9.4 Security, Delivery, Central Fill & Non-Resident Practice
Key Takeaways
- Security of controlled substances is addressed by 247 CMR 9.21 and, federally, by 21 CFR 1301.71 through 1301.76; by its own terms 247 CMR 9.21 does not apply to non-resident pharmacies.
- A pharmacy may store Schedule II through V substances either in a securely locked, substantially constructed cabinet or dispersed through the Schedule VI stock so as to obstruct theft and diversion.
- The Schedule II perpetual inventory must be reconciled by physical count at least once every ten days, and every requirement of 247 CMR 9.21 extends to stock that is expired, quarantined or pending reverse distribution.
- A certified pharmacy technician may make entries into the perpetual inventory, but an unlicensed individual may not, and an adjustment arising from a discrepancy may be performed only by the Manager of Record or, in their absence, a pharmacist designee.
- A registrant must notify the local DEA Field Division in writing within one business day of discovering a significant theft or loss and file DEA Form 106; 247 CMR 20.03(7) additionally requires the Board copy within seven days.
Security of Controlled Substances, Delivery & Non-Resident Practice
Physical Security of Controlled Substances
Massachusetts addresses the security of controlled substances at 247 CMR 9.21, on top of the federal physical security standards in 21 CFR 1301.71 through 1301.76.
The two federal storage options
A pharmacy may store Schedule II through V controlled substances by either:
- a securely locked, substantially constructed cabinet; or
- dispersal throughout the stock of non-controlled substances in such a manner as to obstruct the theft or diversion of the controlled substances.
The second option — the "scatter" method — is what most community pharmacies use. It is a genuine alternative, not a concession, but it only works if the dispersal actually obstructs diversion; lining all the oxycodone up on one shelf labelled "C-II" among the antihypertensives is not dispersal.
[!WARNING] Neither option permits leaving Schedule II stock on an open counter overnight, however good the alarm. The alarm is a detection control. The regulation requires a storage control.
General security factors
The DEA assesses a registrant's security by reference to the location and construction of the premises, the type and quantity of controlled substances handled, the adequacy of key and access control, the screening and supervision of personnel who have access, and the adequacy of the registrant's own systems for detecting loss.
Access
Access to the prescription department and to controlled substance stock must be controlled: under 247 CMR 9.21(6) the Manager of Record and the pharmacist on duty are responsible for pharmacy security and control access to the prescription area, and under 9.21(7) all drug order deliveries containing controlled substances must be delivered directly to the pharmacy.
Who may touch the perpetual inventory
247 CMR 9.21(8) is more precisely drawn than candidates remember, and the distinction between an entry and an adjustment is the whole point:
| Act | Who may do it |
|---|---|
| Make an entry into the Schedule II perpetual inventory | A pharmacist or a certified pharmacy technician (9.21(8)(f)) |
| Make an entry or adjustment where the individual is unlicensed | Nobody — expressly prohibited (9.21(8)(e)) |
| Make an adjustment arising from a discrepancy | Only the Manager of Record; in the MOR's absence a pharmacist designee, who then reports to the MOR (9.21(8)(d)) |
The inventory itself must be reconciled at least once every ten days by an accurate physical count compared against the record, with the MOR investigating any discrepancy and reporting significant loss or suspected theft (9.21(8)(c)). Every requirement of 247 CMR 9.21 extends to controlled substances that are expired, quarantined or pending reverse distribution (9.21(10)) — stock out of active circulation is still accountable stock.
Two further Massachusetts requirements
- Surveillance. A pharmacy must maintain surveillance cameras positioned to record theft and diversion, retaining video for at least 14 days, or at least two years where theft or diversion is known or suspected (9.21(4)).
- Alarm and barrier. A centrally monitored security system must be activated whenever the pharmacy is closed, and a pharmacy inside another retail establishment must be secured by a floor-to-ceiling barrier, locked and separately alarmed when closed (9.21(3) and (5)).
When Stock Goes Missing
| Step | Requirement | Source |
|---|---|---|
| 1. Immediate federal notice | Notify the local DEA Field Division in writing within one business day of discovering a significant theft or loss | 21 CFR 1301.76(b) |
| 2. Federal report | File DEA Form 106 electronically once the investigation establishes the facts | 21 CFR 1301.76(b) |
| 3. Massachusetts report | Submit to the Board a copy of the Report of Theft or Loss of Controlled Substance and DEA Form 106 within seven days, and comply with DEA, Department and state and local police requirements | 247 CMR 20.03(7) |
What counts as significant. The DEA does not set a numeric threshold. Registrants weigh the quantity lost relative to the pharmacy's business volume, the specific substances involved, whether the loss can be associated with particular individuals or access patterns, whether a pattern of losses exists, and whether the substances are prime diversion targets.
In-transit losses are the supplier's responsibility until the pharmacy signs for the shipment; after acceptance they are the pharmacy's. Breakage or spillage where the product is recoverable is not a loss — the damaged stock goes to a reverse distributor. Where the drug is unrecoverable, document the event with two employee witnesses.
Delivery and Mail Order
Delivery does not change the identity of the dispensing pharmacy or its obligations. Whatever the delivery method, the pharmacy remains responsible for:
- product integrity in transit — particularly cold-chain products, which must remain within labelled storage conditions;
- delivery to the correct person, with the identification requirements of 247 CMR 9.04 satisfied for Schedules II through V;
- the offer to counsel, which for a delivered or mailed prescription is made in writing accompanying the medication, with a means of reaching a pharmacist; and
- the full record trail, exactly as for a counter transaction.
