Veterinary Controlled Substance Log Requirements: What the DEA Actually Requires

The Governing Regulation: 21 CFR Part 1304

Every veterinary practice that holds a DEA registration must comply with 21 CFR Part 1304— the DEA's record-keeping requirements for controlled substances. This regulation specifies exactly what records you must maintain, for how long, and in what form.

The single most important thing to understand: the regulation is about records, not software. The DEA does not mandate a specific system. What it mandates is that your records are complete, accurate, retrievable within 72 hours of a DEA request, and retained for a minimum of two years. How you achieve that is up to you.

Required Records: The Complete List

Under 21 CFR Part 1304, veterinary practices must maintain records for the following categories of controlled substance activity:

1. Biennial Inventory (§ 1304.11)

Every DEA registrant must conduct a complete physical inventory of all controlled substances on hand every two years (within two years of the previous inventory date, not on a fixed calendar). The inventory must be taken at the close of business on the inventory date and must include:

• Name of the substance
• Each finished form (e.g., 10 mg tablet, 100 mg/mL injectable)
• Number of units or volume of each finished form
• Total quantity

For Schedule II substances, the count must be exact. For Schedule III–V, an estimate is permitted only if the substance is in an unopened commercial container. Opened containers must be counted.

2. Order Forms and Acquisition Records (§ 1304.21–1304.22)

Every receipt of a Schedule II controlled substance must be accompanied by a DEA Form 222 (or its electronic equivalent, the CSOS — Controlled Substance Ordering System). For Schedule III–V, a standard invoice or purchase record suffices, but it must be maintained separately and must include the date received, quantity, supplier, and DEA registration number of the supplier.

3. Dispensing and Administration Records (§ 1304.22)

This is where most practices have the largest compliance gap. Every time a controlled substance is administered or dispensed, your record must capture:

Note that while a running balance is not explicitly required under federal law for all schedules, many states do require it, and DEA field inspectors have consistently cited its absence as a finding that indicates inadequate controls. Without a running balance, you cannot detect diversion until month-end — and by then, it may be too late.

4. Waste and Disposal Records

The DEA does not have a single unified regulation on controlled substance waste in veterinary settings — but the absence of an explicit requirement does not mean you can discard waste without documentation. Federal and state law intersect here in ways that create significant exposure:

• DEA 21 CFR § 1317 governs disposal of controlled substances by registrants. Practices may use a DEA-authorized collector (reverse distributor, take-back program) or apply for on-site destruction authority.
• Waste during administration (e.g., drawing 5 mL but administering 3 mL — the 2 mL remainder must be documented) is effectively governed by the dispensing record requirement. The waste amount must be recorded, and DEA field inspectors expect a witness signature for Schedule II wastes.
• State veterinary board rules frequently require dual-witness documentation for any controlled substance waste, including mid-vial waste during a procedure.

5. Discrepancy and Loss Reports

Any significant loss or theft of controlled substances must be reported to the DEA within one business day of discovery using DEA Form 106. "Significant loss" is not defined in quantity — it is determined by context. An investigator will evaluate whether the loss could indicate diversion.

Beyond formal theft, practices should maintain internal discrepancy logs: any time the running balance does not match a physical count, that discrepancy should be documented, investigated, and resolved — or escalated to DEA Form 106 if unresolvable.

Record Retention: The 2-Year Rule

All records required under 21 CFR Part 1304 must be maintained for a minimum of two years from the date of the transaction. For Schedule II, records must be kept separately from all other records at the registered location. Schedule III–V records may be kept with other business records, provided they are retrievable within 48 hours.

The safest approach: maintain controlled substance records in a system that is independent of your EMR. This ensures that EMR changes, data migrations, vendor failures, or software sunsets do not put your DEA compliance at risk.

Are Digital / Electronic CS Logs DEA-Acceptable?

