DEA Narcotics Log Compliance for EMS: What You Actually Need

Who needs DEA registration

EMS agencies that handle controlled substances must hold a DEA registration. This is true whether the agency is a fire-based EMS service, a hospital-based service, a private ambulance company, or an independent third-service EMS. The registration is held by the agency, not by individual paramedics - though individual practitioners may need their own registration in some states.

Key facts about registration:

• Application is filed on DEA Form 224 (for retail-level handlers, which includes EMS).
• Registration is renewed every three years.
• Each separate physical location where controlled substances are stored typically requires its own registration. A multi-station EMS agency often has multiple registrations - one per station, or one master registration with sub-locations depending on state and DEA local field office guidance.
• The agency's medical director, in most states, must hold a DEA registration that authorizes the standing orders under which paramedics administer controlled substances.

Verify your registration status and any sub-location requirements with your DEA local field office. The DEA's Diversion Control Division publishes guidance at deadiversion.usdoj.gov.

The schedules and what EMS commonly carries

Controlled substances are categorized into five schedules under federal law. EMS most often handles drugs in Schedules II through V. The recordkeeping requirements vary by schedule.

State scheduling sometimes differs from federal scheduling. Some states have ketamine in Schedule II at the state level. Always defer to the stricter requirement - typically the state's.

What 21 CFR 1304 actually requires

21 CFR 1304 is the section of the Code of Federal Regulations that governs controlled substance recordkeeping for registrants. The full regulation is available at ecfr.gov/current/title-21/chapter-II/part-1304. The key requirements for EMS:

• Inventory records. An initial inventory at registration, plus a biennial (every two years) inventory of all controlled substances on hand. The inventory must be dated and signed.
• Individual transaction records. Every receipt, dispensing, administration, transfer, or disposal must be recorded. Each record must include date, drug name, strength, quantity, and the persons involved.
• Records must be readily retrievable. The DEA can request inspection of records, and "readily retrievable" means within a reasonable time - typically interpreted as same day or next day.
• Schedule II records must be maintained separately from records of Schedule III-V substances, or in a form that allows them to be readily distinguishable.
• Records must be kept for a minimum of two years at the federal level. Many states require longer (commonly five to seven years).

Chain of custody - the practical pattern

Chain of custody is not explicitly the term used in 21 CFR 1304, but it is the operational concept that EMS agencies use to satisfy the regulation. Every controlled substance that comes into the agency must be traceable from the moment it is received to the moment it is administered, transferred, or destroyed.

The minimum data points for each transaction:

• Date and time - to the minute for administrations.
• Drug - name, strength (e.g., fentanyl 50 mcg/mL), and total quantity.
• Action - received from supplier, transferred from station to vehicle, administered to patient, wasted, destroyed, returned.
• Persons involved - every person who handled the drug, by name. For administrations, the administering paramedic plus any required witnesses. For waste, the wasting provider plus the witness.
• Patient identifier for administrations - typically run number or PCR number, not patient name (PHI).
• Lot number and expiration date - required when the drug is received and ideally captured for each administration so a recalled lot can be traced to specific patients.
• Quantity remaining - after every transaction, the running balance.
• Signature - physical or compliant electronic signature of every person making a record.

The pattern that survives inspection is consistency. If your fentanyl log records lot numbers but your morphine log doesn't, that gap is a finding. If 80% of waste records have a witness signature and 20% don't, that's also a finding. The single most-cited weakness in EMS controlled substance programs is incomplete or inconsistent records - not malicious diversion.

Witnessed waste and the two-witness rule

When a controlled substance is partially administered and the remainder is wasted (a fentanyl ampule is 100 mcg, the patient receives 50 mcg, the rest is wasted), the waste must be witnessed and recorded. The witness must be a different person, and many agencies require both the wasting paramedic and the witness to be authorized handlers - typically licensed EMS providers, sometimes RNs at receiving facilities.

The waste record must include:

• Drug name and amount wasted.
• Reason for waste (typically tied to a patient administration).
• Method of waste - the destruction method (typically rendered unusable by mixing with absorbent material, dish soap, or a chemical waste pouch).
• Date and time.
• Wasting provider - name and signature.
• Witness - name and signature.

