10.1 Theft, Loss Reporting (DEA 106) & Disposal (DEA 41)

10.1 Theft, Loss Reporting (DEA 106) & Disposal (DEA 41)

The security, accountability, and lawful disposition of controlled substances represent central pillars of both federal and Virginia pharmacy jurisprudence. Under the Controlled Substances Act of 1970 (CSA, 21 U.S.C. § 801 et seq.) and the Virginia Drug Control Act (Va. Code § 54.1-3400 et seq.), licensed pharmacies function as closed-system guardians of scheduled medications. When this closed distribution system is breached through armed robbery, employee pilferage, burglary, or unexplained inventory shrinkage—or when expired, adulterated, or unwanted controlled substances must be removed from stock—pharmacists must adhere to exact statutory timelines and documentation protocols.

Failing to properly notify regulatory agencies or misinterpreting reporting thresholds carries severe administrative penalties, including license suspension, civil monetary fines, and federal criminal liability. For the Virginia Multistate Pharmacy Jurisprudence Examination (MPJE), candidates must master the distinct parallel reporting pathways established by the federal Drug Enforcement Administration (DEA) and the Virginia Board of Pharmacy, the multi-factorial legal definition of a "significant loss," and the mechanics of DEA Forms 106, 222, and 41.

---

Dual Regulatory Architecture: Federal DEA vs. Virginia Board of Pharmacy

When a theft or significant loss occurs in a Virginia pharmacy, the Pharmacist-in-Charge (PIC) cannot simply notify a single agency. Federal and state statutes operate concurrently, each imposing independent legal obligations with different reporting deadlines, documentation forms, and investigative requirements.

Controlled Substance Theft / Significant Loss Discovery Flow:
┌─────────────────────────────────────────────────────────────┐
│      Discovery of Theft or Significant Loss in Pharmacy     │
└─────────────────────────────────────────────────────────────┘
                                │
        ┌───────────────────────┴───────────────────────┐
        ▼                                               ▼
┌───────────────────────────────┐     ┌───────────────────────────────┐
│     Federal DEA Track         │     │  Virginia Board of Pharmacy   │
│     (21 CFR § 1301.76(b))     │     │ (Va. Code § 54.1-3404 / 18VAC)│
├───────────────────────────────┤     ├───────────────────────────────┤
│ • Notify local Field Division │     │ • Notify Board IMMEDIATELY    │
│   in writing within:          │     │   upon discovery (call/email) │
│   ONE (1) BUSINESS DAY        │     │ • Complete internal audit     │
│ • Conduct investigation       │     │ • Submit full written report, │
│ • Submit electronic Form 106  │     │   audit inventory, & DEA 106  │
│   upon conclusion of inquiry  │     │   copy within: THIRTY (30)    │
│ • If no loss occurred, send   │     │   CALENDAR DAYS               │
│   written update to DEA       │     │                               │
└───────────────────────────────┘     └───────────────────────────────┘

1. Federal Requirements (21 CFR § 1301.76(b))

Under federal law, the DEA registrant (or designated agent holding Power of Attorney) must execute two distinct steps upon discovering a theft or significant loss:

1. Immediate Written Notice within One (1) Business Day: The registrant must notify the Special Agent in Charge (SAC) of the local DEA Field Division Office in writing (via official portal, fax, or certified mail) within one (1) business day of discovery. This initial notification is a brief preliminary notice stating that a theft or significant loss has occurred, alerting federal authorities before a full audit is completed.
2. Electronic DEA Form 106 Submission: Following the initial notice, the pharmacy must conduct a thorough internal investigation. Once the facts are established, the registrant completes and submits DEA Form 106 (Report of Theft or Loss of Controlled Substances) electronically through the DEA Diversion Control Division secure web portal. The form details the pharmacy DEA number, date of discovery, type of incident (e.g., robbery, burglary, employee diversion), specific NDC numbers, commercial package sizes, and exact quantities of each controlled substance lost.
3. Resolution When No Loss Occurred: If the pharmacy conducts an exhaustive audit and discovers that no actual theft or significant loss occurred (for example, an apparent discrepancy was an operational inventory miscount or clerical data-entry error), the registrant must formally notify the DEA in writing to explain the resolution, thereby closing the initial one-business-day notification.

2. Virginia Board of Pharmacy Requirements (Va. Code § 54.1-3404 & 18VAC110-20-240)

Virginia law establishes a more stringent and immediate reporting mandate than federal regulations:

• Immediate Notification: Under Virginia Code § 54.1-3404 and Board regulation 18VAC110-20-240, whenever a theft or unusual loss of controlled substances (Schedules I through V) is discovered, the PIC must notify the Virginia Board of Pharmacy immediately by telephone, fax, or electronic communication.
• The Thirty (30) Day Comprehensive Submission: Within thirty (30) calendar days of the initial discovery, the PIC must prepare and deliver to the Board:
  1. A detailed written explanation of the circumstances surrounding the theft or loss;
  2. A complete audit inventory of the controlled substances involved, documenting all discrepancies and missing units; and
  3. A true, complete copy of the electronic DEA Form 106 submitted to the federal Drug Enforcement Administration.

