Prepare to avoid DEA Audit for Controlled Substance Logging in 2026

Disclaimer: This is not legal advice; I am not an attorney. I am trying to plain-speak how DEA and California controlled-substance rules generally work for small animal practices. Importantly, I will try to flag some common errors that show up most in cases.

You can skip reading this blog if you do a self-audit every quarter. It takes far less time than the paperwork involved in responding to an audit. Here is the outline of the self-audit:

• Try to reconcile every controlled substance log against actual physical counts, not just for the drugs you use regularly but for anything sitting in the safe, including back stock and anything in a mobile or traveling kit.
• Do confirm that your biennial inventory is current, dated and complete, and don't wait for the two-year mark to start one if your last count is getting close to stale.
• Check your list of staff authorized to access controlled substances and remove anyone who's left or changed roles; confirm every assistant on that list holds a current VACSP if California law requires one for their role.
• Check that your DEA registration itself is current and that the registered address, activity and schedules match what your practice is doing day to day.
• Spot-check a sample of dispensing entries for completeness: patient, species, drug, strength, quantity and any documented waste, with two.
• Confirm your safe is properly rated, bolted down and inaccessible to anyone outside the authorized list.
• Verify any client dispensing events from the last quarter were reported to the PMP Clearinghouse within the seven-day window.
• Walk through your theft and loss reporting process with staff so a shortage triggers a real Form 106 evaluation rather than a shrug and a note in the margin.
• Keep every record for the full two-year retention window, on-site and genuinely retrievable, not scattered across three different systems nobody remembers how to search anymore.

In 2025, a veterinary hospital in New Hampshire agreed to pay $53,500 after DEA investigators found altered record pages, forged signatures and missing inventories. A year earlier, a Wyoming practice paid $30,000 for systemic record-keeping gaps and failure to properly safeguard controlled drugs. Go back a bit further and a Colorado hospital paid $226,000 and surrendered its DEA registration entirely after years of poor tracking around opioids including fentanyl and morphine. Check this out.

None of these were pill mills or diversion rings run by bad actors. They were ordinary small animal practices that let a logbook drift, skipped a reconciliation, or assumed a missing vial was probably just a counting error. That's the uncomfortable truth about DEA compliance for a veterinary hospital: the gap between "compliant" and "facing a six-figure civil penalty" is usually a few missed logbook entries, not a moral failing.

If you own or manage an independent California practice, here's what the rules require in 2026, where the DEA layer meets the state layer most owners don't think about, and what a quarterly habit of checking your own work can save you from finding out the hard way.

This matters more (yes, absolutely more) for an independent practice than a corporate-owned one, and not because independents are less careful. A large, consolidated group typically has a compliance department whose entire job is chasing down exactly these details across dozens of locations they manage. A five-person independent practice has an office manager juggling scheduling, billing, staffing and a hundred (or thousands it seems like) other things, with controlled substance logging somewhere on that list rather than at the top of it. The rules don't scale down for smaller operations; the bandwidth to track them does.

Beware: Two systems, not one: DEA plus California's own layer

Every practice that handles Schedule II through V drugs already knows it needs a DEA registration. What gets missed is that California stacks its own requirements on top of the federal ones, and an inspector or auditor can flag either layer independently.

The first piece is CURES, California's prescription drug monitoring program. Every veterinarian with an active California license and a DEA registration has been required to register with CURES since mid-2016. The good news is that, unlike physicians, veterinarians aren't required to query a patient's controlled-substance history before dispensing. The part that trips people up is the other direction: if you dispense a controlled substance directly to a client rather than writing a prescription filled elsewhere, you have seven days to report that dispensation to the state's PMP Clearinghouse database. Check out the CVMA's compliance guidance on this .

The second piece is the Veterinary Assistant Controlled Substances Permit, or VACSP. If a veterinary assistant at your practice, someone who isn't a licensed veterinarian or a registered veterinary technician, obtains or administers controlled substances, California requires that person to hold a VACSP on top of whatever your practice's DEA registration covers. Check this out. I covered this in the earlier piece on this year's new California veterinary laws: AB 1502 specifically expanded the Board's disciplinary reach to cover VACSP holders directly, which means a controlled substance problem involving an assistant is no longer purely a federal DEA matter. It's a state licensing matter too, with its own investigation and its own consequences.

None of this replaces your DEA obligations. It sits on top of them. A practice can be perfectly squared away with the DEA and still have a gap at the state level if an assistant is handling controlled substances without a VACSP, or if dispensing reports to the PMP Clearinghouse aren't getting filed on time.

This layered structure also shows up at the worst possible moment for an owner thinking about a sale. Buyers, whether that's a private equity-backed consolidator or another independent owner, run due diligence on controlled substance records as a matter of course, and a gap that would have cost a warning letter during a routine DEA check can knock real money off a valuation or kill a deal outright once it surfaces in a data room. Clean logs aren't just a regulatory obligation. They're an asset on your balance sheet that nobody puts a line item on until it's missing.

