A DEA number is a registration number the Drug Enforcement Administration assigns to providers and organizations authorized to prescribe, dispense, or handle controlled substances. It confirms the holder is registered under the Controlled Substances Act to work with Schedule II through V drugs, and it appears on every controlled substance prescription.
It is often mistaken for a medical license or a general provider ID.
It is neither, and that misunderstanding is where a surprising number of compliance and billing problems begin.
What does a DEA number look like?
Every DEA number follows the same pattern: two letters followed by seven digits, such as AB1234563.
The first letter identifies the type of registrant, where A, B, F, and G cover practitioners, hospitals, clinics, and pharmacies, and M covers a mid-level practitioner such as a nurse practitioner or physician assistant.
The second letter is the first letter of the registrant’s last name or business name. The seven digits that follow include a built-in check digit as the final number.
That check digit is a quick way to catch obviously fake numbers. Add the first, third, and fifth digits, then add the second, fourth, and sixth and double the result. The last digit of those two totals combined should match the last digit of the DEA number. It is a useful screen, but passing the math is not the same as confirming the registration is real and active.
DEA number vs. NPI vs. state license
These three credentials get conflated constantly, and keeping them straight is the foundation of using any of them correctly.
- A DEA number is federal authorization to handle controlled substances, issued by the DEA.
- An NPI number is a general provider identifier used across all HIPAA transactions and billing, issued by CMS.
- A state medical license is the authority to practice, issued by a state board. They come from different agencies and serve different purposes.
Because of that, a DEA number is not a substitute for a license or an identifier, and it should not be used as a general ID. Doing so is both a security risk and a common source of errors.
Every DEA number follows the same pattern: two letters followed by seven digits, such as AB1234563.
What a DEA number authorizes, and what it does not
An active DEA number does not grant blanket authority to prescribe anything, anywhere.
The controlled substances a provider can actually prescribe depend on their state license and what they registered for, so a practitioner authorized for Schedules III through V cannot legally write a Schedule II prescription.
Registration is also state-specific. It is tied to a state license and a registered location, which means a provider generally needs separate registration for each state where they handle controlled substances.
Registration under the Controlled Substances Act runs on a three-year cycle and must be renewed. More recently, applicants have also had to attest to completing a one-time eight-hour training on treating patients with substance use disorders as a condition of registration and renewal.
Why DEA numbers matter for compliance
For a compliance or credentialing team, a DEA number is not just paperwork. It is a credential that has to be confirmed and kept current.
Verifying it means checking that the registration is active, unrestricted, and matched to the right provider, schedules, and state.
The red flags are specific: a registration that is expired, revoked, suspended, or marked surrendered for cause, the last of which is treated much like a revocation and signals the DEA took action.
The stakes are real, since using a fictitious, revoked, or expired DEA number to handle controlled substances is a federal crime, and letting a provider’s registration lapse can interrupt care and billing.
How DEA numbers are verified
The authoritative check is the DEA’s registrant validation tool, though access is restricted to organizations that hold their own DEA registration rather than the general public. DEA numbers are not openly searchable by name, which is a deliberate safeguard against fraudulent prescriptions.
That leaves most verification to a combination of the check digit screen, the restricted validation tool, and primary source verification during credentialing, where the DEA registration is confirmed alongside the provider’s license and other credentials. Because registration expires on a fixed cycle, tracking those dates is as important as the initial check.
Where DEA verification fits into provider screening
Confirming a DEA number is one part of a larger question: is this provider eligible and in good standing across every credential that matters?
A DEA revocation or a surrender for cause rarely travels alone, and often accompanies license actions or an exclusion from federal healthcare programs.
That is why DEA verification sits next to exclusion screening rather than apart from it. A provider can hold a valid license and NPI and still have lost the authority, or the eligibility, that makes them safe to employ or bill under.
How Streamline Verify supports provider eligibility screening
Credential verification confirms a provider’s standing at a point in time. The harder problem is keeping that picture current across a full workforce, because a status that was clean at hire can change months later.
Streamline Verify is a fully automated solution for exclusion and sanction screening. It continuously screens providers, employees, and vendors against the OIG LEIE, the SAM exclusion list, and applicable state Medicaid lists, flags potential matches for review, and records every check in a time-stamped audit trail.
When a provider’s standing changes, the kind of change that often shows up alongside a DEA adverse action, it surfaces quickly rather than at the next review.
As a fully automated solution, Streamline Verify does not replace DEA registration verification itself. It keeps the exclusion and sanction side of provider eligibility continuous and documented, so the rest of the credentialing picture rests on current information.
Want to see how automated exclusion and sanction screening supports your credentialing workflow?
