(a) All applicants and registrants shall provide effective controls and procedures to guard against theft and diversion of controlled substances. In order to determine whether a registrant has provided effective controls against diversion, the Administrator shall use the security requirements set forth in §§ 1301.72-1301.76 as standards for the physical security controls and operating procedures necessary to prevent diversion. Materials and construction which will provide a structural equivalent to the physical security controls set forth in §§ 1301.72, 1301.73 and 1301.75 may be used in lieu of the materials and construction described in those sections.
(b) Substantial compliance with the standards set forth in §§ 1301.72-1301.76 may be deemed sufficient by the Administrator after evaluation of the overall security system and needs of the applicant or registrant. In evaluating the overall security system of a registrant or applicant, the Administrator may consider any of the following factors as he may deem relevant to the need for strict compliance with security requirements:
(1) The type of activity conducted (e.g., processing of bulk chemicals, preparing dosage forms, packaging, labeling, cooperative buying, etc.);
(2) The type and form of controlled substances handled (e.g., bulk liquids or dosage units, usable powders or nonusable powders);
(3) The quantity of controlled substances handled;
(4) The location of the premises and the relationship such location bears on security needs;
(5) The type of building construction comprising the facility and the general characteristics of the building or buildings;
(6) The type of vault, safe, and secure enclosures or other storage system (e.g., automatic storage and retrieval system) used;
(7) The type of closures on vaults, safes, and secure enclosures;
(8) The adequacy of key control systems and/or combination lock control systems;
(9) The adequacy of electric detection and alarm systems, if any including use of supervised transmittal lines and standby power sources;
(10) The extent of unsupervised public access to the facility, including the presence and characteristics of perimeter fencing, if any;
(11) The adequacy of supervision over employees having access to manufacturing and storage areas;
(12) The procedures for handling business guests, visitors, maintenance personnel, and nonemployee service personnel;
(13) The availability of local police protection or of the registrant's or applicant's security personnel;
(14) The adequacy of the registrant's or applicant's system for monitoring the receipt, manufacture, distribution, and disposition of controlled substances in its operations; and
(15) The applicability of the security requirements contained in all Federal, State, and local laws and regulations governing the management of waste.
(c) When physical security controls become inadequate as a result of a controlled substance being transferred to a different schedule, or as a result of a noncontrolled substance being listed on any schedule, or as a result of a significant increase in the quantity of controlled substances in the possession of the registrant during normal business operations, the physical security controls shall be expanded and extended accordingly. A registrant may adjust physical security controls within the requirements set forth in §§ 1301.72-1301.76 when the need for such controls decreases as a result of a controlled substance being transferred to a different schedule, or a result of a controlled substance being removed from control, or as a result of a significant decrease in the quantity of controlled substances in the possession of the registrant during normal business operations.
(d) Any registrant or applicant desiring to determine whether a proposed security system substantially complies with, or is the structural equivalent of, the requirements set forth in §§ 1301.72-1301.76 may submit any plans, blueprints, sketches or other materials regarding the proposed security system either to the Special Agent in Charge in the region in which the system will be used, or to the Regulatory Section, Drug Enforcement Administration. See the Table of DEA Mailing Addresses in § 1321.01 of this chapter for the current mailing address.
(e) Physical security controls of locations registered under the Harrison Narcotic Act or the Narcotics Manufacturing Act of 1960 on April 30, 1971, shall be deemed to comply substantially with the standards set forth in §§ 1301.72, 1301.73 and 1301.75. Any new facilities or work or storage areas constructed or utilized for controlled substances, which facilities or work or storage areas have not been previously approved by the Administration, shall not necessarily be deemed to comply substantially with the standards set forth in §§ 1301.72, 1301.73 and 1301.75, notwithstanding that such facilities or work or storage areas have physical security controls similar to those previously approved by the Administration.
(f) A collector shall not employ, as an agent or employee who has access to or influence over controlled substances acquired by collection, any person who has been convicted of any felony offense relating to controlled substances or who, at any time, had an application for registration with DEA denied, had a DEA registration revoked or suspended, or has surrendered a DEA registration for cause. For purposes of this subsection, “for cause” means in lieu of, or as a consequence of, any Federal or State administrative, civil, or criminal action resulting from an investigation of the individual's handling of controlled substances.
