Thefts and Significant Losses of Controlled Substances – Understanding Federal and State Reporting Requirements

Controlled substances are tightly regulated for a reason, they carry high potential for abuse, diversion, and misuse. When a theft or significant loss occurs, the risk to public health and facility liability increases significantly. That’s why both the U.S. Drug Enforcement Administration (DEA) and individual state authorities have stringent requirements for how registrants must respond when controlled substances go missing.

Timely and accurate reporting of losses is not just a regulatory formality, it’s a critical element of compliance and a safeguard against diversion. Below, we break down the core federal requirements and highlight key differences in how various states enforce their own rules.

1. Federal Reporting Requirements (DEA)

Under federal law, any DEA registrant (e.g., pharmacies, hospitals, medical spas, veterinary clinics, ambulatory surgical centers, etc.) must take immediate action upon discovering the theft or significant loss of a controlled substance.

Required Actions:

• Notify your local DEA Field Office in writing within 1 business day of discovery.
  (21 C.F.R. § 1301.76(b))
• Submit DEA Form 106 (Report of Theft or Loss of Controlled Substances) electronically through the DEA’s secure online system within 45 calendar days.
  (21 C.F.R. § 1301.74(c))

The DEA emphasizes that “significant loss” is not strictly defined by quantity. It must be assessed based on several factors, including the type of drug, whether it’s susceptible to diversion, quantity of the substance your facility utilizes, and if patterns or discrepancies exist. Losses due to breakage, known spills, or documented wastage typically don’t meet the threshold unless negligence or diversion is suspected.

2. State-Level Requirements: Varying Rules Across the U.S.

While DEA rules provide a national baseline, state requirements often go further, with additional reporting mandates, tighter deadlines, or broader definitions of what constitutes a reportable event.

Here’s a look at how various states address theft and significant loss reporting:

States Aligned with DEA Form 106 Submission

Several states require that the same DEA Form 106 submitted federally also be submitted to the state’s pharmacy board or health department. This includes:

• Arizona – Report to the Arizona Board of Pharmacy using the DEA-106.
  Ariz. Admin. Code § R4-23-1003(A)(2)
• Colorado – Report within 30 days using the DEA-106.
  3 Colo. Code Regs. § 719-1:15.05.13 & 7.00.10
• Delaware – Must submit a copy of the DEA-106 within 1 day.
  Del. Code Regs. 24 § 7.3.1-.2

States with Unique or Stricter Timing Requirements

Some states have distinct timelines that deviate from the DEA’s 1-day and 45-day rule, and facilities must follow whichever requirement is stricter. Examples include;

• Connecticut – Reporting required within 72 hours.
  Conn. Agencies Regs. § 21a-262-3(b)
• New Mexico – Report must be filed within 5 business days.
  N.M. Code R. § 16.19.20.36B
• Nevada – Must report within 10 days.
  Nev. Rev. Stat. § 453.568
• Mississippi – Requires reporting within 15 days.
  30-030 Miss. Code R. § 3001, Art. XXXII.4
• Colorado – In addition to the DEA reporting requirement, Colorado law allows up to 30 days for state-level notification, but encourages earlier reporting.
  3 Colo. Code Regs. § 719-1:15.05.13

States Requiring Broader Drug Loss Reporting

• Ohio – Requires reporting for any prescription drug, not just controlled substances. This includes both controlled and non-controlled medications.
  • Immediate reporting of discovery
  • DEA-106 submitted within 30 days
    Oh. Admin. Code 4729:6-3-02

States That Specifically Require Pharmacy Reporting

• California – Pharmacies must report theft or loss directly to the state board.
  Cal. Code Regs. tit. 16, § 1715.6
• Kentucky – Pharmacists must report immediately upon discovery.
  Ky. Rev. Stat. § 315.335(1)
• New Hampshire – Pharmacy permit holders must notify the Board of Pharmacy.
  N.H. Admin. Code § Ph 702.03(a)

Policy and Procedure Requirements

A few states go a step further by mandating that facilities include theft and loss reporting procedures in their written policies:

• Facilities in these states are expected to not only respond to losses but to have a documented plan for doing so as part of their broader controlled substance management program.

Why This Matters

Failing to report a theft or significant loss on time, to the right agencies, or with complete documentation, can result in:

• DEA or state board citations
  
• Monetary fines
  
• License suspension or revocation
  
• Increased scrutiny during audits
  
• Legal and reputational damage

Moreover, delayed or incomplete reporting may allow drug diversion to continue undetected, posing serious risks to public health and employee safety.

Know the Requirements Before You Need Them

Every medical facility that handles controlled substances, no matter the size, should have a clear, written protocol for detecting, documenting, and reporting losses. This includes designating responsible personnel, maintaining ready access to DEA and state reporting portals, and routinely training staff on what constitutes a “significant loss.”