Yes — with conditions. The DEA does not require paper records. Electronic records are explicitly permissible under 21 CFR § 1304.03, provided they:

• Are maintained in a format that can be readily retrieved and printed or displayed
• Are available for inspection at the registered location within 48–72 hours of a DEA request
• Are complete, accurate, and legible
• For electronic order records (CSOS), meet the specific requirements of 21 CFR § 1305.21

The DEA's 2010 Interim Policy Statement and subsequent guidance have consistently affirmed that electronic records that satisfy the completeness, accuracy, and retrieval requirements of Part 1304 are compliant. An audit-grade, append-only electronic log with timestamped entries and a verifiable chain of custody is not just acceptable — it is more defensible than a paper binder.

8 Compliance Gaps Most Practices Don't Know They Have

Based on DEA inspection findings and community reports from veterinary practice managers, these are the most common silent compliance gaps:

1. No running balance maintained after each draw. Without a running balance, you cannot detect diversion or arithmetic errors until month-end. Many state boards require it explicitly.
2. Waste entries missing a second witness signature. The most frequently cited finding in DEA field inspections. Even one unsigned waste entry creates audit exposure.
3. Multiple vials of the same drug tracked in aggregate instead of by lot/vial. If Morphine 10 mg/mL is tracked as a single running balance across all open vials, you cannot reconstruct which vial had the discrepancy.
4. Biennial inventory not conducted on schedule. The two-year clock runs from the date of the previous inventory, not January 1st. Many practices lose track and fall out of compliance without realizing it.
5. EMR "CS tracking" doesn't enforce DEA format. Most EMR modules are designed to track inventory for billing, not to satisfy DEA record-keeping requirements. Fields are often optional, witnesses are not enforced, and exports may not be in a DEA-compliant format.
6. Records not retrievable within 48–72 hours. Paper binders stored offsite, in storage units, or misfiled fail the retrieval requirement even if the entries themselves are complete.
7. CS records destroyed or lost when changing EMRs. The 2-year retention requirement applies regardless of what software you use. EMR changes do not reset the clock.
8. No documented discrepancy investigation process.When a count is off, "we recount and move on" is not defensible. Discrepancies should be documented, investigated, and resolved or escalated.

State Law: Where It Gets More Restrictive

Federal DEA requirements are the floor, not the ceiling. Many states impose additional controlled substance record-keeping requirements that are stricter than federal law. Common examples:

You must comply with both federal and state requirements. When state requirements are stricter, the state requirement controls. Consult your state veterinary board or a DEA compliance consultant for the current requirements in your jurisdiction.

What Makes a CS Log "Audit-Grade"?

A log that satisfies DEA requirements is not automatically a log that performs well under inspection. DEA field investigators are experienced at identifying documentation that is technically compliant but practically unreliable. The attributes that distinguish an audit-grade log:

• Append-only: No entries can be deleted or overwritten. Corrections are made with a new entry noting the error and its correction.
• Timestamped: Every entry has a precise timestamp, not just a date. This enables investigators to correlate entries with patient records.
• Per-user attribution: Each entry is attributed to a specific individual — not just "a staff member."
• Running balance maintained: After each transaction, the current balance is recorded alongside the transaction.
• Tamper-evident: The log cannot be modified retroactively without evidence. Hash-chained digital logs are the gold standard.
• Dual-witness enforced: Waste entries cannot be completed without a second authorized individual authenticating separately.
• Readily exportable: The full log can be produced in printed or electronic form within 48–72 hours of a DEA request, covering any date range.

Next Steps

Understanding the requirements is step one. Closing the gaps is step two. If your current system — paper, spreadsheet, or EMR module — cannot reliably satisfy the record-keeping requirements above, it is worth evaluating purpose-built options before your next DEA inspection or biennial inventory.

• How to prepare for a DEA inspection at your veterinary practice →
• Dual-witness C-II waste: best practices for veterinary teams →
• Detecting and preventing controlled substance diversion →
• Free compliance checklist — download and use at your practice →