How a study drug under the drug control laws is kept

Two rulebooks on the same vial

A drug being studied in people is already governed by the research rules. Where it is also a controlled substance, a second body of law attaches, run by a different agency.

The research rule that connects them is short. It puts a duty on the investigator rather than on the company, and it is written in physical terms.

Whether any particular compound is controlled is a separate question, answered by the schedules and covered elsewhere on this site. This is about what follows once the answer is yes.

What makes it worth reading is how concrete it is. Most regulation in this area is about documents. This one is about a cabinet.

The sentence about the cabinet

The research rule states the duty in one sentence, and every part of it is doing work.

Where the investigational drug is subject to the controlled substances law, the investigator "shall take adequate precautions." The rule names one: "storage of the investigational drug in a securely locked, substantially constructed cabinet, or other securely locked, substantially constructed enclosure, access to which is limited."

The purpose is stated in the same sentence: "to prevent theft or diversion of the substance into illegal channels of distribution."

Note the word including. The locked enclosure is a floor rather than a ceiling, because the duty is adequate precautions and the cabinet is one named example of them.

The same words, in the other agency's rules

That phrasing is not unique to the research rules. The drug control regulations use it too.

Their storage rule for practitioners says that substances in the most restricted schedule "shall be stored in a securely locked, substantially constructed cabinet." The wording is identical.

The same rule treats the less restricted schedules slightly differently. Pharmacies and institutional practitioners may disperse those substances "throughout the stock of noncontrolled substances in such a manner as to obstruct the theft or diversion."

And the storage rule reaches researchers explicitly. It states that the section "shall also apply to nonpractitioners authorized to conduct research or chemical analysis under another registration."

Security judged as a whole

The drug control rules do not stop at a list of fixtures. They set a general standard and then say how compliance is judged.

The general duty is that all applicants and registrants "shall provide effective controls and procedures to guard against theft and diversion of controlled substances."

Substantial compliance may be deemed sufficient after evaluating the overall security system. The regulation then lists fifteen factors that may be considered, and reading them is the fastest way to see what the agency is actually looking at.

They include the quantity handled, the location of the premises, and the type of closures on safes and secure enclosures. They also include the adequacy of key and combination control, the extent of unsupervised public access, and the procedures for handling visitors and maintenance personnel.

Security has to move when the drug does

One provision handles what happens when the legal status of a substance changes, and it moves in both directions.

Where controls become inadequate because a substance was moved to a different schedule, or a previously uncontrolled substance was scheduled, or the quantity held rose significantly, the physical controls "shall be expanded and extended accordingly."

The reverse is permitted rather than required. A registrant may adjust controls downward where a substance is rescheduled or removed from control, or where the quantity held falls significantly.

Read together, those two sentences say something useful about how the system thinks. Security follows the substance and the volume, not the label on the door.

What a research protocol has to contain

Research in the most restricted schedule requires a protocol in a prescribed form, and the contents are specific.

It names the investigator with their address, registration number if any, institutional affiliation and qualifications, including a curriculum vitae and a bibliography.

It names the project: the title, a statement of purpose, and the substances involved "and the amount of each needed." A description then covers the number and species of subjects, the dosage, the route and method of administration, and the duration.

It also requires a statement of the security provisions for storing the substances and for dispensing them "in order to prevent diversion." The location, institutional approval, and approval of a human research committee for human studies go in as well.

Asking for more, and reporting a loss

Two procedures show how tightly the quantity is held, and both create records outside the research team.

Wanting more of a substance for an approved project is not a decision the researcher makes. A request goes by registered mail, naming the registration number, the substance, the quantity already authorized and the additional quantity wanted.

The two agencies then handle it jointly. One reviews the letter and forwards it to the other with comments, and the second approves or denies it as an amendment to the protocol.

A loss is reported on a clock. A registrant must notify the field division office in writing of the theft or significant loss of any controlled substances "within one business day of discovery." A complete and accurate form is then filed within 45 days.

What significant means, and who may not be employed

Two more provisions are unusually candid about how the judgment is made.

Deciding whether a loss is significant is not a threshold quantity. The regulation lists factors to consider, including the quantity lost relative to the type of business, whether the loss can be tied to access by specific individuals, and any pattern of losses over time.

The last two factors are about the outside world rather than the premises: whether the substances are "likely candidates for diversion," and local trends and other indicators of diversion potential.

There is also a hiring rule. A registrant may not employ anyone convicted of a felony offense relating to controlled substances as an agent or employee with access to them. The same bar covers anyone who has had a registration application denied, or a registration revoked or surrendered for cause.

The contrast worth carrying away

Put beside the way this market usually works, the picture is stark.

A controlled study drug is counted, stored in a defined enclosure with limited access, covered by a protocol naming the exact amount needed, and increased only by written request approved by two agencies. A loss is reported within one business day.

A vial sold over the internet has none of that structure behind it, and no chain of custody a buyer can inspect. That is not an accusation about any seller. It is a description of two different systems.

The practical use is comparative. When a page invokes research, this is what the word looks like when a substance is genuinely being controlled, and the gap between the two is the answer.

Sources

Each document below is named as it names itself, with the date printed on that document rather than the day it was read.

1. Title 21 Code of Federal Regulations section 312.69, Handling of controlled substances — requiring the investigator to take adequate precautions, including storage in a securely locked, substantially constructed cabinet or other securely locked, substantially constructed enclosure with limited access, to prevent theft or diversion into illegal channels of distribution — Electronic Code of Federal Regulations, Office of the Federal Register, March 1987
2. Title 21 Code of Federal Regulations section 1301.75, Physical security controls for practitioners — the securely locked, substantially constructed cabinet requirement at (a), the dispersal alternative for pharmacies and institutional practitioners at (b), and the statement at (d) that the section applies to nonpractitioners authorized to conduct research or chemical analysis under another registration — Electronic Code of Federal Regulations, Office of the Federal Register, August 2016
3. Title 21 Code of Federal Regulations section 1301.71, Security requirements generally — the duty to provide effective controls and procedures against theft and diversion, substantial compliance judged on the overall security system, the fifteen factors that may be considered, and the requirement at (c) that controls be expanded where a substance is rescheduled or quantities increase significantly — Electronic Code of Federal Regulations, Office of the Federal Register, September 2014
4. Title 21 Code of Federal Regulations section 1301.76, Other security controls for practitioners — the employment prohibition at (a), and at (b) the duty to notify in writing within one business day of discovering a theft or significant loss, to file the required form within 45 days, and the listed factors for judging whether a loss is significant — Electronic Code of Federal Regulations, Office of the Federal Register, June 2023
5. Title 21 Code of Federal Regulations section 1301.18, Research protocols — the prescribed contents of a protocol for research with substances in the most restricted schedule, including investigator qualifications, the substances and the amount of each needed, the description of the research, the security provisions for storage and dispensing, and the required approvals, plus the procedure at (c) for requesting an increased quantity — Electronic Code of Federal Regulations, Office of the Federal Register, March 2010