DEA activity is on the rise. Is your healthcare organization prepared?

For healthcare provider organizations, Drug Enforcement Administration regulations are not only complex and often difficult to understand but violating these regulations can lead to multi-million-dollar settlements. In addition, a DEA audit or inspection can lead to criminal prosecution and administrative action against your DEA registration if the agency finds violations of the Controlled Substances Act. And if an entity is a member of a larger organization, DEA may inspect other locations within that health system to investigate practices throughout the organization. 

In this article, we’ll outline some of the top DEA regulations your organization should know. We’ll also discuss recent DEA settlements related to those regulations. The settlements underscore the serious consequences of noncompliance. Further, the subsequent findings highlight where you and your organization are most at risk. To help you strengthen your organization’s compliance related to DEA regulations, we have included action plans to help you avoid fines, negative press, and the possibility of loss of licensure for personnel and entities. 

Power of Attorney 

About the regulation:  

Title 21 CFR Part 1305.05 indicates a Registrant may authorize one or more individuals to issue orders for a Schedule II controlled substance on the Registrant’s behalf by executing a POA for each such individual. The Code of Federal Regulations indicates that POA must be available for inspection together with other order records. 

The POA must be executed by: 

• The Registrant, if an individual; a partner of the Registrant, if a partnership; or an officer of the Registrant, if a corporation, corporate division, association, trust or other entity; 
• The person to whom the POA is being granted; and 
• Two witnesses 

A POA may be signed electronically, by any or all the persons required to sign. A registrant may revoke any POA at any time by executing a notice of revocation. POAs must be revoked by the person who signed the most recent application for DEA registration or reregistration and two witnesses. 

Recent DEA settlement: 

$412,500 fine—February 2021: “DEA contended that MedMark [Treatment Centers of Texas Inc.] was in violation of recordkeeping provisions, including failing to maintain complete and accurate records, failing to maintain a current power of attorney, and failing to keep its records in a readily retrievable manner.” 

Your compliance action plan: 

• Validate that all individuals who have access to order Schedule II controlled substances have an executed POA on file. 
• Make sure the individual executing the POA is appropriate per DEA regulations (e.g., an officer of the Registrant, if a corporation, corporate division, association, trust, or other entity). 
• Validate that a DEA POA revocation is on file for terminated employees previously allowed to order Schedule I and II controlled substances. 
• Implement a POA folder within your DEA recordkeeping filing system to retain both executed and revoked POA forms, facilitating readily retrievable practices as required by the DEA. 

Waste—DEA Form 41 

About the regulation: 

DEA’s Pharmacist’s Manual (2022 edition) indicates if a breakage or spillage is clearly observed, but the controlled substances are not recoverable, the Registrant should document the circumstances of the event in his or her records. 

It is DEA’s position that in order to maintain complete and accurate records in accordance with 21 CFR 1304.21(a), non-recoverable breakage or spillage must be recorded on a DEA Form 41 and, as with any other form of disposal under 21 CFR Part 1317, should be signed by two individuals who can testify that a breakage or spillage occurred. Except, destruction of a controlled substance dispensed by a practitioner for immediate administration at the practitioner's registered location, when the substance is not fully exhausted (e.g., some of the substance remains in a vial, tube, or syringe after administration but cannot or may not be further utilized), shall be properly recorded in accordance with §1304.22(c), and such record need not be maintained on a DEA Form 41. 

Recent DEA settlement: 

$4.5 million civil penalty—November 2021: The University of Texas Southwestern Medical Center failed to properly report the “dispensing and wasting of controlled substances—an essential safeguard against diversion—and made errors in forms documenting the ordering, receipt, and distribution of controlled substances—all violations of the CSA.” 

Your compliance action plan: 

• Print the DEA Form 41 and maintain blank copies for use. 
• Implement a process to complete a Form 41 to record the waste of a non-recoverable breakage, spillage, or expired controlled substance when a reverse distributor is not used. 
• Provide information required on Form 41, which includes the controlled substance’s National Drug Code, name, strength, form, package quantity, number of full and partial packages, and total amount destroyed. The date, location, and method of destruction along with two authorized employee signatures must also be provided on Form 41. 
• Submit the Form 41 to the DEA only if requested to do so. 
• Retain record of destruction (Form 41) for at least two years, at a minimum, unless a state board of pharmacy requires additional years. 
• Implement a Form 41 folder within your DEA recordkeeping filing system, facilitating readily retrievable practices as required by DEA. 
• Make sure the DEA-registered reverse distributor who destroys the controlled substances is responsible for submitting a DEA Form 41 to the DEA when the controlled substances have been destroyed. 

Theft or Loss—106 Form 

About the regulation:  

Title 21 CFR Part 1301.76 Other Security Controls for Practitioners indicates the Registrant shall notify the DEA Field Division Office of the Administration in their area, in writing, of the theft or significant loss of any controlled substances within one business day of discovery of such loss or theft. The Registrant shall also complete and submit the DEA Form 106 regarding the loss or theft to the Field Division Office in their area. 

