Controlled substances are tightly regulated because they carry a high potential for abuse, diversion, and misuse. When a theft or significant loss occurs, the risk to public health increases—and so does a facility’s regulatory exposure. As a result, both the U.S. Drug Enforcement Administration (DEA) and state regulatory authorities impose strict requirements for how registrants must respond when controlled substances go missing.
Timely and accurate reporting is not simply a regulatory formality. It is a critical element of controlled substance compliance and an important safeguard against diversion. Failure to report properly can trigger enforcement actions, financial penalties, and heightened regulatory scrutiny.
Below is an overview of federal reporting requirements and examples of how several states impose additional or more stringent rules.
Federal Reporting Requirements (DEA)
Under federal law, all DEA registrants—including pharmacies, hospitals, veterinary clinics, medical spas, ambulatory surgical centers, and other healthcare facilities—must take immediate action upon discovering the theft or significant loss of a controlled substance.
Required Actions
Notify the Local DEA Field Office
Registrants must notify their local DEA Field Office in writing within one business day after discovering a theft or significant loss. (21 C.F.R. § 1301.76(b))
Submit DEA Form 106
Registrants must complete and submit DEA Form 106 (Report of Theft or Loss of Controlled Substances) electronically through the DEA’s secure reporting system within 45 calendar days. (21 C.F.R. § 1301.74(c))
The DEA does not define “significant loss” based on a fixed quantity. Instead, registrants must evaluate the circumstances using several factors, including:
The type of drug involved
Whether the drug is particularly susceptible to diversion
The quantity normally handled by the facility
Whether there is a pattern of losses or discrepancies
Losses due to documented breakage, spills, or properly recorded wastage generally do not require reporting unless negligence, improper handling, or potential diversion is suspected.
State-Level Reporting Requirements
While DEA regulations establish a national baseline, many states impose additional reporting obligations, shorter timelines, or broader definitions of reportable losses. Registrants must comply with both federal and state rules, and when requirements differ, the more stringent requirement must be followed.
States Requiring Submission of DEA Form 106
Several states require facilities to submit a copy of the same DEA Form 106 filed federally to the state board of pharmacy or health department.
Arizona - Report to the Arizona Board of Pharmacy using the DEA-106. - Ariz. Admin. Code § R4-23-1003(A)(2)
Colorado - Report within 30 days using the DEA-106. - 3 Colo. Code Regs. § 719-1:15.05.13 & 7.00.10
Delaware - A copy of the DEA-106 must be submitted within 1 day. - Del. Code Regs. 24 § 7.3.1–7.3.2
States With Unique or Stricter Reporting Timelines
Some states establish reporting deadlines that differ from federal rules.
Connecticut – Reporting required within 72 hours - Conn. Agencies Regs. § 21a-262-3(b)
New Mexico – Report must be filed within 5 business days - N.M. Code R. § 16.19.20.36(B)
Nevada – Reporting required within 10 days - Nev. Rev. Stat. § 453.568
Mississippi – Reporting required within 15 days - 30-030 Miss. Code R. § 3001, Art. XXXII.4
Colorado – State law allows up to 30 days, though earlier reporting is encouraged - 3 Colo. Code Regs. § 719-1:15.05.13
States With Broader Drug Loss Reporting Requirements
Some states extend reporting requirements beyond controlled substances.
Ohio - Ohio requires reporting for any prescription drug loss, including both controlled and non-controlled medications. Requirements include: Immediate notification upon discovery, Submission of DEA Form 106 within 30 days - Ohio Admin. Code 4729:6-3-02
States With Pharmacy-Specific Reporting Rules
Certain states impose additional obligations specifically on pharmacies.
California - Pharmacies must report theft or loss directly to the state Board of Pharmacy. - Cal. Code Regs. tit. 16, § 1715.6
Kentucky - Pharmacists must report immediately upon discovery. - Ky. Rev. Stat. § 315.335(1)
New Hampshire - Pharmacy permit holders must notify the Board of Pharmacy. - N.H. Admin. Code § Ph 702.03(a)
Policy and Procedure Requirements
Some states require facilities to maintain written policies and procedures that outline how controlled substance thefts or losses are detected, investigated, and reported. These policies should be integrated into a facility’s broader controlled substance management and diversion prevention program.
Why This Matters
Failure to properly report a theft or significant loss can lead to serious regulatory consequences, including:
DEA or state board citations
Civil monetary penalties
License suspension or revocation
Increased scrutiny during inspections and audits
Legal and reputational damage
Delayed or incomplete reporting may also allow drug diversion to continue undetected, posing risks to patients, staff, and the community.
Be Prepared Before an Incident Occurs
Every facility that handles controlled substances—regardless of size—should have a clear protocol for identifying, documenting, and reporting drug losses. This includes:
Designating responsible personnel
Maintaining access to DEA and state reporting portals
Training staff on how to recognize potential diversion
Conducting routine compliance reviews and inventory monitoring
Proactive preparation can significantly reduce both compliance risk and operational disruption.
Need Help Navigating DEA Reporting Requirements?
DEA theft and loss reporting can be complex, particularly when federal and state rules differ. Facilities that fail to report correctly—or fail to identify losses early—often face serious enforcement consequences.
TITAN Group helps healthcare organizations assess diversion risks, respond to theft or loss incidents, and implement compliant reporting and monitoring programs.
If your organization needs assistance with DEA reporting requirements, diversion prevention, or controlled substance compliance, contact TITAN Group to speak with a compliance specialist.