October 2011 Volume 8 Number 2

DEA Audits: “Coming to a Theatre Near You”

By Ronald J. Friedman, Lane Powell PC, Seattle, WA1

AuthorWe live in a time of ever-increasing government regulation and enforcement. One area in which this is becoming increasingly prevalent for medical providers is the area of Drug Enforcement Administration (“DEA”) audits.

The DEA is charged with the responsibility to monitor the supply and distribution of all pharmaceutical controlled substances in the United States. Any medical provider wishing to prescribe, administer, or dispense controlled substances must be registered with the DEA. Manufacturers, distributors, and pharmacies are also DEA registrants.

Title 21, United States Code (USC) Sections 802, et. seq., and 21 Code of Federal Regulations (CFR) Part 1300, set forth a series of laws and regulations governing the activities of all DEA registrants, the violation of which may result in revocation of DEA registration, civil fines, and/or criminal conviction.

The DEA employs hundreds of Diversion Investigators to monitor compliance. The Diversion Investigators are located within DEA offices throughout the country. They report to their local office as well as to the Office of Diversion Control in Washington, D.C. A principal mechanism for ensuring compliance and determining noncompliance by DEA registrants is through the DEA audit.

Such audits are on the rise for various reasons: First, pharmaceutical drug abuse by sheer numbers has eclipsed that of the abuse of “hard” illicit drugs.2 This is a phenomenon which has not gone unnoticed by law enforcement and has triggered greater scrutiny of medical providers who are assumed to be part of the problem. In addition, the federal government is looking for funds for a variety of reasons, and audits resulting in fines are an income source. Caught in the crossfire of this confluence are all DEA registrants.

The purpose of this article is to review the challenges faced by medical providers responding to an audit, although several of the comments are equally applicable to other types of institutional DEA registrants facing such investigations.

Right to Audit

Is there anything a DEA registrant can do to prevent an audit? Answer: No. If one wants to be a DEA registrant, one must submit to such audits, which may occur at any time and repeatedly during the course of one’s DEA registration. Sometimes an audit is complaint driven, but most of the time it is not. It is simply a consequence and repercussion of one’s DEA registration.

The authority to conduct the audit is established by federal regulation.3 Diversion Investigators simply arrive at the registered premises (typically the registrant’s medical office), without prior warning, as they believe the element of surprise is important to their mission (and perhaps they are right), and announce they are there to conduct an audit. Diversion Investigators do not carry guns and they do not have arrest authority. They are required to present official credentials, and to identify the purpose of their visit in a written notice of inspection.4 Typically, they will present the registrant with a written form requesting voluntary consent to conduct the audit.5 It is every registrant’s lawful right to decline such consent. If they do decline, the DEA is required to respect that declination, and must, if they wish to proceed, apply to a United States federal district court for an administrative inspection warrant.6 This administrative inspection warrant will be routinely granted, and is lawfully granted, based upon the following showing: (a) the DEA would like to conduct an audit of the DEA registrant at the registered premises; and (b) the subject is a DEA registrant.7 It is as easy as that. Following that authorization, the DEA will return, paper in hand, but potentially with a negatively impacted attitude because they have been forced to get the warrant, and they will proceed with their audit.

In practice, very few DEA registrants have the personality or conviction to decline consent; and accordingly most audits occur pursuant to written consent.

One should realize, however, that the DEA is required to conduct such audits in a “reasonable manner”8, and that there may be a variety of appropriate reasons why a physician might tell the DEA to come back later, at which time he/she will voluntarily consent, or require the DEA to secure a warrant. First, the registrant may be busy seeing patients, and the visits can be extremely disruptive, burdensome, and requiring the provider’s immediate attention. Second, the actual registrant may not be present and may wish to be present and not have an employee act as agent and authorize the audit.9 Third, a provider may wish time to get organized for the audit, which seems a reasonable thing for a provider to do, especially considering the serious nature of the audit. All of this is reasonable conduct by a DEA registrant. Finally, the registrant may wish to consult with counsel prior to consenting, and may wish to have counsel (or counsel’s representative) present during the audit. Again, this is a registrant’s right and may be prudent. Counsel, acting on behalf of the registrant, may wish to engage the Diversion Investigators in a discussion of rescheduling the audit for a time that is better, and when counsel may be present to observe. There is nothing wrong with this. On the other hand, there may be times, depending upon the circumstances, when trained counsel senses that the best move is for the client to consent to the audit and allow it to proceed without further delay.