---

Statutory Criteria for Evaluating "Significant Loss"

Federal regulations do not establish a rigid numerical cutoff (such as a fixed percentage or pill count) to define what constitutes a "significant loss." Instead, the responsibility rests on the registrant and the PIC to evaluate the totality of the circumstances. Under 21 CFR § 1301.76(b), pharmacists must evaluate six statutory criteria when determining whether a discrepancy is "significant":

1. The actual quantity of controlled substances lost in relation to the type of business: A missing bottle of 100 hydrocodone/acetaminophen tablets represents a massive, highly significant loss for a low-volume independent pharmacy dispensing 500 total controlled units per month, whereas in a mega-volume institutional hospital pharmacy, the context of total throughput must be evaluated.
2. The specific controlled substances lost: A discrepancy involving Schedule II opioids (such as oxycodone, hydromorphone, or fentanyl) or high-street-value benzodiazepines (such as alprazolam) is inherently significant, even if only a few dosage units are unaccounted for, due to extreme abuse and diversion liability. Conversely, a single missing tablet of a Schedule V cough syrup formulation carries lower intrinsic diversion risk.
3. Whether the loss can be associated with access to those controlled substances by specific individuals: Losses tied to individual employees, relief pharmacists, or contractors with access credentials strongly indicate diversion rather than administrative error.
4. A pattern of losses over a specific time period: Recurring, small-scale discrepancies occurring on specific shifts or inventory cycles (e.g., five tablets missing every Friday afternoon) represent an organized diversion pattern and constitute a significant loss requiring immediate reporting.
5. Whether the specific controlled substances are likely candidates for diversion: Medications with high street resale value, active illicit demand, or known abuse potential must be evaluated with heightened scrutiny.
6. Local trends and other indicators of the diversion potential: If local law enforcement or DEA alerts indicate widespread theft of specific agents (e.g., promethazine with codeine syrup), any unexplained loss of that product is deemed significant.

Exam Tip: If a pharmacist is in doubt regarding whether an inventory discrepancy constitutes a "significant loss," federal and Virginia authorities uniformly advise err on the side of caution and report. Filing a DEA Form 106 that is later explained by an audit error carries no penalty, whereas failing to report a theft or significant loss constitutes a federal regulatory and state statutory violation.

---

In-Transit Thefts and Losses (21 CFR § 1301.74(c))

Controlled substances are frequently targeted for diversion during transport between wholesale distributors and retail pharmacies. The legal responsibility for reporting in-transit theft or loss depends strictly on legal custody and physical receipt:

• Supplier Responsibility: If controlled substances are stolen or lost while in transit via a common carrier (e.g., FedEx, UPS, or private wholesale courier) before the purchasing pharmacy accepts delivery, the supplier bears legal responsibility. The supplier must report the in-transit loss to the DEA and file DEA Form 106.
• Purchaser Responsibility: The purchasing pharmacy assumes legal custody the moment a pharmacy representative signs the delivery receipt or manifest. If the delivery container is signed for, and the pharmacy subsequently opens the delivery tote and discovers that bottles are missing or packages have been pilfered, the purchasing pharmacy must report the loss to the DEA and the Virginia Board of Pharmacy and file DEA Form 106.
• Common Carrier Custody Waiver: If the purchaser takes custody of the shipment directly from a common carrier at a shipping depot, or if the contract explicitly specifies transfer of title at the shipping dock (FOB shipping point), the purchaser must report in-transit losses. However, in standard commercial wholesale pharmacy deliveries, the supplier reports until physical signature and acceptance by the receiving pharmacist.

---

Destruction and Lawful Disposal of Controlled Substances

Pharmacies routinely accumulate controlled substances that are expired, recalled, adulterated, damaged, or discontinued. Under federal law (21 CFR Part 1317) and Virginia regulations (18VAC110-20-240), a pharmacy cannot simply discard controlled substances in municipal trash or flush them down the sewer. Controlled substances must be rendered non-retrievable through authorized disposal pathways.

Controlled Substance Disposal and Destruction Pathways:
┌─────────────────────────────────────────────────────────────┐
│         Unwanted / Expired Controlled Substances Stock      │
└─────────────────────────────────────────────────────────────┘
                                │
        ┌───────────────────────┴───────────────────────┐
        ▼                                               ▼
┌───────────────────────────────┐     ┌───────────────────────────────┐
│  Transfer to Reverse          │     │  On-Site Pharmacy Destruction │
│  Distributor (Standard)       │     │  (Requires DEA Authorization) │
├───────────────────────────────┤     ├───────────────────────────────┤
│ • C-II: Reverse distributor   │     │ • Prior written DEA SAC       │
│   issues DEA Form 222 to      │     │   authorization required      │
│   the pharmacy                │     │ • Notify VA Board 14 days     │
│ • C-III-V: Commercial invoice │     │   in advance of destruction   │
│ • Reverse distributor         │     │ • Witnessed by two designated │
│   destroys inventory and      │     │   licensed healthcare pros    │
│   submits DEA Form 41 to DEA  │     │ • Pharmacy completes and      │
│ • PHARMACY DOES NOT FILE      │     │   submits DEA Form 41 to DEA  │
│   DEA FORM 41 FOR TRANSFERS   │     │ • Renders drug non-retrievable│
└───────────────────────────────┘     └───────────────────────────────┘

