DEA Controlled Substance Record Keeping Requirements: A Guide for ASCs (2026)
What the DEA requires, what happens when you fall short, and how surgery centers are staying ahead of it.
DEA auditors do not announce their visits. They show up unannounced at facilities where controlled substances are used and ask to see your records going back two years. If your documentation is incomplete, inconsistent, or difficult to produce, you are not just failing an audit. You are exposing your facility to penalties that range from a formal warning to a prison sentence.
Is your ASC actually audit-ready?
See how MedServe can help before a surveyor does.
Talk to Our TeamWhat the DEA Requires
Two Year Retention
Every transaction involving a controlled substance needs to be documented and retained. DEA auditors can request records going back the full two years during an unannounced inspection.
Four Required Data Points
Each record must capture which staff member interacted with the controlled substance, the quantity used, the date and time of the interaction, and the specific destination of the substance including which patient and which procedure.
Continuous Chain of Custody
Running totals must be maintained transaction to transaction. Your records should show a continuous chain of custody from the moment a controlled substance enters your facility to the moment it is administered, wasted, or disposed of. Gaps in that chain are a red flag for auditors.
Witnessed Daily Counts
Morning and evening counts need a second staff member present and on record as a witness. This applies to both the count itself and any wasting or disposal of controlled substances.
Secure Separate Storage
Controlled substance logs cannot be mixed in with general facility records. They must be stored in a way that limits access and reduces the risk of tampering, which is a significant concern with paper-based systems.
What Happens If You Fall Short
The DEA enforces the Controlled Substances Act with escalating penalties. Non-compliance does not always start with a fine but it can end with one.
Why Paper Records Create Risk
Most of the facilities that fail DEA audits are not failing because of intentional diversion. They are failing because their paper-based systems cannot keep up with the documentation requirements.
Handwriting is illegible. Entries get missed. Witnesses forget to sign. Running totals drift. And when an auditor arrives with two years of records to review, a binder full of inconsistent paper logs is the worst thing you can hand them.
The DEA requirements were not designed around paper. They were designed around accuracy, traceability, and accountability, things that a well-implemented digital system handles automatically.
How to Prepare Your ASC for a DEA Audit
DEA audits can happen at any time without notice. The facilities that get through them without disruption are not the ones that scramble to prepare when an inspector arrives. They are the ones that built preparation into their daily operations long before anyone showed up. Here is exactly what that looks like.
-
Step 1
Organize your two-year record archive
Every controlled substance transaction for the past two years must be immediately accessible. If a DEA auditor asks for records from 18 months ago, you should be able to produce them in minutes. Paper binders sorted by month are the minimum. A digital system that pulls any date range on demand is the standard you should be working toward.
-
Step 2
Confirm your four required data points are captured on every transaction
For every controlled substance interaction, your records must show who accessed it, how much was used, the date and time, and which patient and procedure it was for. Audit one week of records right now and check every entry for completeness. Any gaps are the same gaps a DEA auditor will find.
-
Step 3
Verify your daily count process and witness signatures
Morning and evening counts must have a witness present and documented. Pull your count logs from the last 30 days and confirm every count has two signatures. A single unsigned count is a documentation gap. A pattern of unsigned counts is a compliance failure.
-
Step 4
Review your controlled substance storage and access controls
Your controlled substance logs and medications must be stored separately from general facility records, in a physically secure location with limited access. Document who has access and review whether that list is current. Former staff members with access to keys or combinations are a liability.
-
Step 5
Run a mock audit before the real one
Assign someone on your team to request records as if they were a DEA auditor. Ask for a specific date range, a specific medication, a specific staff member's transactions. Time how long it takes to produce the documentation. If the answer is more than a few minutes, that is your gap.
-
Step 6
Know your DEA Form 106 obligations
Any theft or significant loss of controlled substances must be reported to the DEA within one business day using DEA Form 106. Make sure your team knows what triggers a Form 106 filing, where the form is, and who is responsible for filing it. Not knowing is not a defense.
How MedServe Keeps You Compliant
MedServe automatically generates DEA-compliant records every time a staff member interacts with a controlled substance stored in a MedServe cabinet. Every transaction is time-stamped, tied to a specific user, and synced to the cloud in real time.
Running totals update automatically. Witness verification for counts and waste is built into the workflow. And when an auditor asks for documentation, you pull a report in seconds, not hours.
Your records are tamper-proof, securely stored on HIPAA-compliant cloud infrastructure, and accessible from any browser the moment you need them. And as DEA requirements evolve, MedServe software updates with them so you are never behind.
We always recommend consulting your pharmacy partner or the DEA directly to confirm your facility is fully compliant. MedServe makes that compliance easier to maintain every day.
Find out if your ASC has compliance gaps before a surveyor does.
A 15-minute conversation with our team can show you exactly where you stand and what it would take to close the gaps. No commitment. Just clarity.
Talk to Our TeamThe conversation is free. The risk of not having it is not.
Frequently Asked Questions: DEA Controlled Substance Record Keeping
-
The DEA requires all controlled substance records to be maintained for a minimum of two years. This includes transaction logs, inventory counts, waste and disposal records, and any documentation related to discrepancies. Records must be available for inspection at any time during an unannounced DEA audit.
-
DEA auditors conduct unannounced inspections at facilities registered to handle controlled substances. During an audit they will request documentation going back up to two years, verify that running totals are accurate and continuous, confirm that waste and disposal were properly witnessed and recorded, and check that controlled substance storage meets security requirements. Facilities that cannot produce clean, complete records on demand face escalating penalties including fines, suspension, or revocation of registration.
-
Each transaction must document four things: which staff member interacted with the controlled substance, the quantity used or dispensed, the date and time of the interaction, and the specific destination of the substance — which patient, which procedure, or whether it was wasted or returned. Records must also maintain a running total from transaction to transaction so the chain of custody is unbroken.
-
Paper-based narcotic logs create compliance risk at every step. Handwriting can be illegible or inconsistent. Entries get missed during busy case days. Witnesses forget to sign. Running totals drift when corrections are made. And when a DEA auditor requests two years of records, a binder of inconsistent paper logs is difficult to defend. Digital systems eliminate these risks by recording every transaction automatically, maintaining accurate running totals, and storing tamper-proof records that can be retrieved in seconds.
-
The surgery centers that pass DEA audits without disruption share one thing: they do not prepare for audits — they are always prepared. That means using a system that automatically records every controlled substance transaction in real time, maintains digital running totals, requires witness verification for counts and waste, and generates compliance reports on demand. When your documentation is automatic and continuous, an unannounced audit becomes a non-event.
-
Yes. DEA regulations require that daily controlled substance counts be witnessed by a second staff member. Both the person performing the count and the witness must be recorded. The same witness requirement applies to any wasting or disposal of controlled substances.
-
We offer flexible pricing based on project type and complexity. After an initial conversation, we’ll provide a transparent quote with no hidden costs.
-
DEA Form 106 is a theft or significant loss report. If your controlled substance records show that medications cannot be accounted for, you may be required to report the discrepancy to the DEA using Form 106. Filing this form triggers additional scrutiny so maintaining accurate, complete records is the best way to avoid it. Consult your pharmacy partner or the DEA directly if you believe a significant loss has occurred.
-
Yes. Every time a staff member accesses a MedServe cabinet, the system records the transaction automatically — who accessed it, what medication, the quantity, the time, and the destination. Running totals update in real time. Witness verification for counts and waste is built into the workflow. Reports can be pulled for any time period in seconds. And all records are stored on HIPAA-compliant cloud infrastructure so they are tamper-proof and always accessible.