, including a history of the onset of pain, a palpable taut band of muscle, focal tenderness, and reproduction of the referred pain pattern.^[25]

B. Billing, Coding, and Documentation Compliance. Accurate coding and documentation are the foundation of compliance. The same documentation that supports clinical care is required to justify reimbursement.

• Upcoding E/M Levels. Upcoding occurs when a health care provider bills for a more complex set of services than is justified by medical decision-making or the time spent in the patient's care. For pain management practices, routinely billing high-level established patient visits (e.g., CPT® Code 99214 or CPT® Code 99215) without adequate supporting documentation is a major compliance risk that can trigger audits by the OIG and CMS program integrity contractors. In egregious cases, it may also lead to possible liability under the civil False Claims Act.
  CMS program integrity contractors are experienced in reviewing data analytics to compare a pain management physician's E/M billing distribution with that of peers in other pain specialties. If a pain management physician's billing profile heavily skews toward CPT® Codes 99214 and 99215, they are highly likely to face targeted prepayment probes or post-payment medical reviews. If the subsequent review reveals that the medical decision-making or documented time only supported an E/M service at the 99213 level, the pain management physician and his practice may be liable for repayment of an overpayment and may face possible False Claims Act liability.
• Modifier 25 Misuse. For pain management practices, appending Modifier 25 to an Evaluation and Management (E/M) service on the same day as a minor surgical procedure (such as an epidural steroid injection, a facet joint injection, or a trigger point injection) is a highly scrutinized billing practice. It is important to keep in mind that the Medicare global surgical package already includes both preoperative and postoperative care associated with a minor procedure.
  Both the OIG ^[26] and CMS program integrity contractors have repeatedly raised concerns with health care providers about the inappropriate use of Modifier 25. Claims appended with Modifier 25 are currently being audited, and the government is actively recovering improper payments for overlapping services. To properly bill for an E/M service, the service must be significant, separately identifiable, and supported by documentation beyond the standard pre-procedure assessment.

• Improper Billing of “Incident-To” Services. Many pain practices currently employ nurse practitioners (NPs) and physician assistants (PAs). Medicare has identified several basic prerequisites that must be met for the services of a qualified physician extender (such as NPs and PAs) to be billed incident-to the professional services of a supervising physician. As set out below, Medicare Part B pays for services and supplies incident-to the services of a physician (or another qualified practitioner). The billing requirements for incident-to are discussed below:

  1. Who qualifies as “auxiliary personnel”? In the context of a pain management practice, the primary auxiliary personnel supervised and billed under the incident-to rules are NPs and PAs. They qualify to be billed incident-to, regardless of whether the individual is an employee, a leased employee, or an independent contractor of the physician or of the same entity that employs or contracts with the physician.^[27]
  2. State licensure is required. To bill Medicare, both the supervising physician and the mid-level practitioner whose services are to be billed incident to must be properly licensed by the state.^[28]
  3. State scope of practice limitations. For the services of an NP or PA to qualify for coverage and payment, the specific service at issue must fall within the mid-level practitioner’s scope of practice.^[29]
  4. Collaborative agreement requirements. Many states require that NPs work under an appropriate collaborative practice agreement with a physician.^[30]
  5. Services covered. With respect to NPs, Medicare Part B covers the services they perform only if those services would be covered if furnished by a physician, are not otherwise statutorily excluded from coverage, AND the mid-level practitioner performs the services while working in “collaboration” with a physician. There is considerable controversy over the extent of independent practice that PAs may exercise. We recommend that you regularly monitor your state’s collaborative practice requirements for both NPs and PAs, as these requirements may change. Please note that even in states that require a collaborative agreement, the physician responsible for collaborating with a mid-level practitioner need not be the practitioner’s “supervising physician” for incident-to billing purposes.
  6. Credentialing. The supervising physician must be credentialed by Medicare. As long as the supervising physician is licensed and properly credentialed with Medicare, services performed by qualified NPs and PAs incident-to the professional services of the physician may be billed under the physician’s NPI, even though the mid-level practitioner may not be credentialed with Medicare.
  7. Non-institutional setting. While there are a few exceptions to the general rule, CMS defines an “Institutional Setting” as “all settings other than a hospital or skilled nursing facility.”
  8. Integral, although incidental, part of the physician’s professional service. Over the years, there has been a fair amount of discussion regarding this requirement. Essentially, CMS takes the position that the services provided incident-to those of the supervising physician must be an incidental part of the direct, professional services furnished by the physician to initiate a course of treatment.^[31] One question that frequently arises is “How often does a physician need to see a patient?" As set out in the Medicare Benefit Policy Manual, “there must be subsequent services by the physician of a frequency that reflects the physician’s continuing active participation in and management of the course of treatment.”^[32]
  9. Commonly included in the physician’s bills. This requirement is self-explanatory. If a service would normally be billed by a physician’s office, it is likely to qualify for incident-to billing.^[33]
  10. Services are of a type that are commonly furnished in physicians’ offices or clinics. Where supplies are clearly of a type a physician is not expected to have on hand in his/her office, or where services are of a type not considered medically appropriate to provide in the office setting, they would not be covered under the incident-to provision. Outpatient services that are provided in offices and clinics may still be billed under Medicare’s “incident-to” provisions if Medicare’s restrictive billing guidelines are met.^[34]
  11. “Direct” supervision is required. The physician (or other practitioner) supervising the auxiliary personnel need not be the same physician who is treating the patient more broadly. However, only the supervising physician (or other practitioner) may bill Medicare for incident-to services. Under recently revised regulations, “The presence of the physician (or other practitioner) required for direct supervision may include virtual presence through audio/video real-time communications technology (excluding audio-only) for services without a 010 or 090 global surgery indicator.” ^[35], ^[36]
  12. Must be subsequent to the initial encounter. Incident-to services cannot be rendered on the patient’s first visit or if a change to the plan of care (e.g., medication adjustment) is required.^[37]
  13. New or worsened patient complaint. If the visit involves a new or worsened complaint, a physician must conduct an initial E/M for that complaint and must establish the diagnosis and plan of care.^[38]

