DEA Subpoena for Pharmacy Records

DEA Subpoena for Pharmacy Records

In April 2025, Walgreens agreed to pay $350 million to resolve DEA allegations that it illegally filled millions of controlled substance prescriptions over an eleven-year period. But heres the thing most pharmacists dont understand – every single pharmacist who filled those prescriptions could have faced personal liability. The corresponding responsibility doctrine means your not just an employee following orders. Your on the hook too.

Look. If your a pharmacist or pharmacy owner and youve recieved a DEA administrative subpoena for your pharmacy records, you need to understand something that most people – even alot of pharmacists – dont realize. The DEA isnt just investigating your pharmacy as a business entity. Their investigating whether individual pharmacists met their corresponding responsibility under federal law. Thats personal. Thats your license. Thats potentially criminal liability.

I should mention – actualy, this is important – the Walgreens settlement wasnt unique. Rite Aid paid $410 million in July 2024. OptumRx paid $20 million in June 2024. And those are jsut the big settlements. The DEA has been revoking individual pharmacy registrations at an increasing rate. Coconut Grove Pharmacy in 2024. Neumann’s Pharmacy in 2025. Just Here II Pharmacy. Eagle Pharmacy. The pattern is clear. And in every single one of these cases, the pharmacists could have faced personal consequences.

Permanent. Career-ending. Not worth it.

What Is a DEA Administrative Subpoena

Under 21 U.S.C. § 876, the DEA has authority to issue administrative subpoenas to compel production of records that are “relevant or material” to an investigation. This standard is way lower then probable cause. Way lower. The DEA dont need to convince a judge that theres evidence of a crime. They dont need to show probable cause. They dont even need prior judicial approval.

Administrative subpoenas is different from grand jury subpoenas in several important ways. First, their issued directly by DEA officials – not a grand jury. Second, their not self-enforcing. If you refuse to comply, the DEA has to petition a court to compel production. Third, the scope is suppose to be limited to regulatory purposes – not criminal investigation. I should say – I dont want to guarentee anything here – but courts generally gives the DEA alot of latitude in defining whats “relevant or material.”

The practical reality is that the DEA uses administrative subpoenas as teh primary tool for gathering pharmacy records. In my experiance, most pharmacies recieve these subpoenas during what the DEA calls a “compliance investigation” – which can quickly become something more serious.

Real talk: if your pharmacy has recieved a DEA administrative subpoena, you need specialized legal counsel immediately. Not tomorrow. Not next week. Today.

Who Can Issue DEA Subpoenas to Pharmacies

DEA administrative subpoenas can be issued by a surprisingly wide range of officials. This suprises alot of pharmacists who assume only high-level DEA officials have this authority.

The following officials can issue administrative subpoenas:

• DEA Administrator
• Special Agents-in-Charge (SACs)
• Associate Special Agents-in-Charge
• Assistant Special Agents-in-Charge
• Diversion Program Managers
• DEA Inspectors
• Resident Agents-in-Charge
• Regional Directors

Basically. Any DEA official with supervisory authority over diversion investigations can jsut issue a subpoena for your pharmacy records. No judicial approval. No oversight. They dont even need to be investigating a specific crime – thats how broad the authority is.

Pharmacy Recordkeeping Requirements Under 21 CFR Part 1304

Before we get into responding to subpoenas, you need to understand what records your pharmacy is required to maintain under federal law. Their are specific requirements that most pharmacies dont fully appreciate until they recieve a subpoena.

Under 21 CFR Part 1304, pharmacies must maintain:

• DEA Form 222: Order forms for Schedule II substances (paper or CSOS electronic)
• Inventory Records: Initial inventory and biennial (every 2 years) inventories
• Dispensing Records: All controlled substance prescriptions
• Distribution/Disposal Records: DEA Form 106 for theft/loss, Form 41 for disposal
• Receipts and Invoices: For Schedule III-V substances

The retention period is two years minimum under federal law – though I should mention that alot of states require longer. California requires 3 years. Some states require five years. You need to follow the longer requirement.

Heres where it gets complicated. Schedule II records must be maintained seperately from all other records. Not jsut in a different file – actually physically seperate. Schedule III-V records can be stored with ordinary business records IF they are “readily retrievable” – but what counts as readily retrievable is kinda subjective.

For inventories, Schedule II substances require an exact physical count. Every single pill. Schedule III-V substances allow estimated counts unless the container holds more then 1,000 units. This distinction matters because inventory discrepancies are one of the primary red flags that triggers DEA investigations.

The Corresponding Responsibility Doctrine

This is the part that most pharmacists dont understand – and its the part that creates personal liability. Under 21 CFR 1306.04(a), pharmacists have what the law calls “corresponding responsibility” for ensuring prescriptions are legitimate.