Daily counts and shift transfer logs

The DEA does not explicitly require a daily count - the federal requirement is biennial inventory. But virtually every EMS agency conducts a daily or shift-change count as a matter of internal control, and many state EMS regulations require it. The count establishes:

• The actual physical inventory on hand at start of shift.
• Verification that the running balance from the prior shift matches what's physically present.
• Discrepancies are caught immediately, not at biennial inventory months later.

The shift transfer log captures both the offgoing and oncoming providers as witnesses to the count. If the count doesn't match - if there's a missing ampule or an extra one - the discrepancy must be documented, investigated, and reported through the chain of command. Don't write "count off by one - investigated, no further action" without documenting what the investigation actually found.

Record retention

Federal minimum: two years from the date of the record (21 CFR 1304.04). State requirements often exceed this, sometimes substantially. Some examples (verify against your state's rules):

• Many states: 5-7 years for medical records, including controlled substance records.
• Some states: 10 years or longer for pediatric records.
• Many medical malpractice statutes of limitations extend retention requirements regardless of regulatory minimums.

The defensive practice is to keep records longer, not shorter. Storage is cheap. Defending a lawsuit without records is expensive.

The violations most often cited

1. Missing biennial inventory. Two years pass and no inventory is conducted. This is the single most common federal-level finding because the inventory is rarely tied to a calendar reminder.
2. Incomplete waste records. Either missing witness signatures or missing waste method documentation.
3. Discrepancies not investigated or documented. A count that didn't match, with no follow-up record.
4. Inconsistent record format. Some entries have lot numbers, some don't. Some have patient identifiers, some don't.
5. Records not readily retrievable. When asked for a specific transaction, the agency cannot produce it within a reasonable time.
6. Schedule II records mixed with other schedules in a way that makes them not readily distinguishable.
7. Storage security failures. Controlled substances accessible without dual control, or without limited access. Not a recordkeeping issue per se, but often discovered during a records inspection.
8. Expired or recalled stock not removed. Drugs past expiration date still in active inventory.
9. Personnel without proper credentials handling controlled substances. EMTs who aren't authorized handlers participating in waste or transfer.
10. No standard operating procedure on file. Federal regulation doesn't require an SOP, but absence of one tends to correlate with other findings.

Electronic records - what the DEA accepts

The DEA permits electronic recordkeeping for controlled substance transactions, but the system must meet specific requirements. The relevant guidance is in 21 CFR 1311 (Electronic Orders and Prescriptions). For transaction records, the DEA accepts electronic systems that:

• Maintain the integrity of records (cannot be altered without an audit trail).
• Support electronic signatures that authenticate the signing party.
• Are readily retrievable on request.
• Are backed up and recoverable.
• Maintain records for the required retention period in a form that is accurate, accessible, and protected against unauthorized changes.

Many EMS agencies operate hybrid systems - paper logs in the medication safe, electronic records in the patient care report. As long as the records are complete, internally consistent, and retrievable, the format is flexible.

Preparing for a DEA inspection

DEA inspections (called Cyclic Investigations or compliance investigations) can be announced or unannounced. They typically include:

• Review of your DEA Form 224 registration and any state controlled substance license.
• Review of receiving records, dispensing records, transfer records, waste records, and disposal records over a sampling period (often the past 12-24 months).
• Reconciliation of records against current physical inventory.
• Inspection of the storage location - security, access control, dual control if required.
• Review of standard operating procedures.
• Interviews with staff - typically the controlled substance program manager, sometimes paramedics about their practice.

The 30-day pre-inspection drill - what an honest, well-run agency should be able to do at any point:

1. Pick three random drug administrations from the past 12 months.
2. For each, produce: the receiving record showing where the drug came from, the transfer record showing it moved to the rig, the administration record (PCR), the waste record if applicable, and the running balance.
3. If you can produce all of these in under an hour, you are inspection-ready. If you can't, that's the gap to close.

Further reading

• DEA Diversion Control Division - official DEA guidance for registrants.
• 21 CFR 1304 - the federal regulation for records of registrants.
• 21 CFR 1311 - the federal regulation for electronic records and signatures.
• ISO Class Rating: A Plain-English Guide - fire department compliance from a different angle.