DEA Rule Changes for Reporting Lost or Stolen Drugs
EXECUTIVE SUMMARY
The Drug Enforcement Administration recently changed the rules for reporting lost or stolen drugs. There is a deadline for filing an investigation form.
- Theft or loss must be reported immediately.
- Form 106 must be filed within 45 days.
- Some compliance processes may need to be revised.
The Drug Enforcement Administration (DEA) recently released guidance that clears up some ambiguity regarding compliance with the Controlled Substances Act.
The guidance regards the reporting requirements for controlled substances that are lost or stolen, says Katy E. Koski, JD, partner with Foley & Lardner in Boston. The guidance is a relatively simple but significant change to compliance requirements.
Under DEA rules, all individuals and entities registered to manufacture, distribute, or dispense controlled substances must report “any unusual or excessive loss or disappearance of a listed chemical under the control of the regulated person” within one business day of discovery of the theft or loss. The registrant also must complete DEA Form 106 regarding the theft or loss and submit it to the local Field Division Office. The form must be submitted regardless of whether the controlled substances are later recovered, or the responsible parties are identified and prosecuted.1
However, the regulations did not provide information regarding when they need to file Form 106 following the theft or loss, Koski explains. The recent guidance now requires that registrants file a completed Form 106 “within 45 calendar days after discovery of the theft or loss.”
The rule applies to a significant theft or loss of the product, Koski notes. Typically, the drugs were in transit, such as from a storage facility on site at the hospital. The loss must be reported within a day and investigated. Previously, there was no time limit on submitting the full investigation report.
“You’re required to fill out the form that says, ‘We’ve looked, we followed up with the carrier, and here’s what we think happened.’ There was no deadline to do that before, so that meant the investigation takes as long as it takes with no real stopping point,” Koski says. “You can’t just say to DEA, ‘We had a loss,” and then move on. You have to actually investigate it.”
Good News for Healthcare
The guidance should be welcomed by healthcare providers because it provides goalposts for ensuring compliance, Koski says. Risk managers should look at their processes to ensure that if they must report a loss, their policies and procedures are geared toward submitting the final report in 45 days.
Koski offers a hypothetical scenario in which a hospital or health system employs one person responsible for those investigations, but that one person is on vacation for two weeks. A theft or loss occurs during that time — and in the past, that might not have posed a problem.
“In the past, it may not have been as big a deal because you could wait those two weeks and then have the investigation begin. Now, the risk management team might think about whether you need a backup in case the person who’s normally responsible for doing the investigation is going to be out,” Koski explains. “Maybe we need to have somebody else who is trained on how to do the process because now we have to get it done in in 45 days.”
The deadline could work to the advantage of healthcare entities required to report, Koski notes. With no pressure to report by a certain date, those entities had little leverage when requesting information about the loss from a distributor, third-party logistics company, or a shipping company. Requests usually must go through that organization’s risk prevention and loss departments — and they may have believed there was no need to be quick about responding.
“Now, you can use the added pressure of what the rule requires to say — ‘My policy is now you have to get back to me in two business days because I have this end deadline,’” Koski says. “I think it just puts more pressure on the folks who are in the process to move things along and not let them linger.”
The guidance also introduces a new requirement that Form 106 must be submitted electronically. That might not affect many entities since most already submit electronically, Koski says, but there may be some that still submitted hard copies because it happened so infrequently. Those entities will need to update their processes.
Some Investigations Take Time
Depending on the nature of the investigation, 45 days could require some hustling to comply. Some investigations will consist mainly of querying an outside party and making them respond in time, but others will require more complex internal investigations. It may be necessary to interview employees, study employee records, find out who was on staff that day, and look for unusual circumstances, like a power outage.
“More information is better, so now we know we’re not going to get it done in in 60 days because that’s a violation of the rule. But it’s good because we’re also not going to hear from DEA that we took too long when we submitted in 20 days,” Koski says. “It also puts some certainty in your own program that you can move the ball faster in your investigation if you have hard deadlines.”
The recent guidance does not eliminate all ambiguity from the compliance process, Koski notes. The DEA rule leaves open what constitutes a “significant loss” of controlled substances, but provides these factors to consider:
- The substances that were lost;
- The quantity of controlled substances lost in relation to the type of business;
- Whether the loss can be associated with access by specific individuals;
- Whether the loss can be attributed to unique activities involving the controlled substances;
- A pattern of losses over a period, whether the losses appear random, and efforts to resolve the losses;
- Whether the substances could have been diverted;
- Local trends and other indicators of diversion potential.
The rule also is unclear about what counts as discovering the loss, which triggers the time requirements.
“We would love to see more guidance from the DEA. The DEA has indicated that they’re working on doing some additional guidance, which is always welcomed in the industry,” Koski says.
REFERENCE
- Drug Enforcement Administration. Reporting theft or significant loss of controlled substances. Fed Regist. June 22, 2023.
SOURCE
- Katy E. Koski, JD, Partner, Foley & Lardner, Boston. Phone: (617) 502-3242. Email: [email protected].
The Drug Enforcement Administration recently released guidance that clears up some ambiguity regarding compliance with the Controlled Substances Act. The guidance regards the reporting requirements for controlled substances that are lost or stolen.
Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.