(a) Schedules I and II. Raw material, bulk materials awaiting further processing, finished products which are controlled substances listed in Schedule I or II (except GHB that is manufactured or distributed in accordance with an exemption under section 505(i) of the Federal Food Drug and Cosmetic Act which shall be subject to the requirements of paragraph (b) of this section), and sealed mail-back packages and inner liners acquired in accordance with part 1317 of this chapter, shall be stored in one of the following secured areas:
(1) Where small quantities permit, a safe or steel cabinet;
(i) Which safe or steel cabinet shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques;
(ii) Which safe or steel cabinet, if it weighs less than 750 pounds, is bolted or cemented to the floor or wall in such a way that it cannot be readily removed; and
(iii) Which safe or steel cabinet, if necessary, depending upon the quantities and type of controlled substances stored, is equipped with an alarm system which, upon attempted unauthorized entry, shall transmit a signal directly to a central protection company or a local or State police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve.
(2) A vault constructed before, or under construction on, September 1, 1971, which is of substantial construction with a steel door, combination or key lock, and an alarm system; or
(3) A vault constructed after September 1, 1971:
(i) The walls, floors, and ceilings of which vault are constructed of at least 8 inches of reinforced concrete or other substantial masonry, reinforced vertically and horizontally with
(ii) The door and frame unit of which vault shall conform to the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques;
(iii) Which vault, if operations require it to remain open for frequent access, is equipped with a “day-gate” which is self-closing and self-locking, or the equivalent, for use during the hours of operation in which the vault door is open;
(iv) The walls or perimeter of which vault are equipped with an alarm, which upon unauthorized entry shall transmit a signal directly to a central station protection company, or a local or State police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve, and, if necessary, holdup buttons at strategic points of entry to the perimeter area of the vault;
(v) The door of which vault is equipped with contact switches; and
(vi) Which vault has one of the following: Complete electrical lacing of the walls, floor and ceilings; sensitive ultrasonic equipment within the vault; a sensitive sound accumulator system; or such other device designed to detect illegal entry as may be approved by the Administration.
(b) Schedules III, IV and V. Raw material, bulk materials awaiting further processing, and finished products which are controlled substances listed in Schedules III, IV, and V, and GHB when it is manufactured or distributed in accordance with an exemption under section 505(i) of the FFDCA, shall be stored in the following secure storage areas:
(1) A safe or steel cabinet as described in paragraph (a)(1) of this section;
(2) A vault as described in paragraph (a)(2) or (3) of this section equipped with an alarm system as described in paragraph (b)(4)(v) of this section;
(3) A building used for storage of Schedules III through V controlled substances with perimeter security which limits access during working hours and provides security after working hours and meets the following specifications:
(i) Has an electronic alarm system as described in paragraph (b)(4)(v) of this section,
(ii) Is equipped with self-closing, self-locking doors constructed of substantial material commensurate with the type of building construction, provided, however, a door which is kept closed and locked at all times when not in use and when in use is kept under direct observation of a responsible employee or agent of the registrant is permitted in lieu of a self-closing, self-locking door. Doors may be sliding or hinged. Regarding hinged doors, where hinges are mounted on the outside, such hinges shall be sealed, welded or otherwise constructed to inhibit removal. Locking devices for such doors shall be either of the multiple-position combination or key lock type and:
(a) In the case of key locks, shall require key control which limits access to a limited number of employees, or;
(b) In the case of combination locks, the combination shall be limited to a minimum number of employees and can be changed upon termination of employment of an employee having knowledge of the combination;
(4) A cage, located within a building on the premises, meeting the following specifications:
(i) Having walls constructed of not less than No. 10 gauge steel fabric mounted on steel posts, which posts are:
(a) At least one inch in diameter;
(b) Set in concrete or installed with lag bolts that are pinned or brazed; and
(c) Which are placed no more than ten feet apart with horizontal one and one-half inch reinforcements every sixty inches;
(ii) Having a mesh construction with openings of not more than two and one-half inches across the square,
(iii) Having a ceiling constructed of the same material, or in the alternative, a cage shall be erected which reaches and is securely attached to the structural ceiling of the building. A lighter gauge mesh may be used for the ceilings of large enclosed areas if walls are at least 14 feet in height,
