5.6 Robbery, Break-In & Theft Event Response

5.6 Robbery, Break-In & Theft Event Response

Quick Answer: A theft event has two parallel tracks and the exam tests both. The safety and scene track runs in minutes: comply with the robber, protect people, call 911, lock down, preserve evidence, and capture independent witness descriptions. The regulatory track runs on a fixed clock: written notice to the local DEA Diversion Field Office within one business day of discovery (21 CFR § 1301.76(b)), a physical inventory to quantify exactly what is missing, and a completed DEA Form 106 through the Theft/Loss Reporting (TLR) system within 45 days of discovery. DEA has not accepted paper Form 106 submissions since July 24, 2023.

---

Three Event Types, Three Response Profiles

All three converge on the same DEA reporting obligation once a theft or significant loss is identified.

---

During an Armed Robbery

The governing principle is that controlled substances are replaceable and people are not. Institutional policy and law-enforcement guidance are consistent:

1. Comply with every demand. Hand over what is requested. Do not argue, negotiate, delay, or volunteer that more product is stored elsewhere.
2. Do not resist, chase, or attempt to detain. Pursuit outside the building converts a property crime into a lethal-force encounter and is prohibited by essentially every pharmacy policy.
3. Keep hands visible and movements slow and announced. Say what you are about to do before reaching under a counter — a silent reach toward an alarm reads as a reach for a weapon.
4. Activate the silent duress alarm only if it can be done unobserved. A foot-pedal or covert button is designed for this; a visible reach is not worth the risk.
5. Observe deliberately. Note height relative to a fixed reference (door-frame height strips exist for this reason), build, clothing, accent or speech patterns, visible tattoos or scars, the type of weapon, the number of offenders, what they touched, what they said, and the direction of flight, vehicle description, and plate if visible from a safe position.
6. Protect patients and bystanders by not drawing attention to them.

---

Immediately After the Offender Leaves

┌──────────────────────────────────────────────────────────────────────────────┐
│                        FIRST 60 MINUTES — SCENE ACTIONS                      │
│                                                                              │
│  1. Secure the premises: lock the doors, stop new customers entering         │
│  2. Call 911 — report weapon, injuries, description, direction of flight     │
│  3. Care for anyone injured; account for all staff and patients              │
│  4. DO NOT touch, clean, or straighten anything the offender contacted       │
│     (counters, pens, door handles, dropped items, note or demand slip)       │
│  5. Separate witnesses and have each write an INDEPENDENT description        │
│     before they discuss the event with one another                           │
│  6. Preserve and back up video immediately; note exact clock time            │
│  7. Notify pharmacy leadership, security, risk management, and HR            │
│  8. Begin a controlled substance inventory to determine what is missing      │
└──────────────────────────────────────────────────────────────────────────────┘

Why witnesses are separated: memory is highly suggestible. Once two witnesses compare notes, their descriptions converge and the independent evidentiary value of the second account is destroyed. Each person should write, sign, and date their own account before any group discussion.

Why the scene is not cleaned: latent prints, DNA on a demand note or a handled bottle, and the physical position of disturbed items are evidence. "We tidied up before the police arrived" is a recurring investigative loss.

---

Quantifying the Loss

A theft report is only as good as the inventory behind it. Before filing, the pharmacy must reconstruct exactly what is missing:

• Perform a physical count of all controlled substances, not only the items obviously taken — robbers frequently sweep an entire shelf, and burglars target the Schedule II safe plus whatever is loose.
• Compare against the perpetual inventory, the last biennial or initial inventory, and receipts since that inventory (invoices, DEA Form 222 copies, CSOS records).
• Record each missing item by name, strength, dosage form, and container size — in milliliters for liquids — or the corresponding National Drug Code.
• Document the count with two people, sign, date, and retain it as the supporting record for the Form 106.

---

The Federal Reporting Clock

Highest-yield distinction on this topic: the one business day deadline belongs to the initial written notification, and the 45 days belongs to the completed Form 106. An item that asks "when must you notify DEA" is testing the one-business-day rule; an item that asks "when must the Form 106 be filed" is testing 45 days.

The seven DEA Form 106 data elements

1. Name and address of the firm (pharmacy)
2. DEA registration number
3. Date of the theft or loss — or the date of discovery if the actual date is unknown
4. Name and telephone number of the local police department, if notified
5. Type of theft — for example, night break-in, armed robbery, employee pilferage, loss in transit
6. List of identifying marks, symbols, or price codes used by the pharmacy on container labels
7. A listing of the controlled substances missing, including strength, dosage form, and size of container (in milliliters if liquid) or the corresponding NDC numbers

---

Was It a "Significant Loss"?

Neither the Controlled Substances Act nor the regulations define "significant loss." DEA places the burden on the registrant to use best judgment, noting that what is significant for a community pharmacy may be insignificant for a hospital or manufacturer. DEA's stated expectation is to err on the side of caution and report. The six evaluation factors — the specific substance, quantity relative to business volume, association with specific individuals, pattern over time, likelihood of diversion, and local trends — are covered in Section 5.4.

An armed robbery or a forced break-in removes the judgment question entirely: a theft is reportable regardless of quantity.

---

Internal Theft: A Different Playbook

When the suspected offender is an employee, the first-minute actions invert. There is no scene to secure and no 911 call, and the greatest risk is alerting the suspect:

• Do not confront the suspected individual and do not discuss suspicions on the unit. Route the concern to the MDRT through the escalation path in Section 3.4.
• Preserve electronic evidence first — ADC transaction logs, eMAR entries, badge access records, and video are the perishable assets, and some systems purge on a rolling window.
• Impound physical evidence in serialized tamper-evident packaging with an unbroken chain-of-custody log (Section 6.3) before anyone handles or tests it.
• Coordinate with HR, legal, and security before any interview, for-cause drug test, or access suspension, so the action does not compromise the employment case or the criminal referral.
• Report externally when confirmed: DEA notification and Form 106 if a theft or significant loss occurred, the state licensing board for the individual's license, and law enforcement.
• DEA's employee-security model supports this pathway: 21 CFR § 1301.91 states that an employee with knowledge of a coworker's diversion should report it to a responsible security official of the employer, and § 1301.90 identifies prior non-prescribed controlled substance use and controlled-substance convictions as appropriate pre-employment inquiries. Both sit under the "Employee Screening—Non-Practitioners" heading, so for a pharmacy or hospital they are the adopted model rather than a directly binding rule — see Section 3.4.

---

After-Action Requirements

A theft event is a mandatory trigger to re-evaluate physical security under 21 CFR § 1301.71(a), which requires effective controls appropriate to the registrant's circumstances. Post-incident work includes a security gap analysis (entry point, alarm response time, camera coverage and retention, safe rating, cash and drug separation), a written corrective action plan with owners and dates, and reporting to the diversion prevention committee. Staff support is equally part of the response: an armed robbery is a critical incident, and access to critical incident stress debriefing and the Employee Assistance Program belongs in the response policy alongside the regulatory checklist.