Regulatory Guide

DEA requirements, state board obligations, PDMP mandates, and accreditation standards relevant to diversion prevention.

FEDERAL
DEA Diversion Control — Core Requirements
Registration & Recordkeeping
  • DEA Registration — every location that handles controlled substances must have a current DEA registration. Renewal is every 3 years for most registrants.
  • Biennial Inventory — complete inventory of all controlled substances every 2 years (must match DEA registration anniversary). Separate C-II inventory from C-III through C-V.
  • Perpetual Inventory — C-II drugs must be inventoried every 24 hours for hospital pharmacies. C-III through C-V weekly.
  • Record Retention — all CS records must be maintained for 2 years (federal minimum; some states require longer).
  • CSOS — Controlled Substance Ordering System certificates must be current for electronic Schedule II ordering.
Security & Reporting
  • 21 CFR §1301 — Physical security controls: SII must be in a safe or substantially constructed cabinet. SIII-V in a locked, substantially constructed cabinet.
  • DEA Form 106 — Report theft or significant loss of CS within 1 business day of discovery. Must include investigation summary.
  • DEA Form 41 — Record of destruction/disposal of controlled substances.
  • DEA Form 222 — Paper ordering forms for SII (or CSOS for electronic). Must be maintained and auditable.
  • Self-Assessment — DEA offers a voluntary self-assessment checklist for registrants. Completion is not legally required but strongly recommended.
CONTACTS
DEA Field Division Offices — Regional Contacts

DEA Form 106 filings and diversion investigations are handled by the local DEA Field Division Office. Keep these contacts current in your diversion program binder.

Northeast Region
  • New England FD — Boston, MA
  • New York FD — New York, NY
  • New Jersey FD — Newark, NJ
  • Philadelphia FD — Philadelphia, PA
  • Washington DC FD — Washington, DC
Southeast Region
  • Atlanta FD — Atlanta, GA
  • Miami FD — Miami, FL
  • Caribbean FD — San Juan, PR
  • New Orleans FD — New Orleans, LA
  • Nashville FD — Nashville, TN
Midwest Region
  • Chicago FD — Chicago, IL
  • Detroit FD — Detroit, MI
  • St. Louis FD — St. Louis, MO
  • Houston FD — Houston, TX
  • Dallas FD — Dallas, TX
West Region
  • Los Angeles FD — Los Angeles, CA
  • San Francisco FD — San Francisco, CA
  • Seattle FD — Seattle, WA
  • Denver FD — Denver, CO
  • Phoenix FD — Phoenix, AZ
Visit deadiversion.usdoj.gov for current office contacts and jurisdictional maps.
STATE
State Board of Pharmacy Requirements

State boards of pharmacy have distinct requirements that often go beyond DEA minimums. Key areas where state requirements commonly diverge:

Requirement Federal (DEA) State Variation
CS record retention 2 years Some states require 3-5 years. Check your state board regulations.
Biennial inventory timing Every 2 years Some states require annual inventory. Some dictate specific dates.
Waste documentation Must document wastage Some states require specific wording, dual signatures, or video recording of destruction.
Self-assessment Voluntary (recommended) Some states mandate annual self-assessment and reporting to the board.
Reporting timeline 1 business day (theft/loss) Some states require 24-hour reporting of any discrepancy, not just significant loss.
Pharmacist-in-Charge duties General responsibility Many states define specific PIC duties for diversion prevention in regulation.
State board contacts: nabp.pharmacy
PDMP
Prescription Drug Monitoring Program (PDMP) Requirements

All 50 states plus DC and most territories operate a PDMP. Requirements for querying vary significantly.

Mandatory Query States

In these states, practitioners must query the PDMP before prescribing or dispensing controlled substances under certain conditions:

  • Most states: first fill of a C-II or C-III opioid, or when a patient is new to the practice
  • Several states: every CS prescription, every fill, no exceptions
  • Some states: only for opioid prescriptions over a certain daily MME threshold
  • Many states now require PDMP integration directly in the EHR (automatic query)
pdmpassist.org/state for current state-by-state requirements.
PDMP Integration for Diversion Prevention
  • Red flag detection: Multiple providers + multiple pharmacies in 30 days = PMP alert
  • Doctor shopping detection: Overlapping CS prescriptions from different prescribers
  • Patient assessment: High MME, opioid + benzodiazepine combinations, early refill patterns
  • Internal staff monitoring: Some states allow pharmacies to monitor prescriber patterns to identify potential diversion schemes
ACCREDITATION
Joint Commission — Medication Management Standards

Joint Commission MM standards most relevant to diversion prevention:

MM.01.01.01

Medication management plan includes safe storage, handling, and security of all medications — including controlled substances. Must include periodic inspections of storage areas.

MM.01.01.03

Discrepancies in medication storage are resolved, investigated, and reported per law and regulation. Requires documentation of discrepancy investigation.

MM.03.01.01

Safe medication storage — emergency medications, look-alike/sound-alike, and controlled substances are addressed with specific security measures.

GUIDELINES
ASHP Guidelines on Preventing Diversion of Controlled Substances

The ASHP published comprehensive guidelines in 2022 covering the full lifecycle of controlled substance diversion prevention. Key recommendation areas:

  • Governance: Dedicated controlled substance officer, interdisciplinary committee, written policies
  • Storage: Secure CS storage at every point from receiving to administration
  • Surveillance: Data analytics for outlier detection, automated reporting, waste monitoring
  • Investigation: Standardized process, chain of custody, documentation requirements
  • Training: Initial and ongoing education, red flag recognition, non-punitive reporting culture
  • Recovery: Referral pathways for healthcare workers with substance use disorder
Full ASHP Guidelines (PDF)