(iv) Is equipped with a door constructed of No. 10 gauge steel fabric on a metal door frame in a metal door flange, and in all other respects conforms to all the requirements of 21 CFR 1301.72(b)(3)(ii), and
(v) Is equipped with an alarm system which upon unauthorized entry shall transmit a signal directly to a central station protection agency or a local or state police agency, each having a legal duty to respond, or to a 24-hour control station operated by the registrant, or to such other source of protection as the Administrator may approve;
(5) An enclosure of masonry or other material, approved in writing by the Administrator as providing security comparable to a cage;
(6) A building or enclosure within a building which has been inspected and approved by DEA or its predecessor agency, BND, and continues to provide adequate security against the diversion of Schedule III through V controlled substances, of which fact written acknowledgment has been made by the Special Agent in Charge of DEA for the area in which such building or enclosure is situated;
(7) Such other secure storage areas as may be approved by the Administrator after considering the factors listed in § 1301.71(b);
(8)(i) Schedule III through V controlled substances may be stored with Schedules I and II controlled substances under security measures provided by 21 CFR 1301.72(a);
(ii) Non-controlled drugs, substances and other materials may be stored with Schedule III through V controlled substances in any of the secure storage areas required by 21 CFR 1301.72(b), provided that permission for such storage of non-controlled items is obtained in advance, in writing, from the Special Agent in Charge of DEA for the area in which such storage area is situated. Any such permission tendered must be upon the Special Agent in Charge's written determination that such non-segregated storage does not diminish security effectiveness for Schedules III through V controlled substances.
(c) Multiple storage areas. Where several types or classes of controlled substances are handled separately by the registrant or applicant for different purposes (e.g., returned goods, or goods in process), the controlled substances may be stored separately, provided that each storage area complies with the requirements set forth in this section.
(d) Accessibility to storage areas. The controlled substances storage areas shall be accessible only to an absolute minimum number of specifically authorized employees. When it is necessary for employee maintenance personnel, nonemployee maintenance personnel, business guests, or visitors to be present in or pass through controlled substances storage areas, the registrant shall provide for adequate observation of the area by an employee specifically authorized in writing.
All manufacturing activities (including processing, packaging and labeling) involving controlled substances listed in any schedule and all activities of compounders shall be conducted in accordance with the following:
(a) All in-process substances shall be returned to the controlled substances storage area at the termination of the process. If the process is not terminated at the end of a workday (except where a continuous process or other normal manufacturing operation should not be interrupted), the processing area or tanks, vessels, bins or bulk containers containing such substances shall be securely locked, with adequate security for the area or building. If such security requires an alarm, such alarm, upon unauthorized entry, shall transmit a signal directly to a central station protection company, or local or state police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant.
(b) Manufacturing activities with controlled substances shall be conducted in an area or areas of clearly defined limited access which is under surveillance by an employee or employees designated in writing as responsible for the area. “Limited access” may be provided, in the absence of physical dividers such as walls or partitions, by traffic control lines or restricted space designation. The employee designated as responsible for the area may be engaged in the particular manufacturing operation being conducted: Provided, That he is able to provide continuous surveillance of the area in order that unauthorized persons may not enter or leave the area without his knowledge.
(c) During the production of controlled substances, the manufacturing areas shall be accessible to only those employees required for efficient operation. When it is necessary for employee maintenance personnel, nonemployee maintenance personnel, business guests, or visitors to be present in or pass through manufacturing areas during production of controlled substances, the registrant shall provide for adequate observation of the area by an employee specifically authorized in writing.
(a) Before distributing a controlled substance to any person who the registrant does not know to be registered to possess the controlled substance, the registrant shall make a good faith inquiry either with the Administration or with the appropriate State controlled substances registration agency, if any, to determine that the person is registered to possess the controlled substance.
(b) The registrant shall design and operate a system to disclose to the registrant suspicious orders of controlled substances. The registrant shall inform the Field Division Office of the Administration in his area of suspicious orders when discovered by the registrant. Suspicious orders include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency.
