§ 1301.71 Security requirements generally.

(a) All applicants and registrants shall provide effective controls and procedures to guard against theft and diversion of controlled substances. In order to determine whether a registrant has provided effective controls against diversion, the Administrator shall use the security requirements set forth in § 1301.72-§ 1301.76 as standards for the physical security controls and operating procedures necessary to prevent diversion. Materials and construction which will provide a structural equivalent to the physical security controls set forth in § 1301.72, § 1301.73 and § 1301.75 may be used in lieu of the materials and construction described in those sections. (b) Substantial compliance with the standards set forth in § 1301.72-§ 1301.76 may be deemed sufficient by the Administrator after evaluation of the overall security system and needs of the applicant or registrant. In evaluating the overall security system of a registrant or applicant, the Administrator may consider any of the following factors as he may deem relevant to the need for strict compliance with security requirements:

(1) The type of activity conducted (e.g., processing of bulk chemicals, preparing dosage forms, packaging, labeling, cooperative buying, etc.);

(2) The type and form of controlled substances handled (e.g., bulk liquids or dosage units, usable powders or nonusable powders);

(3) The quantity of controlled substances handled;

(4) The location of the premises and the relationship such location bears on security needs;

(5) The type of building construction comprising the facility and the general characteristics of the building or buildings;

(6) The type of vault, safe, and secure enclosures or other storage system (e.g., automatic storage and retrieval system) used;

(7) The type of closures on vaults, safes, and secure enclosures;

(8) The adequacy of key control systems and/or combination lock control systems;

(9) The adequacy of electric detection and alarm systems, if any including use of supervised transmittal lines and standby power sources;

(10) The extent of unsupervised public access to the facility, including the presence and characteristics of perimeter fencing, if any;

(11) The adequacy of supervision over employees having access to manufacturing and storage areas;

(12) The procedures for handling business guests, visitors, maintenance personnel, and nonemployee service personnel;

(13) The availability of local police protection or of the registrant's or applicant's security personnel, and;

(14) The adequacy of the registrant's or applicant's system for monitoring the receipt, manufacture, distribution, and disposition of controlled substances in its operations.

(c) When physical security controls become inadequate as a result of a controlled substance being transferred to a different schedule, or as a result of a noncontrolled substance being listed on any schedule, or as a result of a significant increase in the quantity of controlled substances in the possession of the registrant during normal business operations, the physical security controls shall be expanded and extended accordingly. A registrant may adjust physical security controls within the requirements set forth in § 1301.72-§ 1301.76 when the need for such controls decreases as a result of a controlled substance being transferred to a different schedule, or a result of a controlled substance being removed from control, or as a result of a significant decrease in the quantity of controlled substances in the possession of the registrant during normal business operations.

(d) Any registrant or applicant desiring to determine whether a proposed security system substantially complies with, or is the structural equivalent of, the requirements set forth in § 1301.72-§ 1301.76 may submit any plans, blueprints, sketches or other materials regarding the proposed security system either to the Special Agent in Charge in the region in which the system will be used, or to the Diversion Operations Section, Drug Enforcement Administration, Department of Justice, Washington, DC 20537.

(e) Physical security controls of locations registered under the Harrison Narcotic Act or the Narcotics Manufacturing Act of 1960 on April 30, 1971, shall be deemed to comply substantially with the standards set forth in § 1301.72, § 1301.73 and § 1301.75. Any new facilities or work or storage areas constructed or utilized for controlled substances, which facilities or work or storage areas have not been previously approved by the Administration, shall not necessarily be deemed to comply substantially with the standards set forth in § 1301.72, § 1301.73 and § 1301.75, notwithstanding that such facilities or work or storage areas have physical security controls similar to those previously approved by the Administration.

[36 FR 18729, Sept. 21, 1971. Redesignated at 38 FR 26609, Sept. 24, l973 [sic], and amended at 46 FR 28841, May 29, 1981; 47 FR 41735, Sept. 22, 1982; 51 FR 5319, Feb. 13, 1986]

§ 1301.72 Physical security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment programs; storage areas.

