Medicine plays a vital role in safeguarding public health throughout the world. Pharmaceutical companies develop medicines to treat and cure sickness and disease. However, despite these noble intentions, occasionally substances created for a specific therapeutic purpose become dangerous. Heroin, for example, was introduced in 1898 as a therapeutic drug but was later determined to be highly addictive, leading to significant abuse. Since then, numerous pharmaceuticals products developed for specific therapeutic uses have been proven to be moderately to highly addictive, resulting in overdoses and deaths.

In 2018, there were 67,367 drug overdose deaths from scheduled or controlled substances in the U.S. alone.1 Worldwide, in 2017 there were 585,000 deaths from the use of controlled substances. North America continues to experience the highest drug-related mortality rate in the world from the abuse of scheduled or controlled substances.2 As such, federal and state governments have passed numerous laws to control and manage the prescription, use, storage, handling and disposal of such controlled substances.

The global controlled substance market was valued $64 Billion in 2018, and is projected to reach a value of $115 Billion by 2027.3 It is a highly lucrative industry and includes a large number of entities that manufacture the active pharmaceutical ingredients and/or the final product, warehouse and distribute the product, as well as those that administer and ultimately dispose of the product.

To regulate the use of these substances, the U.S. Government created the Drug Enforcement Agency (DEA) in 1970 under the Department of Justice. Shortly after, the Controlled Substances Act (CSA) was enacted. The CSA seeks to protect the public from the dangers of controlled substances, while also making sure that patients have access to pharmaceutical controlled substances for legitimate medicinal purposes. This is accomplished by establishing rules for proper handling, and by imposing penalties for the illicit production, distribution and possession of controlled substances.4

The DEA’s mission is to enforce the controlled substances laws and regulations of the U.S. and bring to civil and criminal justice those individuals or organizations that are involved in the illicit growing, manufacturing, distribution and trafficking of controlled substances. They also recommend and support programs aimed at reducing availability of illicit controlled substances.5

In the U.S., controlled substances are categorized into five schedules based on the different levels of control required for their distribution, medicinal purposes and potential for abuse.6

• Schedule I - The drug or substance has a high potential for abuse and has no currently accepted medical use in treatment in the United States. Production and possession are limited to research and other special purposes.
  
  Examples: Heroin, methylenedioxymethamphetamine (Ecstasy), lysergic acid diethylamide (LSD), marijuana, and Quaalude.7
• Schedule II - The drug or substance has a high potential for abuse, has a currently accepted medical use in treatment in the United States or a currently accepted medical use with severe restrictions. Abuse of the drug or other substance may lead to severe psychological or physical dependence.
  
  Examples: Opiates such as Methadone and morphine, methamphetamine, methylphenidate (Ritalin®), oxycodone (OxyContin®), phencyclidine (PCP),8 synthetic opioids (currently the main driver of drug overdose deaths as they were involved in 46,802 overdose deaths in 2018 and accounted for 69.5% of all drug overdose deaths.9)
• Schedule III - The drug or other substance has less potential for abuse than those noted in Schedules I and II. It has a currently accepted medical use in treatment in the United States. Abuse of the drug may lead to moderate or low physical dependence or high psychological dependence.
  
  Examples: Anabolic steroids, Tylenol with codeine, ketamine, testosterone.10
• Schedule IV - The drug or other substance has a low potential for abuse relative to schedule III. It has a currently accepted medical use in treatment in the United States. Abuse of the drug or other substance may lead to limited physical dependence or psychological dependence relative to the drugs or other substances in schedule III.
  
  Examples: Xanax, Ambien, Tramadol, Soma, Valium, Talwin, Darvon, Darvocet.11
• Schedule V - The drug or other substance has a low potential for abuse relative to schedule IV. It has a currently accepted medical use in treatment in the United States. Abuse of the drug or other substance may lead to limited physical dependence or psychological dependence relative to schedule IV.
  
  Examples: Cough preparations with limited codeine (Robitussin AC), Lomotil, Motofen.12

The DEA has an extensive list of requirements and security levels a manufacturer/packager/ distributor must follow to prevent diversion or theft of controlled substances. These requirements make it challenging for companies, especially smaller ones, that work with scheduled drugs intended for clinical trial use. Due to its complexity, this type of work is increasingly outsourced to specialized clinical trial service companies who will assist pharmaceutical companies navigate the regulatory environment during testing and commercialization.13

An overview summary of the physical security requirements for the various scheduled drugs is noted below but detailed information can be found in the Additional Sources section at the end of the paper.

