How long must we keep old controlled drug logs?

Controlled drug records may be in the form of hand-written documents such as logs and inventory sheets.  They may be computer generated printouts such as invoices or ordering documents.  The records may be electronic such as computerized medical records or sales information.  Or they may be documents that are typed or printed then manually signed such as a “memorandum for record” to explain a loss because of a broken bottle.

No matter what the format, the DEA requires the registrant to keep all controlled drug records for at least two years.  Although the regulation is silent on the method one may use to retain the records, at the preset time, the DEA does not accept “scanned then destroy the original” methods.  They expect the registrant to maintain the documents in their original format. That may change in the future, but the DEA just isn’t there yet!

Here’s a very important point.  Once a record is generated, NEVER, EVER alter those records.  Even if you are trying to clarify an issue or to make them more readable.  Records must be maintained in their original state.  It’s acceptable to ADD entries or attach memorandums or documents to EXPLAIN something that may be unclear, but never CHANGE ANYTHING on a record that has already been generated.

Although the majority of states adhere to the federal requirement for records retention, some states require controlled drug records to be maintained for a bit longer than two years. Most commonly, when a state requires a longer retention period, it’s for three years instead of two years.  We’ve seen a couple of states that require a five-year retention, but we’re not aware of any state that requires more than a 5-year retention. 

Destroying Old Records

As I travel around the country working with practices on these issues, it's not uncommon to see 20 years’ worth of old logs in some places. Since most places I visit are “space challenged”, it makes no sense to keep that stuff around if you don’t need to.  So get rid of it!

The easiest method of maintaining control over old records is to adopt a “replace not add” philosophy.  When adding records for the past year, search out and destroy that are no longer necessary – in essence, at any one time there are just 2 years worth of records in storage.  Don’t wait until the space is unmanageable to start the destruction process!

A lot of folks really fret about getting rid of old records for fear of losing valuable data.  Well, that’s fine for history or clinical research records, but old controlled drug logs are really not very useful at all.  The information that they contain SHOULD already be in the medical records and even then, a dose of pain medication three or eight years ago really doesn’t add much to a current discussion about a patient’s treatment plan.

Another reason to get rid of the old stuff: they can use it against you!  Although you are not required to keep old logs for more than the time specified in the regulation, if they are available during an audit and there are problems, the DEA agents CAN use those in considering a citation!  So don't confess to past transgressions if you don't have to – get rid of records you are no longer required to keep!

It’s smart to destroy old records promptly but one shouldn’t have to spend a lot of time doing so. Every practice should put some thought into managing old records and develop a records retention and destruction plan. - That’s not complicated - Simply, it’s a list of what records exist, where they are located and the date they should be destroyed.

When records are identified as ready for destruction, some thought must be put into how the destruction is to take place. For most paper-based business records, including controlled drug records, the acceptable methods are shredding, incineration and maceration, that is dissolving the records into pulp.

When records are shredded, cross-shredding is preferred over strip style shredding. Although not required, security conscious practices will dispose of those shredded documents by mixing them with some “objectionable waste” and maybe even spreading the contents out over several trash bags or containers.

The destruction can be local, such as a staff member shredding documents in-house. Or it can be contracted out, such as hiring a service that specializes in the destruction of records.

However, destruction can never be in the form of recycling, even recycling shredded or partially shredded documents can pose a security risk and is discouraged.

When it comes to electronic records, simply deleting the files is usually enough. There are times when deleted files can be recovered on hard drives and flash drives if the actual data has not been replaced with new data, however, for this level of destruction those limitations are not necessarily a concern. There are computer programs that “sanitize” computer records in electronic format so that they can’t be recovered if that level of destruction is desired. For computer-based files that can’t be simply erased, such as CDs and DVDs, physical destruction is the method of choice. Most office shredders are able to destroy CDs and DVDs.

Did You Know...?

insert content here