(a) Schedules I and II. Raw materials, bulk materials awaiting further processing, and finished products which are controlled substances listed in Schedule I or II shall be stored in one of the following secure storage areas:

(1) Where small quantities permit, a safe or steel cabinet;

(i) Which safe or steel cabinet shall have the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques;

(ii) Which safe or steel cabinet, if it weighs less than 750 pounds, is bolted or cemented to the floor or wall in such a way that it cannot be readily removed; and

(iii) Which safe or steel cabinet if necessary, depending upon the quantities and type of controlled substances stored, is equipped with an alarm system which, upon attempted unauthorized entry, shall transmit a signal directly to a central protection company or a local or State police agency which has a legal duty to respond or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve.

(2) A vault constructed before, or under construction on, September 1, 1971, which is of substantial construction with a steel door, combination or key lock, and an alarm system; or

(3) A vault constructed after September 1, 1971:

(i) The walls, floors, and ceilings of which vault are constructed of at least 8 inches of reinforced concrete or other substantial masonry, reinforced vertically and horizontally with 1/2- inch steel rods tied 6 inches on center, or the structural equivalent to such reinforced walls, floors, and ceilings;

(ii) The door and frame unit of which vault shall conform to the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation, and 20 man-hours against radiological techniques;

(iii) Which vault, if operations require it to remain open for frequent access, is equipped with a "day-gate" which is self-closing and self-locking, or the equivalent, for use during the hours of operation in which the vault door is open;

(iv) The walls or perimeter of which vault are equipped with an alarm, which upon unauthorized entry shall transmit a signal directly to a central station protection company, or a local or State police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant, or such other protection as the Administrator may approve, and, if necessary, holdup buttons at strategic points of entry to the perimeter area of the vault;

(v) The door of which vault is equipped with contact switches; and

(vi) Which vault has one of the following: Complete electrical lacing of the walls, floor and ceilings; sensitive ultrasonic equipment within the vault; a sensitive sound accumulator system; or such other device designed to detect illegal entry as may be approved by the Administration.

(b) Schedules III, IV and V. Raw materials, bulk materials awaiting further processing, and finished products which are controlled substances listed in Schedules III, IV and V shall be stored in the following secure storage areas:

(1) A safe or steel cabinet as described in paragraph (a)(1) of this section;

(2) A vault as described in paragraph (a)(2) or (3) of this section equipped with an alarm system as described in paragraph (b)(4)(v) of this section;

(3) A building used for storage of Schedules III through V controlled substances with perimeter security which limits access during working hours and provides security after working hours and meets the following specifications:

(i) Has an electronic alarm system as described in paragraph (b)(4)(v) of this section,

(ii) Is equipped with self-closing, self-locking doors constructed of substantial material commensurate with the type of building construction, provided, however, a door which is kept closed and locked at all times when not in use and when in use is kept under direct observation of a responsible employee or agent of the registrant is permitted in lieu of a self-closing, self-locking door. Doors may be sliding or hinged. Regarding hinged doors, where hinges are mounted on the outside, such hinges shall be sealed, welded or otherwise constructed to inhibit removal. Locking devices for such doors shall be either of the multiple-position combination or key lock type and:

(a) In the case of key locks, shall require key control which limits access to a limited number of employees, or;

(b) In the case of combination locks, the combination shall be limited to a minimum number of employees and can be changed upon termination of employment of an employee having knowledge of the combination;

(4) A cage, located within a building on the premises, meeting the following specifications:

(i) Having walls constructed of not less than No. 10 gauge steel fabric mounted on steel posts, which posts are:

(a) At least one inch in diameter;

(b) Set in concrete or installed with lay bolts that are pinned or brazed; and

(c) Which are placed no more than ten feet apart with horizontal one and one-half inch reinforcements every sixty inches;

(ii) Having a mesh construction with openings of not more than two and one-half inches across the square,

(iii) Having a ceiling constructed of the same material, or in the alternative, a cage shall be erected which reaches and is securely attached to the structural ceiling of the building. A lighter gauge mesh may be used for the ceilings of large enclosed areas if walls are at least 14 feet in height,

