DEA Form 106 Filing Guide

Statutory Requirement

21 CFR §1301.76(b): "The registrant shall notify the Field Division Office of the Administration in his area, in writing, of the theft or significant loss of any controlled substances within one business day of discovery of such loss or theft. The registrant must also file a complete and accurate DEA Form 106 with the Administration through DEA's Diversion Control Division secure network application within 45 days after discovery of the theft or loss."

Two Deadlines, Not One

• Written notice to the DEA Field Division Office — within 1 business day of discovery of the theft or significant loss
• DEA Form 106, filed through the Diversion Control Division secure network application — within 45 days after discovery

What Constitutes a Reportable Event

• Theft — any intentional, unauthorized taking of a controlled substance, regardless of quantity or value
• Significant loss — any loss that is not explained by normal inventory variation, including:
  • Discrepancies that cannot be resolved after investigation
  • Missing controlled substances from inventory or ADC counts
  • Controlled substances unaccounted for after patient discharge or transfer
  • Unexplained shortages during perpetual inventory
• Diversion by an employee — confirmed or strongly suspected diversion by a staff member with CS access

"Within One Business Day" — What This Means

• The one-business-day deadline is for the written notice to the Field Division Office. The Form 106 itself is due within 45 days after discovery
• Both clocks run from discovery of the theft or significant loss. Do not hold the written notice until the investigation is finished
• The DEA expects investigation to proceed promptly. The Form 106 should carry what the investigation found
• "One business day" = the next business day. Friday discovery + weekend = written notice by Monday
• Federal holidays don't count — discovery on Friday before Labor Day = written notice by Tuesday

Reportable Thresholds — DEA's Position

Section 1 — Registrant Information

• DEA registration number — verify it's the correct registration for the affected location
• Registrant name — must match exactly what's on the DEA certificate
• Registered address — physical location where the loss/theft occurred
• Business activity code — select the appropriate activity (hospital, pharmacy, etc.)

Section 2 — Contact Information

• Name, title, phone, email of the person filing the report
• Best contact number — someone who can answer follow-up questions
• Alternate contact — important in case the primary is unavailable

Section 3 — Incident Information

• Type of incident: theft, significant loss, or both
• Date of discovery — the date the theft/loss was first determined
• Date of incident (if known) — when the theft/loss actually occurred
• Location of incident — be specific: "Pharmacy ADC, 3rd Floor North Wing" not just "Hospital"
• How the loss/theft was discovered — inventory check, ADC discrepancy, patient complaint, etc.

Section 4 — Drugs Involved

• List each controlled substance with: drug name, strength, dosage form, NDC if available
• Quantity: number of dosage units (tablets, mL, patches, vials)
• DEA schedule (II, III, IV, V) for each drug — verify before submitting
• Total estimated value — use acquisition cost, not retail. If unknown, estimate
• If multiple drugs were involved, list each one separately. Do not aggregate.

Section 5 — Circumstances

• Detailed narrative of the circumstances — who, what, when, where, how
• Include: how the drugs were stored, who had access, any known suspects
• Describe the security measures in place at the time of the incident
• Include any corrective actions already taken
• Be factual — do not speculate or make accusations

Section 6 — Investigation Summary

• Brief summary of steps taken to investigate the loss/theft
• Who conducted the investigation (title, not name if still in progress)
• Any evidence collected (transaction logs, camera footage, witness statements)
• Current status of the investigation