Pharmacy Security, Theft, & Diversion Reporting

Securing the Pharmacy and Managing Controlled Substances

The physical security of a pharmacy and the rigorous tracking of its inventory, particularly controlled substances, are among the highest priorities of state and federal regulatory agencies. The California Board of Pharmacy and the federal Drug Enforcement Administration (DEA) hold the Pharmacist-in-Charge (PIC) and the pharmacy permit holder strictly accountable for preventing theft, loss, and diversion of dangerous drugs.

Physical Security Requirements (16 CCR § 1714)

The foundational regulation governing pharmacy security in California is 16 CCR § 1714. This regulation stipulates that the pharmacy must be physically secured in a manner that prevents unauthorized access.

Key security provisions under 16 CCR § 1714 include:

• Only a pharmacist may possess a key to the pharmacy. The pharmacy owner, if not a pharmacist, may not possess a key that allows access to the prescription department without a pharmacist present. (An exception exists for a key kept in a tamper-evident safe for emergency access by fire or police).
• The pharmacist is responsible for the security of the prescription department. This means the pharmacist must lock the pharmacy when they are absent, even for a brief meal break, unless they remain within the immediate facility and the pharmacy remains properly staffed according to specific temporary absence rules.
• The pharmacy must utilize alarm systems and physical barriers to secure the space after hours.

Reporting Theft and Impairment: Timelines and Forms

Despite the best security measures, theft or significant loss of controlled substances can occur, whether due to external burglary, internal employee diversion, or in-transit loss. When a loss occurs, strict reporting timelines are triggered at both the federal and state levels.

Federal Reporting (DEA): Under the federal Controlled Substances Act, a pharmacy must notify the local DEA Diversion Field Office in writing within one business day of the discovery of a "theft or significant loss" of controlled substances. Following this initial notification, the pharmacy must conduct a thorough investigation and submit a formal report using DEA Form 106. The DEA Form 106 immediately outlines the details of the loss, the specific drugs involved, and the circumstances surrounding the event.

State Reporting (California Board of Pharmacy): California's Board reporting rule in 16 CCR § 1715.6 also addresses controlled substances, not every non-controlled dangerous drug. No later than 30 days after discovery, the owner must report losses that meet one of the following triggers:

1. Aggregate threshold losses of controlled substances discovered on or after the same day of the previous year that equal or exceed: 99 dosage units for tablets/capsules/other oral medication; 10 dosage units for single-dose injectables, lozenges, films, suppositories, or patches; or two or more multi-dose vials/infusion bags/other multi-dose containers.
2. Any controlled-substance loss attributed to employee theft, regardless of amount (this is in addition to separate B&P § 4104 reporting duties and timelines for impaired or diverting licensed personnel).
3. Any other significant loss as determined by the Pharmacist-in-Charge, including losses significant relative to the pharmacy's dispensing volume.

The Board report must identify each controlled substance lost (identity, amounts, strengths) and the date of discovery. A DEA Form 106 may be shared with the Board when one was filed, but Board notice can be in any format that includes the required elements. Do not confuse § 1715.6 with a blanket duty to report every missing antibiotic or non-controlled prescription drug.

The Impaired Licensee and Pharmacists Recovery Program (PRN)

One of the most challenging aspects of diversion involves impaired healthcare professionals—pharmacists or technicians who divert drugs for their own illicit use due to substance use disorders or mental illness. The Board of Pharmacy has a dual mandate: to protect the public from impaired practitioners and to offer a pathway to rehabilitation for licensees struggling with addiction.

Under B&P § 4360, California law addresses the impaired licensee through the Pharmacists Recovery Program (PRN), previously known as the Maximus program. The PRN is a confidential monitoring and rehabilitation program for pharmacists and intern pharmacists whose competency may be impaired due to abuse of alcohol, drugs, or mental illness.

If a pharmacist self-refers to the PRN voluntarily, their participation can remain completely confidential from the Board's enforcement division, provided they comply with all program requirements and do not pose an immediate threat to the public. However, if a pharmacist is caught diverting drugs or is reported by their employer, the Board may mandate PRN participation as part of a formal disciplinary probation order. The impaired licensee PRN B&P § 4360 framework is essential for providing compassionate but rigorously monitored recovery pathways.

In conclusion, maintaining the security of the pharmacy and adhering to strict diversion reporting protocols are absolute necessities. Understanding that physical security is governed by 16 CCR § 1714, that federal law requires a DEA Form 106 immediately, that 16 CCR § 1715.6 mandates a Board controlled-substance loss report within 30 days when thresholds or other listed triggers are met, and that the impaired licensee PRN B&P § 4360 exists for rehabilitation, are all critical competencies for any practicing pharmacist in California.