(iv) Is equipped with a door constructed of No. 10 gauge steel fabric on a metal door frame in a metal door flange, and in all other respects conforms to all the requirements of 21 CFR § 1301.72(b)(3)(ii), and

(v) Is equipped with an alarm system which upon unauthorized entry shall transmit a signal directly to a central station protection agency or a local or state police agency, each having a legal duty to respond, or to a 24-hour control station operated by the registrant, or to such other source of protection as the Administrator may approve;

(5) An enclosure of masonry or other material, approved in writing by the Administrator as providing security comparable to a cage;

(6) A building or enclosure within a building which has been inspected and approved by DEA or its predecessor agency, BNDD, and continues to provide adequate security against the diversion of Schedule III through V controlled substances, of which fact written acknowledgment has been made by the Special Agent in Charge of DEA for the area in which such building or enclosure is situated;

(7) Such other secure storage areas as may be approved by the Administrator after considering the factors listed in

§ 1301.71(b), (1) through (14);

(8) (i) Schedule III through V controlled substances may be stored with Schedules I and II controlled substances under security measures provided by 21 CFR § 1301.72(a);

(ii) Non-controlled drugs, substances and other materials may be stored with Schedule III through V controlled substances in any of the secure storage areas required by 21 CFR § 1301.72(b), provided that permission for such storage of non-controlled items is obtained in advance, in writing, from the Special Agent in Charge of DEA for the area in which such storage area is situated. Any such permission tendered must be upon the Special Agent in Charge's written determination that such non-segregated storage does not diminish security effectiveness for Schedules III through V controlled substances.

(c) Multiple storage areas. Where several types or classes of controlled substances are handled separately by the registrant or applicant for different purposes (e.g., returned goods, or goods in process), the controlled substances may be stored separately, provided that each storage area complies with the requirements set forth in this section.

(d) Accessibility to storage areas. The controlled substances storage areas shall be accessible only to an absolute minimum number of specifically authorized employees. When it is necessary for employee maintenance personnel, nonemployee maintenance personnel, business guests, or visitors to be present in or pass through controlled substances storage areas, the registrant shall provide for adequate observation of the area by an employee specifically authorized in writing.

[36 FR 18730, Sept. 21, 1971, as amended at 37 FR 15919, Aug. 8, 1972. Redesignated at 38 FR 26609, Sept. 24, l973 [sic]].

Editorial Note: For Federal Register citations affecting § 1301.72, see the List of CFR Sections Affected in the Finding Aids section of this volume.

§ 1301.73 Physical security controls for non-practitioners; compounders for narcotic treatment programs; manufacturing and compounding areas.

All manufacturing activities (including processing, packaging and labeling) involving controlled substances listed in any schedule and all activities of compounders shall be conducted in accordance with the following:

(a) All in-process substances shall be returned to the controlled substances storage area at the termination of the process. If the process is not terminated at the end of a workday (except where a continuous process or other normal manufacturing operation should not be interrupted), the processing area or tanks, vessels, bins or bulk containers containing such substances shall be securely locked, with adequate security for the area or building. If such security requires an alarm, such alarm, upon unauthorized entry, shall transmit a signal directly to a central station protection company, or local or state police agency which has a legal duty to respond, or a 24-hour control station operated by the registrant.

(b) Manufacturing activities with controlled substances shall be conducted in an area or areas of clearly defined limited access which is under surveillance by an employee or employees designated in writing as responsible for the area. "Limited access" may be provided, in the absence of physical dividers such as walls or partitions, by traffic control lines or restricted space designation. The employee designated as responsible for the area may be engaged in the particular manufacturing operation being conducted: Provided, That he is able to provide continuous surveillance of the area in order that unauthorized persons may not enter or leave the area without his knowledge.

(c) During the production of controlled substances, the manufacturing areas shall be accessible to only those employees required for efficient operation. When it is necessary for employee maintenance personnel, nonemployee maintenance personnel, business guests, or visitors to be present in or pass through manufacturing areas during production of controlled substances, the registrant shall provide for adequate observation of the area by an employee specifically authorized in writing.

