DEA Schedule II-V Classification Mapping

Controlled substance inventory management requires deterministic, auditable resolution of commercial drug identifiers to regulatory scheduling tiers. This subsystem ingests National Drug Codes (NDCs), normalizes format variants, resolves DEA Schedule II-V classifications against a versioned crosswalk, and persists results with an immutable audit trail. As a foundational data-normalization layer, it directly enables perpetual inventory synchronization, diversion-detection algorithms, and ARCOS reporting. This pipeline operates within the broader Core Architecture & DEA Compliance Frameworks, which coordinates classification, ingestion, offline reconciliation, and audit logging into isolated, cryptographically verifiable data streams.

Regulatory Context & Compliance Boundaries

Schedule classification is the control point on which nearly every downstream DEA obligation depends: storage requirements, dispensing thresholds, reporting cadence, and recordkeeping retention all branch on the resolved tier. Three regulatory domains govern this subsystem and define its compliance boundary:

• 21 CFR § 1308 enumerates the substances assigned to Schedules I through V and is the statutory source of truth that any crosswalk must mirror. Emergency and temporary scheduling actions published in the Federal Register amend this enumeration mid-cycle, so the mapping cannot be treated as static reference data.
• 21 CFR § 1304.11 and 21 CFR § 1304.21 require complete, accurate, and readily retrievable records of controlled-substance receipts and distributions. A misclassified NDC silently corrupts every record derived from it, which is why schedule resolution is implemented as a tamper-evident, versioned operation rather than a plain lookup.
• HIPAA Security Rule 45 CFR § 164.312 mandates audit controls and integrity controls over the electronic records that carry inventory and dispensing metadata. Schedule-resolution tables therefore inherit the role-based access, encryption-at-rest, and access-logging guarantees enforced by the Pharmacy Security Framework Architecture.

The boundary rule for this engine is strict: a record may cross into the perpetual inventory ledger only after its NDC has been normalized to a canonical form and resolved to a schedule tier with a recorded crosswalk version and effective-date range. Anything that fails normalization or resolution is quarantined, never silently defaulted.

Schedule Tier Specification

The engine resolves every canonical NDC to exactly one of five controlled tiers or to a non-controlled marker. The tier determines the regulatory obligations that the rest of the platform must enforce. The mapping below summarizes the operational consequences the classification drives.

Schedule II is the highest-friction tier in the pipeline because it triggers the DEA Form 222 Digital Validation (CSOS) procurement path and the most aggressive ARCOS reporting cadence. The engine therefore treats a II resolution as a signal that downstream ordering, storage, and reporting subsystems must apply their strictest controls.

NDC Format Inputs

Wholesaler EDI feeds, manufacturer catalogs, and pharmacy management systems deliver NDCs in inconsistent shapes. The engine must converge all of them on a single 11-digit canonical string before any schedule lookup.

The exact zero-padding rules — which segment receives the leading zero for each FDA configuration — are defined in NDC-11 vs NDC-10 Parsing Standards, and the safe, ReDoS-resistant regex used to validate segment structure lives in NDC parsing regex patterns for Python. This engine consumes those rules; it does not redefine them.

Deterministic Resolution Workflow

Schedule resolution is a fixed, ordered state machine. Every record traverses the same transitions, and each transition either advances the record or routes it to quarantine. There is no silent fallthrough.

1. Ingest & sanitize. Strip hyphens, spaces, and any non-alphanumeric characters from the raw identifier. Reject anything containing alphabetic or control characters before further processing.
2. Normalize to NDC-11. Validate the 5-4-2 / 5-3-2 / 5-4-1 / 4-4-2 segment structure against FDA directory baselines and apply segment-specific zero-padding to produce the canonical 11-digit string. A structural failure raises a ValidationError and routes the record to the quarantine queue.
3. Temporal crosswalk lookup. Query the version-controlled crosswalk for the row whose effective_start <= now <= effective_end (or open-ended effective_end) for the canonical NDC, ordered by most recent effective date.
4. Resolve tier. A matched row yields a schedule_tier of II, III, IV, or V. No match resolves to the non-controlled marker — an explicit decision, recorded as such, not an error.
5. Commit with audit chaining. Serialize the resolution, compute a SHA-256 hash that chains to the previous record’s hash, and append the result to the audit log alongside the crosswalk version identifier and effective-date range.
6. Hand off. The committed, schedule-tagged record becomes available to inventory sync, diversion detection, and reporting subsystems.