• Schedule I & II - Raw material, bulk materials awaiting further processing, finished products which are controlled substances listed in Schedule I or II and sealed mail-back packages and inner liners shall be stored in one of the following secured areas:14
  
  
• For small quantities, provide a safe or steel cabinet. It should be equipped with a 24 hour/day central station, monitored burglar alarm system. If it is under 750 pounds, it should be securely bolted to the floor or wall. There are also specifications on man-minutes against force entry.
• For vaults constructed after September 1, 1971, the walls, floors and ceilings should be constructed of 8” reinforced concrete. It should be equipped with a 24 hour/day central station, monitored burglar alarm system. The door of the vault should be equipped with contact switches and the vault itself should have sensors to detect illegal entry. If the vault needs to remain open during the day it should be equipped with a self-closing, self-locking “day-gate.” There are also specifications on man-minutes against force entry. If necessary panic/hold up buttons should be strategically placed at points of entry and perimeter of the vault.
• The building should be equipped with a burglar alarm system directly connected to a central station and monitored 24 hours/day.
•  Schedule III, IV and V15- Raw material, bulk materials awaiting further processing, and finished products which are controlled substances listed in Schedule III, IV, and V shall be stored in the following secure storage areas:
  • Should have a safe or steel cabinet and/or vault storage with protections noted above.
  • Storage building has perimeter security that limits access during working hours and provides security after working hours. There should be burglar alarm system monitored 24 hours/day by a central station. The door should be self-closing and self-locking and be kept closed and locked at all times when not in use. When in use it should be attended at all times. Only designated employees should have the key to the door or the combination to a lock.
  • A cage in the building should be equipped with a burglar alarm system monitored 24 hours/day by a central station. The cage needs to meet specific construction parameters. Alternatives to a cage need to have written approval of the Administrator.
  • Alternative storage requirements
    • Schedule III through V controlled substances may be stored with Schedule I and II controlled substances.
    • Non-controlled drugs, substances and other materials may be stored with Schedule III through V controlled substances in any of the secure storage areas with the written permission of the DEA.
• Multiple Storage Areas - Where several types or classes of controlled substances are handled separately for different purposes (e.g., returned goods, or goods in process), the controlled substances may be stored separately, provided that each storage area complies with the requirements.
• Accessibility to Storage Areas - The controlled substances storage areas shall be accessible only to a minimum number of specifically authorized employees. When necessary for others to be present in or pass through controlled substances storage areas, the registrant shall provide for adequate observation of the area by an employee specifically authorized in writing.

Employees that are handling or processing scheduled substances are required to undergo strict criminal and background checks, including being screened and assessed for disciplinary, ethical or criminal activities. An employee convicted of a felony related to controlled substances cannot work or have access to controlled substances areas. Firms are required to have policies and standard operating procedures (SOPs) for security and the strict and controlled access to their production and storage. Firms also need to provide a rigid training program to employees that covers regulations that govern the handling of controlled substances.16

Every company that handles and processes controlled substances should practice the following:

• Ensure that they comply with federal and state regulations pertaining to their use of controlled substances.
• Ensure that designated staff handling controlled substances are trained properly.
• Maintain a record of order, receipt, use, storage, loss and disposal of controlled substances.
• Maintain strict control over inventory and security.
• Perform regular audits of records and procedures of individuals or departments who have possession of controlled substances.
• When shipping controlled substances, a manufacturer/registrant is responsible for selecting common or contract carriers who can provide adequate security to guard against in-transit losses.
• When storing controlled substances in a public warehouse, the manufacturer/registrant is also responsible for selecting a warehouseman who can provide adequate security to guard against theft and storage losses. Wherever possible, the manufacturer/registrant shall store controlled substances in a public warehouse that complies with the requirements noted in 21 CFR 1301.72. In addition, the manufacturer/registrant shall employ precautions (such as assuring that shipping containers do not indicate that contents are controlled substances) to guard against storage or in-transit losses.17
• Ensure that products meet appropriate packaging and labeling requirements. These are noted in the Additional Sources section at the end of the paper.

The DEA’s preferred disposal of controlled substances is by destruction where the drug must be rendered non-retrievable. This means that the controlled substance’s physical or chemical properties are permanently altered through irreversible means, and making it unavailable and unusable for all practical purposes. Incineration is the only method currently accepted by the DEA to render a drug non-retrievable. Pouring the substance down the drain or disposing it in a landfill (mixing with kitty litter, coffee grounds, etc.) does not meet the DEA’s non-retrievable standards.

The manufacturer/registrant is also required to provide in writing the date, location, and method of destruction. This is done on the DEA’s Form 41. In addition, two authorized employee witnesses are also required and must declare by signature under penalty of perjury, that such employees personally witnessed the destruction of the controlled substances.18

It is important that any company working with controlled substances has the necessary controls, procedures and policies to ensure compliance with the DEA requirements. Failure to do so may result in penalties that could include reprimands, monetary fine (varies from $1,000 to $500,000), imprisonment, and/or business closure.19

To learn more about how OneBeacon Technology Insurance can help you manage online and other technology risks, please contact Dan Bauman, VP of Risk Control for OneBeacon Technology Insurance at dbauman@intactinsurance.com or 262-951-1455.