1. Transfer to a DEA-Registered Reverse Distributor

The standard, lawful method for a community or institutional pharmacy to dispose of unwanted controlled substances is transfer to a DEA-registered reverse distributor:

• Schedule II Transfers: The reverse distributor acts as the "purchaser" and issues an official single-sheet DEA Form 222 (or CSOS electronic order) to the pharmacy. The pharmacy acts as the "supplier", fills the order from its expired stock, retains a copy of the Form 222, and records the shipment date.
• Schedule III–V Transfers: Documented via a formal commercial invoice generated by the pharmacy or reverse distributor, detailing the drug name, dosage form, strength, quantity, date of transfer, and the names, addresses, and DEA numbers of both entities.
• Destruction Execution: Once the reverse distributor receives the controlled substances, the reverse distributor destroys the substances to a non-retrievable standard. The reverse distributor completes and submits DEA Form 41 (Registrants Inventory of Drugs Surrendered) directly to the DEA.

Critical Board Exam Rule: A community pharmacy DOES NOT submit DEA Form 41 when transferring controlled substances to a reverse distributor. The reverse distributor files Form 41. The pharmacy maintains the executed DEA Form 222, invoice records, and the reverse distributor's receipt of destruction on premises for two (2) years.

2. On-Site Destruction by the Pharmacy (21 CFR § 1317.05)

Pharmacies rarely perform on-site chemical or thermal destruction of controlled substances due to stringent regulatory burdens. Under federal law, on-site destruction requires:

1. Prior DEA Authorization: The pharmacy must submit a written request to the local DEA Special Agent in Charge outlining the proposed date, method of destruction, and names of two designated witnesses. Destruction cannot proceed without written DEA approval, unless the pharmacy is an authorized collector utilizing continuous disposal methods.
2. Virginia Board Notification: Under Virginia administrative rules, the pharmacy must notify the Virginia Board of Pharmacy in writing at least fourteen (14) calendar days prior to the proposed on-site destruction.
3. Witness Requirements: Destruction must be personally witnessed by two responsible individuals: two licensed pharmacists, or a licensed pharmacist and a law enforcement officer or registered nurse.
4. DEA Form 41 Submission: The pharmacy completes DEA Form 41, recording the exact inventory destroyed and obtaining the physical signatures of both witnesses. The original Form 41 is submitted to the DEA, and a copy is retained in the pharmacy's records for two years.
5. Non-Retrievable Standard: The destruction method must permanently alter the chemical integrity of the substance through chemical digestion or high-temperature incineration, rendering the drug unavailable and unusable for all practical purposes.

3. Breakage and Spillage (21 CFR § 1317.15)

Accidental breakage or spillage of a controlled substance (e.g., dropping an amber glass bottle of liquid morphine or shattering a vial of injectable diazepam) represents an operational loss, not a theft or diversion loss:

• DEA Form 106 is PROHIBITED: A pharmacy must never file DEA Form 106 for accidental breakage or spillage. Form 106 is strictly reserved for thefts, armed robberies, and significant diversion losses.
• Recoverable vs. Unrecoverable Waste:
  • Recoverable Residue: If the drug container cracks and a portion of the controlled substance remains intact or recoverable in the broken container, it cannot be flushed. The remaining recoverable drug must be transferred to a reverse distributor (using Form 222 for Schedule II) or destroyed pursuant to DEA Form 41 procedures.
  • Unrecoverable Spillage: If a liquid controlled substance is completely absorbed into floor tiles, spilled down a wastewater drain, or crushed into non-recoverable dust on a dirty floor, the loss must be documented directly in the pharmacy's controlled substance perpetual inventory and waste log. The documentation must describe the incident in detail, specify the exact volume or tablet count lost, and be signed and dated by the dispensing pharmacist and one adult witness (such as a second pharmacist, pharmacy technician, or nurse).

---

Statutory Record Retention Rules

Under federal CSA regulations (21 CFR § 1304.04) and Virginia Board regulations (18VAC110-20-240), all controlled substance documentation must satisfy the following baseline standards:

• Retention Period: All records concerning thefts, significant losses, DEA Forms 106, disposal logs, witness statements, reverse distributor invoices, and DEA Forms 222 must be maintained on premises for a minimum of TWO (2) YEARS from the date of execution.
• Segregation of Records: Schedule II records (including Schedule II theft logs and DEA Forms 222) must be maintained completely separate from all other pharmacy records. Schedules III, IV, and V records must either be maintained separately or maintained in a form that makes them readily retrievable from standard commercial business records.
• Readily Retrievable Standard: During an unannounced inspection by a Virginia Board of Pharmacy inspector or DEA diversion investigator, paper records must be produced immediately, and electronic records must be retrievable and printable within forty-eight (48) hours.