The sentence that every diversion prevention program ultimately rests on is short: “All applicants and registrants shall provide effective controls and procedures to guard against theft and diversion of controlled substances” (21 CFR 1301.71(a)). It does not say how. The how is in the rest of the section and the five that follow it, and most of it is written for a factory or a warehouse. This guide reads the section slowly and translates each part into what it means behind a pharmacy counter or in a hospital.
Paragraph (a): the standard, and the yardstick
Paragraph (a) does two things. It states the obligation, and it says how DEA will judge whether you have met it: the Administrator “shall use the security requirements set forth in §§ 1301.72–1301.76 as standards for the physical security controls and operating procedures necessary to prevent diversion.” It adds that materials and construction giving a “structural equivalent” to the physical requirements in 1301.72, 1301.73 and 1301.75 may be used instead.
For a pharmacy or hospital, the relevant sections are 1301.75 (physical security for practitioners) and 1301.76 (other security controls for practitioners). Sections 1301.72 through 1301.74 are written for non-practitioners such as distributors and manufacturers; they describe vaults, safes and alarm specifications that a pharmacy is not required to install. The practitioner storage rule is one sentence: Schedule II through V substances must be stored in a “securely locked, substantially constructed cabinet”, except that pharmacies and institutional practitioners may instead disperse them through the stock of non-controlled drugs “in such a manner as to obstruct the theft or diversion” (21 CFR 1301.75(b)).
Paragraph (b): substantial compliance and the fifteen factors
Paragraph (b) is where the words “effective controls” get their content. It says substantial compliance with the standards “may be deemed sufficient by the Administrator after evaluation of the overall security system and needs of the applicant or registrant”, and then lists fifteen factors DEA “may consider” in that evaluation. The list is permissive and non-exclusive. It is also the closest thing in the regulations to a description of what an investigator is weighing when they walk through your building. Here is each factor, quoted, with a practice reading for a dispensing setting.
- “The type of activity conducted.” The examples given are industrial, but the point carries: an outpatient pharmacy, an inpatient pharmacy with an IV room, and an anesthesia workroom are different activities with different exposure.
- “The type and form of controlled substances handled.” Injectable opioids in single-use vials, which can be tampered with and replaced, sit at the high end. Bulk liquids that are measured rather than counted are another.
- “The quantity of controlled substances handled.” Paragraph (c), discussed below, makes this dynamic: when quantity rises significantly, controls must expand with it.
- “The location of the premises and the relationship such location bears on security needs.” A pharmacy with a public window, a 24-hour emergency department, a satellite in a clinic building with shared corridors.
- “The type of building construction.” Drywall and drop ceilings between a narcotics room and a corridor are a construction question before they are a policy question.
- “The type of vault, safe, and secure enclosures or other storage system (e.g., automatic storage and retrieval system) used.” The parenthetical covers automated dispensing cabinets and carousel systems. For a practitioner this is the “securely locked, substantially constructed cabinet” of 1301.75(b).
- “The type of closures on vaults, safes, and secure enclosures.” Mechanical lock, electronic lock, biometric, and whether the cabinet actually latches.
- “The adequacy of key control systems and/or combination lock control systems.” Who has a key or code, how it is issued, how it is revoked, and whether anyone can answer those questions today. This factor is where most pharmacy findings land.
- “The adequacy of electric detection and alarm systems, if any.” The words “if any” matter: alarms are not mandated for practitioners, but if you have one it should work, be monitored and have standby power.
- “The extent of unsupervised public access to the facility.” Can a visitor reach the pharmacy door, the medication room, the anesthesia cart?
- “The adequacy of supervision over employees having access to manufacturing and storage areas.” This is the factor a diversion prevention program most directly answers: who works alone with the stock, who reviews their activity, how often.
- “The procedures for handling business guests, visitors, maintenance personnel, and nonemployee service personnel.” Cabinet technicians, contractors, agency staff and students all count.
- “The availability of local police protection or of the registrant's or applicant's security personnel.” Mostly a siting question, but it is also why an unmonitored alarm is a weaker control than a monitored one.
- “The adequacy of the registrant's or applicant's system for monitoring the receipt, manufacture, distribution, and disposition of controlled substances in its operations.” Read this one twice. It is not about cameras. It is about whether you can account for every unit from the loading dock to the patient or the destruction record, and whether anyone is watching that accounting. Perpetual inventory, cabinet reports, discrepancy review and the periodic reconstruction of one drug's movement all live here.