Delivery personnel who do nothing but transport are not support personnel for ratio purposes under 247 CMR 8.06(3)(b) — but only while they are not supporting the pharmacist in a professional capacity.
Centralised Prescription Processing and Central Fill
The blueprint lists centralised prescription processing or central-fill pharmacy dispensing as a distinct operations competency, and the two terms mean different things.
| Model | What moves | What stays |
|---|---|---|
| Centralised prescription processing | Part of the processing — data entry, prospective DUR, prescriber clarification, refill authorisation, or a remote verification step — is performed by a different pharmacy | The product is dispensed by the originating pharmacy |
| Central fill | The filling and labelling of the product is performed by a central fill pharmacy, which returns the finished prescription to the retail pharmacy for delivery to the patient | The patient relationship and delivery stay with the retail pharmacy |
The federal framework
Federal law expressly contemplates central fill for controlled substances. A retail pharmacy may transmit a controlled substance prescription to a central fill pharmacy for filling, and a central fill pharmacy registers with the DEA in the same registrant class as a retail pharmacy, using DEA Form 224. The central fill pharmacy may not deliver the finished prescription directly to the patient; it returns the filled prescription to the retail pharmacy that transmitted it, and the retail pharmacy delivers it and counsels the patient.
The consequences for records are the ones examiners like:
- both pharmacies keep records identifying their role in the transaction;
- the retail pharmacy remains the dispensing pharmacy for the patient-facing duties — the offer to counsel, the patient profile, and the PMP submission; and
- the label identifies the pharmacies in accordance with the applicable rules, so that a patient and an inspector can reconstruct who did what.
The Massachusetts position
Any centralised processing or central fill arrangement involving a Massachusetts pharmacy has to satisfy the ordinary Massachusetts requirements as well: each participating pharmacy must be licensed for what it does, a pharmacy outside the Commonwealth is a non-resident pharmacy under 247 CMR 9.20 and must comply with Massachusetts law in full, the final dispensing process validation remains a pharmacist function under 247 CMR 9.04, and the shared records must satisfy the record-maintenance rules in 247 CMR 9.16.
[!WARNING] Do not assume a general Massachusetts central-fill authorisation. Confirm the arrangement against the current 247 CMR and any Board policy before relying on it, in the same way that 247 CMR 9.12 confines automated dispensing devices for controlled substances to licensed health care facilities. Where an exam item turns on whether a particular shared-processing arrangement is permitted, the analysis is licensure of each participant, the non-delegable pharmacist functions, and the record trail — not a generic assumption that central fill is freely available.
Non-Resident Pharmacies — 247 CMR 9.20 and 20.07
A non-resident pharmacy shall comply with all Massachusetts laws and regulations governing the practice of pharmacy when filling, dispensing, or shipping medications into Massachusetts, unless otherwise specified.
That is the whole principle, and it is broader than candidates expect: a pharmacy in another state that ships into the Commonwealth is practising Massachusetts pharmacy.
Specific obligations include:
- holding a Massachusetts non-resident pharmacy licence, with a Massachusetts-licensed designated pharmacist in charge;
- submitting to the Board the location, name and title of all principal managers, the name and Massachusetts licence number of the designated pharmacist in charge, a letter from the home-state board certifying that the pharmacist in charge is in good standing, documentation of a current unrestricted home-state licence, and a list of all prescriptions dispensed in Massachusetts — annually, and within 30 days after any transfer of ownership or change in corporate officers, management personnel or Manager of Record;
- notifying the Board within 14 calendar days of a change of the Massachusetts-licensed designated pharmacist in charge (247 CMR 20.05(2));
- reporting improper dispensing into Massachusetts that results in serious injury or death within seven business days of discovery (247 CMR 20.07(3)); and
- reporting to MassPAT for controlled substances delivered to a person in Massachusetts.
Certain requirements are disapplied to non-resident pharmacies, and the carve-outs are express rather than implied: specified paragraphs of 247 CMR 9.19 on required references and facilities (9.19(23)), the whole of 247 CMR 9.21 on security of controlled substances (9.21(11)), and the general 247 CMR 20.02 reporting duties (20.02(5)), which are replaced by the narrower 20.07(3) duty.
Worked Traps
- A pharmacy keeps its Schedule II stock in an unlocked drawer marked "C-II" beside the safe. Neither storage option is satisfied — it is neither securely locked nor dispersed to obstruct diversion.
- A certified technician corrects a perpetual inventory discrepancy in the system. Prohibited — but read the reason. A certified pharmacy technician may make entries into the perpetual inventory under 247 CMR 9.21(8)(f); what she may not do is perform the adjustment arising from a discrepancy, which 9.21(8)(d) reserves to the Manager of Record or a pharmacist designee.
- A pharmacy discovers a significant loss on a Friday and files DEA Form 106 the following Thursday, having sent nothing in the meantime. Violation — written notice to the local DEA Field Division was due within one business day.
- A Rhode Island mail-order pharmacy ships alprazolam to a Worcester patient and reports only to Rhode Island's PMP. Violation — an out-of-state pharmacy delivering into Massachusetts must report to MassPAT and must otherwise comply with Massachusetts law under 247 CMR 9.20.
Which storage arrangements satisfy the federal physical security requirement for Schedule II through V controlled substances in a community pharmacy?
A Massachusetts pharmacy discovers a significant theft of controlled substances. What are the reporting steps and their deadlines?
A pharmacy located in another state ships maintenance medications to Massachusetts residents. Which statement is correct?