An Employee Is Diverting Drugs: Who You Must Tell, and When

The short answer

The federal report is about the drugs, not the person. If there was a theft or significant loss, the DEA must be told in writing within one business day of discovery, whether or not you know who took them. Reports about the employee, to a licensing board or the police, are set by state law and by the board that licensed them, and they differ from state to state and between professions.

Who may need to be told

Your registration, license and accreditation may each add obligations. Check them for your own facility rather than relying on this table alone.

Do not wait for the investigation to finish

The one-business-day clock runs from discovery of the theft or loss, not from the end of your investigation or the employee's interview. There is no fixed quantity that makes a loss significant. The regulation lists factors to weigh, including the quantity in relation to the type of business, the specific drug, “whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals”, and any pattern of losses over time (21 CFR 1301.76(b)). If the loss can be tied to one employee, that is itself one of the factors.

The DEA Form 106 guide covers what goes on the form.

Reports from staff, inside the organization

Most concerns start with a colleague. DEA has stated its position that “an employee who has knowledge of drug diversion from his employer by a fellow employee has an obligation to report such information to a responsible security official of the employer”, and that the employer “shall take all reasonable steps to protect the confidentiality of the information and the identity of the employee furnishing information” (21 CFR 1301.91).

That section sits under the heading “Employee Screening—Non-Practitioners”, which covers registrants such as distributors, not hospitals or pharmacies. Do not cite it as a rule that binds a hospital or pharmacy. It is still a sound model for your own policy: tell staff they must report, tell them to whom, and protect the person who does. For the staff-side steps, see how to report drug diversion.

When the employee reports themselves

Some diversion comes to light because the employee discloses a substance use problem. Many states have an alternative-to-discipline or peer assistance program for licensed professionals. Who is eligible, whether a self-report changes what the employer must report, and what the board is told all depend on the state and the profession. Ask the licensing board or the program directly, and check with counsel before telling the employee what will happen. A self-report does not remove the DEA report if drugs were lost.

Keep a record of every report

For each report, keep the date and time it was made, who made it, who received it, what it said, and any reply or reference number. When an inspector or a board asks whether a loss was reported on time, this is the record that answers.

Sources

• 21 CFR 1301.76 and 1301.91; 42 CFR 482.25. 2025 annual edition.

Read on October 16, 2026. Educational content, not legal advice; check your state's current rules and your licensing boards' rules before relying on a deadline.

Further reading