Introduction

Over the last several years, many DEA registrants have noticed a significant shift in how DEA approaches to DEA recordkeeping and compliance issues. In the past, Diversion Investigators often worked collaboratively with registrants to identify deficiencies and encourage corrective action. Today, however, DEA increasingly relies on administrative actions and civil penalties for recordkeeping violations that previously may have been addressed through education and remediation.

As a result, registrants face difficult challenges. They must maintain all records required by the Controlled Substances Act (CSA) and DEA regulations while also avoiding the common mistake of producing documents, spreadsheets, reports, logs, and business records that are not required to be kept under the CSA and DEA regulations. During an inspection, many registrants provide far more information than the law and regulations require simply because they believe they must do so if DEA has requested it. In some cases, those voluntarily maintained and produced records later become the basis for allegations of noncompliance.

The reality is simple: if a record is required by law or regulation, it should be complete, accurate, and readily retrievable. If a record is not required by law or regulation, registrants should carefully evaluate whether maintaining it creates additional risk without providing a corresponding compliance benefit.

The Foundation: DEA Can Only Require Records Authorized by Law

The Controlled Substances Act requires DEA registrants to maintain certain inventories and records involving controlled substances. Those requirements are primarily found in 21 U.S.C. § 827 and 21 C.F.R. Part 1304. DEA regulations specify what must be inventoried, documented, maintained, and produced during an inspection. DEA cannot simply create new DEA recordkeeping requirements because an investigator would find additional information useful. DEA’s authority is limited to records required by statute and regulation.

Before You Sign DEA Form 82: Understanding the Risks of Voluntary Disclosure

DEA Form 82, officially titled the Notice of Inspection of Controlled Premises, is the document DEA Diversion Investigators present when seeking consent to conduct an administrative inspection of a DEA registrant under 21 U.S.C. § 880 and 21 C.F.R. Part 1316. When a registrant signs DEA Form 82, they are voluntarily consenting to DEA’s inspection of the controlled premises and to DEA’s examination of records, controlled substances, and other items that are within the lawful scope of an administrative inspection. DEA Form 82 is used in lieu of an Administrative Inspection Warrant when the registrant voluntarily consents to the inspection. Any records or documents provided to DEA during the inspection may be copied, retained, and used by DEA as part of its compliance, civil, administrative, or potentially criminal investigations. For this reason, registrants should understand exactly which records are required by regulation, maintain those records in an organized manner, and thoughtfully manage their record retention practices before an inspection occurs.

Registrants should also recognize that voluntarily providing records that are not required to be maintained can create unnecessary compliance risks. Internal emails, draft reports, correspondence, internal investigation files, discrepancy reviews, quality assurance documents, and other supporting records may contain information that investigators are not generally entitled to review and may generate additional questions, requests for explanation, or expanded lines of inquiry. While such records may be maintained for legitimate business, legal, accreditation, or operational purposes, they should be clearly separated from required DEA records. A disciplined record-retention program that focuses on maintaining and producing the records required by DEA regulations helps keep inspections efficient, organized, and focused on regulatory requirements rather than unnecessary supporting documentation.

General DEA Recordkeeping Requirements

All required DEA records must generally:

• Be complete and accurate.
• Be maintained in a readily retrievable manner.
• Be available for inspection by DEA.
• Be retained for at least two years from the date of the record, unless state law requires a longer retention period.

Remember that the two-year federal requirement is a minimum standard. Many states, boards of pharmacy, and health-care licensing agencies require longer retention periods.

The Records Most Registrants Must Keep

While requirements vary by registrant type, the following DEA recordkeeping requirements generally apply to pharmacies, distributors, manufacturers, hospitals, practitioners, and other DEA registrants.

Record Retention

One of the most common mistakes registrants make during a DEA inspection involves retaining and providing records that fall outside the required retention period. In most cases, DEA requires controlled substance records to be maintained and readily retrievable for a minimum of two years. As a best practice, pharmacies and hospitals should maintain a dedicated DEA records file containing only records from the current two-year retention period.

Records that must be retained longer due to state, accreditation, legal, or organizational requirements should be archived separately from the DEA records file. During an inspection, personnel should be careful to provide only those records required by DEA regulations. Producing records that are older than the required retention period can unnecessarily expand the scope of an inspection and create additional review burdens for both the registrant and the investigators. Proper record organization and retention practices can help ensure a more efficient and focused DEA inspection.

A common mistake during DEA inspections is retaining unnecessary supporting documentation with required controlled substance records. Many registrants staple emails, internal approvals, packing slips, receiving reports, discrepancy investigations, transaction histories, correspondence, and other supporting documents to DEA Forms 222, Schedule III-V invoices, or DEA Form 106 reports. While these records may have operational value, they are often not records specifically required by DEA regulations.

