DEA On-Site Inspection Response: What to Do When the DEA Arrives

A DEA diversion investigator at the front desk with a Form 82, Notice of Inspection, is a controlled event, not a routine audit. The inspection authority sits at 21 USC § 880 and 21 CFR § 1316. In the first 30 minutes, escalate to the DEA registrant, contact counsel, lock down records under document hold, and decide the consent question at the registrant-and-counsel level. Do not allow the front desk to consent unilaterally.

First 30 minutes when the DEA arrives

The opening half-hour determines the posture for the entire inspection.

1. Identify the DEA personnel. Ask for DEA credentials. Note name, badge number, division office, and any accompanying personnel (state board inspectors, local law enforcement). DEA Diversion Investigators identify as such; Special Agents identify as Special Agents. The distinction matters — administrative diversion inspections under 21 CFR § 1316 and criminal investigations under DOJ authority operate under different legal frameworks.
2. Receive the Form 82. The Notice of Inspection should be presented at the outset. Acknowledge receipt — but do NOT sign the consent block on Form 82 unless the registrant (with counsel) has decided to consent. Under 21 CFR § 1316.05 and § 1316.08, DEA must obtain consent (evidenced by a signed written statement) or an administrative inspection warrant before entry and inspection.
3. Escalate to the DEA registrant immediately. The DEA registration is held by a specific individual (typically the practitioner or, for a hospital/group, the institutional registrant). The registrant or a designated representative makes the consent decision, not the front-desk staff.
4. Contact counsel. Outside healthcare counsel with DEA experience. The decision to consent to an administrative inspection or to require an Administrative Inspection Warrant is a counsel-driven decision based on the specific posture, the practice's controlled-substance records, and any known prior contact.
5. Designate a single point of contact. One named person handles all interactions with the DEA team during the inspection. No staff member speaks to the inspector without the point-of-contact's knowledge.
6. Activate document hold. Suspend any routine record destruction. Capture the state of the controlled-substance inventory, the pharmacy log, the prescription records, the EHR audit log. Litigation-hold language to IT and to records custodians.
7. Document everything. Start a contemporaneous log: arrival time, personnel present, scope statements made by DEA, records requested, areas accessed, photographs taken (by either side), interviews conducted, statements made.
8. Do not obstruct, do not volunteer. Obstruction under 21 USC § 843(a)(5) is a separate offense. Volunteering information beyond what is required widens the scope. The point-of-contact's job is to provide what the legal framework requires and document the rest.

The consent question itself: refusing consent does not end the inspection. DEA can return with an Administrative Inspection Warrant under 21 CFR § 1316.09. The decision is whether the additional 24-48 hours that buys is worth the framing it creates. Counsel decides.

What the inspector can access

The administrative inspection authority is scoped. It is not a general fishing expedition into the practice's records.

The inspector has authority to inspect:

• Required records under the CSA — initial inventory, biennial inventory, dispensing logs, prescription records, DEA Form 222 (Schedule II ordering), DEA Form 41 (controlled-substance destruction), DEA Form 106 (theft/loss), records required under 21 CFR § 1304
• The controlled-substance inventory itself — physical inspection, count, and reconciliation
• The storage area — the lock, the safe, the cabinet where Schedule II-V drugs are kept under 21 CFR § 1301.72-1301.76
• DEA registration documents — the practice's DEA Certificate of Registration, state controlled-substance license, any related certifications
• The prescription drug monitoring program access record for the registrant, where the inspection touches prescribing patterns

The inspector does not, by virtue of the administrative inspection alone, have authority to:

• Access patient charts that contain only non-controlled-substance care information
• Compel interviews of staff outside the consent framework
• Seize records beyond copying or imaging of required records
• Access the EHR for any purpose beyond controlled-substance record verification

A criminal search warrant or grand-jury subpoena expands the authority materially. If the inspector arrives with either, the situation changes — counsel and the registrant evaluate the document, the scope, and the response in real time.

What you must produce

The records to have organized and ready for any DEA inspection, regardless of advance notice:

• DEA Certificate of Registration, current, posted in the registered location per 21 CFR § 1301.35
• Initial inventory taken when registration was first issued; biennial inventory taken every two years thereafter under 21 CFR § 1304.11
• DEA Form 222 records for every Schedule II order (electronic CSOS records or paper Form 222), retained for two years
• DEA Form 41 records for every controlled-substance destruction, with witness signatures
• DEA Form 106 records for any theft or significant loss — written notice to the DEA Field Division Office within one business day of discovery, with the complete DEA Form 106 filed within 45 days after discovery under 21 CFR § 1301.76(b)
• Dispensing logs for every controlled-substance dose administered or dispensed in-office, with patient identifier, date, drug, strength, quantity, and dispensing practitioner
• Prescription records for every controlled-substance prescription written, with the elements required under 21 CFR § 1306
• Storage-area access log — who has access to the safe or locked cabinet, when, why
• State controlled-substance license, current, posted alongside the DEA Certificate
• Prescription drug monitoring program (PDMP) registration for the prescribing provider, with documentation of query frequency where state law requires

The two-year retention floor at 21 CFR § 1304.04 is the federal minimum. Many states require longer (five years in California, three to five years in most). Retain to the longer standard.