36 FR 18731, Sept. 21, 1971. Redesignated at 38 FR 26609, Sept. 24, l973 [sic] and amended at 39 FR 37984, Oct. 25, 1974]

§ 1301.74 Other security controls for non-practitioners; narcotic treatment programs and compounders for narcotic treatment programs.

(a) Before distributing a controlled substance to any person who the registrant does not know to be registered to possess the controlled substance, the registrant shall make a good faith inquiry either with the Administration or with the appropriate State controlled substances registration agency, if any, to determine that the person is registered to possess the controlled substance.

(b) The registrant shall design and operate a system to disclose to the registrant suspicious orders of controlled substances. The registrant shall inform the Field Division Office of the Administration in his area of suspicious orders when discovered by the registrant. Suspicious orders include orders of unusual size, orders deviating substantially from a normal pattern, and orders of unusual frequency.

(c) The registrant shall notify the Field Division Office of the Administration in his area of any theft or significant loss of any controlled substances upon discovery of such theft or loss. The supplier shall be responsible for reporting in-transit losses of controlled substances by the common or contract carrier selected pursuant to § 1301.74(e), upon discovery of such theft or loss. The registrant shall also complete DEA Form 106 regarding such theft or loss. Thefts must be reported whether or not the controlled substances are subsequently recovered and/or the responsible parties are identified and action taken against them.

(d) The registrant shall not distribute any controlled substance listed in Schedules II through V as a complimentary sample to any potential or current customer (1) without the prior written request of the customer, (2) to be used only for satisfying the legitimate medical needs of patients of the customer, and (3) only in reasonable quantities. Such request must contain the name, address, and registration number of the customer and the name and quantity of the specific controlled substance desired. The request shall be preserved by the registrant with other records of distribution of controlled substances. In addition, the requirements of part 1305 of the chapter shall be complied with for any distribution of a controlled substance listed in Schedule II. For purposes of this paragraph, the term "customer" includes a person to whom a complimentary sample of a substance is given in order to encourage the prescribing or recommending of the substance by the person.

(e) When shipping controlled substances, a registrant is responsible for selecting common or contract carriers which provide adequate security to guard against in-transit losses. When storing controlled substances in a public warehouse, a registrant is responsible for selecting a warehouseman which will provide adequate security to guard against storage losses; wherever possible, the registrant shall store controlled substances in a public warehouse which complies with the requirements set forth in § 1301.72. In addition, the registrant shall employ precautions (e.g., assuring that shipping containers do not indicate that contents are controlled substances) to guard against storage or in-transit losses.

(f) When distributing controlled substances through agents (e.g., detailmen), a registrant is responsible for providing and requiring adequate security to guard against theft and diversion while the substances are being stored or handled by the agent or agents.

(g) Before the initial distribution of carfentanil etorphine hydrochloride and/or diprenorphine to any person, the registrant must verify that the person is authorized to handle the substances(s) [sic] by contacting the Drug Enforcement Administration.

(h) The acceptance of delivery of narcotic substances by a narcotic treatment program shall be made only by a licensed practitioner employed at the facility or other authorized individuals designated in writing. At the time of delivery, the licensed practitioner or other authorized individual designated in writing (excluding persons currently or previously dependent on narcotic drugs), shall sign for the narcotics and place his specific title (if any) on any invoice. Copies of these signed invoices shall be kept by the distributor.

(i) Narcotics dispensed or administered at a narcotic treatment program will be dispensed or administered directly to the patient by either (1) the licensed practitioner, (2) a registered nurse under the direction of the licensed practitioner, (3) a licensed practical nurse under the direction of the licensed practitioner, or (4) a pharmacist under the direction of the licensed practitioner.

(j) Persons enrolled in a narcotic treatment program will be required to wait in an area physically separated from the narcotic storage and dispensing area. This requirement will be enforced by the program physician and employees.

(k) All narcotic treatment programs must comply with standards established by the Secretary of Health and Human Services (after consultation with the Administration) respecting the quantities of narcotic drugs which may be provided to persons enrolled in a narcotic treatment program for unsupervised use.