Proper Bounds of an Audit

What does an audit involve? Generally, the audit is a review of records at the registered location designed to determine whether the registrant is in compliance with its responsibilities under law and regulation. During the audit, there are certain things the DEA is allowed to do, and there are certain things the DEA is not allowed to do. Indeed, the authority to conduct the audit, whether voluntary or pursuant to warrant is the same and is narrowly defined as follows: The DEA is authorized by regulation to “inspect, copy, and verify the correctness of records required to be kept” under the CFRs.10 The authority to audit does not extend to a review of financial data, sales or pricing data, or personal records which happen to be located at the registered premises. Nor does it include a review of patient charts.11

Generally speaking, the DEA is there for two reasons: (1) to ensure that the registrant is keeping those records required to be kept, and (2) to do an accounting to ensure there is no diversion. That is the reason for their presence.

However, if there are problems with the registrant’s records, or any significant accounting issues (overages or underages) involving controlled substances, the registrant should be prepared for what may be a wild ride, with varying consequences.

Also, the registrant should be aware that the right to audit does not include the right to interview witnesses, including the registrant and employees of the registrant. This is very significant. Even if the audit is pursuant to administrative warrant, there is no requirement that individuals answer questions or submit to interviews. And while one might not encourage the registrant to stand mute while the Diversion Investigators stare at him/her blankly, the registrant should be aware that the choice to speak belongs to the individual, and that anything an employee or the registrant says during the audit may be introduced in an administrative, civil, or criminal proceeding against the individual. While many providers desire to see themselves as cooperating with the licensing authority, they need to realize that the DEA can have a very different way of looking at things, and statements a registrant makes in order to be helpful and courteous may well be thrust back at them as admissions of noncompliance and possibly guilt. Thus, all registrants are well advised to be mindful of this potential and to consider declining to speak other than as necessary without having consulted with counsel or having counsel present during the interview. Such counsel requests are not a matter of being dilatory; they are a way of ensuring that the registrant is appropriately and fairly protected given the possibility of jeopardy.

The Likelihood of an Audit

The likelihood of an audit of a registrant’s medical practice depends on a variety of factors. Some registrants are of more interest to the DEA than others.

Every year each DEA office compiles a list of those registrants to be audited during the prospective calendar year. The lists are quite long, growing longer, and it is the objective of each office to complete their lists by the end of the year. The offices may be evaluated by the Office of Diversion Control depending upon their degree of completion.

Is there perhaps an unwritten prioritizing that occurs within the DEA in terms of who may be audited? Yes. Certainly anyone with prior DEA issues of noncompliance stands a greater likelihood of being audited. In addition, the nature of the provider’s practice can increase the prospect of an audit. Currently, DEA has a particular focus upon buprenorphine prescribing and dispensing registrants. Accordingly, any physician involved in using buprenorphine (a Schedule III controlled substance) in the maintenance or detoxification of patients addicted to opoids is quite likely to be audited. Next in line would be anyone engaged in a pain practice. Also of interest to the DEA are any physicians whose general practices involve the dispensing or administering, as opposed to only prescribing them.12 Least likely to be of interest to the DEA are those providers who do not prescribe buprenorphine and who only write prescriptions for drugs. Such physicians have no inventory of controlled substances to monitor, and they have no real record-keeping requirements imposed by 21 CFR 1300, et. seq.

So, depending on a registrant’s practice, he or she can plan accordingly.

Records Required to Be Kept

As previously indicated, when the DEA is conducting an audit it is inspecting to ensure that certain records required to be kept are, in fact, being kept. These records are defined fully by regulation and include, as to dispensing physicians: (a) a dispensing log which includes the name and address of the patient, the drug and quantity dispensed, and the date the dispensing occurred;13 (b) all original acquisition invoices relating to all controlled substances which the practitioner has received into the office as office stock and the date received;14 and (c) an initial inventory of all controlled substances on hand as office stock, and a new inventory every two years.15 In addition, in the case of a buprenorphine prescribing, dispensing, or administering physician, where buprenorphine is being used for the purpose of drug maintenance and/or detoxification, the registrant is required to maintain records of all such buprenorphine being prescribed, dispensed, and/or administered to each patient.16 In this event, it is recommended that the registrant maintain such patient specific information in a separate log, and that the registrant maintain copies of all such written prescriptions.17

All of the above records must be maintained for a two-year period from their inception.18

Further, not only does the DEA insist that such records be meticulously maintained in accordance with regulation, but there is an additional requirement that all such records relating to Schedule II controlled substances be kept separately from all other records of the registrant, and if they relate to Schedule III-V controlled substances, such records must be kept separate or be “readily retrievable” from the ordinary business records of the registrant.19 While the term “readily retrievable” lacks clarity, what it generally means is that the Diversion Investigators expect such records to be promptly provided during the audit and in complete fashion.

