PDMP data quality gaps that break opioid AI safety tools
Prescription Drug Monitoring Programs report data to 49 states, but latency, format mismatches, and missing dispensation records undermine every AI safety tool that relies on them. Without trust scoring at the record level, opioid prescribing algorithms inherit the errors PDMP databases have carried for years.
Every U.S. state except Missouri operated a Prescription Drug Monitoring Program by 2021, and Missouri launched its own in 2023. That means 50 states, the District of Columbia, Guam, and Puerto Rico now collect dispensation records for controlled substances. The assumption behind every opioid prescribing AI tool is that this data is accurate, timely, and complete. It is none of those things consistently.
PDMP data is the foundation for clinical decision support alerts, risk scoring algorithms, and state-level surveillance dashboards that guide enforcement and public health intervention. When the foundation is unreliable, every layer built on top of it inherits that unreliability. For AI safety tools designed to flag dangerous prescribing patterns, this is not a theoretical concern. It is an operational failure mode that is already producing false negatives and false positives at clinical scale.
The latency problem: when "real-time" means 24 to 72 hours
Most PDMP mandates require pharmacies to report dispensation data within 24 hours. A 2019 study published in the Journal of the American Medical Informatics Association found that actual reporting timelines varied from same-day to more than 72 hours depending on the state, the pharmacy chain, and the transmission method.
In practice, a prescriber checking a patient's PDMP record on a Monday morning may be looking at data that reflects Friday's dispensations but not Saturday's or Sunday's. For an AI model scoring a patient's overdose risk or flagging potential doctor shopping, a 48-hour gap can mean the difference between a valid alert and a missed signal.
Some states have moved toward real-time reporting. Oklahoma, for example, mandated real-time pharmacy reporting in 2020. But "real-time" in state regulatory language often means "within one business day," not within minutes. The gap between regulatory language and clinical expectation creates a trust problem that no AI model can solve on its own.
Format fragmentation across state lines
PDMP data does not follow a single national standard. The NABP (National Association of Boards of Pharmacy) operates PMP InterConnect, which enables interstate data sharing across 53 jurisdictions as of 2024. But interconnection does not mean standardization.
Each state defines its own data fields, coding conventions, and reporting thresholds. Some states require reporting of all Schedule II through V substances. Others limit mandatory reporting to Schedules II through IV. The Prescription Drug Monitoring Program Training and Technical Assistance Center (PDMP TTAC), funded by the CDC and housed at Brandeis University, documented in 2022 that data elements such as method of payment, prescriber specialty, and days' supply are captured inconsistently across states.
For an AI model training on multi-state PDMP data, these inconsistencies create concordance failures. A patient who fills prescriptions in two states may appear as two separate individuals, or the same medication may be coded under different identifiers depending on which state's format the pharmacy uses. Without concordance scoring at the record level, the model cannot distinguish between a data artifact and a genuine clinical pattern.
Missing dispensation records
Not every dispensation makes it into a PDMP. The Government Accountability Office reported in 2020 that several categories of prescriptions are routinely excluded from PDMP databases. These include prescriptions dispensed by the Department of Veterans Affairs, the Indian Health Service, and Department of Defense pharmacies, though integration efforts have expanded VA reporting to many state PDMPs through the Veterans Health Administration's PDMP integration initiative announced in 2018.
Mail-order pharmacies present another gap. While most states require mail-order pharmacies to report, compliance and timeliness vary. A 2021 analysis by the Pew Charitable Trusts found that inconsistent reporting from mail-order and specialty pharmacies creates blind spots in the dispensation record, particularly for patients with chronic pain who receive 90-day supplies.
For AI safety tools, missing records produce false negatives. A patient who appears to have received only one opioid prescription may in fact have filled three, with two dispensed through channels that did not report to the state PDMP. The model sees a low-risk patient. The clinical reality is different.
The identity matching problem
PDMP records rely on patient demographic data entered at the pharmacy counter: name, date of birth, address, and sometimes a partial identifier. There is no universal patient identifier in the United States. The RAND Corporation published a 2018 analysis showing that patient matching error rates in health data systems range from 8% to 12%, with higher rates in populations that share common names or have recent address changes.
In PDMP data specifically, the identity matching problem compounds with every interstate query. PMP InterConnect uses probabilistic matching algorithms, but these algorithms produce both false positives (merging two different patients into one record) and false negatives (splitting one patient's history across two records). A 2020 study in Drug and Alcohol Dependence found that patient matching errors in PDMP queries led to incorrect risk assessments in approximately 5% of cases reviewed.
Five percent may sound small. In a system processing millions of queries per year, that percentage translates to tens of thousands of patients whose risk scores are wrong.
What this means for AI opioid safety tools
AI-based opioid prescribing tools fall into several categories: clinical decision support systems that alert prescribers at the point of care, population-level surveillance models that identify high-risk prescribing patterns, and predictive models that score individual patient overdose risk. All of them depend on PDMP data as a primary input.
The CDC Clinical Practice Guideline for Prescribing Opioids for Pain, updated in 2022, recommends that clinicians review PDMP data before initiating opioid therapy and periodically during treatment. Many states have codified this recommendation into law, requiring mandatory PDMP checks. The assumption embedded in these mandates is that the data clinicians retrieve is trustworthy.
When an AI model layers on top of that data, it amplifies whatever errors the data contains. A latency gap becomes a missed alert. A format mismatch becomes a phantom patient. A missing dispensation record becomes an underestimated risk score. The model is not wrong in its logic. It is wrong in its inputs.