Recent DEA settlements: 

$7.75 million civil penalty—January 2021: According to the DEA, McLaren Health Care Corporation failed to notify the DEA of known employee thefts of controlled substances. “These violations, the government claimed, stemmed in part from certain facility policies that were inconsistent with the CSA’s requirements and MHCC’s failure to revise other legacy policies that remained in place after MHCC acquired corporate health care providers.” 

$1 million civil penalty—April 2022: The United States alleges that Prisma Health Midlands “failed to notify the DEA within one business day regarding thefts or significant losses of controlled substances over a three-year time period. As a DEA registrant, Prisma has certain record keeping and reporting obligations and one of these is to promptly notify the DEA whenever a theft or significant loss occurs.” 

Your compliance action plan: 

• Define and document your organization’s controlled substance significant loss threshold. This document will assist an entity on when a 106 Form should be used when a loss is identified. DEA does not expect a 106 Form to be submitted for a loss that has been deemed insignificant to an organization. 
• Notify the local DEA Diversion Field Office in writing within one business day of discovery of a theft or significant loss of a controlled substance. 
• Implement a process to complete and submit a Form 106 for any theft or significant loss of any controlled substances communicated to the DEA. Maintain evidence of loss or theft investigation materials along with the Form 106. This often contains confidential information and may need to be kept in a secure location. 
• Implement a Form 106 folder within your DEA recordkeeping filing system to retain at least two years’ worth of 106 Forms as required by DEA, at a minimum, unless a BOP requires additional years. 
• If the 106 Forms are kept outside the standardized DEA recordkeeping filing system, then a placeholder folder should be maintained within the filing cabinet directing where the 106 forms are kept. This facilitates readily retrievable practices as required by the DEA.  
• If, after the initial notification to DEA, the investigation of the theft or loss determines no such theft or loss of controlled substances occurred, a DEA Form 106 does not need to be filed. However, for complete and accurate records, it is strongly recommended that the registrant notify DEA in writing of this fact to resolve the initial report and explain why no DEA Form 106 was filed regarding the incident. 

Biennial Inventory 

About the regulation: 

The DEA Pharmacist’s Manual (2022 edition) indicates that the inventory records of Schedule II controlled substances must be kept separate from all other records of the pharmacy and that the records for Schedules III, IV, and V controlled substances must be maintained either separately from all other records of the pharmacy or in such format that the information required is readily retrievable from the pharmacy’s ordinary business records. 

The DEA Pharmacist’s Manual (2022 edition) also indicates that “inventory” is a complete and accurate list of all stocks and forms of controlled substances in the possession of the registrant on the date the inventory is taken as determined by an actual physical count for Schedule II controlled substances and shall be maintained in written, typewritten, or printed form at the registered location. With respect to inventories of a schedule III, IV, or V controlled substance, the registrant may, with respect to an open bottle that contains no more than 1,000 tablets, make an estimated count or measure of the contents, unless the container holds more than 1,000 tablets or capsules in which case an exact count of the contents must be made. 

Title 21 CFR Part 1304.11 (a) indicates the controlled substance inventory may be taken either as of opening of business or as of the close of business on the inventory date and that it shall be indicated on the inventory. 

Recent DEA settlements: 

$1.9 million civil penalty—December 2022: Northeast Hospital Corp. agreed to pay civil penalties to resolve allegations it violated the CSA by failing to keep accurate records of controlled substances and that “based on DEA’s audit of the controlled substances that Northeast had on site, Northeast’s actual controlled substances inventory differed from what its records showed should be present.” 

$250,000 civil penalty—August 2023: Christian & Missionary Alliance Foundation, Inc. agreed to pay the United States $250,000 to resolve allegations that the company “violated the Controlled Substances Act by failing to maintain records required by the CSA.” The United States determined that “Christian & Missionary Alliance Foundation, Inc. committed 176 violations of the CSA, including failing to take a new inventory of all controlled substances on hand at least once every two years, failing to maintain records of the number of units acquired from other persons, and failing to notify the DEA of a theft or loss within one business day of the discovery.” 

Your compliance action plan: 

• Ensure your biennial inventory includes the name of the controlled substance, finished form, number of units or volume, number of commercial containers, and the total count of the controlled substance. 
• Confirm biennial inventory documentation includes an actual physical count of all controlled substances in the registrant’s possession, including expired controlled substances. Electronic inventory records cannot be used for the biennial inventory count. 
• Confirm the biennial inventory documentation indicates whether the inventory was completed at opening of business or at of the close of business on the inventory date. 
• Although not required by law, DEA recommends that registrants keep an inventory record that includes the name, address, and DEA registration number of the registrant and the signature of the person or persons responsible for taking the inventory. 
• Implement a biennial inventory folder within your DEA recordkeeping filing system to retain biennial inventory documentation, facilitating readily retrievable practices as required by DEA. 

Need DEA compliance assistance? 

The settlement examples above offer significant reminders of the importance of compliance with DEA regulations. The costs to not only your organization’s finances but to your organization’s reputation as a trustworthy operation are great. 

For more information on DEA regulations or how Kodiak can assist you with your compliance program, please reach out to our compliance experts. Don’t miss part 2 of this article, which will cover DEA regulations and settlements related to physical security controls, diversion reporting and monitoring, drug testing, and dispensing.