Regulatory Alert: DEA’s New Controlled Substance Theft or Loss Rule Includes a New Deadline and May Require Changes to Corporate Compliance Systems

On July 24, 2023, a new final rule from the Drug Enforcement Administration (DEA) became effective, with important consequences for companies and individuals registered to manufacture, distribute, or dispense controlled substances. Specifically, DEA will now require that registrants submit DEA’s “Form 106”, which provides information regarding the theft or significant losses of controlled substances, electronically and within 45 calendar days of discovery of the theft or loss. As there previously was no specific deadline to submit Form 106, this update could have significant potential implications for companies at all levels of the controlled substances supply chain and require immediate attention and allocation of resources to ensure compliance.

Pursuant to the relevant provision of the Controlled Substances Act (CSA), 21 U.S.C. § 830(b)(1)(C), all individuals and entities registered to manufacture, distribute, or dispense controlled substances must report “any unusual or excessive loss or disappearance of a listed chemical under the control of the regulated person.” DEA regulations have provided additional guidance on this requirement, previously requiring in 21 C.F.R. § 1301.74(c) that:

The registrant must notify the Field Division Office of the Administration in his or her area, in writing, of any theft or significant loss of any controlled substances within one business day of discovery of the theft or loss. . . . The registrant must also complete, and submit to the Field Division Office in his or her area, DEA Form 106 regarding the theft or loss. Thefts and significant losses must be reported whether or not the controlled substances are subsequently recovered or the responsible parties are identified and action taken against them.

Similarly, 21 C.F.R. § 1301.76(b) previously provided:

The registrant shall notify the Field Division Office of the Administration in his area, in writing, of the theft or significant loss of any controlled substances within one business day of discovery of such loss or theft. The registrant shall also complete, and submit to the Field Division Office in his area, DEA Form 106 regarding the loss or theft.

These regulations failed, however, to provide registrants with any guidance as to when they needed to file Form 106 following the theft or loss.

As a result of this ambiguity, DEA issued the new rule revising both Sections 1301.74(c) and 1301.76(b) to now require that registrants file a completed Form 106 “through the DEA Diversion Control Division secure network application within 45 calendar days after discovery of the theft or loss.” DEA published its initial notice of proposed rulemaking on July 29, 2020 (85 FR 45547), and after a lengthy comment period, which included pushback from industry groups concerning DEA’s initially-proposed 15-day deadline, DEA issued its final rule with the 45-day deadline.

Implications for Registrants: Critical to Complete Form 106 Within 45 Calendar Days

DEA’s clarification of the deadline to file a completed Form 106 within 45 calendar days of discovery of the theft or loss will have significant consequences for DEA registrants, which include manufacturers, distributors, pharmacies, and practitioners that are registered to manufacture, distribute, or dispense controlled substances.

This new 45-day deadline represents a greater opportunity for registrants to investigate the circumstances surrounding the theft or loss, and complete Form 106 accordingly. However, with a strict deadline in place, registrants will need to ensure that they have a compliance system in place that can adequately investigate the theft or loss, complete Form 106, and submit it to the local DEA Field Division Office within 45 calendar days. Failure to submit on time risks significant penalties pursuant to 21 U.S.C. § 842(c), including potential loss of registration to distribute controlled substances, civil fines, and criminal fines. Further, the small minority of registrants that file a Form 106 via paper submissions (DEA has reported that as of 2018, 99.5% of submissions of Form 106 were conducted electronically) will have to revise their compliance schemes to report through DEA’s electronic system.

It must be noted that this rule does not revise 21 CFR § 1310.05(b)(1), which still requires registrants to report “unusual or excessive loss or disappearance of a listed chemical” using DEA Form 107 within 15 calendar days after being aware of the loss. This update also does not change the requirement under 21 C.F.R. § 1301.74(c) that all registrants must notify DEA of the theft or loss within one business day of discovery.

Lingering Questions: Regulatory Vagueness Concerning “Discovery” of Theft and Loss and the Definition of a “Significant Loss”

Despite DEA providing clarity on the method and deadline for filing a Form 106, there remain open questions in the regulations for registrants for when it is necessary to report losses of controlled substances to DEA and what losses are reportable under 21 C.F.R. § 1301.74(c) and 21 C.F.R. § 1301.76(b).

Both of those regulations require registrants to report a “significant loss” of controlled substances to DEA. Although it does not provide a precise definition, 21 C.F.R. §1301.74(c) provides six factors for a registrant to determine a significant loss:

(1) The actual quantity of controlled substances lost in relation to the type of business

(2) The specific controlled substances lost

(3) Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances

(4) A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,

(5) Whether the specific controlled substances are likely candidates for diversion

(6) Local trends and other indicators of the diversion potential of the missing controlled substance

In the final rule, DEA acknowledges the ambiguity of these factors, noting that “[t]he distinction between a significant loss and a normal loss is case and circumstance specific, and registrants are best positioned to determine whether a loss rises to the level of a significant loss.” Accordingly, registrants will have to remain vigilant as to whether DEA will consider any losses of controlled substances “significant” under this standard.

The second open issue concerns when the 45-day countdown begins for filing the Form 106 and when the one-day deadline begins for providing notice to DEA of the loss or theft. Pursuant to 21 C.F.R. § 1301.74(c) and 21 C.F.R. § 1301.76(b), the responsibility arises when the registrant “discovers” the loss or theft.

Again, however, the regulations do not provide a clear definition of what constitutes discovery of the loss or theft. In the final rule, DEA recognizes “that there is some confusion on the meaning of ‘discovery’” and stated that “the discovery occurs in incremental stage.” Crucially, the final rule includes that “DEA is planning on addressing the definition of Discovery in a future rulemaking.” Accordingly, registrants may be looking forward to receiving additional guidance for when they need to report losses or thefts of controlled substances.

Foley is here to help you address the short- and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Foley relationship partner, or to our Health Care Practice Group with any questions.

Disclaimer

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.