DEA Controlled Substance Compliance for Surgical Practices
DEA registration and controlled substance management are among the most audit-prone compliance areas for surgical and procedural practices. The Controlled Substances Act (21 USC 801 et seq.) and its implementing regulations (21 CFR Parts 1301 through 1321) set specific requirements for registration, storage, inventory, recordkeeping, dispensing, and disposal. Non-compliance results in civil fines of up to $15,691 per violation (as adjusted in the 2024 Federal Register), criminal prosecution, or loss of DEA registration.
DEA Registration Requirements Under 21 CFR 1301
Every location where controlled substances are stored, administered, or dispensed requires its own DEA registration (21 CFR 1301.12). A single practitioner operating at two clinic sites needs two registrations. Mobile surgical units and ambulatory surgery centers that stock controlled substances need separate registrations.
Registration renewal is required every 3 years for practitioners (Schedule II through V) through the DEA Diversion Control Division's online portal. Lapsed registration makes any controlled substance activity illegal, even if a renewal application is pending. The DEA recommends submitting renewal 45 days before expiration.
Mid-level practitioners (nurse practitioners, physician assistants, CRNAs) must hold their own DEA registration to prescribe controlled substances. Some states grant these practitioners independent prescribing authority, while others require a collaborative practice agreement with a physician. The practitioner's DEA registration must reflect the schedules authorized under their state license.
A DEA 224 form (new registration) or DEA 224a (renewal) must be completed for each registered location. The registrant must report any change of address, name, or drug schedules within 30 days.
Storage and Security Under 21 CFR 1301.71 through 1301.76
Schedule II substances (fentanyl, morphine, oxycodone, hydromorphone, methadone) must be stored in a substantially constructed, locked cabinet or safe. The DEA does not prescribe a specific safe rating, but it must be sufficiently secure to prevent unauthorized access. Many practices use GSA-rated security containers or pharmacy-grade safes.
Schedule III through V substances must be stored in a locked cabinet or distributed throughout the stock of non-controlled medications in a manner that prevents theft (21 CFR 1301.75). Combining all controlled substances in a locked cabinet is the most practical approach for audit readiness.
Access to controlled substance storage must be limited to the minimum number of authorized employees. Maintain a written list of individuals with access, and update it within 24 hours of any staffing change. Combination locks should be changed when an authorized employee departs.
Security cameras covering the controlled substance storage area are not required by 21 CFR but are strongly recommended by the DEA Practitioner's Manual and are becoming a de facto standard during audits. Footage should be retained for a minimum of 30 days.
Inventory and Recordkeeping Under 21 CFR 1304
An initial inventory must be completed on the date DEA registration is granted, and a biennial (every 2 years) inventory is required thereafter (21 CFR 1304.11). The registrant may choose any date for the biennial inventory, but once chosen, subsequent inventories must fall within 2 years of the prior one.
Schedule II inventory must be an exact count. Schedule III through V may be an estimated count if the container holds 1,000 or fewer units, otherwise an exact count is required. Record the drug name, dosage form, strength, number of units, and the date and time (opening or close of business) of the inventory.
Administration records (for controlled substances administered in the office, such as during procedures): document the patient name, date, drug name, strength, quantity administered, and the name or initials of the administering practitioner. These records must be maintained for 2 years (21 CFR 1304.04) and be available for DEA inspection.
Dispensing records for Schedule II require a separate record from Schedules III through V. Prescribing records must include the prescriber's DEA number, patient name, drug, strength, quantity, directions, and number of refills (zero for Schedule II). All records must be readily retrievable within 48 hours of a DEA request.
Disposal, Loss Reporting, and EPCS
Expired or unused controlled substances must be destroyed through a DEA-registered reverse distributor (21 CFR 1317.05) or through a DEA-authorized collection program. Flushing, pouring down the drain, or discarding in regular trash is not compliant for registrant disposal (distinct from FDA patient disposal guidance). File a DEA Form 41 to document destruction.
Theft or significant loss of any controlled substance must be reported to the DEA on Form 106 immediately upon discovery (21 CFR 1301.76(b)). Local law enforcement should also be notified. Failure to report theft is itself a violation that can result in sanctions against the registration.
Electronic Prescribing for Controlled Substances (EPCS) is required in most states as of 2025. The DEA regulations (21 CFR 1311) require identity proofing, two-factor authentication for each prescription, and use of a DEA-certified electronic prescribing application. Audit logs of all EPCS transactions must be retained and accessible.
Wasting controlled substances (partial doses not administered to a patient): must be witnessed by a second authorized individual and documented with the date, drug, amount wasted, amount administered, patient name, and both signatures. Some states require the witness to be a licensed healthcare professional.
The DEA does not publish a fixed audit schedule. Inspections are triggered by complaints, suspicious ordering patterns, theft reports, or random selection. The DEA Diversion Control Division reviews purchasing data from the Automation of Reports and Consolidated Orders System (ARCOS), and practices ordering unusually high quantities of Schedule II substances relative to their specialty and size are flagged for investigation. Practices that have previously reported a theft or loss are more likely to receive a follow-up inspection. Being audit-ready at all times is the recommended approach.
What happens if our DEA registration lapses?
Operating with a lapsed registration means every controlled substance activity (prescribing, administering, storing) is technically a violation of the Controlled Substances Act. The DEA may impose civil penalties, and patients who received controlled substances during the lapse could trigger individual violation counts. To cure a lapse, submit a new registration application (DEA Form 224), not a renewal. Until the new registration is granted, the practice must not prescribe, administer, or possess controlled substances. The DEA recommends setting calendar reminders 90 and 45 days before expiration.
Do we need to inventory samples of controlled substances?
Yes. Drug samples containing controlled substances are subject to the same inventory and recordkeeping requirements as any other controlled substance in the practice (21 CFR 1304.11). Samples must be included in the biennial inventory, stored in the locked controlled substance area, and their receipt and disposition must be documented. In practice, many compliance officers recommend declining controlled substance samples entirely because the recordkeeping burden and audit risk outweigh the benefit.
Who can witness controlled substance wasting?
Federal law (21 CFR) does not specify the qualifications of a wasting witness. However, most state boards of pharmacy and nursing require the witness to be a licensed healthcare professional (RN, LPN, pharmacist, or physician). Some states accept any employee authorized to access controlled substances. Check your state board of nursing and pharmacy regulations for the specific witness requirements in your jurisdiction. The witness and the administering practitioner both sign the wasting record.
For practices
Bring this to your own practice.
QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.
This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.
