Security Requirements and the Records That Must Balance

Security and recordkeeping are usually treated as separate obligations, and in an inspection they are not. The question an inspector is answering is whether everything that came in can be accounted for, and the physical controls and the paper trail are two ways of asking it. A registrant with excellent locks and unreconcilable records is in worse trouble than one with the reverse.

The standard the storage must meet

The rule requires registrants to provide effective controls and procedures to guard against theft and diversion. It is a performance standard rather than a specification, and the regulation says explicitly that substantial compliance with the stated standards may be deemed sufficient where the overall system provides a substantial deterrent.

The factors that determine whether a system is adequate include the location of the premises and the relative security of the surrounding area, the type of building construction and the general characteristics of the building, the type and quantity of controlled substances stored, the availability of local police protection, the adequacy of the registrant's own systems for monitoring, and the extent of unsupervised public access.

For practitioners, including pharmacies, the specific controls are short. Controlled substances must be stored in a securely locked, substantially constructed cabinet, or dispersed through the stock of non-controlled items in a manner that obstructs theft or diversion. Non-practitioners face graduated requirements running from a safe or steel cabinet of stated weight and construction up to a vault with alarm coverage, depending on quantity and schedule.

Controls over the people, not only the room

A significant share of losses are internal, and the rules treat personnel screening as part of the security system rather than as a separate human resources matter. Registrants are directed to inquire into an applicant's background, including any experience with controlled substances, and are told that the applicant's authorization for such inquiry is an appropriate part of the process.

Two prohibitions are absolute for practitioners. A registrant may not employ, as an agent or employee with access to controlled substances, any person convicted of a felony offense relating to controlled substances, or any person who has had an application for registration denied, a registration revoked, or who has surrendered a registration for cause.

Separately, employees are placed under a stated responsibility to report diversion, and registrants are expected to inform employees that reporting is a condition of continued employment. A registrant that discovers diversion and cannot show that any reporting channel existed has a harder case to make about the adequacy of its controls.

The inventory cycle and how it is counted

Three inventories are required. An initial inventory is taken on the date the registrant first engages in manufacturing, distributing or dispensing; where the business starts with nothing on hand, that fact is recorded as the initial inventory. A biennial inventory follows, taken at least every two years on any date within two years of the previous one. And a further inventory is required on the effective date of a rule adding a previously uncontrolled substance to a schedule.

Each inventory must be a complete and accurate record of all controlled substances on hand, made in written, typewritten or printed form and kept at the registered location. It may be taken at the opening or the close of business, and the record must indicate which.

The counting method differs by schedule. Schedule II substances are counted exactly. For Schedules III, IV and V a registrant may make an estimated count, except that an exact count is required where the container holds more than a threshold number of units. Substances are on hand if they are in the possession or under the control of the registrant, which includes stock returned by a customer and stock held by employees for distribution as samples.

Receipts, dispositions and the two-year window

Between inventories, the registrant keeps a complete and accurate record of each substance manufactured, received, sold, delivered, disposed of or otherwise handled. For a dispenser that means the acquisition record on one side and the dispensing record on the other, with enough detail on each entry to identify the substance, the quantity, the date and the counterparty.

Every inventory and record must be kept and be available for inspection and copying for at least two years from the date of the inventory or record. State law frequently requires longer, and where it does, the longer period governs in practice because the records still exist and remain discoverable.

Filing is prescribed as well as retention. Schedule II records must be maintained separately from all other records of the registrant. Records for Schedules III, IV and V must either be maintained separately or be in a form that renders them readily retrievable from ordinary business records. Electronic systems satisfy the requirement if they can produce the controlled substance entries on demand.

The consequence of a gap is not merely administrative. Unaccounted stock is the factual basis for most diversion cases, and a registrant that cannot show where a quantity went is left arguing about inference. Where the gap is large enough to be significant, the obligation described under reporting a theft or significant loss is triggered on discovery, and the records supporting the reconciliation will be the first thing requested during an administrative inspection. The same records also underpin every dispensing decision, since the dispensing history is what makes a red flag visible in the first place.