(c) The registrant must notify the Field Division Office of the Administration in his or her area, in writing, of any theft or significant loss of any controlled substances within one business day of discovery of the theft or loss. Unless the theft or loss occurs during an import or export transaction, the supplier is responsible for reporting all in-transit losses of controlled substances by their agent or the common or contract carrier selected pursuant to paragraph (e) of this section, within one business day of discovery of such theft or loss. In an import transaction, once a shipment has been released by the customs officer at the port of entry, the importer is responsible for reporting all in-transit losses of controlled substances by their agent or the common or contract carrier selected pursuant to paragraph (e) of this section, within one business day of discovery of such theft or loss. In an export transaction, the exporter is responsible for reporting all in-transit losses of controlled substances by their agent or the common or contract carrier selected pursuant to paragraph (e) of this section within one business day of discovery of such theft or loss, until the shipment has been released by the customs officer at the port of export. The registrant must also complete, and submit to the Field Division Office in his or her area, DEA Form 106 regarding the theft or loss. Thefts and significant losses must be reported whether or not the controlled substances are subsequently recovered or the responsible parties are identified and action taken against them. When determining whether a loss is significant, a registrant should consider, among others, the following factors:
(1) The actual quantity of controlled substances lost in relation to the type of business;
(2) The specific controlled substances lost;
(3) Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances;
(4) A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,
(5) Whether the specific controlled substances are likely candidates for diversion;
(6) Local trends and other indicators of the diversion potential of the missing controlled substance.
(d) The registrant shall not distribute any controlled substance listed in Schedules II through V as a complimentary sample to any potential or current customer (1) without the prior written request of the customer, (2) to be used only for satisfying the legitimate medical needs of patients of the customer, and (3) only in reasonable quantities. Such request must contain the name, address, and registration number of the customer and the name and quantity of the specific controlled substance desired. The request shall be preserved by the registrant with other records of distribution of controlled substances. In addition, the requirements of part 1305 of the chapter shall be complied with for any distribution of a controlled substance listed in Schedule II. For purposes of this paragraph, the term “customer” includes a person to whom a complimentary sample of a substance is given in order to encourage the prescribing or recommending of the substance by the person.
(e) When shipping controlled substances, a registrant is responsible for selecting common or contract carriers which provide adequate security to guard against in-transit losses. When storing controlled substances in a public warehouse, a registrant is responsible for selecting a warehouseman which will provide adequate security to guard against storage losses; wherever possible, the registrant shall store controlled substances in a public warehouse which complies with the requirements set forth in § 1301.72. In addition, the registrant shall employ precautions (e.g., assuring that shipping containers do not indicate that contents are controlled substances) to guard against storage or in-transit losses.
(f) When distributing controlled substances through agents (e.g., detailmen), a registrant is responsible for providing and requiring adequate security to guard against theft and diversion while the substances are being stored or handled by the agent or agents.
(g) Before the initial distribution of thiafentanil, carfentanil, etorphine hydrochloride and/or diprenorphine to any person, the registrant must verify that the person is authorized to handle the substance(s) by contacting the Drug Enforcement Administration.
(h) The acceptance of delivery of narcotic substances by a narcotic treatment program shall be made only by a licensed practitioner employed at the facility or other authorized individuals designated in writing. At the time of delivery, the licensed practitioner or other authorized individual designated in writing (excluding persons currently or previously dependent on narcotic drugs), shall sign for the narcotics and place his specific title (if any) on any invoice. Copies of these signed invoices shall be kept by the distributor.
(i) Narcotics dispensed or administered at a narcotic treatment program will be dispensed or administered directly to the patient by either (1) the licensed practitioner, (2) a registered nurse under the direction of the licensed practitioner, (3) a licensed practical nurse under the direction of the licensed practitioner, or (4) a pharmacist under the direction of the licensed practitioner.
(j) Persons enrolled in a narcotic treatment program will be required to wait in an area physically separated from the narcotic storage and dispensing area. This requirement will be enforced by the program physician and employees.
(k) All narcotic treatment programs must comply with standards established by the Secretary of Health and Human Services (after consultation with the Administration) respecting the quantities of narcotic drugs which may be provided to persons enrolled in a narcotic treatment program for unsupervised use.
(l) DEA may exercise discretion regarding the degree of security required in narcotic treatment programs based on such factors as the location of a program, the number of patients enrolled in a program and the number of physicians, staff members and security guards. Similarly, such factors will be taken into consideration when evaluating existing security or requiring new security at a narcotic treatment program.
(m) A reverse distributor shall not employ, as an agent or employee who has access to or influence over controlled substances, any person who has been convicted of any felony offense relating to controlled substances or who, at any time, had an application for registration with the DEA denied, had a DEA registration revoked or suspended, or has surrendered a DEA registration for cause. For purposes of this subsection, “for cause” means in lieu of, or as a consequence of, any Federal or State administrative, civil, or criminal action resulting from an investigation of the individual's handling of controlled substances.
