While many sources say that the DEA audits registrants every three year, in my experience as a pharmacy attorney it usually happens less frequently. But if you are a pharmacy owner or manager, it is likely that your business would be (or was) audited by the DEA at some point.

In the pharmacy context, the DEA conducts an audit for the following reasons:

  • It received a tip regarding potential violations of the Controlled Substances Act (“CSA”) (such tips may come from the Board of Pharmacy, wholesalers, prescribers, or even patients);
  • It flags the pharmacy as an outlier compared to similarly situated pharmacies; or
  • It randomly audits to ensure compliance with CSA.

Many of my clients often say: “I have nothing to hide, DEA can audit me at any time.” This statement comes from misunderstanding of how the DEA conducts its audits. While the DEA focuses on over-dispensing (pill-mills) and diversion, most of the audits result in monetary penalties due to simple and apparently innocent record-keeping errors. Almost every single DEA audit that I worked on resulted in record-keeping fines.

There are two types of monetary penalties in the DEA’s arsenal:

  • One is a hefty fine of $64,820 per violation, found in 21 U.S.C. Sec. 842(a) (all subsections other than 5, 10, 16). Most commonly cited violations under this section are failure to exercise corresponding responsibility, dispensing on invalid prescription blanks, purchasing controlled substances under invalid or missing power of attorney.
  • Another one is a smaller monetary penalty of $15,040 for violations of Sec. 842(a)(5) and (10) only. These are all record-keeping errors, such as failure to list patient addresses or failure to keep complete and accurate records. It is not uncommon that such record-keeping violations add up to millions of dollars.

If, for example, the prescriptions are missing patients’ addresses and you have 10,000 of such prescriptions, the monetary penalty may reach $150,400,000 (which is reduced depending on the pharmacy’s ability to pay). Therefore, I cannot stress enough how important record-keeping and compliance with the CSA to the letter are.

Here are some of the issues that often come up during DEA audits and which usually result in large monetary penalties:

  • Improperly performed inventories. It’s common for the pharmacy inventory to omit necessary requirements (such as a date/time or finished form of the substance) or some controlled substances on inventory forms;
  • Records of receipt and dispensing. CSOS receiving records must document the quantity received and the date of receipt. Dispensing records must state number of units dispensed, name and address of the person to whom it was dispensed, the date of dispensing, the name or initials of the individual who dispensed or administered the substance. Very often, pharmacy records omit patients’ addresses or/and the DEA number of the prescriber (or list incorrect number).
  • Power of attorney. All ordering personnel must properly execute a power of attorney with the registrant. Often, the power of attorney is not dated, not coming from the registrant or missing altogether.
  • Employee screening. Per federal regulations, pharmacy shall not employ anyone who has access to controls, if such person has been convicted of a felony relating to controlled substances or whose application with the DEA had been denied, revoked, or surrendered for cause. Pharmacy should run state, county, and federal background checks on all the employees with access to controls.
  • Corresponding Responsibility. Pharmacists usually run into this problem when they do not run PDMP reports on new and existing patients or they are filling scripts coming from problematic prescribers who are already on the DEA’s or Medical Board’s radar.

Always keep in mind that every record-keeping violation could potentially turn into a monetary penalty. Therefore, training staff on proper record-keeping and following every regulation of Title 21 Code of Federal Regulations (starting with § 1300, which is available on the DEA’s website) is a part of a solution to comply with federal regulations and to avoid administrative actions and monetary penalties.