DEA 21 CFR Part 1304 Document Destruction

Healthcare providers, pharmacies, and other DEA registrants in New York face strict recordkeeping obligations under the Controlled Substances Act and its implementing regulations — including specific rules about how long records must be retained and how they must ultimately be destroyed. DEA 21 CFR Part 1304 document destruction requirements apply to any entity registered with the Drug Enforcement Administration that dispenses, distributes, or manufactures controlled substances, including every pharmacy, hospital, clinic, and practitioner in New York City, Long Island, Westchester, and the Hudson Valley.

Noncompliance with DEA recordkeeping and destruction requirements can result in suspension or revocation of your DEA registration, significant civil monetary penalties, and in serious cases, criminal prosecution. Understanding what records must be kept, for how long, and how they must be destroyed is essential for every DEA registrant.

What Records Are Covered Under DEA 21 CFR Part 1304?

DEA regulations at 21 CFR Part 1304 establish the types of records that DEA registrants must maintain relating to controlled substances. These include:

• Biennial inventories: A physical count of all controlled substances on hand, conducted every two years
• Order forms (DEA Form 222): Records of controlled substance orders and transfers
• Receipts and invoices: Records of all controlled substances received from suppliers or distributors
• Distribution records: Records of controlled substances transferred to other registrants
• Dispensing records: Prescriptions and dispensing logs for Schedule II–V controlled substances
• Theft and loss reports: DEA Form 106 reports of stolen or lost controlled substances

These records must generally be retained for a minimum of two years from the date of the record, unless state law requires a longer period. New York has its own controlled substance recordkeeping requirements that may extend retention periods beyond the federal minimum. Our compliance resource center can help you navigate both federal and state requirements.

DEA Requirements for Secure Document Destruction

DEA regulations do not prescribe a specific method for destroying controlled substance records, but they do require that records be maintained intact and accessible throughout the retention period. Once the retention period expires, records must be disposed of in a manner that protects the confidentiality of patient and prescribing information contained in those records.

Federal law and guidance from the DEA support the use of shredding as the appropriate method for destroying expired controlled substance records. Key destruction requirements include:

• Records must be rendered unreadable and unrecoverable before disposal
• Destruction must be documented — a Certificate of Destruction from a certified shredding company satisfies this requirement
• Prescriptions and dispensing records containing PHI are also subject to HIPAA disposal rules, requiring secure shredding
• Electronic records on storage media must be physically destroyed, not simply deleted

Our shredding services include HIPAA-compliant paper shredding and hard drive destruction for healthcare facilities and pharmacies throughout New York.

HIPAA and DEA: Dual Compliance for Healthcare Records

DEA-regulated records in healthcare settings are often also subject to HIPAA, since controlled substance prescriptions and dispensing records contain Protected Health Information (PHI). This dual compliance requirement means that New York pharmacies and healthcare providers must satisfy both the DEA’s recordkeeping requirements and HIPAA’s disposal requirements — which align well but must each be addressed.

HIPAA’s disposal rule (45 CFR § 164.310(d)(2)(i)) requires covered entities to implement policies and procedures to address the final disposition of PHI and the hardware or electronic media on which it is stored. Combined with DEA requirements, this means:

• All paper records containing PHI — including controlled substance prescriptions — must be destroyed by a certified shredding company
• Electronic records and storage media must be physically destroyed or rendered permanently unreadable
• A Certificate of Destruction must be obtained for each destruction event and retained as part of the compliance record
• Locked shredding consoles should be placed in areas where controlled substance records are generated or stored

Learn about our shredding process for healthcare providers and how we ensure dual HIPAA and DEA compliance for every destruction event.

Controlled Substance Record Destruction: A Compliance Checklist

Use this checklist to assess your DEA recordkeeping and destruction compliance. Healthcare providers and pharmacies in New York City, Long Island, and Westchester should review this list periodically — especially before a DEA inspection.

• ☐ All DEA-required records are retained for at least 2 years (or longer as required by New York state law)
• ☐ Records are stored in a secure, accessible location throughout the retention period
• ☐ A written records retention schedule identifies when each record type can be destroyed
• ☐ Expired controlled substance records are destroyed by a certified shredding company — not placed in trash or recycling
• ☐ A Certificate of Destruction is obtained and retained for each destruction event
• ☐ HIPAA disposal requirements are satisfied for all PHI-containing records
• ☐ Electronic storage media containing controlled substance records is physically destroyed
• ☐ Employees are trained on DEA recordkeeping and secure disposal requirements

Visit our service area page to confirm we serve your New York pharmacy or healthcare facility location.

Consequences of Noncompliance with DEA Recordkeeping Rules

DEA inspections — both announced and unannounced — routinely check registrants’ compliance with 21 CFR Part 1304 recordkeeping requirements. Noncompliance can result in serious consequences, including:

• Suspension or revocation of DEA registration, preventing the dispensing of controlled substances
• Civil monetary penalties of up to $10,000 per violation under the Controlled Substances Act
• Criminal referrals for willful violations of recordkeeping requirements
• New York Board of Pharmacy disciplinary actions, including license suspension
• Increased scrutiny and more frequent DEA inspections

The cost of a certified shredding program is minimal compared to the potential cost of noncompliance. View our pricing for pharmacy and healthcare shredding services, or contact us for a custom quote tailored to your facility’s needs.

Why New York Businesses Choose New York Shredding

For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give healthcare providers and pharmacies the proof they need for DEA inspections and HIPAA audits.

Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your facility on a shredding schedule that keeps you protected year-round.

Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.