Under the Controlled Substances Act, every person who manufactures, distributes, dispenses, imports or exports a controlled substance is required to register with the U.S. Department of Justice Drug Enforcement Administration (DEA). This requirement reaches retail pharmacies, hospitals, clinics, teaching institutions and individual practitioners. DEA’s implementing regulations for the Controlled Substance Act require under 21 C.F.R. § 1301.76(b) that all registrants notify their local DEA Field Office, in writing, of the “theft or significant loss” of controlled substances within one business day of discovering the theft or significant loss. Registrants must notify their local DEA Field Office of reportable thefts and losses using a DEA Form 106, entered electronically (unless Internet access is not available) through DEA's web portal. With only one business day after discovery to submit these reports, DEA expects providers and pharmacies to have well-oiled systems in place to assess reportability and to submit these reports in a timely manner. Note that DEA requires registrants to report thefts and significant losses whether or not the registrants subsequently recover the controlled substances or identify the responsible parties.
What Is a “Significant” Loss?
While DEA’s requirement to report any theft of controlled substances is fairly unambiguous, the requirement to report only “significant” losses can perplex some registrants and result in lost time during the one-business-day reporting window or, worse yet, unreported losses. In a 2003 Proposed Rule, DEA addressed the issue of "What Constitutes a Significant Loss" and explained that “[t]here is no single objective standard which can be established and applied to all registrants to determine whether a loss is significant.” DEA explained that registrants must undertake a case-by-case review of losses “within the context of a registrant's business activity and environment,” noting that “[w]hat constitutes a significant loss for one registrant may be construed as comparatively insignificant for another.” For example, DEA said that the “loss by a pharmacy of a 100-count bottle of controlled substance tablets would be viewed as significant, whereas the same loss by a full line distributor may be viewed differently, particularly if the loss is an unexplained inventory discrepancy that may have resulted from a picking error.” In addition, DEA explained in 2003 that, for non-manufacturer registrants, “the repeated loss of small quantities of controlled substances over a period of time may indicate a significant aggregate problem” triggering reporting even where the quantity lost in each occurrence, by itself, is not significant.
In its 1971 regulation, 21 C.F.R. § 1301.74(c), DEA provided the following list of factors to consider when making determinations about whether losses are significant:
- the actual quantity of controlled substances lost in relation to the type of business;
- the specific controlled substances lost;
- whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances;
- a pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,
- whether the specific controlled substances are likely candidates for diversion; and
- local trends and other indicators of the diversion potential of the missing controlled substance.
These factors still stand today. While DEA has indicated that the loss by a pharmacy of a 100-count bottle or entire supply of a controlled substance clearly rises to the level of a “significant” and reportable loss, the majority of losses providers and pharmacies typically confront are more nuanced and frequently occur on a much smaller scale than this. As a result, since smaller quantities lost generally may not be significant, having procedures in place to identify patterns is of critical importance for providers and pharmacies. This is discussed in more detail below.
Another challenge providers and pharmacies have to face as a result of the short reporting window is that it may not be possible to determine within one business day whether a loss was, in fact, a theft. If the loss was a theft, then under DEA’s regulations, it is reportable whether significant or not and local authorities generally should be notified to investigate the incident. When a provider or pharmacy is unable to determine whether a loss was a theft in one business day, a report of loss should be filed (if the loss is significant) and a follow-up report (or an initial report if the loss was not significant) can be made to the local DEA Field Office upon later discovery that the loss actually was a theft.
Recognizing that the facts and circumstances of apparent thefts and losses can vary a great deal, DEA has said that, when in doubt, registrants should err on the side of notifying the appropriate law enforcement authorities, including DEA, of thefts and losses of controlled substances. As such, it is a good rule of thumb for providers and pharmacies to be conservative in their approach to reporting in cases where controlled substances are missing and significance or theft may be unclear.
Monitoring Pharmacy Sales
Beyond monitoring losses or thefts where controlled substances have disappeared, DEA expects that pharmacies will be mindful of overall sales trends for controlled substances so as to identify trends where large increases occur that could signal theft by employees or invalid prescriptions. In recent enforcement actions by DEA, the agency cited retail pharmacies for failure to maintain proper controls to prevent dispensing controlled substances to dealers or addicts on invalid prescriptions. DEA also cited increases in sales of certain controlled substances from tens of thousands to over a million in a one or two year span as missed patterns of dispensing activity that the registrants should have identified in their monitoring practices.
Know Your State’s Diversion/Loss Disclosure Law
Understanding DEA’s reportability expectations is not enough to ensure provider and pharmacy compliance with diversion reporting obligations as each state has its own reporting scheme for controlled substance thefts and losses. Some of these states—for example, Georgia—require more stringent reporting than required at the federal level, such as the reporting of all losses of controlled substances, significant or not. Georgia requires registrants to file a DEA Form 106 with their local DEA Field Office for any loss the registrants’ discover, significant or not, which modifies the reporting standard DEA federally has established for the Form 106. Registrants must ensure familiarity with their state reporting obligations and understand how those may intersect with their federal reporting obligations.
Tools for Investigating and Reporting Thefts and Losses
All losses should be investigated and reviewed together with any related facts and circumstances and within the context of the type of business of the registrant (e.g., a hospital, a small clinic, or a retail pharmacy). Discovering patterns of missing controlled substances can take time and it is a best practice to track losses of smaller quantities over time to help detect when a pattern of loss activity is present. To achieve this, some providers and pharmacies utilize tracking software that records employees’ removal of controlled substances from locked cabinets together with an associated patient identifier. This software can help identify instances where an employee removes controlled substances, for example, for patients that a hospital has already discharged or for a patient for which there is no corresponding prescription on file. The software flags any unusual or suspicious activity for review.
Beyond utilizing tools like software for flagging suspicious dispensing behaviors and monitoring for steep increases in sales of particular controlled substances over time, it is important for providers and pharmacies to have standard operating procedures in place that track the federal and applicable state reporting requirements for losses and thefts, assign responsibility for making reportability determinations and for submitting the reports in a timely manner, and assign responsibility for routinely reviewing reports generated by internal software of suspicious activities and for following-up on those reports. For state pharmacy inspections, or a DEA inquiry, it is important for a registrant to demonstrate working systems for monitoring dispensing activities and for timely reporting losses and thefts to the applicable regulatory authorities. Periodic internal audits can also provide a check on compliance with these requirements.
In sum, these tools and procedures can help ensure providers and pharmacies have well-oiled systems in place to comply with the narrow federal and state reporting windows for losses and thefts of controlled substances. Finally, effective employee training on reporting requirements, reporting windows, and provider or pharmacy standard operating procedures will be the key to maintaining compliant systems for reporting losses and thefts.