This is the core problem that data trust scoring addresses. Quality is not the same as trust. A PDMP record can pass a quality check (all fields populated, valid codes, correct format) and still be untrustworthy because it is 72 hours stale, missing a dispensation from a VA pharmacy, or matched to the wrong patient.
The consent and privacy layer
PDMP data carries additional complexity because of 42 CFR Part 2, the federal regulation governing substance use disorder records. While Part 2 was revised in 2024 to align more closely with HIPAA, the regulation still imposes restrictions on how substance use disorder treatment records can be shared and used. PDMP data itself is generally exempt from Part 2 because it tracks dispensation, not treatment. But when AI models combine PDMP data with clinical records that do fall under Part 2, the consent architecture becomes critical.
An AI safety tool that merges a patient's PDMP history with their behavioral health records, emergency department visits, and pharmacy benefit claims must respect different consent regimes for each data source. Without a structured consent layer, the tool risks using data for purposes that exceed original consent, a problem we have written about in the context of substance use disorder data and its special status challenge.
Provenance: the missing dimension
| | Value (%) | |---|---| | Provenance | 25 | | Consent | 20 | | Recency | 15 | | Quality | 10 | | Concordance | 10 | | Validation | 10 | | Breadth | 5 | | Stability | 5 |
PDMP records typically lack provenance metadata. The record shows that a prescription was dispensed, but it does not carry information about when the record was transmitted to the PDMP, how many times it was transformed between pharmacy system and state database, or whether it was manually corrected after initial submission.
Provenance is the single most heavily weighted dimension in the DTI framework, accounting for 25% of a record's trust score. For PDMP data, provenance failures are endemic. A dispensation record may pass through a pharmacy management system, a clearinghouse, and a state database before an AI model queries it. Each hop introduces the possibility of transformation errors, truncation, or delay. Without a chain of custody for each record, the AI model has no way to assess whether the data it is acting on reflects the original dispensation event or a degraded copy of it.
What trust-scored PDMP data looks like
Scoring PDMP data for trust means evaluating each record across multiple dimensions before it enters an AI model. Recency scoring captures whether the record reflects a dispensation from today or from last week. Concordance scoring identifies whether the patient identity in the PDMP record matches the patient identity in the clinical system querying it. Provenance scoring traces the chain of custody from pharmacy counter to state database to point-of-care query.
A record that scores below a defined trust threshold gets flagged, not discarded. The prescriber still sees the PDMP result, but the AI safety tool annotates it with a confidence indicator. "This record reflects data current as of 48 hours ago" is more useful than a binary pass/fail alert that the prescriber cannot interpret.
This approach also addresses the recency problem that affects nearly every health data source feeding AI models. PDMP data degrades faster than most clinical data because prescribing patterns change daily. A trust score that weights recency appropriately prevents stale data from driving high-stakes clinical decisions.
The regulatory pressure building
The SUPPORT Act of 2018 required states to adopt electronic prescribing for controlled substances and enhance PDMP integration with health IT systems. The DEA's mandate for electronic prescribing of controlled substances has pushed more dispensation data into digital channels, which improves data capture but does not automatically improve data quality.
Meanwhile, the FDA has signaled increasing scrutiny of AI-based clinical decision support tools. As we discussed in the context of FDA AI guidance and data provenance, any AI tool that influences prescribing decisions will eventually face questions about the quality and provenance of its training data. PDMP-based opioid safety tools sit squarely in this regulatory path.
State attorneys general have also entered the conversation. Several state AG offices have investigated whether PDMP data gaps contributed to delayed identification of pill mill operations. When enforcement actions depend on data completeness, and the data is incomplete, the accountability question shifts from the prescriber to the data infrastructure.
The path forward
| | Value | |---|---| | Reporting latency (hrs) | 72 | | Patient match error rate (%) | 12 | | CDS alert override rate (%) | 90 |
Fixing PDMP data quality requires action at multiple levels. States need to enforce reporting timelines with audit mechanisms, not just mandates. NABP's PMP InterConnect needs concordance standards that go beyond probabilistic matching. And every AI tool that consumes PDMP data needs to score that data for trust before acting on it.
The alternative is what we have now: AI safety tools that inherit the errors of the databases they query, producing alerts that clinicians learn to ignore because they cannot tell which ones are based on trustworthy data and which ones are artifacts of data gaps.
Alert fatigue in clinical decision support is already severe. A 2019 study in the Journal of the American Medical Informatics Association found that clinicians override more than 90% of drug safety alerts. Adding opioid prescribing alerts built on unscored PDMP data will not improve safety. It will add noise to a system already drowning in it.
Trust-scored data does not eliminate PDMP quality problems. It makes them visible. And visibility is the prerequisite for every fix that follows.
The DTI Engine scores every record 0 to 100 across eight dimensions before your AI model sees it. If your team is building or deploying opioid prescribing safety tools and needs to know which PDMP records can be trusted, schedule a conversation with the SuperTruth commercial team or call (215) 918-4140.
Further reading:
Sources
Jason Alan Snyder
Co-founder of SuperTruth and Artists & Robots, and an inventor on the Data Trust Index patents. Twenty-plus years building technology inside Interpublic Group. He writes here nearly every day on data trust, provenance, and what AI should be allowed to act on, and publishes essays on his Substack.
About SuperTruth · LinkedIn · Substack · jasonalansnyder.com
See it in practice
DTI scores the record, not the patient.
8 dimensions. 0 to 100. Travels with every record permanently.