DEA Theft and Loss Reporting: The One-Business-Day Notice and Form 106 Clock for Behavioral Health Programs

When a count comes up short in a behavioral health medication room, the clinical team usually wants to recount, check the trash, and ask the night shift. The problem is that the federal reporting clock for controlled substances does not wait for the internal search to finish. For programs that hold a DEA registration and stock buprenorphine, methadone, benzodiazepines or other scheduled drugs on site, theft and significant loss reporting is one of the few compliance obligations measured in business days rather than months, and it is the one we most often see handled late.

This guide is written for owners, clinical directors and compliance officers at residential, outpatient, MAT and opioid treatment programs. It is operational guidance, not legal advice. Confirm the details with your DEA field division and your state board before relying on them.

The DEA Theft and Loss Rule in One Paragraph

A behavioral health program registered with the DEA that discovers a theft or significant loss of controlled substances must notify its DEA Field Division Office in writing within one business day of discovery, and must then complete and submit DEA Form 106 electronically, which DEA rules require within 45 days of discovery. The one-business-day notice and the Form 106 are two separate obligations: the first is a short written alert sent before the facts are fully known, the second is the detailed report sent once the investigation is complete. Missing the first because the team was still working on the second is the most common way programs fall out of compliance.

The requirement sits in DEA’s security regulations at 21 CFR Part 1301 on the Electronic Code of Federal Regulations, and the Form 106 itself is filed through the DEA Diversion Control Division online reporting system. Read the current text at the source rather than relying on a summary, including this one.

What Counts as a Significant Loss

Theft is usually obvious. Significant loss is not, and DEA deliberately does not set a fixed quantity threshold. Instead, the regulation asks the registrant to weigh a set of factors. In plain terms, they are:

• Quantity relative to the business: how much is missing compared with what the program normally handles.
• The specific substance: a missing dose of a Schedule II opioid carries more weight than the same count of a Schedule IV drug.
• Whether the loss can be tied to a unique activity: for example, a documented dropped dose during an observed induction.
• A pattern over time: several small, unexplained discrepancies across weeks can add up to a significant loss even when no single one does.
• Whether diversion is a likely explanation: the same shift, the same staff member, or the same cabinet showing up repeatedly.
• Local trends and diversion indicators: what is being diverted in your area right now.

The practical consequence is that “significant” is a judgment the program has to make and document. If you decide a discrepancy is not significant and do not file, write down why, who decided, and when. A surveyor or DEA investigator reviewing your records later will look for that reasoning, and its absence reads as a decision nobody made.

Why Programs Miss the One-Business-Day Window

In our work reviewing medication management systems for behavioral health operators, late reporting almost never comes from not knowing the rule exists. It comes from the way the discovery moment is handled. The causes repeat:

Discovery is not timestamped: the count sheet shows the discrepancy at the 7 a.m. shift change, but the compliance officer hears about it two days later, and nobody can say when the clock started.

Recounting is treated as investigation: staff recount for a day before escalating, which uses up the entire notification window on a step that does not change the obligation.

The registrant of record is not the person on site: the DEA registration sits with a medical director who works two days a week, and the notice waits for them.

Nobody has the field division contact: the program knows it has to notify DEA but has never identified which field division office covers its registered address or how that office accepts written notice.

State reporting is assumed to cover federal reporting: a report to the state board of pharmacy, the state opioid treatment authority or the licensing agency does not satisfy the DEA notice, and the reverse is also true.

The inconvenient truth is that the written notice is supposed to be sent before you know what happened. It can be brief and say the investigation is ongoing. Programs that wait until they have an explanation are, by design, late.

What a Surveyor or Investigator Pulls First

During an accreditation survey, state licensing visit or DEA inspection, reviewers start in the same places. They sample the count sheets or perpetual inventory for a recent period and look for discrepancies that were corrected without explanation. They then ask to see what happened next: an incident report, a significant-loss determination, a copy of the written notice to DEA, and the Form 106 confirmation if one was filed.

They also check the records that make a loss report credible. DEA requires controlled substance records to be kept for at least two years and to be readily retrievable, and requires a complete inventory of controlled substances on hand at least every two years. If your last biennial inventory is missing or undated, any loss figure you report has no defensible starting point. Our earlier guide to DEA recordkeeping for buprenorphine at MAT clinics covers the underlying dispensing and inventory records in more detail.

Accreditors look at the same event from a different angle. The Joint Commission and CARF both expect medication discrepancies to move through the organization’s incident management and performance improvement process, so a theft or loss should also appear in your incident log and, where warranted, a root cause review. Our guide to behavioral health incident reporting and root cause analysis explains how to connect those records.

Situations That Change Who Reports

Loss in transit: under DEA’s rules, when controlled substances go missing while being shipped to you, the supplier that shipped them is responsible for reporting the in-transit loss. Your job is to document what you received, note short shipments at receipt, and notify the supplier promptly so they can meet their own clock.

Breakage and spillage: a witnessed, documented accident such as a dropped bottle is generally handled through destruction and disposal records rather than as a theft or loss. An unwitnessed “spill” that cannot be verified should be treated as a possible loss and evaluated against the significance factors above.

Suspected employee diversion: DEA’s security rules also address employee screening and expect employees who know of diversion by a coworker to report it. If staff involvement is suspected, coordinate the DEA notice, your HR process and any law enforcement contact so that one does not compromise another. The Form 106 asks whether local police were notified, so decide that question deliberately.

Opioid treatment programs: OTPs are also accountable to SAMHSA certification and their state opioid treatment authority. Review SAMHSA guidance and your state authority’s reporting expectations alongside DEA’s, because each has its own notification path.

Build a Discovery-to-Notice Protocol

The fix is not more training on the regulation. It is a short written protocol that removes judgment calls from the first 24 hours. At minimum it should:

• Require whoever finds a discrepancy to record the date and time of discovery on the count sheet and in the incident system immediately.
• Name a primary and a backup person, by role, who can send the written DEA notice without waiting for the registrant of record.
• Store the field division office contact and a pre-drafted notice template in the same place as the incident form.
• Set a same-day significance decision, documented with the factors considered, even when the answer is “not significant.”
• Diary the Form 106 deadline at 45 days from discovery, with an internal target well before it.
• Route every event into state reporting review and the performance improvement log.

Three Things to Do This Week

First, pull your last 90 days of controlled substance count sheets and list every discrepancy that was corrected. For each one, check whether there is a written significance determination.

Second, find the date of your most recent biennial inventory and confirm it is signed, dated and filed where an investigator could retrieve it on request.

Third, ask your on-site charge nurse tomorrow morning which DEA field division office covers your registration and how they would send written notice today. If they cannot answer, write the protocol above before the next short count.

If you would like a second set of eyes on your medication room records or help drafting the protocol, Circa’s behavioral health compliance services team works with operators on exactly this. Call (888) 458-6619.

A short count is a clinical, operational and federal reporting event at once. To review your controlled substance procedures with a compliance specialist, reach us at (888) 458-6619.