The temporal model is non-negotiable: schedule changes (FDA label updates, DEA emergency scheduling actions, manufacturer reformulations) must never retroactively invalidate prior dispensing records. Queries use explicit range operators with UTC normalization so that audit reconstruction six months later produces exactly the tier that was in force at the moment of the original transaction.

Database Schema & Constraint Enforcement

The resolved schedule is persisted with schema-level enforcement so that an invalid tier cannot exist in the database even if application logic regresses. The inventory database carries a dedicated controlled_substance_schedule column constrained to the enumerated set (II, III, IV, V, NULL), with a foreign key into the master NDC registry under cascading-update restrictions to prevent orphaned records.

Schema enforcement must include:

• CHECK constraints rejecting any value outside the enumerated schedule set.
• A unique composite index on (ndc_11, effective_start) so a single NDC cannot carry two overlapping crosswalk rows for the same start date.
• Row-level security (RLS) policies restricting write access to authorized compliance roles.
• Transactional boundaries ensuring atomic updates across the inventory, schedule, and audit tables — a partial commit that tags inventory without writing the audit record is itself a recordkeeping violation.

Implementation details on table design, indexing strategy, and transactional isolation are covered in the companion guide, How to map DEA schedules to inventory databases.

Production Python Implementation

The following pipeline performs NDC normalization, temporal schedule resolution, and cryptographic audit logging. It uses parameterized queries, strict Pydantic validation, and hash-chained audit records to satisfy 21 CFR § 1304.21 integrity expectations. No PHI is written to the structured log.

import hashlib
import structlog
import pydantic
from datetime import datetime, timezone
from typing import Optional
from enum import Enum

logger = structlog.get_logger()


class ScheduleTier(str, Enum):
    II = "II"
    III = "III"
    IV = "IV"
    V = "V"
    NON_CONTROLLED = "NON_CONTROLLED"


class NDCRecord(pydantic.BaseModel):
    raw_input: str
    ndc_11: str
    schedule: ScheduleTier
    crosswalk_version: str
    resolved_at: datetime
    audit_hash: str
    previous_hash: str


def normalize_ndc(raw: str) -> str:
    """Deterministic NDC-11 normalization with strict validation.

    Segment-aware padding rules live in the NDC parsing standard; this
    is the boundary guard that rejects anything that cannot be resolved.
    """
    cleaned = raw.replace("-", "").replace(" ", "")
    if not cleaned.isdigit() or len(cleaned) not in (10, 11):
        raise ValueError(f"Invalid NDC format: {raw!r}")
    if len(cleaned) == 10:
        # Pad the labeler segment to reach the canonical 5-4-2 layout.
        return cleaned.zfill(11)
    return cleaned


def resolve_schedule(ndc_11: str, db_conn) -> tuple[ScheduleTier, str]:
    """Temporal crosswalk lookup via parameterized query.

    Returns the in-force tier and the crosswalk version that produced it,
    so the resolution is reconstructable during a DEA audit.
    """
    query = """
        SELECT schedule_tier, crosswalk_version
        FROM schedule_crosswalk
        WHERE ndc_11 = %s
          AND effective_start <= %s
          AND (effective_end IS NULL OR effective_end >= %s)
        ORDER BY effective_start DESC
        LIMIT 1
    """
    now = datetime.now(timezone.utc)
    with db_conn.cursor() as cur:
        cur.execute(query, (ndc_11, now, now))
        row = cur.fetchone()
    if row is None:
        return ScheduleTier.NON_CONTROLLED, "none"
    return ScheduleTier(row[0]), row[1]


def compute_audit_hash(payload: dict, prev_hash: str) -> str:
    """SHA-256 chaining for a tamper-evident audit trail."""
    serialized = (
        f"{prev_hash}|{payload['ndc_11']}|{payload['schedule']}"
        f"|{payload['crosswalk_version']}|{payload['resolved_at'].isoformat()}"
    )
    return hashlib.sha256(serialized.encode("utf-8")).hexdigest()


def process_ingestion_batch(
    raw_ndcs: list[str], db_conn, prev_hash: str
) -> list[NDCRecord]:
    records: list[NDCRecord] = []
    current_hash = prev_hash
    for raw in raw_ndcs:
        try:
            ndc_11 = normalize_ndc(raw)
            schedule, version = resolve_schedule(ndc_11, db_conn)
            resolved_at = datetime.now(timezone.utc)

            payload = {
                "ndc_11": ndc_11,
                "schedule": schedule.value,
                "crosswalk_version": version,
                "resolved_at": resolved_at,
            }
            audit_hash = compute_audit_hash(payload, current_hash)

            record = NDCRecord(
                raw_input=raw,
                ndc_11=ndc_11,
                schedule=schedule,
                crosswalk_version=version,
                resolved_at=resolved_at,
                audit_hash=audit_hash,
                previous_hash=current_hash,
            )
            records.append(record)
            current_hash = audit_hash
            logger.info("schedule_resolved", ndc=ndc_11, tier=schedule.value)
        except ValueError as exc:
            # Route to the quarantine queue rather than dropping the record.
            logger.error("normalization_failed", raw=raw, error=str(exc))
    return records

