The DEA has issued a final rule specifying that the agency form used by registrants to report thefts or significant losses of controlled substances must be submitted electronically and must be provided within 45 days after discovery of the theft or loss (88 Fed. Reg. 40707, June 22, 2023).

Currently, DEA registrants — both practitioners and nonpractitioners — must notify their local DEA Field Division Office in writing of any theft or significant loss of any controlled substances within one business day of discovery of the theft or loss. In addition, registrants must complete and submit to the same Field Division Office a DEA Form 106 regarding the theft or loss.

Until now, the regulations have been silent as to the submission method to be used for the DEA Form 106 — for example, whether the delivery should be by mail, by hand, or electronic — and as to the deadline for submitting the form.

By contrast, the agency’s regulations set a mandatory electronic submission method and reporting deadline for filing DEA Form 107, which is used by regulated persons to report any unusual or excessive loss or disappearance of a listed chemical. Under 21 C.F.R. §1310.05(b)(1), a DEA Form 107 must be submitted electronically through the DEA Diversion Control Division secure network application within 15 calendar days after the regulated person becomes aware of the circumstances that require the report.

Proposed Rule

In a notice of proposed rulemaking (NPRM) published in the Federal Register on July 29, 2020 (85 Fed. Reg. 45547), the DEA proposed that registrants be required to file the DEA Form 106 electronically through the DEA Diversion Control Division secure network application within 15 calendar days of the discovery of the theft or significant loss of a controlled substance.

The proposed rule did not propose any change to the requirement that practitioners and nonpractitioners preliminary notify their local DEA Field Division Office of the theft or significant loss in writing within one business day of discovering the theft or loss.

DEA Responses to Comments

The majority of those commenting on the NPRM did not favor the 15-day time frame for filing the DEA Form 106. For example, the American Pharmacists Association said that the time frame did not provide enough time for completion of all required documentation and the investigation and would be unduly burdensome to DEA registrants.

In response, the DEA determined in the final rule to allow registrants 45 days to submit DEA Form 106, saying that 45 days would be “more than enough time to conduct investigations.”

Some who submitted comments expressed concerns about the one-day preliminary reporting requirement and the separate requirement that a DEA Form 106 be submitted. Some thought that the requirements were redundant, some called the one-day reporting requirement arbitrary, and some called for the one-day reporting requirement to be abolished altogether. Another suggested that there should be only one reporting requirement and that the report should be submitted to a central location within the DEA.

In response to these comments, the DEA said that it was “appropriate to retain the two-step reporting requirement,” which the agency said allowed the DEA “to know right away about the theft and significant loss, to have an immediate record of the initial incident, and … to promptly institute any actions deemed appropriate to the situation.” Moreover, the separate DEA Form 106 filing requirement “allows the registrant time to adequately investigate the theft or loss and make a final determination,” the agency said.

Responding to other comments, the DEA stated the following in the preamble to the final rule:

• In clinics owned by multiple doctors with individual DEA registrations, records and controlled substances for each individual registrant should be kept separate from those of other registrants to help distinguish which controlled substances belong to which registrant. Each registered practitioner whose stock has been affected by a theft or significant loss is responsible for providing the one-day notification to the DEA Field Division Office and for filing DEA Form 106. “Each practitioner is responsible for designating who files a report of theft or loss within their clinic or pharmacy,” the agency said. “Therefore, DEA leaves this decision solely for the practitioner.”
• Regarding what constitutes a “significant loss” — a term not defined in the regulations — the DEA said, “What constitutes a significant loss for one registrant may be construed as comparatively insignificant for another. A manufacturer may experience continuous losses in the manufacturing process due to, for example, atmospheric changes or mixing procedures. Such losses may not be deemed by the registrant to be significant and may be recorded in batch records. Conversely, for registrants other than manufacturers, the repeated loss of even small quantities of controlled substances over a period of time may indicate a significant aggregate significant loss that must be reported to DEA, even though the individual quantity of each occurrence is not significant. The distinction between a significant loss and a normal loss is case- and circumstance-specific, and registrants are best positioned to determine whether a loss rises to the level of a significant loss.”

The final rule, which amends 21 C.F.R. §1301.74 and 21 C.F.R. §1301.76, is effective July 24.