A Break-In, an Overdue Inventory, and an Unreported Move
On Monday morning the pharmacist-in-charge of an independent pharmacy in rural Nebraska finds the back door pried open and the Schedule II safe standing open. A preliminary review shows roughly 900 tablets of oxycodone-acetaminophen 10/325 and three pint bottles of promethazine-codeine syrup (Schedule V) are missing. The pharmacy's last full controlled substance inventory was taken 26 months ago. Four months ago the pharmacy moved to a new suite in the same strip mall; the DEA registration certificate on the wall still shows the old suite number, and no paperwork was filed. A technician hired six weeks ago holds a CSOS certificate but has no power of attorney on file; her certificate is still active. The owner wants to restock and "deal with the paperwork after the weekend." The local police have taken a report, and the alarm company cannot confirm whether the alarm was armed.
1. What must happen today, and to whom must the loss be reported?
Read the worked answer
The owner's sequencing is backwards. Reporting obligations run from discovery, not from a convenient date.
- DEA: a registrant must notify the DEA field division in writing of a theft or significant loss within one business day of discovery. That notice is DEA Form 106. Both the oxycodone-acetaminophen (Schedule II) and the promethazine-codeine (Schedule V) must be listed with drug name, strength, and best available quantity.
- Nebraska Board of Pharmacy: state law requires prompt reporting of theft or significant loss of controlled substances; this is a separate obligation from the DEA report and must not be skipped because the federal form was filed.
- Local police: already done; obtain the report number and attach it.
- Internally: secure the premises and inventory, preserve video and access records, and do not restock or move stock until the on-hand counts are documented. Restocking before counting destroys the ability to complete the Form 106 accurately.
"Significant loss" is judged against the practice's volume and the drug's likelihood of diversion - 900 tablets of an immediate-release opioid is unambiguously significant. Waiting until after the weekend risks a missed federal deadline on a report that is easy to file correctly on day one. Keep copies of the 106, the Board report, and the police report with the controlled substance records.
2. How should the PIC handle the overdue inventory and the unreported relocation?
Read the worked answer
Inventory. A controlled substance inventory must be taken every two years. This one is two months late, so a complete inventory must be taken now: an exact count of all Schedule II stock and an estimated count for Schedule III–V (estimated counts are permitted unless a container holds more than 1,000 units). The inventory must be dated, signed, kept at the registered location, and retained for two years. It should be reconciled against receipts and dispensing records since the last inventory to determine whether the shortage is limited to the burglary - a gap that large after a 26-month interval can hide diversion that has nothing to do with the break-in. That reconciliation should be completed before anyone signs a Form 106 stating a loss figure.
Relocation. A DEA registration is location-specific. A registrant that moves must apply for a modification of registration before the move; it may not conduct business at an address not on its certificate. This pharmacy has been dispensing from an unregistered location for four months, which is a substantive violation independent of the burglary. The PIC should file the modification immediately, notify the Board of the address change as state law requires, and stop treating the old certificate on the wall as current. The owner should be told in writing that this is not paperwork to be handled "after the weekend" - controlled substance activity at the new suite has been occurring outside the registration.
3. What is the CSOS power-of-attorney problem, and what must be corrected?
Read the worked answer
CSOS digital certificates are issued to individuals, but the registrant's authority to use them is created by a power of attorney. Under 21 CFR Part 1311, the registrant must execute a POA for each certificate holder before that person signs or receives Schedule I or II orders electronically; the POA must identify the certificate holder and be signed by the person who signed the most recent DEA application (or a properly authorized delegate). The POA is retained with the CSOS records and is revocable.
Here, an active certificate with no POA means the technician is not authorized to act for the registrant. Until a valid POA is executed and filed, she cannot sign or receive CII orders, and any order she has already handled should be reviewed. Practical corrections:
- Execute the POA now if the pharmacy intends to use her for ordering, and file it with the CSOS records.
- Audit any electronic CII orders since her hire to confirm who signed and under what authority.
- Build a termination checklist: when a certificate holder leaves, revoke the POA in writing and deactivate the certificate.
- Verify on a schedule that each certificate is unexpired and each holder has a matching, current POA.
The certificate proves identity; the POA proves authority. Confusing the two is a common finding in DEA inspections and one the PIC can fix with a single signed document.