What changed with the 2026 telemedicine extension

If your practice does any tele-health triage or virtual follow-ups involving controlled substances, here's the update. DEA and HHS extended the telemedicine flexibilities that let a practitioner prescribe controlled medications without a prior in-person exam through December 31, 2026, the fourth temporary extension of rules that trace back to pandemic-era policy. Check this out

For a small animal practice, this mostly matters if you're prescribing something like a controlled anxiolytic for a patient you're managing partly through virtual check-ins, or if an associate is covering telehealth triage shifts. The extension keeps that path open through the end of the year rather than forcing a sudden reversion to in-person-only rules mid-stream. It doesn't loosen anything else: prescriptions still need to be for a legitimate medical purpose, issued by a licensed practitioner and compliant with both federal and California law. DEA has said it's working on permanent rules, including a special registration category for telemedicine prescribing, so treat 2026 as a bridge year rather than a settled destination. What's allowed today is worth revisiting again before the extension's end date rather than assuming it rolls over automatically.

The five errors that show up repeatedly

Compliance consultants and inspectors tend to cite the same handful of problems across veterinary practices, and they line up closely with the real cases above.

1. Recordkeeping gaps: Missing dispensing entries, illegible handwritten logs, undated corrections. This is the single most common citation, and it's also the cheapest to fix, since it's almost always a training and habit problem rather than a systems problem ([one compliance firm's inspection checklist breaks this down in detail.
2. Missing or stale biennial inventory: Federal rules require a complete physical count of every controlled substance on hand at least once every two years, and that count needs a documented substance name, form, strength, container count, time of day and a witness signature. Practices that treat this as a once-every-two-years chore instead of a standing habit are the ones who can't produce a clean, dated count when asked, which makes it impossible to reconcile anything that follows.  Check this out.
3. Unauthorized access or dispensing: Controlled substances administered under an expired DEA registration or accessed by staff who aren't on the practice's authorized list. This is where the VACSP layer described above matters: an assistant handling controlled substances without the right permit is both a federal and a state problem at once.
4. Inadequate security: A safe that isn't bolted down, isn't rated as "substantially constructed," or sits somewhere staff outside the authorized list can reach. Pentobarbital in particular typically needs two-signature documentation for every euthanasia event, and that requirement gets skipped more often than owners expect.
5. Failure to report theft or loss: A missing vial gets chalked up to a counting mistake instead of triggering a DEA Form 106 filing. The rule is one business day from discovery to notify your local DEA Field Division Office, not one business day from when you're sure it wasn't a paperwork error. See DEA's Diversion Control Division has the reporting requirements California practices file with the San Francisco Field Division, which covers the state.

Majority of the real cases cited earlier traces back to some combination of these five. None of them started with a dramatic diversion scheme. They started with a shortage nobody explained, a count that never got reconciled, or a log that had gaps nobody caught for months.

What a real audit day looks like, from notice to close-out

Most DEA contact with a veterinary practice isn't the dramatic version. It's a routine registration inspection, or a follow-up visit tied to a registration renewal, and it's generally announced ahead of time. The less common but more serious version is an unannounced visit, which can be triggered by something as simple as a call from a current or former employee, and in rare cases involves investigators arriving with a task force and a warrant.

Either way, the inspection itself centers on two things: your records and your security measures. Investigators will want your DEA registration certificate, your receiving records for every Schedule II through V substance including invoices and CSOS or Form 222 order confirmations, your dispensing logs and your most recent biennial inventory. Then they'll want to physically reconcile what's on paper against what's actually in your safe, which is where a practice's pre-existing logbook discrepancies stop being a paperwork problem and start being an explanation you have to give on the spot.

What happens after depends on what they find. A Letter of Admonition signals a minor issue that needs correcting but doesn't escalate further on its own. A Memorandum of Agreement is a more formal corrective action plan with specific deadlines and expectations. Beyond that sit monetary penalties, which under current inflation-adjusted caps run somewhere in the range of $15,000 to $16,000 per violation, and the real cases above show those add up fast when an inspection turns up more than one problem. At the far end sit registration suspension, revocation or a criminal referral, though those are reserved for the more serious pattern-of-conduct cases rather than a single missed log entry.

The uncomfortable statistic worth thinking over: compliance reviewers who've walked through hospital records after the fact routinely find double-digit numbers of violations once they start looking closely, even at practices that considered themselves careful. That's not because these practices were reckless. It's because nobody was checking the work on a regular cadence, so small gaps compounded quietly for months or years before anyone noticed.

None of this requires new software or a consultant on retainer. It requires a recurring hour on someone's calendar and the discipline to do the reconciliation instead of skimming the log and assuming it's fine. Every practice in the case list above almost certainly believed its records were fine right up until an inspector proved otherwise.

The pattern across all six real cases cited earlier is the same one, playing out at a different scale each time: a small gap sat unexamined long enough to become a big one. A quarterly hour spent reconciling counts, rather than glancing at a logbook and moving on, is the cheapest insurance policy an independent practice can buy against turning up on a list like that one.