What NOT to say

The single most damaging category of inspection error is the unstructured statement to the investigator made by staff who do not have full picture of the practice's controlled-substance posture. Specific patterns to avoid:

• Do not speculate. "I think the Schedule II inventory was last counted in May" creates a record that is wrong if the inventory was actually counted in April. The DEA Form 82 inquiry is fact-based — only documented facts go to the inspector, and only from the designated point of contact.
• Do not characterize past practice as "the way we've always done it." Even a true statement that the practice has been inconsistent in counts or recordkeeping is an admission that follows the matter through CMP or registration-action proceedings.
• Do not minimize a known discrepancy. If a count discrepancy exists in the record, the discrepancy is documented in the record. Do not attempt to explain it away in the moment; counsel and the registrant build the response.
• Do not consent to an interview without counsel. DEA Diversion Investigators may request informal interviews of providers or staff. Decline politely, refer to counsel, schedule for a later date if appropriate. Voluntary statements made during an inspection are admissible in any subsequent CMP, civil, or criminal proceeding.
• Do not provide records beyond what is required. The inspector's authority is scoped to the CSA-required records. Providing additional records widens the scope and creates new exposure surface.
• Do not destroy or alter records. Document destruction during or in anticipation of an inspection is obstruction under 21 USC § 843(a)(5) and obstruction of justice under 18 USC § 1519.
• Do not waive privilege. Do not produce communications with counsel, internal compliance memoranda, or attorney work product. The administrative inspection does not reach privileged materials.

After they leave

The post-inspection workflow determines whether a clean inspection stays clean or escalates.

1. Document the inspection. Within 24 hours, the point-of-contact and counsel compile the contemporaneous log: every record requested, every record produced, every statement made by DEA, every photograph taken, every area accessed, every staff interaction. This becomes the foundational document for any follow-up.
2. Reconcile the inventory. If the DEA conducted a physical inventory count, reconcile their count against the practice's records the same day. Any discrepancy is identified, documented, and the source investigated.
3. Triage any identified discrepancy. A count discrepancy, a documentation gap, or a procedural lapse identified during the inspection is identified for remediation. For any theft or significant loss, send the written one-business-day notice to the DEA Field Division and file the complete DEA Form 106 within 45 days after discovery per 21 CFR § 1301.76(b).
4. Brief leadership and counsel. A debrief with the registrant, practice leadership, and counsel within 48 hours. The debrief covers what was inspected, what was found, what the DEA stated about findings, what the likely follow-up is, and what remediation begins immediately.
5. Implement corrective action. Any identified gap is corrected. Inventory procedures, storage controls, prescription documentation, PDMP query workflow — whatever was implicated.
6. Track follow-up communications. Any DEA follow-up — request for additional records, request for a meeting, Order to Show Cause, Letter of Admonition — runs through counsel. Front-desk staff route every DEA-related communication to the point-of-contact.
7. Evaluate self-disclosure posture. Where the inspection surfaces conduct that may warrant self-disclosure to the OIG (e.g., AKS-tainted prescribing) or to CMS (e.g., billed prescriptions tied to a non-compliant arrangement), counsel evaluates the path — see the OIG Self-Disclosure Protocol guide.

DEA follow-up actions range from no-action closures to Letters of Admonition to Memorandum of Agreement (MOA) negotiations to Orders to Show Cause initiating registration-action proceedings. The post-inspection 30-60 days is when the matter takes shape; counsel-led remediation in that window materially influences the outcome.

State-law overlay

State controlled-substance boards run independent inspection authority that often parallels DEA:

• California Bureau of Narcotic Enforcement and the Medical Board run state-side inspections under Business & Professions Code Chapter 9; under Cal. Health & Safety Code § 11165.4, CURES PDMP queries are required at the first prescription of any Schedule II–IV controlled substance and at least every six months thereafter for ongoing therapy.
• Florida Department of Health Bureau of Pharmacy Services and the state board of medicine run inspections; E-FORCSE PDMP queries are required.
• Texas Department of Public Safety and the Texas State Board of Pharmacy run inspections; Texas Prescription Monitoring Program queries are required.
• New York Bureau of Narcotic Enforcement runs state-level inspections; the I-STOP PMP and Official Prescription Program (paper Schedule II forms) layer additional requirements.

A federal DEA inspection often triggers parallel state-board inquiry, particularly on registration-action matters. State medical and pharmacy board self-reporting obligations may be triggered by DEA action regardless of outcome.

Restraint about outcomes

No protocol guarantees a clean DEA inspection. The posture rests on the records that exist at the moment of inspection, the controls in place, and the discipline of the response. A well-organized, counsel-coordinated response materially outperforms a scrambled one. The practices that resolve DEA matters cleanly are the ones that maintained controlled-substance records as if an inspector might walk in tomorrow — and then, when one did, executed the first-30-minutes protocol without improvisation.

This guide is not legal advice. The decisions during a DEA inspection — consent, scope, document production, staff interviews — are legal decisions; engage outside healthcare counsel with DEA experience the moment a Form 82 is presented.

How d3rx fits

The d3rx compliance binder holds the source-grounded administrative documentation a DEA-ready controlled-substance program is built from — DEA registration tracker, biennial inventory log, DEA Form 222 / Form 41 / Form 106 file, dispensing log policy, storage controls, and PDMP query evidence. The d3rx audit defense workflow walks the first-30-minutes protocol, the document-hold process, the contemporaneous log template, and the post-inspection reconciliation. d3rx does not represent the practice in any DEA proceeding, does not provide legal advice, and does not replace counsel; it is a point-in-time administrative documentation aid that counsel and the practice work from.