(a) Controlled substances listed in Schedule I shall be stored in a securely locked, substantially constructed cabinet.
(b) Controlled substances listed in Schedules II, III, IV, and V shall be stored in a securely locked, substantially constructed cabinet. However, pharmacies and institutional practitioners may disperse such substances throughout the stock of noncontrolled substances in such a manner as to obstruct the theft or diversion of the controlled substances.
(c) Sealed mail-back packages and inner liners collected in accordance with part 1317 of this chapter shall only be stored at the registered location in a securely locked, substantially constructed cabinet or a securely locked room with controlled access, except as authorized by § 1317.80(d).
(d) This section shall also apply to nonpractitioners authorized to conduct research or chemical analysis under another registration.
(e) Thiafentanil, carfentanil, etorphine hydrochloride and diprenorphine shall be stored in a safe or steel cabinet equivalent to a U.S. Government Class V security container.
(a) The registrant shall not employ, as an agent or employee who has access to controlled substances, any person who has been convicted of a felony offense relating to controlled substances or who, at any time, had an application for registration with the DEA denied, had a DEA registration revoked or has surrendered a DEA registration for cause. For purposes of this subsection, the term “for cause” means a surrender in lieu of, or as a consequence of, any federal or state administrative, civil or criminal action resulting from an investigation of the individual's handling of controlled substances.
(b) The registrant shall notify the Field Division Office of the Administration in his area, in writing, of the theft or significant loss of any controlled substances within one business day of discovery of such loss or theft. The registrant shall also complete, and submit to the Field Division Office in his area, DEA Form 106 regarding the loss or theft. When determining whether a loss is significant, a registrant should consider, among others, the following factors:
(1) The actual quantity of controlled substances lost in relation to the type of business;
(2) The specific controlled substances lost;
(3) Whether the loss of the controlled substances can be associated with access to those controlled substances by specific individuals, or whether the loss can be attributed to unique activities that may take place involving the controlled substances;
(4) A pattern of losses over a specific time period, whether the losses appear to be random, and the results of efforts taken to resolve the losses; and, if known,
(5) Whether the specific controlled substances are likely candidates for diversion;
(6) Local trends and other indicators of the diversion potential of the missing controlled substance.
(c) Whenever the registrant distributes a controlled substance (without being registered as a distributor as permitted in §§ 1301.13(e)(1), 1307.11, 1317.05, and/or 1317.10 of this chapter), he/she shall comply with the requirements imposed on non-practitioners in § 1301.74(a), (b), and (e).
(d) Central fill pharmacies must comply with § 1301.74(e) when selecting private, common or contract carriers to transport filled prescriptions to a retail pharmacy for delivery to the ultimate user. When central fill pharmacies contract with private, common or contract carriers to transport filled prescriptions to a retail pharmacy, the central fill pharmacy is responsible for reporting in-transit losses upon discovery of such loss by use of a DEA Form 106. Retail pharmacies must comply with § 1301.74(e) when selecting private, common or contract carriers to retrieve filled prescriptions from a central fill pharmacy. When retail pharmacies contract with private, common or contract carriers to retrieve filled prescriptions from a central fill pharmacy, the retail pharmacy is responsible for reporting in-transit losses upon discovery of such loss by use of a DEA Form 106.
(a) All Schedule II-V controlled substances that will be temporarily stored at the freight forwarding facility must be either:
(1) stored in a segregated area under constant observation by designated responsible individual(s); or
(2) stored in a secured area that meets the requirements of Section 1301.72(b) of this Part. For purposes of this requirement, a facility that may be locked down (i.e., secured against physical entry in a manner consistent with requirements of Section 1301.72(b)(3)(ii) of this part) and has a monitored alarm system or is subject to continuous monitoring by security personnel will be deemed to meet the requirements of Section 1301.72(b)(3) of this Part.
(b) Access to controlled substances must be kept to an absolute minimum number of specifically authorized individuals. Non-authorized individuals may not be present in or pass through controlled substances storage areas without adequate observation provided by an individual authorized in writing by the registrant.
(c) Controlled substances being transferred through a freight forwarding facility must be packed in sealed, unmarked shipping containers.