4 Storage, Security, and Loss Reporting
Learn the federal security expectations for controlled substances, practical access safeguards, and the steps and deadlines for reporting theft or significant loss.
Federal security and storage
DEA registrants must maintain effective controls and procedures to guard against theft and diversion. Security should fit the setting and account for building access, employee supervision, visitors and service personnel, alarms, and monitoring of controlled-substance activity. Federal rules establish minimum standards, and state law may impose stricter requirements.
For pharmacies, must be kept in a securely locked, substantially constructed cabinet. generally have the same storage requirement, but a pharmacy may instead disperse them throughout noncontrolled stock in a way that obstructs theft or diversion. Dispersal is not permission to leave controlled substances unsecured.
Access controls and loss prevention
DEA rules prohibit employing a person with access to controlled substances if that person has a qualifying controlled-substance felony conviction or has had a DEA registration denied, revoked, or surrendered for cause.
Practical safeguards that support effective security include:
Limit pharmacy and storage-area access to authorized staff, and supervise visitors, contractors, and maintenance workers.
Restrict keys, combinations, and alarm codes. Change access promptly when staff roles change or employment ends.
Keep controlled-substance work areas secured when unattended, and use alarms or monitoring appropriate to the site.
Reconcile receipts, dispensing, returns, destruction, and on-hand quantities. Investigate discrepancies promptly and document the outcome.
Train staff to report suspected diversion, suspicious activity, and unexplained shortages without delay.
These operational measures support the registrant’s broad duty to maintain effective controls. They do not replace checking applicable state requirements.
Assessing theft and
A theft must be reported even if the drugs are later recovered. A has no fixed federal quantity threshold. The registrant evaluates whether a loss is significant by considering the type of business; the amount and drug involved; possible access by particular people; patterns and explanations for losses; diversion potential; and local trends. Repeated small unexplained losses can be significant.
A controlled-drug count that is short should be investigated rather than automatically treated as theft or dismissed as minor. For example, if a review of recent transactions identifies a posting error that fully explains the difference, documenting and correcting the clerical error is appropriate; is not used for that routine adjustment. If the discrepancy remains unexplained, or similar shortages recur, the registrant assesses significance using the relevant factors and reports theft or as required.
Reporting and documenting a loss
When theft or is discovered, follow these steps:
Secure the site and preserve information. Protect people first, prevent further access, and preserve relevant records or video. Promptly notify the responsible pharmacist or registrant.
Reconcile and document. Conduct a focused inventory and review dispensing, receiving, transfer, return, and destruction records. Record what is known, what remains uncertain, and when the loss was discovered.
Notify DEA in writing. The registrant must notify the local DEA Field Division Office within of discovery. Do not wait for the internal investigation to be complete. Internal or corporate notice alone does not replace notice to DEA.
File electronically. Submit a complete and accurate form through DEA’s Theft Loss Reporting system within 45 days after discovery. Keep a copy for two years. The form is not for routine clerical miscounts or minor inventory adjustments.
Contact law enforcement and follow local rules. DEA guidance recommends notifying local police and applicable state authorities. State reporting requirements may also apply. Keep the incident record, investigation findings, notifications, and corrective actions together.
If an investigation establishes that no theft or loss occurred, DEA guidance says a Form 106 is not required. Documenting the finding and notifying DEA in writing can help close the record.