2.2 DEA Forms, Registration & Security

The Closed System of Distribution and Who Must Register

Federal controlled-substance law is built on a closed system of distribution: every person who handles controlled substances must be registered with, and accountable to, the DEA. Under 21 USC § 822, the following must register:

• Manufacturers, distributors, and importers/exporters of controlled substances;
• Practitioners (physicians, dentists, veterinarians, podiatrists, and qualifying mid-level practitioners such as nurse practitioners and physician assistants where state law authorizes them to prescribe CS) who prescribe, administer, or dispense CS;
• Pharmacies that dispense CS — the pharmacy itself registers as a "dispenser," and pharmacists employed by a registered pharmacy dispense as agents of that pharmacy; individual pharmacists do not need their own DEA registration to dispense at a registered pharmacy;
• Researchers and teaching institutions handling CS, including Schedule I researchers who need a separate Schedule I registration.

A DEA registration is specific to one person or entity at one physical location. A chain pharmacy with five locations needs five separate DEA registrations. A registrant may not operate at multiple locations under a single registration unless DEA expressly authorizes it. Registrations must be renewed every 3 years (21 CFR 1301.14). A registrant must file an electronic modification with DEA for any change of address, name, or pharmacist-in-charge within 30 days.

Pharmacist-in-Charge (PIC) Responsibilities

Under 21 CFR 1304.04 and the corresponding PA rules at 49 Pa. Code § 27.11, the pharmacist designated as the pharmacist-in-charge (also called pharmacist-manager in PA) is personally responsible for the pharmacy's CS compliance:

• Ensuring the DEA registration and PA pharmacy permit remain current and match the physical location;
• Maintaining all CS records (prescriptions, inventories, DEA Form 222 orders, receipt records, dispensing logs) for a minimum of 2 years and making them available for DEA inspection;
• Notifying the DEA and the PA State Board of Pharmacy of any change in PIC, address, ownership, or closure;
• Overseeing the initial inventory upon registration (or upon PIC change at the pharmacy), the biennial inventory every 2 years, and the timely filing of DEA Form 106 for theft or loss;
• Supervising dispensing and security procedures, and ensuring compliance with PA's e-prescribing mandate and PDMP query requirements.

DEA Forms Quick Reference

Inventory Requirements

Federal inventory rules under 21 CFR 1304.03–1304.11 require two distinct inventory types:

1. Initial inventory — A complete, accurate, all-schedules inventory taken on the date the pharmacy first registers with DEA, on the date a new permit is issued, or on the date of a transfer of ownership or PIC change. The initial inventory becomes the baseline against which all subsequent inventory is measured.
2. Biennial inventory — A complete inventory of all controlled substances on hand, taken at least once every 2 years (21 CFR 1304.11). The registrant may select the biennial date and may take the inventory at either the opening of business or the close of business, but the inventory record must state which. A registrant who fails to take the biennial inventory commits a violation and may be subject to civil penalties.

What the Inventory Must Include

For each controlled substance, the inventory record must list:

• The name of the substance (and dosage form and strength);
• The finished-form count (e.g., tablets, capsules, milliliters) — for CI–CII, an exact count is required; for CIII–CV, an approximate count is acceptable;
• The date and time the inventory is taken;
• The signature of the person taking the inventory.

PA Note

PA does not require an annual CS inventory separate from the federal biennial inventory — the federal biennial schedule applies. The PIC is responsible for ensuring the biennial inventory is performed and documented.

Theft, Loss, and Form 106

Upon discovery of a theft or significant loss of any controlled substance, the registrant must:

1. Notify the DEA Field Division Office in writing within one business day of discovery (21 CFR 1301.76(b));
2. File a complete DEA Form 106 electronically through the DEA Diversion Control Division website. Since the July 24, 2023 final rule, paper Form 106 is no longer accepted; the registrant has 45 days after discovery to finalize the complete filing, but the preliminary notice is still due within one business day;
3. Also report the theft or loss to local law enforcement and to the PA State Board of Pharmacy;
4. Conduct a reconciliation and keep the Form 106 on file for a minimum of 2 years.

What counts as a "significant loss" is a judgment call, but DEA guidance instructs registrants to err on the side of reporting when the loss is unexplained or exceeds normal dispensing waste. Recurring small losses that, in the aggregate, suggest diversion must also be reported.

Security and Storage

Under 21 CFR 1301.72–1301.76, controlled substances must be stored in a securely locked, substantially constructed cabinet or safe. Specific requirements:

• Schedule I and II — Must be stored in a safe or steel cabinet equivalent to a U.L. Class 2 rating (or better), bolted to the floor or wall; the storage area must be alarmed or monitored, and access limited to authorized personnel.
• Schedule III, IV, and V — Must be stored in a securely locked, substantially constructed cabinet or dispersed throughout the stock of non-controlled drugs so as to obstruct theft; many pharmacies elect to store all CS in the same safe for simplicity.
• Working stock — A limited working stock of CII may be kept out of the safe during business hours for dispensing, but it must be returned to the safe at the close of business.
• DEA inspection authority — DEA may inspect CS records and storage without a warrant during business hours; the registrant must make records available for copying.

Common MPJE Traps on Forms and Security

1. "One business day" vs. "45 days" — The preliminary notice of theft/loss to the DEA Field Division is due within one business day of discovery, even though the complete electronic Form 106 may be finalized within 45 days. Many candidates confuse these two deadlines.
2. Form 222 retention — 2 years, not 3 years (which is the registration renewal cycle) or 7 years (HIPAA).
3. Biennial inventory timing — The pharmacy chooses its own biennial date; there is no universal federal "every October" date. PA follows federal biennial cadence.
4. Initial vs. biennial inventory — An initial inventory is taken on registration, ownership transfer, or PIC change; a biennial inventory is taken every 2 years thereafter. Both must be on file.