DEA Fine-Tunes the Theft and Significant Loss Reporting Two-Step

Like the celebrated Texas dance of the same name, reporting controlled substance thefts and significant losses to the Drug Enforcement Administration (“DEA”) requires just that: two steps.  For the first time in eighteen years, DEA has revised its controlled substance theft and significant loss reporting regulations.  Since 1995, at least 28 registrants, primarily hospitals and pharmacies, have paid significant civil penalties ranging from $10,000 to $5,000,000 to settle allegations that they wholly or in part failed to report, or failed to report in a timely manner, controlled substance thefts or significant losses to DEA.  We thought it appropriate to take this opportunity to not only explain DEA’s revised regulations but also how registrants must now report controlled substance thefts and significant losses.

Step 2: DEA-106 Submission

DEA just published a final rule amending its theft and loss reporting regulations to require registrants to submit a “Report of Theft or Loss of Controlled Substances,” DEA Form 106 (“DEA-106”), electronically to the agency within 45 days of discovery of a theft or significant loss.  Reporting Theft or Significant Loss of Controlled Substances, 88 Fed. Reg. 40707, 40708 (June 22, 2023) (to be codified at 21 C.F.R. §§ 1301.74(c) and .76(b)). Attached here.

The rule now requires registrants to first report a theft or significant loss in writing within one business day of discovery (step 1), followed literally by a DEA-106 filed through the agency’s secure network application “within 45 calendar days” (for non-practitioners) and “within 45 days” (for practitioners) after discovery (step 2).  Id. at 40712.  DEA will no longer accept hardcopy DEA-106s as of July 24, 2023.  Id. at 40708.

DEA’s notice of proposed rulemaking would have required registrants to electronically file a DEA-106 within 15 calendar days after discovery, the original intent to align the shorter DEA-106 submission with the time required for submission of a “Report of Theft or Loss of Listed Chemicals,” DEA Form 107, for listed chemicals.  Id.  DEA expanded the proposed rule to allow 45 days, reasoning “that adequate time is needed in order to complete an accurate and thorough investigation” to submit a DEA-106.  Id. at 40709.  The 45-day timeframe within which to complete the second step allows registrants time to adequately investigate and make a final determination about the incident.  Id.  DEA justified requiring electronic submission of DEA-106s rather than a paper copy because it “will allow all report submissions to be received more quickly and stored in a central database, as well as allow for analysis.”  Id. at 40710.

Step 1: Initial Notification

The final rule does not revise the requirement that registrants must initially notify the DEA field division office in their area in writing within one business day of discovery of a theft or significant loss.  21 C.F.R. §§ 1301.74(c) and .76(b).  Notification by email or facsimile work; a telephone call does not.  Written notification eliminates misunderstanding that can arise with oral communication.  It documents what information was provided, when, and to whom.  Registrants should provide as much information about the incident as possible, including controlled substance quantity and the circumstances if known.  Reporting within one day of discovery allows the agency to know promptly about a theft or significant loss and to investigate immediately or undertake other appropriate actions.  88 Fed. Reg. 40707, 40709.

Thefts

Registrants must report all controlled substance thefts but only those losses that are “significant.”  The agency does not clarify what constitutes a “theft,” an intentional taking or diversion, while non-theft losses can include miscounting, dispensing an incorrect quantity, or misplacing or accidentally disposing of controlled substances.  In addition, registrants should also report thefts to local law enforcement.

Significant Loss

While DEA regulations require registrants to report all thefts, they must report only controlled substance losses that are “significant.”  21 C.F.R. §§ 1301.74(c) and .76(b).  Registrants have long wrestled with whether a particular loss they have experienced is significant and therefore reportable.  Over the years industry has requested DEA to define what constitutes a “significant loss.”  As with its 2005 revision of the regulations, the agency has again punted on defining “significant loss,” reasoning that what constitutes a significant loss for a manufacturer experiencing continuous losses in the manufacturing process may not be deemed significant by that registrant (but would need to be recorded in batch records).  88 Fed. Reg. 40707, 40709.  For non-manufacturer registrants, the loss of small quantities over time “may indicate a significant aggregate significant loss that must be reported to DEA, even though the individual quantity of each occurrence is not significant.”  Id.  DEA concluded once again that registrants are in the best position to determine whether their loss is significant, requiring reporting.

While not defining what constitutes a significant loss, DEA has again provided a list of factors that registrants should consider in determining whether a loss is significant.  Factors include:

1. The actual quantity of controlled substances lost in relation to the type of business;
2. The specific controlled substances lost (schedule IIs as opposed to schedule IIIs, IVs and Vs);
3. Whether the loss can be associated with access by specific individuals or attributed to unique activities that may take place involving the controlled substances;
4. A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses, and, if known;
5. Whether the controlled substances are likely candidates for diversion; and
6. Local trends and other indicators of diversion potential of the missing controlled substances. 21 C.F.R. §§ 1301.74(c) and .76(b).

Because DEA has abdicated defining whether a loss is significant, the agency should only seek enforcement for failure to report a significant loss in the most egregious cases.

Discovery

Registrants must report a theft or significant loss in writing within one business day of discovery, followed by a DEA-106 filed electronically within 45 days after discovery.  In 2005, DEA acknowledged that discovery can occur incrementally.  Reports by Registrants of Theft or Significant Loss of Controlled Substances, 79 Fed. Reg. 47094, 47095 (Aug. 12, 2005).  The agency has again declined to define discovery in the current final rule, but plans “on addressing the definition of Discovery in a future rulemaking.”  88 Fed. Reg. 40707, 40709.

DEA Field Division Office

The regulations require registrants to notify the DEA field division office in their area of thefts and significant losses.  Field division offices are the largest offices within a DEA field division where diversion program managers, diversion investigators, program analysts, and registration assistants are assigned, while resident and district offices are smaller offices, only some of which may be staffed by diversion investigators.  Strict adherence to the regulation requires reporting to the larger field division office despite geographic proximity or a relationship with a particular diversion group or investigator.

In-Transit Losses

Suppliers must report all in-transit controlled substance losses, not just those that are thefts or significant.  The agency also does not define “in-transit,” but uses the term in connection with use of a common or contract carrier.  21 C.F.R. § 1301.74(c).  So, suppliers must report any controlled substance lost while en route via common or contract carrier.  Purchasers must report any loss after they have signed for and taken custody of controlled substances.  DEA, Pharmacist’s Manual: An Informational Outline of the Controlled Substances Act (Rev. 2022), at 63.

Breaks and Spills

Breaks, spills, and other witnessed controlled substance losses do not require reporting to DEA.  DEA has reasoned that they are not actually lost “because they can be accounted for.”  Reports by Registrants by Registrants of Theft or Significant Loss of Controlled Substances, 70 Fed. Reg. 40576, 40578 (July 8, 2003).

Miscounts and Inventory Adjustments

Neither controlled substance miscounts nor inventory adjustments involving clerical errors should be reported.

ARCOS Reporting

Thefts and losses must be reported to DEA’s Automation of Reports and Consolidated Orders System (“ARCOS”).  Registrants should report thefts via ARCOS as “thefts” using the appropriate transaction code and report losses as “losses.”  Reporting to ARCOS is in addition to initial notification and electronic submission of a DEA-106.

****

A one and a two…