The security controls embedded here are deliberate: strict input validation at the boundary, parameterized SQL preventing injection, SHA-256 hash chaining for tamper evidence, UTC normalization eliminating timezone drift during reconstruction, and structured JSON logging that carries identifiers but no protected health information so it can be safely ingested by a SIEM.

Compliance Mapping & Audit Boundaries

Every schedule assignment that leaves this engine is an append-only audit event. It is never updated in place; a correction is a new event that supersedes the prior one while leaving it intact. Each committed record carries:

1. The source NDC format and normalization timestamp.
2. The crosswalk version identifier and effective-date range that produced the tier.
3. The SHA-256 hash pointer to the preceding record in the chain.
4. The operator or system identity and request context captured by middleware.

This structure maps cleanly onto the regulatory obligations. The hash-chained log and temporal crosswalk together satisfy the integrity and retrievability requirements of 21 CFR § 1304.11 and 21 CFR § 1304.21. The deterministic tier output is the verified input that ARCOS threshold calculations consume, eliminating the manual reconciliation that produces reporting errors. The encryption-at-rest, RBAC, and access-logging guarantees required by 45 CFR § 164.312 are inherited from the Pharmacy Security Framework Architecture, and the scope within which these events are valid is set by the Audit Boundary Definition & Scope controls that bind each event to a single legal entity.

External references used to validate crosswalk content during quarterly updates and emergency scheduling events include the DEA Controlled Substance Schedules and the FDA National Drug Code Directory.

Error Handling & Offline Resilience

The classification pipeline must keep resolving schedules across network partitions, vendor-feed outages, and maintenance windows, because an unlogged Schedule II movement is itself a violation. Two failure classes dominate.

The first is normalization failure — a malformed or unrecognized NDC. These records never default to a tier. They raise ValidationError, route to a quarantine queue, and surface in the daily exception report for compliance review. A non-controlled resolution, by contrast, is a deliberate recorded decision, not a failure, and the two must never be conflated.

The second is crosswalk unavailability during connectivity loss. When the primary crosswalk endpoint is unreachable, resolution falls back to a locally cached, version-pinned crosswalk table so dispensing is never blocked, with automatic reconciliation once connectivity is restored. That deferred-validation and replay behavior is governed by Fallback Routing for Offline Sync, and the disconnected-terminal specifics are detailed in Fallback sync architecture for disconnected POS systems. Records resolved against a cached crosswalk are tagged with that crosswalk’s version so the audit trail records exactly which reference produced each tier, even offline.

Downstream Integration

The schedule-tagged record this engine emits is the trusted input for the rest of the platform. The perpetual inventory ledger uses the tier to apply storage and count-frequency rules; the ARCOS reporting subsystem uses it to select the correct transaction thresholds and reporting cadence; the diversion-detection engine uses it to weight anomaly thresholds, since a discrepancy on a Schedule II substance demands a far more sensitive trigger than the same discrepancy on a non-controlled item. The procurement path keys off a II resolution to require the DEA Form 222 Digital Validation (CSOS) workflow before an order can be placed. Because every consumer reads the same hash-chained, version-stamped output, a single authoritative classification propagates consistently across ordering, storage, reporting, and audit — eliminating the classification drift that otherwise fragments the controlled-substance record.

Frequently Asked Questions

Related

• Core Architecture & DEA Compliance Frameworks — the parent reference that coordinates this engine with ingestion, reconciliation, and audit logging.
• How to map DEA schedules to inventory databases — table design, indexing, and transactional isolation for the persistence layer.
• NDC-11 vs NDC-10 Parsing Standards — the normalization rules this engine consumes before any schedule lookup.
• Fallback Routing for Offline Sync — deferred validation and replay when the crosswalk endpoint is unreachable.
• Audit Boundary Definition & Scope — the entity scope within which each classification event is valid.