All of these records need to be maintained at the registered location, not at some other location.20

Any deviation from the record-keeping requirements may give rise to a finding and conclusion by the DEA that the registrant is not in compliance.

All inventories of controlled substances maintained at the registered location must be stored in a locked cabinet.21

The Diversion Investigators will examine the records, and then do the math. The numbers should add up. In other words, the DEA should be able to determine the quantity of controlled substances received by the registrant during the period of review, and if the records are accurately maintained, determine where all of the drugs legitimately went. If the numbers do not add up, the DEA will conclude that the records are not in compliance and/or that unlawful diversion has occurred.


The DEA takes very seriously its mission and the requirements of the regulations, and interprets them literally. They expect them to be followed not substantially, but to the detail. When the records are lacking, or not so maintained, the DEA can easily issue an audit report indicating noncompliance and refer the registrant for further disciplinary action. This action may include a referral to a United States Attorneys Office for a fine or criminal prosecution. Federal criminal law provides that the “knowing” f ailure to “make, keep, or furnish” any record required by regulation to be kept is punishable by up to one year in prison and a $100,000 fine.22 The “negligent” failure to do is treated as a civil violation punishable by a fine of up to $10,000 per occurrence.23 Alternatively, or in conjunction, the DEA may commence an administrative action against the registrant by issuing an “order to show cause” as to why the practitioner’s DEA registration should not be revoked as being “inconsistent with the public interest.”24

If problems arise during an audit, the consequences to the registrant will vary depending upon the asserted level of noncompliance. If the audit indicates that significant diversion of controlled substances is taking place or that some other flagrant illegality is occurring which affects the public interest, one can expect the most serious of consequences to follow. If, on the other hand, the audit discloses simply that the records are not being maintained correctly, or in complete fashion, the DEA has more informal sanctions at its disposal, including a letter of admonition issued to the registrant or entering into a memorandum of understanding with the registrant. A memorandum of understanding is often provided to a first-time violator whose offenses are mainly technical in nature and the DEA is able to conclude that no diversion is occurring and the registrant can be expected to learn from the mistakes. The memorandum is tailored to the case and typically involves the imposition of even greater record-keeping requirements, and often restricts in some way the ability of the provider to practice. For example, if there were problems with the dispensing records, the memorandum, typically in place for three to five years, may require the registrant to forego dispensing controlled substances for that period, and require the provider to provide all drugs only via prescription where the patient picks up the drugs at a pharmacy. Even this requirement can be extremely onerous and disturbing to the practitioner who may need to dispense and administer drugs in order to have a successful practice.

Take Away Lessons

All of this is very serious; moreover, one can forecast more inspections in the months and years to come for the reasons cited above.

What can the registrant do to protect itself?

First, the registrant should be very familiar with the requirements of the CFRs as they apply to the registrant’s practice, and if need be, the registrant should hire a consultant or attorney familiar with the subject matter to devote several hours to ensuring that the records are in order and that the registrant has effective policies and procedures in place to ensure compliance and to prevent diversion. Those hours spent having a consultant or attorney review the practice and records beforehand is well worth the effort and expense.

Second, the registrant should have an audit response plan, in writing, and the plan should be communicated to other employees. That plan should include direction for when the registrant is not present. Further, the registrant should have the name and number of an attorney available beforehand, so that they are not looking for one at a critical moment in time. Once contacted, the attorney can speak directly with the DEA, and potentially direct the audit to a more appropriate time and make sure that the rights of the registrant are protected. The attorney can advise as to the appropriateness of consenting to the audit and as to any interviews being sought by the DEA. So long as the DEA is not kept waiting hours while a registrant is trying to speak with an attorney, the DEA investigators should not be bothered by this request for advice of counsel. They should easily understand, because they know full well the serious consequences that may flow from such audits.

Third, in the same spirit that we have fire drills at our workplaces, it is not a bad idea for a registrant to take a day and pretend there is an audit and go through the steps and review the location and order and accessibility of required records in order to ensure that if the DEA does visit, the registrant can effectively comply. If problems are detected, they should be corrected.

