Regulatory Alert: DEA’s New Controlled Substance Theft or Loss Rule Includes a New Deadline and May Require Changes to Corporate Compliance Systems

On July 24, 2023, a new final rule from the Drug Enforcement Administration (DEA) became effective, with important consequences for companies and individuals registered to manufacture, distribute, or dispense controlled substances. Specifically, DEA will now require that registrants submit DEA’s “Form 106”, which provides information regarding the theft or significant losses of controlled substances, electronically and within 45 calendar days of discovery of the theft or loss. As there previously was no specific deadline to submit Form 106, this update could have significant potential implications for companies at all levels of the controlled substances supply chain and require immediate attention and allocation of resources to ensure compliance.

Pursuant to the relevant provision of the Controlled Substances Act (CSA), 21 U.S.C. § 830(b)(1)(C), all individuals and entities registered to manufacture, distribute, or dispense controlled substances must report “any unusual or excessive loss or disappearance of a listed chemical under the control of the regulated person.” DEA regulations have provided additional guidance on this requirement, previously requiring in 21 C.F.R. § 1301.74(c) that:

The registrant must notify the Field Division Office of the Administration in his or her area, in writing, of any theft or significant loss of any controlled substances within one business day of discovery of the theft or loss. . . . The registrant must also complete, and submit to the Field Division Office in his or her area, DEA Form 106 regarding the theft or loss. Thefts and significant losses must be reported whether or not the controlled substances are subsequently recovered or the responsible parties are identified and action taken against them.

Similarly, 21 C.F.R. § 1301.76(b) previously provided:

The registrant shall notify the Field Division Office of the Administration in his area, in writing, of the theft or significant loss of any controlled substances within one business day of discovery of such loss or theft. The registrant shall also complete, and submit to the Field Division Office in his area, DEA Form 106 regarding the loss or theft.

These regulations failed, however, to provide registrants with any guidance as to when they needed to file Form 106 following the theft or loss.

As a result of this ambiguity, DEA issued the new rule revising both Sections 1301.74(c) and 1301.76(b) to now require that registrants file a completed Form 106 “through the DEA Diversion Control Division secure network application within 45 calendar days after discovery of the theft or loss.” DEA published its initial notice of proposed rulemaking on July 29, 2020 (85 FR 45547), and after a lengthy comment period, which included pushback from industry groups concerning DEA’s initially-proposed 15-day deadline, DEA issued its final rule with the 45-day deadline.

Implications for Registrants: Critical to Complete Form 106 Within 45 Calendar Days

DEA’s clarification of the deadline to file a completed Form 106 within 45 calendar days of discovery of the theft or loss will have significant consequences for DEA registrants, which include manufacturers, distributors, pharmacies, and practitioners that are registered to manufacture, distribute, or dispense controlled substances.

This new 45-day deadline represents a greater opportunity for registrants to investigate the circumstances surrounding the theft or loss, and complete Form 106 accordingly. However, with a strict deadline in place, registrants will need to ensure that they have a compliance system in place that can adequately investigate the theft or loss, complete Form 106, and submit it to the local DEA Field Division Office within 45 calendar days. Failure to submit on time risks significant penalties pursuant to 21 U.S.C. § 842(c), including potential loss of registration to distribute controlled substances, civil fines, and criminal fines. Further, the small minority of registrants that file a Form 106 via paper submissions (DEA has reported that as of 2018, 99.5% of submissions of Form 106 were conducted electronically) will have to revise their compliance schemes to report through DEA’s electronic system.

It must be noted that this rule does not revise 21 CFR § 1310.05(b)(1), which still requires registrants to report “unusual or excessive loss or disappearance of a listed chemical” using DEA Form 107 within 15 calendar days after being aware of the loss. This update also does not change the requirement under 21 C.F.R. § 1301.74(c) that all registrants must notify DEA of the theft or loss within one business day of discovery.

Lingering Questions: Regulatory Vagueness Concerning “Discovery” of Theft and Loss and the Definition of a “Significant Loss”

Despite DEA providing clarity on the method and deadline for filing a Form 106, there remain open questions in the regulations for registrants for when it is necessary to report losses of controlled substances to DEA and what losses are reportable under 21 C.F.R. § 1301.74(c) and 21 C.F.R. § 1301.76(b).

Both of those regulations require registrants to report a “significant loss” of controlled substances to DEA. Although it does not provide a precise definition, 21 C.F.R. §1301.74(c) provides six factors for a registrant to determine a significant loss:

(1) The actual quantity of controlled substances lost in relation to the type of business

(2) The specific controlled substances lost

(3) Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances

(4) A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,

(5) Whether the specific controlled substances are likely candidates for diversion

(6) Local trends and other indicators of the diversion potential of the missing controlled substance

In the final rule, DEA acknowledges the ambiguity of these factors, noting that “[t]he distinction between a significant loss and a normal loss is case and circumstance specific, and registrants are best positioned to determine whether a loss rises to the level of a significant loss.” Accordingly, registrants will have to remain vigilant as to whether DEA will consider any losses of controlled substances “significant” under this standard.

The second open issue concerns when the 45-day countdown begins for filing the Form 106 and when the one-day deadline begins for providing notice to DEA of the loss or theft. Pursuant to 21 C.F.R. § 1301.74(c) and 21 C.F.R. § 1301.76(b), the responsibility arises when the registrant “discovers” the loss or theft.

Again, however, the regulations do not provide a clear definition of what constitutes discovery of the loss or theft. In the final rule, DEA recognizes “that there is some confusion on the meaning of ‘discovery’” and stated that “the discovery occurs in incremental stage.” Crucially, the final rule includes that “DEA is planning on addressing the definition of Discovery in a future rulemaking.” Accordingly, registrants may be looking forward to receiving additional guidance for when they need to report losses or thefts of controlled substances.

Foley is here to help you address the short- and long-term impacts in the wake of regulatory changes. We have the resources to help you navigate these and other important legal considerations related to business operations and industry-specific issues. Please reach out to the authors, your Foley relationship partner, or to our Health Care Practice Group with any questions.