As a best practice, maintain required DEA records separately and avoid intermingling them with non-required supporting documents. During an inspection, DEA is entitled to review records required to be maintained under the Controlled Substances Act and the DEA regulations. Providing investigators with unnecessary records can expand the scope of an inspection, lead to additional questions, and increase the time required to complete the audit. Maintaining a clean, organized DEA records file containing only required records helps ensure a more efficient inspection and reduces the risk of unnecessary scrutiny.

• Initial and Biennial Inventories

DEA requires registrants to conduct and maintain:

• An initial inventory when they first engage in controlled substance activities.
• A biennial inventory at least every two years thereafter.

Inventories must include all controlled substances on hand and must comply with DEA counting requirements for Schedule II and Schedule III-V substances.

• Records of Receipt

Registrants must maintain records showing the receipt of controlled substances, including:

• DEA Forms 222 (or electronic CSOS records) for Schedule I and II substances.
• Purchase invoices and receiving documentation for Schedule III-V substances.

These records establish the chain of custody for controlled substances received by the registrant.

• Records of Distribution or Dispensing

Registrants must maintain records documenting the transfer, distribution, or dispensing of controlled substances, as applicable to their registration category. These records allow DEA to reconcile controlled substance movement from receipt through final disposition.

This is an important record for hospitals to understand and preserve. DEA Diversion Investigators often do not fully appreciate the complexity of hospital medication-use systems and frequently request Automated Dispensing Cabinet (ADC) dispensing reports during audits. However, the official record of medication administration is the Electronic Medical Record (EMR) Medication Administration Record (MAR), which documents when medications were actually administered to patients. When DEA requests dispensing records, hospitals should recognize that the Medication Administration Record is the record required to be maintained and serves as the most accurate documentation of drug administration to patients.

Electronic prescriptions present another frequently misunderstood DEA recordkeeping requirement for both retail and hospital pharmacies. Electronic Prescriptions for Controlled Substances (EPCS) are a prime example of DEA’s “once electronic, always electronic” expectation. Pharmacies should not print EPCS prescriptions and intermingle them with manually signed or paper prescriptions. Instead, these records should be maintained within the electronic prescription system and remain readily retrievable in their original electronic format. Personnel should be familiar with the pharmacy’s EPCS system and capable of promptly providing DEA investigators with electronic prescription records during an inspection. Additionally, if EPCS prescriptions are printed for any reason, DEA regulations require specific information and annotations to appear on the printed copy. Failure to maintain or produce EPCS records properly may result in DEA recordkeeping deficiencies during an inspection.

Theft and Loss Records

DEA registrants must maintain documentation relating to:

• The Initial Notification of a suspected theft or loss.
• DEA Form 106 submissions when required.

These records document the registrant’s response to actual or suspected diversion events.

Disposal and Destruction Records

Whenever controlled substances are destroyed, transferred for destruction, or otherwise disposed of, registrants must maintain the appropriate supporting records and DEA forms 41 documenting the disposition.

DEA Order Forms and Electronic Ordering Records

Schedule I and II controlled substances require specific ordering documentation through DEA Form 222 or the Controlled Substance Ordering System (CSOS). These CSOS records must be maintained electronically and readily available during inspections. The original DEA Form 222 must be maintained at the registered location for 2 years.

This is another commonly misunderstood DEA recordkeeping requirement. As indicated above for EPCS records, it is also the case that for ordering records, DEA has consistently maintained the position that “once electronic, always electronic.” As a result, CSOS records should not be printed and maintained in paper form. Instead, they should remain electronically linked and be retained within the electronic system in accordance with applicable DEA recordkeeping requirements. Registrants should ensure they are familiar with their CSOS platform and understand how to quickly retrieve these records during an inspection. Being able to promptly access and produce electronic records can significantly improve the efficiency of a DEA audit or investigation.

Power of Attorney

Powers of Attorney (POAs) are frequently overlooked during DEA inspections, yet they are required controlled substance records that must be properly maintained. A Power of Attorney authorizes designated individuals to execute DEA Form 222 orders or sign Controlled Substance Ordering System (CSOS) orders on behalf of the registrant. DEA expects these records to be readily retrievable and available for review during an inspection. Registrants should ensure that all current Powers of Attorney are documented, signed, and maintained with their controlled substance records. In addition, records documenting the revocation of a Power of Attorney should be retained and readily available. During an inspection, DEA investigators will often verify that individuals ordering Schedule I and II controlled substances are properly authorized, making accurate and organized Power of Attorney records an important component of a compliant controlled substance program.

Summary of DEA Records Required to Be Maintained

One of the most important principles during a DEA inspection is understanding which records federal regulations actually require a registrant to maintain. While investigators may request additional documents, registrants should be familiar with their DEA recordkeeping obligations and be prepared to provide the records required by regulation. If records outside the required DEA recordkeeping requirements are requested, it is reasonable to respectfully ask for the specific regulatory authority requiring their maintenance. Understanding your obligations in advance can help ensure inspections remain focused on the records that DEA regulations require registrants to keep.