Finally, if problems do arise due to an audit it is the obligation of trained counsel to get ahead of the problem, to have the registrant make the internal corrections, to play a constructive and facilitative role in the dialogue between the DEA and the registrant, and to make its best factual and policy arguments in an effort to minimize any adverse consequences to the registrant. In the end, much of what happens to the registrant for such violations is determined by the discretion of the DEA and its attitude to the issue. This provides a very real opportunity for counsel and the registrant to affect the process. Counsel can play a paramount role in making sure that in such situations the registrant “puts its best foot forward” in addressing the matter. In the end, if the DEA believes the registrant is not taking the issues seriously, and cannot act as an effective partner with the DEA, the consequences of noncompliance are apt to be most serious. If, on the other hand, the DEA is persuaded, through the assistance of counsel as well as the attitude of the registrant, that the DEA has an effective partner, and that the registrant can learn from its mistakes and be trusted to comply in the future, the makings of a resolution that will meet the objectives of the DEA and insure to the benefit of the registrant are most likely to be achieved. In the end, both the DEA and the registrant need to understand that they are both essential in their missions and they must work together in a progressive way consistent with the public interest. The DEA Practitioners Manual, established by the DEA as a guide to practitioners, asserts in its Preface, that “[t]he DEA can best serve the public interest by working with practitioners…”25 Successfully navigating a DEA audit involves drawing upon this aspect of the DEA’s mission and working with regulatory authorities to achieve the best result for the registrant.


Ronald J. Friedman is a shareholder at Lane Powell, a Pacific Northwest law firm. Ron represents corporate entities and individuals in regulatory, civil, and criminal proceedings related to the manufacture and distribution of pharmaceuticals. Prior to joining Lane Powell, Ron served as a federal prosecutor in Seattle for several years where he handled numerous investigations of pharmaceutical providers for violations of federal law. Ron is a member of the Washington Attorney General’s Prescription Drug Advisory Task Force, is published in legal and medical journals, and is a graduate of Harvard Law School. He can be reached at friedmanr@lanepowell.com or 206.223.7032.

2 According to the 2010 National Survey on Drug Use and Health, commissioned by the Substance Abuse and Mental Health Services Administration (SAMHSA), it is estimated that 7 million Americans are currently abusing prescription drugs, whereas the total for heroin, cocaine, hallucinogens and methamphetamine combined, are estimated at just over 3 million Americans. In addition, only 4% of those abusing prescription drugs reported obtaining the drug from a drug dealer or stranger. Results from the 2010 National Survey on Drug Use and Health: Summary of National Findings, NSDUH Series H-41 HHS Publication No. (SMA) 11-4658.

21 CFR Section 1316.03 authorizes the DEA, through its inspectors “to enter controlled premises and conduct administrative inspections thereof”.


21 CFR Sections 1316.05 and 1316.06.


21 CFR Section 1316.08.


21 CFR Section 1316.07.


21 CFR Sections 1316.09 and 1316.10.


21 CFR Section 1316.11.


Title 21 CFR Section 1316.08(b) provides that valid consent to the audit may be provided by the “owner, operator, or agent in charge of the premises.”


21 CFR Section 1316.03(a).


21 CFR Section 1316.04.


It is noted that “dispense” and “administer” are technical terms defined by statute. “Dispensing” refers to the provider delivering the drugs to the patient at the medical office from office stock maintained for that purpose at that location and the patient typically leaves with this supply of drugs. “Administering” occurs when the physician, or the provider’s agent, actually administers the drug to the patient at the registered premises by for example, injection or some other means of ingestion, from office stock maintained for that purpose. 21 USC Sections 802(2) and (10). This is wholly lawful, but different from the most normative way patients receive drugs which is pursuant to a prescription and pick-up at a pharmacy.


21 CFR Section 1304.22(c).


21 CFR Section 1304.21(a).


21 CFR Section 1304.11.


21 CFR Section 1304.03(c).


If a physician wishes to use buprenorphine in drug addiction treatment, either for detoxification or maintenance purposes, the physician must be specifically authorized by the DEA to do so. Such application must be made and approved by the DEA. If approved, the physician uses a special DEA “X” number when issuing prescriptions. In addition, if such approval is granted, the physician is limited to a total patient population of 30 for such treatment, which may increase to 100 patients following a twelve month period. 21 CFR Section 1301.28.


21 CFR Section 1304.04(a).


21 CFR Section 1304.04(f).


21 CFR Section 1304.04.


21 CFR Section 1301.75.


21 USC Sections 842(a)(5) and 842(c)(2)(A).


21 USC Sections 842(a)(5) and 842(c)(1)(B).

24 21 CFR Section 1301.36.

DEA Practitioner’s Manual, 2006 Edition, Preface, p. 4.

The ABA Health eSource is distributed automatically to members of the ABA Health Law Section . Please feel free to forward it! Non-members may also sign up to receive the ABA Health eSource.