DEA Controlled Substance Record Keeping Requirements: A Guide for ASCs (2026)

What the DEA requires, what happens when you fall short, and how surgery centers are staying ahead of it.

DEA auditors do not announce their visits. They show up unannounced at facilities where controlled substances are used and ask to see your records — going back two years. If your documentation is incomplete, inconsistent, or difficult to produce, you are not just failing an audit. You are exposing your facility to penalties that range from a formal warning to a prison sentence.

Here is exactly what the DEA requires and what it means for your team day to day.

What the DEA Requires

Records must be kept for a minimum of two years.
Every transaction involving a controlled substance needs to be documented and retained. DEA auditors can request records going back the full two years during an unannounced inspection.

Each record must capture four specific things:

  • Which staff member interacted with the controlled substance

  • The quantity used

  • The date and time of the interaction

  • The specific destination of the substance — which patient, which procedure

Running totals must be maintained transaction to transaction.
Your records should show a continuous chain of custody from the moment a controlled substance enters your facility to the moment it is administered, wasted, or disposed of. Gaps in that chain are a red flag for auditors.

Daily counts must be witnessed.
Morning and evening counts need a second staff member present and on record as a witness. This applies to both the count itself and any wasting or disposal of controlled substances.

Records must be stored separately and securely.
Controlled substance logs cannot be mixed in with general facility records. They must be stored in a way that limits access and reduces the risk of tampering — which is a significant concern with paper-based systems.

What Happens If You Fall Short

The DEA enforces the Controlled Substances Act with escalating penalties. Non-compliance does not always start with a fine — but it can end with one.

A single unaccounted controlled substance may require you to file DEA Form 106 with authorities — a formal report that triggers further scrutiny.

Why Paper Records Create Risk

Most of the facilities that fail DEA audits are not failing because of intentional diversion. They are failing because their paper-based systems cannot keep up with the documentation requirements.

Handwriting is illegible. Entries get missed. Witnesses forget to sign. Running totals drift. And when an auditor arrives with two years of records to review, a binder full of inconsistent paper logs is the worst thing you can hand them.

The DEA's requirements were not designed around paper. They were designed around accuracy, traceability, and accountability — things that a well-implemented digital system handles automatically.

How MedServe Keeps You Compliant

MedServe automatically generates DEA-compliant records every time a staff member interacts with a controlled substance stored in a MedServe cabinet.

Every transaction is time-stamped, tied to a specific user, and synced to the cloud in real time. Running totals update automatically. Witness verification for counts and waste is built into the workflow. And when an auditor asks for documentation, you pull a report in seconds — not hours.

Your records are tamper-proof, securely stored on HIPAA-compliant cloud infrastructure, and accessible from any browser the moment you need them. And as DEA requirements evolve, MedServe's software updates with them so you are never behind.

We always recommend consulting your pharmacy partner or the DEA directly to confirm your facility is fully compliant. MedServe makes that compliance easier to maintain every day.

Violation Level

First offense

Individual violation

Serious or repeated violations

Severe cases

Consequence

Letter of Admonition

Up to $18,759 fine per violation

Suspension or revocation of registration

Criminal prosecution and prison sentence

Frequently Asked Questions: DEA Controlled Substance Record Keeping

  • The DEA requires all controlled substance records to be maintained for a minimum of two years. This includes transaction logs, inventory counts, waste and disposal records, and any documentation related to discrepancies. Records must be available for inspection at any time during an unannounced DEA audit.

  • DEA auditors conduct unannounced inspections at facilities registered to handle controlled substances. During an audit they will request documentation going back up to two years, verify that running totals are accurate and continuous, confirm that waste and disposal were properly witnessed and recorded, and check that controlled substance storage meets security requirements. Facilities that cannot produce clean, complete records on demand face escalating penalties including fines, suspension, or revocation of registration.

  • Each transaction must document four things: which staff member interacted with the controlled substance, the quantity used or dispensed, the date and time of the interaction, and the specific destination of the substance — which patient, which procedure, or whether it was wasted or returned. Records must also maintain a running total from transaction to transaction so the chain of custody is unbroken.

  • Paper-based narcotic logs create compliance risk at every step. Handwriting can be illegible or inconsistent. Entries get missed during busy case days. Witnesses forget to sign. Running totals drift when corrections are made. And when a DEA auditor requests two years of records, a binder of inconsistent paper logs is difficult to defend. Digital systems eliminate these risks by recording every transaction automatically, maintaining accurate running totals, and storing tamper-proof records that can be retrieved in seconds.

  • The surgery centers that pass DEA audits without disruption share one thing: they do not prepare for audits — they are always prepared. That means using a system that automatically records every controlled substance transaction in real time, maintains digital running totals, requires witness verification for counts and waste, and generates compliance reports on demand. When your documentation is automatic and continuous, an unannounced audit becomes a non-event.

  • Yes. DEA regulations require that daily controlled substance counts be witnessed by a second staff member. Both the person performing the count and the witness must be recorded. The same witness requirement applies to any wasting or disposal of controlled substances.

  • We offer flexible pricing based on project type and complexity. After an initial conversation, we’ll provide a transparent quote with no hidden costs.

  • DEA Form 106 is a theft or significant loss report. If your controlled substance records show that medications cannot be accounted for, you may be required to report the discrepancy to the DEA using Form 106. Filing this form triggers additional scrutiny so maintaining accurate, complete records is the best way to avoid it. Consult your pharmacy partner or the DEA directly if you believe a significant loss has occurred.

  • Yes. Every time a staff member accesses a MedServe cabinet, the system records the transaction automatically — who accessed it, what medication, the quantity, the time, and the destination. Running totals update in real time. Witness verification for counts and waste is built into the workflow. Reports can be pulled for any time period in seconds. And all records are stored on HIPAA-compliant cloud infrastructure so they are tamper-proof and always accessible.

See how surgery centers are using MedServe to stay audit-ready.

See How It Works