The following are the list of records that are required to be maintained for controlled substance compliance purposes:

• Initial Inventory
• Biennial Inventories
• Inventories of Newly Scheduled Controlled Substances
• DEA Registration Certificate
• DEA Form 222 Records (or electronic CSOS records, as applicable)
• Schedule III-V Purchase Invoices and Records
• Initial Notifications of Theft or Significant Loss
• DEA Form 106 (Report of Theft or Loss)
• DEA Form 41 (Destruction Records)
• Powers of Attorney and Revocations
• CMEA Self-Certification Records (for scheduled listed chemical products sold over the counter)
• CMEA Purchase Records (for scheduled listed chemical products sold over the counter)
• CMEA Distribution and Sales Records (for scheduled listed chemical products sold over the counter)

Maintaining these records in an organized manner and ensuring they are readily retrievable can significantly improve the efficiency of a DEA inspection and demonstrate a strong commitment to controlled substance compliance.

Records DEA May Request But Are Not Necessarily Required

One of the most misunderstood areas of DEA inspections involves records that businesses voluntarily create.

Examples may include:

• Internal compliance scorecards
• Pharmacy performance reports
• Custom exception reports
• Internal audit spreadsheets
• Prescriber risk rankings
• Informal diversion tracking logs
• Business intelligence dashboards
• Analytical reports generated solely for management purposes
• Standard Operating Procedures
• ADC Reports
• Other (nonrequired) Inventories
• Security Contracts
• Floor Plans
• Pharmacist licenses
• Employee Access List
• Other Lists of Employees
• State Board Investigative or Inspection Documents

While these records may be useful for operating a business, DEA regulations generally do not require their creation simply because they concern controlled substances. Once created, however, they often become discoverable during an inspection or investigation.

This does not mean registrants should never create such records. Compliance programs frequently benefit from sophisticated monitoring tools. It does mean organizations should be deliberate about what they create, why they create it, how it is reviewed, and what corrective actions are documented.

A Common Mistake During DEA Inspections

Many registrants mistakenly assume that because DEA requests a document, the registrant must maintain that document and provide it to DEA.

This is not necessarily the case.

The appropriate question to ask a DEA Diversion Investigator is:

“What specific statute or regulation requires this record?”

As former investigators, we have observed client facilities producing years of internal reports, emails, draft analyses, and management documents that far exceeded DEA recordkeeping requirements. In some cases, a formal DEA inspection subsequently focused on inconsistencies or issues found within those voluntarily created records rather than on the records actually required by regulation.

Registrants should understand the difference between:

1. Records required by the Controlled Substances Act and DEA regulations.
2. Records voluntarily created by the business.

That distinction can become extremely important when facing an inspection, order to show cause proceeding, civil penalty action, or criminal investigation.

The Bottom Line

Every DEA registrant should know exactly which records federal law requires them to maintain and should ensure those records are complete, accurate, and readily retrievable. At the same time, organizations should avoid the assumption that every document relating to controlled substances is a DEA-required record.

In today’s regulatory environment, where DEA is increasingly pursuing administrative sanctions and civil penalties rather than collaborative compliance efforts, understanding the difference between required records and voluntary records is more important than ever. The best defense is not producing more records than what is required. The best defense is maintaining the records the law actually requires and maintaining them correctly.

Conclusion: Be Prepared, Be Professional, and Know Your Rights

DEA inspections are often won or lost long before the first Diversion Investigator arrives at your facility. Organizations that understand their DEA recordkeeping obligations, maintain required records in an organized and readily retrievable manner, and separate required records from voluntary business records are generally in a much better position to navigate an inspection successfully.

If DEA requests records and you are uncertain whether the records are required by law to be maintained or produced, do not guess. Politely ask the investigators for the specific statutory or regulatory authority to support the request. If uncertainty remains, consider pausing and seeking professional guidance before producing records that may fall outside DEA’s recordkeeping requirements.

Brinks DEA Consulting routinely assists registrants in understanding DEA recordkeeping requirements, preparing for inspections, responding to investigator requests, and evaluating whether records are required under the Controlled Substances Act and DEA regulations. When legal representation is needed, Brinks DEA Consulting can also refer clients to highly qualified attorneys with extensive experience in DEA regulatory, administrative, and enforcement matters.

Finally, inspections should always remain professional and respectful on both sides. If at any point you believe an inspection is becoming confrontational, expanding beyond its lawful scope, or involving requests that you do not understand, you may choose to discontinue your consent to the inspection and request that the investigators return with an Administrative Inspection Warrant. While each situation is unique, and legal counsel should be consulted whenever possible, registrants should remember that a DEA Form 82 inspection is based upon voluntary consent. Understanding your rights, maintaining proper records, and obtaining experienced guidance when needed are among the most effective tools available to protect your organization and ensure compliance with DEA regulations.

Remember: The goal is not to maintain the most records. The goal is to maintain the records required by law, maintain them correctly, and be prepared to produce them when requested. A well-organized compliance program, a thorough understanding of DEA recordkeeping requirements, and access to qualified regulatory and legal expertise remain the best defense during today’s increasingly aggressive enforcement environment.