- “The applicability of the security requirements contained in all Federal, State, and local laws and regulations governing the management of waste.” Pharmaceutical waste streams are a diversion route, and the rules governing them are part of the security picture.
Paragraphs (c) and (d): controls that move, and asking first
Paragraph (c) says that when controls become inadequate because a drug is rescheduled, a non-controlled drug becomes scheduled, or there is “a significant increase in the quantity of controlled substances in the possession of the registrant during normal business operations”, the controls “shall be expanded and extended accordingly”. A pharmacy that added an infusion service, took on a hospice contract or absorbed another site's stock has had this paragraph triggered whether or not anyone noticed. The same paragraph allows controls to be scaled back when quantities fall or a drug is descheduled.
Paragraph (d) is the one nobody uses: a registrant may submit plans, blueprints or sketches of a proposed security system to the local Special Agent in Charge or to DEA's Regulatory Section to learn whether it substantially complies. If you are building a new pharmacy or vault, this is available.
The two practitioner sections the yardstick points to
Because paragraph (a) names 1301.72 through 1301.76 as the standards, a practitioner should know the two that apply:
- 1301.75, storage: the locked cabinet or dispersal rule for Schedules II through V, plus a specific requirement that the strongest opioid agonists used in veterinary practice (thiafentanil, carfentanil, etorphine and diprenorphine) go in a safe or steel cabinet equivalent to a government Class V container (21 CFR 1301.75(b) and (e)).
- 1301.76, other controls: a registrant may not employ, in a position with access to controlled substances, anyone convicted of a felony relating to controlled substances or who has had a DEA registration denied, revoked or surrendered for cause (21 CFR 1301.76(a)); theft or significant loss must be reported in writing within one business day and on Form 106 within 45 days (21 CFR 1301.76(b)); and a practitioner who distributes controlled substances to another registrant must follow the non-practitioner rules on verifying the recipient's registration, suspicious orders and carrier selection (21 CFR 1301.76(c)).
Where the phrase shows up again
“Effective controls” is also the language DEA uses to decide how often to come back. The regulation on inspection frequency says non-practitioner registrants outside the annual categories are inspected “as circumstances may require, based in part on the registrant's history of compliance with the requirements of this chapter and maintenance of effective controls and procedures to guard against the diversion of controlled substances” (21 CFR 1316.13). The same phrase, the same judgment.
Turning the factors into a self-review
The factors were not written as a checklist, but they make a good one. For each, write one sentence describing your current state and one naming the evidence you would show an investigator.
- Access (factors 7, 8, 10, 12): a current list of everyone with keys, codes or cabinet rights; the date each was last reviewed; the procedure that removes access on the day someone leaves; the sign-in process for contractors and cabinet technicians.
- Supervision (factor 11): which roles handle controlled substances alone, what review their activity gets, and how often. Solo shifts and single-person waste are the two places to look first.
- Accounting (factor 14): whether you can reconstruct one drug's movement from receipt to disposition for any 90-day window without calling anyone, and who reviews discrepancies and cabinet reports on what schedule.
- Scale (factors 3 and paragraph (c)): whether volume has changed since the controls were designed.
- Waste (factor 15): how pharmaceutical waste is secured between the point of waste and destruction.
The free assessment scores these areas item by item, and the program requirements page explains how 1301.71 relates to the hospital Conditions of Participation and accreditor standards.
Frequently asked questions
Does 21 CFR 1301.71 require cameras?
No. Cameras are not mentioned. Factor 14, the monitoring system, refers to accounting for receipt and disposition, and factor 9 refers to detection and alarm systems “if any”. Cameras can support several factors, particularly supervision and public access, but their absence is not a violation of this section.
Does it require a written diversion prevention program?
The words do not appear. What the section requires is effective controls and procedures, judged by the factors above. A written program is the usual way to show that the controls exist and are maintained, and factors 11 and 14 are hard to satisfy without one.
Is “substantial compliance” a safe harbor?
It is a discretion given to the Administrator, exercised “after evaluation of the overall security system and needs” of the registrant. It is not something a registrant can declare. The practical lesson is that strength in one area can be weighed against weakness in another, which is why factor 14 is worth investing in: a strong accounting system is visible evidence of control.