Table  1 presents the number and type of individuals and entities that are  registered with DEA to manufacture, distribute, or dispense controlled  substances. However, we found limitations in DEA’s processes to collect and validate  registrants’ identifying information and verify continued registrants’  eligibility. Our examination of DEA’s CSA2 data revealed gaps and other issues  pertaining to registrants’ SSNs, as described below. Instructions on DEA’s application form state that SSNs are required  for individual registrations, and tax identification numbers (such as an  EIN) are required for business registrations. Our analysis of DEA’s CSA2 data identified 41,909 of about 1.4  million individual registrations (about 3 percent) who were registered  using an EIN instead of an SSN. As a result, DEA would have to obtain additional legal authority in  order to require SSNs for all individuals. We identified 688  SSNs associated with multiple individuals, which is a risk indicator for  potential fraud. Some Registrants Were Potentially Ineligible Because They Were Reported as Deceased, Did Not Have a Current State License, or Had Criminal Violations Related to Controlled Substances

Of the approximately 1.4 million individual registrations in DEA’s CSA2,  we found 764 registrants that may have been ineligible to have controlled  substance registrations because the registrants were reported deceased  by SSA, did not possess state-level controlled substance authority, or  were incarcerated for felony offenses related to controlled substances. In  addition, we also found 100 registrants who presented issues that may  increase the risk of illicit diversion of controlled substances, such as  registrants with active or recent warrants for offenses related to controlled  substances, registrants incarcerated or with active or recent warrants for  offenses unrelated to controlled substances, and registrants listed in the  NSOR. The physician was still actively registered with  DEA as of March 2014. However, DEA  does not verify practitioners’ state licenses after initial registration to  ensure they are still actively licensed by the state. The Manual also emphasizes that applicants and registrants who hire  employees to work in or around areas where controlled substances are  handled must carefully screen these employees, identifying this process  as “a critical first step in diversion prevention,” “vital to fairly assess  the likelihood of an employee committing a drug security breach,” and  “essential to overall controlled substances security.” According to DEA, as  part of the screening process, criminal-background checks with local law- enforcement authorities should be performed by the employer, and each  potential employee should be required to answer the question, “Within the  past five years, have you been convicted of a felony, or within the past  two years, of any misdemeanor, or are you presently charged (formally)  with committing a criminal offence?” Given DEA’s guidance to registrants  that their employees with criminal convictions, or pending charges, may  pose an increased risk of illicit diversion of controlled substances, we  assessed the extent to which DEA’s internal controls help ensure  individual registrants do not present similar issues that may increase the  risk of illicit diversion of controlled substances. Registered Sex Offenders. DEA has implemented controls to register individuals to handle or  prescribe controlled substances. Given that unique identifying information, such  as SSNs, is critical to validating the identities and implementing controls  to identify deceased registrants, obtaining legal authority to require such  information and developing policies and procedures to validate this  information would help ensure that DEA’s registrants are and remain  eligible to prescribe and handle controlled substances. Similarly, developing procedures to verify the continued eligibility of its  registrants in other areas, such as verifying that registrants maintain  appropriate state authority and have not been subject to disciplinary  actions that may affect their eligibility, would help ensure that its  registrants maintain eligibility to handle and prescribe controlled  substances. In its written comments, DEA stated that it appreciates the intent of our  recommendations, but raised concerns about its legal authority to take  some of the actions we recommended. We believe that developing procedures to monitor registrants’ criminal  backgrounds using these databases would be beneficial for DEA to help  ensure that its registrants are and remain eligible and do not possess an  increased risk of illicit diversion. Appendix I: Objectives, Scope, and Methodology

This report (1) identifies and describes the internal controls that selected  states and the Drug Enforcement Administration (DEA) use to help  ensure the eligibility of individuals to handle controlled substances, and  (2) assesses the extent to which DEA’s internal controls help ensure that  individuals listed in the controlled substances database are and remain  eligible and do not present issues that may increase the risk of illicit  diversion of controlled substances. We also interviewed  relevant DEA officials to identify DEA’s processes for registrants’ initial  registration, renewal, and monitoring. FSMB licensure and disciplinary action data.
Why GAO Did This Study

DEA registers individuals and entities authorized to manufacture, distribute, or dispense controlled substances in accordance with the Controlled Substances Act, which seeks to ensure that only authorized individuals handle controlled substances. States also have a role in the registration process as they determine general licensing requirements for health-care professionals who are permitted to handle or prescribe controlled substances. Controlled substances include prescription pain relievers, such as OxyContin, stimulants, and sedatives.
GAO was asked to review DEA's processes for registering applicants, monitoring the eligibility of registrants, and managing CSA2 data. This report assesses the extent to which DEA's internal controls help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion, among other objectives. GAO reviewed relevant documents and interviewed DEA and state officials. GAO matched CSA2 data to several databases to identify potentially ineligible registrants.

What GAO Found

The Drug Enforcement Administration (DEA) has established controls for determining registrant eligibility to handle and prescribe controlled substances. However, GAO found limitations in DEA's controls to help ensure that individual registrants are and remain eligible and do not present issues that may increase the risk of illicit diversion. GAO's examination of DEA's controlled substances database (CSA2) as of March 2014 (the most-current data available) revealed gaps and other issues pertaining to registrants' identifying information. For example, GAO's analysis identified 40,785 of about 1.4 million individual registrations that were registered using a business tax identification number instead of a Social Security number (SSN). According to DEA officials, DEA does not have legal authority to require SSNs for individuals applying as a business. For individuals registered with an SSN, GAO found 11,740 SSNs that could not be validated by the Social Security Administration (SSA) and 688 SSNs that were registered to multiple names or variations of names, which can be a risk indicator of potential fraud. SSNs are needed to identify and remove deceased registrants as well as identify any past adverse history that may affect registrant eligibility. Given that SSNs are critical to validating identities, implementing DEA's controls, and identifying registrants' past adverse history, obtaining legal authority to require SSNs for all individuals and developing policies and procedures to validate them would help ensure that registrants are and remain eligible.
GAO also found limitations in DEA's processes for verifying continued eligibility of its registrants. Of the approximately 1.4 million individual registrations in CSA2 as of March 2014, GAO found 764 registrants who were potentially ineligible because they were reported deceased by SSA, did not possess state-level controlled substance authority, or were incarcerated for felony offenses related to controlled substances. GAO also found 100 registrants who presented issues that may increase the risk of illicit diversion, such as registrants incarcerated for offenses unrelated to controlled substances, registrants with active or recent warrants, and registrants listed as sex offenders. DEA does not have processes in place to verify its registrants' state licenses or criminal background after initial registration, unless the registrant self-reports or the state notifies DEA of actions taken against its registrants. Developing processes to monitor registrant state licensure and disciplinary actions, such as verifying that registrants maintain appropriate state authority and assessing the cost and feasibility of monitoring registrants' criminal backgrounds, would help ensure that registrants maintain eligibility to handle and prescribe controlled substances and do not present issues that may increase the risk of illicit diversion.

What GAO Recommends

GAO is making five recommendations to DEA to help ensure practitioners are and remain eligible and that those who pose an increased risk of illicit diversion are identified. DEA stated it appreciated the intent of GAO's recommendations, but raised concerns about its legal authority to take some of the actions. GAO's recommendations include having DEA seek legal authority as needed, and remain valid.