A recent $3.2 million settlement between the Drug Enforcement Administration and a pair of California health centers should remind hospitals and health centers to review and, when necessary, strengthen their controlled substance compliance programs. They should pay particular attention to recordkeeping and linking for the Controlled Substances Ordering System (CSOS) and reporting any thefts or losses of controlled substances. They should also expect a potential investigation if an employee dies, even if the death appears to be an isolated incident.
On March 24, 2026, the U.S. Attorney’s Office for the Eastern District of California announced that Sutter Medical Center, Sacramento (SMCS) and Sutter Fairfield Surgery Center (SFSC) agreed to pay $3.2 million to resolve allegations that the two facilities collectively committed at least 628 violations of recordkeeping and security requirements under the Controlled Substances Act (CSA). The settlement, reached with the DEA, underscores the federal government’s continued focus on holding healthcare providers accountable for failures to safeguard controlled substances against theft and diversion.
Background
The DEA launched an investigation into SMCS following the death of a pediatric anesthesiologist. The DEA identified 360 violations at SMCS, consisting of 356 violations of 21 C.F.R. § 1305.22(g) for failure to electronically link Controlled Substance Ordering System (CSOS) records to original orders. It alleged that SMCS failed to electronically archive and notate the date and quantity received on all electronic DEA-222 order forms from Nov. 4, 2019, to March 9, 2021. The DEA also identified four security violations of 21 C.F.R. § 1301.76(b) for failure to notify the DEA of theft or loss of controlled substances.
The DEA identified 268 violations at SFSC spanning a broader range of regulatory requirements. These included one violation for an employee failing to report diversion internally (21 C.F.R. § 1301.91); 135 violations for failure to accurately keep records of controlled substances administered in the lawful course of professional practice (21 C.F.R. § 1304.03(d)); one violation for failure to complete a biennial inventory (21 C.F.R. § 1304.11(c)); 22 violations for failure to report date of receipt of controlled substances (21 C.F.R. § 1304.21(d)); 50 violations for failure to link the quantity of each item received in a shipment and the date received to the original order (21 C.F.R. § 1305.22(g)); four violations for failure to maintain a complete controlled substance order record (21 C.F.R. § 1305.27(a)); and 50 violations for maintaining CSOS electronic orders and linked records, maintained in a readily retrievable manner (21 C.F.R. § 1311.60(a)). SFSC’s violations also included one security violation for failure to provide effective controls against diversion (21 C.F.R. § 1301.71(a)) and one violation for failure to report theft or loss within one business day of discovery (21 C.F.R. § 1301.76(b)).
Settlement Terms
Under the terms of the settlement agreement, SMCS and SFSC agreed to pay $3.2 million and comply with several obligations.
- The facilities must notify the applicable DEA Field Division Office in writing of the theft or significant loss of any controlled substances within one business day of discovery and complete and submit a DEA Form 106 within 45 days of discovery. This is already required by regulation, though DEA Form 106 does not have an express filing deadline under the Controlled Substance Act or its implementing regulations.
- The facilities must make available for inspection a monthly reconciliation report demonstrating that all controlled substance discrepancies have been reconciled, including documentation of how they were logged and resolved.
- The facilities must adhere to employee screening procedures outlined in 21 C.F.R. §§ 1301.90 and 1309.72 for all employees who have access to controlled substances via Pyxis. This is already required by regulation.
- The facilities must identify and implement comprehensive training on the CSA and the Code of Federal Regulations, Title 21, for all employees with Pyxis access to controlled substances. Required training topics include records and reports for registrants, records maintained for two years, effective controls against theft and diversion, maintenance of records and inventory, and DEA 222 order forms. The facilities must document the completion date for each employee who receives training.
- Both facilities must include a copy of the settlement agreement with any future application for DEA registration or request for modification of registration. The facilities must also notify the DEA whenever their registration addresses change. Any future DEA registration issued to the facilities prior to the expiration of the agreement will also be subject to its terms.
Takeaways for Healthcare Providers
- DEA-222 order form compliance is a major area of focus.
The largest single category of violations at SMCS — 356 of 360 total violations — involved failures to properly link CSOS records to original electronic DEA-222 order forms. Facilities should ensure that their electronic ordering systems are configured to properly archive and notate the date and quantity received on all electronic order forms on an ongoing basis. - Failure to report theft or loss is treated as a serious security violation.
Both SMCS and SFSC were cited for failures to notify the DEA of theft or loss of controlled substances within the required timeframe. Healthcare providers should establish clear protocols for identifying and reporting suspicious discrepancies promptly and ensure that controlled substance training makes clear the reporting obligation. - Triggering events such as employee deaths can initiate broader investigations.
The SMCS investigation was prompted by the death of a pediatric anesthesiologist. Healthcare facilities should be aware that unusual incidents involving controlled substances, even those that appear isolated, can lead to comprehensive DEA audits and investigations. This has been a consistent theme across significant diversion-related settlements in recent history.
McGuireWoods continues to monitor developments in controlled substances regulations and enforcement. For questions, contact the authors.