  Liles Parker attorneys are regularly asked to speak at conferences and provider meetings on incident-to issues. Unfortunately, this issue has been a recurring problem for pain management practices for many years. Although incident-to billing has been around (in one form or another) since 1977, physicians and their billing staff still have problems billing incident-to services correctly.^[39] We strongly recommend that pain management practices billing the services of NPs and PAs incident-to the supervision of a credentialed physician, engage experienced health care counsel to review these services.

C. Urine Drug Testing Risks. Urine drug testing is essential for responsible opioid management, but it is also one of the largest sources of False Claims Act enforcement and overpayment demands in pain management.

• Blanket Orders for Urine Drug Testing. For pain management practices, using standing orders for definitive urine drug testing is among the most dangerous actions a practice or ordering physician can take. A standing order that automatically triggers comprehensive, definitive urine drug testing for every patient at every visit, without an individualized clinical assessment at the time of ordering, directly violates Medicare's coverage requirements. Both the DOJ and OIG have aggressively pursued cases against pain practices, laboratories, and ordering physicians that used protocol-driven, non-individualized urine drug testing protocols. The enforcement record is extensive. Ordering urine drug testing in this fashion can expose both your practice AND the ordering physician (in his individual capacity) to massive civil damages and penalties under the False Claims Act. In egregious cases, federal prosecutors have charged individuals and entities with criminal violations for this conduct. The regulatory framework is unambiguous: definitive urine drug testing must be ordered on an individualized, patient-specific basis, and routine or blanket standing orders are expressly prohibited.
• Presumptive vs. Definitive Testing. Federal prosecutors, the OIG,^[40] and CMS program integrity contractors have repeatedly audited and penalized pain management practices that order expensive definitive (laboratory-based, quantitative) urine drug testing without first conducting lower-cost presumptive (point-of-care or immunoassay) testing and considering those results. The government argues that this improper practice bypasses the clinically and regulatorily required two-step testing sequence, generates medically unnecessary costs, and has cost the Medicare and Medicaid programs millions of dollars.
  While we recognize that, at first glance, the government’s arguments make sense, regulators have failed to account for the inherent weaknesses of presumptive testing. Arguably, the emergence of illicitly manufactured fentanyl analogs and synthetic opioids in the United States has made it medically necessary to order both presumptive and definitive urine drug testing when monitoring patients with pain and substance abuse. This is, in part, because standard presumptive drug testing screens do not detect fentanyl. Fentanyl is a synthetic product, not a natural opioid derivative. Like oxycodone and methadone, it is not metabolized into morphine. As a result, it can be quite challenging to detect new analogs of fentanyl and other synthetic opioids using presumptive drug testing.