(l) DEA may exercise discretion regarding the degree of security required in narcotic treatment programs based on such factors as the location of a program, the number of patients enrolled in a program and the number of physicians, staff members and security guards. Similarly, such factors will be taken into consideration when evaluating existing security or requiring new security at a narcotic treatment program.

[36 FR 7778, Apr. 24, 1971; 36 FR 13386, July 21, 1971, as amended at 36 FR 18731, Sept. 21, 1971. Redesignated at 38 FR 26609, Sept. 24, l973 [sic]]

Editorial Note: For Federal Register citations affecting § 1301.74, see the List of CFR Sections Affected in the Finding Aids section of this volume.

§ 1301.90 Employee screening procedures.

It is the position of DEA that the obtaining of certain information by non-practitioners is vital to fairly asses the likelihood of an employee committing a drug security breach. The need to know this information is a matter of business necessity, essential to overall controlled substances security. In this regard it is believed that conviction of crimes and unauthorized use to controlled substances are activities that are proper subjects for inquiry. It is, therefore, assumed that the following questions will become a part of an employer's comprehensive employee screening program:

Question. Within the past five years, have you been convicted of a felony, or within the past two years, of any misdemeanor or are you presently formally charged with committing a criminal offense? (Do not include any traffic violations, juvenile offenses or military convictions, except by general court-martial.) If the answer is yea, furnish details of convictions, offense, location, and date and sentence.

Question. In the past three years, have you ever knowingly used any narcotics, amphetamines or barbiturates, other than those prescribed to you by a physician? If the answer is yes, furnish details.

Advice. An authorization, in writing, that allows inquiries to be made of courts and law enforcement agencies for possible pending charges or convictions must be executed by a person who is allowed to work in an area where access to controlled substances clearly exists. A person must be advised that any false information or omission of information will jeopardize his or her position with respect to employment. the application for employment should inform a person that information furnished or recovered as a result of any inquiry will not necessarily preclude employment, but will be considered as part of an overall evaluation of the person's qualifications. The maintaining of fair employment practices, the protection of the person's right of privacy, and the assurance that the result of such inquiries will be treated by the employer in confidence will be explained to the employee.

[40 FR 17143, Apr. 17, 1975]

§ 1301.91 Employee responsibility to report drug diversion.

Reports of drug diversion by fellow employees is not only necessary part of an overall employee security program but also serves the public interest at large. It is, therefore, the position of DEA that an employee who has knowledge of drug diversion from his employer by a fellow employee has an obligation to report such information to a responsible security official of the employer. The employer shall treat such information as confidential and shall take all reasonable steps to protect the confidentiality of the information and the identity of the employee furnishing information. A failure to report information of drug diversion will be considered in determining the feasibility of continuing to allow an employee to work in a drug security area. The employer shall inform all employees concerning this policy.

[40 FR 17143, Apr. 17, 1975]

§ 1301.92 Illicit activities by employees.

It is the position of DEA that employees who possess, sell, use or divert controlled substances will subject themselves not only to State and Federal prosecution for any illicit activity, but shall also immediately become the subject of independent action regarding their continued employment. The employer will assess the seriousness of the employee's violation, the position of responsibility held by the employee, past record of employment, etc., in determining whether to suspend, transfer, terminate or take other action against the employee.

[40 FR 17143, Apr. 17, 1975]

§ 1301.93 Sources of information for employee checks.

DEA recommends that inquires concerning employees' criminal records be made as follows:

Local inquiries. Inquiries should be made by name, date and place of birth, and other identifying information, to local courts and law enforcement agencies for records of pending charges and convictions. Local practice may require such inquiries to be made in person, rather than by mail, and a copy of an authorization from the employee may be required by certain law enforcement agencies.

DEA inquiries. Inquiries supplying identifying information should also be furnished to DEA field Division Offices along with written consent from the concerned individual for a check of DEA files for records of convictions. The Regional check will result in a national check being made by the Field Division Office.

[40 FR 17143, Apr. 17, 1975, as amended at 47 FR 41735, Sept. 22, 1982]