Michael A. Dowell (mdowell@hinshawlaw.com) is Health Law Partner in the Los Angeles office of Hinshaw & Culbertson, LLP.
Part 1 of this two-part article was published in the November 2019 issue of Compliance Today.
Last month we looked at how the Drug Enforcement Administration (DEA) administers and enforces the federal law governing the manufacture, distribution, and use of prescription and illicit opioids under the Controlled Substances Act (CSA). Part 1 covers the record-keeping requirements, security requirements, and dispensing requirements for pharmacies under the CSA. Part 2 reviews the reporting requirements as well as issues involved in the development of a controlled substance compliance program.
Reporting requirements
The CSA requires pharmacies to report periodically to the DEA every sale, delivery, disposal, or dispensing of any controlled substance.[1]
Internet dispensing
Pharmacies that are authorized to dispense controlled substances by means of the internet must report to the DEA the total quantity of each controlled substance that the pharmacy has dispensed each month. However, pharmacies are exempt from this reporting requirement if, in each month the report is required, they do not exceed either of two thresholds: (1) 100 or more prescriptions dispensed, or (2) 5,000 or more dosage units of all controlled substances combined.[2]
Theft or significant loss
Within one business day of the discovery of a theft or significant loss of any controlled substance, the pharmacy must: (1) notify the DEA and police, and (2) complete DEA Form 106 documenting the loss or theft.
DEA inspections
The DEA’s principal method to monitor and ensure pharmacy compliance with the CSA and its implementing regulations are “inspections.”[4] The CSA authorizes diversion investigators to inspect “controlled premises,” which are places where pharmacies may “lawfully hold, manufacture, distribute, dispense, administer, or otherwise dispose of controlled substances or listed chemicals or where records relating to those activities are maintained.”[5] A DEA inspection may include a review of security measures, record-keeping procedures, inventory records, and a controlled substances audit. Investigators can inspect, copy, and verify required records and reports, and inspect finished and unfinished drugs, equipment, containers, labeling, processes, and controls.[6] Investigators may also inventory controlled substances on-hand.
The three types of inspections that the DEA may undertake are: (1) regulatory, (2) complaint, and (3) criminal.[7] Regulatory investigations can include pre-registration inspections and cyclic inspections of pharmacies. Pre-registration inspections are usually scheduled appointments. Cyclic inspections may be scheduled or unannounced, and they occur every two, three, or five years.[8]
Complaint investigations may be started on the basis of third-party information obtained by the DEA or state regulators, or other information the DEA obtains regarding the diversion of controlled substances. The Automation of Reports and Consolidated Order System (ARCOS) is an automated reporting system used by the DEA to monitor the flow of controlled substances from their point of manufacture to the point of sale or distribution at the dispensing/retail level, such as hospitals, pharmacies, practitioners, and teaching institutions.[9]
The DEA also conducts investigations into criminal activities involving diversion of controlled substances that may involve DEA pharmacies or non-pharmacies, such as prescription forgery, illegal prescribing, or diversion of controlled substances.[10]
Pre-registration inspections
Once the DEA receives a completed DEA Form 510 application, DEA personnel from the local DEA field office will contact the pharmacy to schedule an on-site inspection of the premises. An on-site inspection will be conducted for every new application, regardless of whether the pharmacy currently holds a DEA registration or has been inspected previously by the DEA. Pre-registration inspections will generally address the following areas: (1) review of the DEA Form 510 application; (2) obtain background information on pharmacy officers and individuals who will be responsible for controlled substance ordering, handling, and security; (3) review of state licenses to verify that the pharmacy has obtained all required state licenses; (4) review the applicant’s proposed supplier and customer lists; (5) review of the pharmacy’s controlled substances policies and procedures; and (6) inspection and testing of the pharmacy’s physical security, including storage vaults, safes, cages, and alarm systems.[11]
Cyclic inspections
The DEA makes cyclical inspections (every 3–5 years), which may include scheduled or unannounced inspections.[12] Cyclic inspections may address the areas noted for review in a pre-registration inspection and will also inspect, copy, and verify required controlled substance records and reports to ensure that they are complete, accurate, and available for at least two years.[13] Cyclic inspections may include an audit of various controlled substances.[14]