  Notably, the inadequacy of UDT presumptive testing is well recognized. In fact, CMS has noted that presumptive testing cannot detect newer drug classes and synthetic drugs.^[41] Quest Diagnostics has estimated that if only presumptive testing is used, up to 74% of fentanyl analogs would be missed.^[42]

  

  Fortunately, the current administration has been systematically ramping up efforts to dismantle synthetic fentanyl trafficking.^[43] As recently as last week, President Trump announced the inaugural “Fentanyl Free America Summit” that brought together more than 3,000 members of law enforcement and other stakeholders to strategize the disruption of illicit fentanyl supply chains.^[44]
  In terms of medical necessity, we respectfully point out that, depending on the specific facts of a case, it may be irresponsible for a pain management provider to limit its review to the results of presumptive urine drug testing alone. Doing so could endanger both the patient and the community.
  Regarding medical necessity, if direct-to-definitive testing is appropriate because of the significant risks of fentanyl abuse in a community, you may ask whether presumptive testing is also necessary. The answer is “Yes.” Only presumptive urine drug testing includes specific gravity testing. Specific gravity testing helps pain management providers determine whether a sample has been diluted, either by accident or to produce a false negative. Therefore, ordering such tests is essential to ensure test result integrity.
• Financial Incentives in Testing. Pain management practices that refer urine drug testing to outside reference laboratories face substantial Anti-Kickback Statute exposure whenever the laboratory provides anything of value to the practice in connection with those referrals. The Anti-Kickback Statute makes it a federal felony to knowingly and willfully offer, pay, solicit, or receive any remuneration—directly or indirectly, in cash or in kind—to induce or reward referrals of items or services reimbursable by a federal health care program.^[45]
  One of the most common examples of Anti-Kickback Statute exposure in the pain practice management context involves laboratories providing free point-of-care drug testing cups, conditioned on the practice's agreement to return urine specimens to the laboratory for expensive confirmatory testing. The government has consistently treated this arrangement as an illegal kickback. Beyond free point-of-care urine drug testing cups, laboratories have also been found to have paid illegal remuneration in the form of cash, speaker fees, gift cards, and other items of value in exchange for urine drug testing referrals.

D. Controlled Substance Prescribing and DEA Compliance. Prescribing controlled substances exposes pain physicians to criminal, civil, and administrative liabilities under the CSA and state laws.

• Legitimate Medical Purpose and Usual Course of Practice. Under 21 C.F.R. § 1306.04, prescriptions must be issued for a legitimate medical purpose by a practitioner acting in the usual course of professional practice. Prescribing outside accepted medical norms, prescribing dangerous combinations (e.g., the "Holy Trinity" of improperly prescribing combinations of opioids, benzodiazepines, and skeletal muscle relaxants),^[46] or operating a "pill mill" are primary triggers for DEA enforcement.
• Prescription Drug Monitoring Programs (PDMP). The Prescription Drug Monitoring Program (PDMP) is one of the most powerful tools available to prescribers for identifying patients who are obtaining controlled substances from multiple providers, exhibiting drug-seeking behavior, or receiving dangerous combinations of opioids and other central nervous system depressants. A physician's failure to consult the PDMP before prescribing controlled substances has become an increasingly prominent factor in state medical board disciplinary actions, civil malpractice litigation, and DEA administrative proceedings. Additionally, in criminal prosecutions of physicians for unlawful opioid distribution, the government has introduced PDMP data as direct evidence that: (1) A physician either knew or had reason to know that a patient was obtaining controlled substances from multiple sources; (2) A patient had tested positive for illicit drugs; or (3) A patient had exhibited clear signs of addiction and diversion. Despite one or more clear signs of abuse being present, the defendant physician still chose to prescribe controlled substances to the patient.
• Telemedicine Prescribing. Prescribing opioids and other controlled substances via telemedicine is permitted under a framework of temporary regulatory flexibilities that have been repeatedly extended since the COVID-19 public health emergency. Under the DEA's Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities, effective through December 31, 2026, DEA-registered practitioners may prescribe Schedule II through V controlled substances to patients they have never physically examined, provided the encounter occurs via a real-time audiovisual communication platform. However, relaxing the traditional in-person examination requirement has created substantial opportunities for abuse, which the DOJ and DEA have aggressively pursued. In the event of an investigation, law enforcement won’t merely limit its review to the telemedicine visit and evaluation; it will also examine whether the prescriber first checked the PDMP and whether the prescriber was under a financial arrangement with third-party pharmacies and testing laboratories.
• Recordkeeping and Security. Every DEA-registered practitioner who dispenses, administers, or otherwise handles controlled substances is subject to comprehensive federal recordkeeping obligations under the CSA and its implementing regulations.^[47] These requirements include maintaining a complete and accurate biennial inventory of all Schedule II through V controlled substances on hand, retaining all records for at least two years at the registered location in a readily retrievable manner, and promptly reporting any theft or significant loss of controlled substances to the DEA on Form 106. Failure to comply with these obligations is a federal violation that can trigger a cascade of administrative and criminal consequences. It is unlawful for any registrant to "refuse or negligently fail to make, keep, or furnish any record, report, notification, declaration, order or order form, statement, invoice, or information required" under the CSA.^[48]

Please note that the controlled substance and opioid risks outlined in Sections A through C above are not an exhaustive list of concerns for pain management physicians and practices.