The regulation states: “A prescription for a controlled substance to be effective must be issued for a legitimate medical purpose by an individual practitioner acting in the usual course of his professional practice. The responsibility for the proper prescribing and dispensing of controlled substances is upon the prescribing practitioner, but a corresponding responsibility rests with the pharmacist who fills the prescription.”

Real talk: this means you cant just fill a prescription because a doctor wrote it. You have an independent duty to verify legitimacy. The Holiday CVS case in 2012 established what DEA calls the “three-part test” – actualy, some people call it the three-prong test:

1. Pharmacist dispensed a controlled substance
2. A red flag was present or should have been recognized
3. The red flag was not conclusively resolved before dispensing

In my experiance, this is where most pharmacies get into trouble. Not because they knowingly filled bad prescriptions – but because they failed to document their red flag resolution. Ive seen it happen over adn over. Pharmacist sees a red flag, calls the doctor, gets a reasonable explanation, fills the prescription. But they dont document it. Two years later, the DEA shows up with a subpoena and the pharmacist has no contemporaneous record of what they verified.

The consequences is devastating. Personal liability. Possible criminal charges. License revocation. All because of documentation failures.

Red Flags Pharmacists Must Recognize

I know what your thinking – “what exactly counts as a red flag?” Good question. The problem is their are no codified list of red flags in DEA regulations. You have to piece it together from DEA administrative decisions and enforcement actions.

Based on recent cases, these are the red flags pharmacists must recognize and resolve:

Patient-Related Red Flags

• Cash payments (especially for expensive controlled substances)
• Long-distance travel to pharmacy
• Multiple pharmacies (pharmacy shopping)
• Early refill requests
• Nervous demeanor or signs of intoxication
• Multiple patients from same address
• Young patients on high doses

Prescription-Related Red Flags

• “Holy Trinity” combinations (opioid + benzodiazepine + muscle relaxant)
• Pattern prescribing (same drugs, same quantities, same directions)
• Unusually large quantities
• High dosages
• Multiple controlled substances on same date
• Prescriptions that dont make clinical sense together

Prescriber-Related Red Flags

• Geographic anomalies (patients traveling far from prescriber)
• Same prescriptions to all patients
• Cash-only medical practice
• Known disciplinary actions against prescriber
• Prescriber in specialty unrelated to controlled substances
• High volume of controlled substance prescriptions

Your probly wondering – do I have to document resolution for every single one of these? Yes. Everytime you see a red flag and decide to fill anyway, you need contemporaneous documentation of what you verified and why you concluded the prescription was legitimate.

Documentation Requirements – “Verified” Isn’t Enough

The Coconut Grove Pharmacy decision in 2024 made this extremley clear: writing “verified” on a prescription does NOT meet the standard of care. The Neumann’s Pharmacy decision in 2025 went further – DEA explicitly rejected what they called “undocumented, post hoc justifications.”

Most pharmacists… well, many pharmacists anyway… think that if they called the doctor and got an explanation, their covered. Their not. Wait, I should clarify – the call itself isnt enough. You need to document:

• Date and time of red flag identification
• Specific red flag(s) that were identified
• Steps taken to investigate
• Who you contacted (name, not just “doctor’s office”)
• What information you obtained
• Your rationale for dispensing decision

The documentation requirements is critical because DEA reviews come years after dispensing. Your memory isnt reliable. The prescriber’s memory isnt reliable. Only contemporaneous documentation matters.

In the Neumann’s case, the pharmacist tried to explain after the fact why certain prescriptions were legitimate. DEA said essentially: “You didnt document this at the time, so we dont believe you.” Thats the reality your dealing with.

Ruan v. United States Changed Everything

In 2022, the Supreme Court issued a unanimous decision in Ruan v. United States that fundamentally changed how pharmacist liability works in criminal cases. Everyone agrees… well, most experts agree… this is one of the most important controlled substance cases in decades.

Before Ruan, prosecutors could convict pharmacists based on objective unreasonableness. If a “reasonable pharmacist” would have recognized the prescription as illegitimate, you could be convicted even if you genuinley believed it was legitimate.

After Ruan, the government must prove you subjectively knew the prescription was illegitimate – or at least acted with willful blindness. This is huge. The Court held that DEA must prove the defendant “knowingly or intentionally” acted in an unauthorized manner.

Game-changing.

What this means for pharmacists facing criminal charges: good faith efforts to verify prescriptions are now a powerful defense. If you genuinley believed the prescriptions were legitimate and took steps to verify – even if those steps were inadequate – its much harder for prosecutors to prove criminal intent.

No competitor article I’ve seen adequetly explains this. Ruan provides substantial protection for pharmacists who acted in good faith. Its not a get-out-of-jail-free card, but its significant.

The Two-Step Enforcement Reality

Heres something else most pharmacists dont understand: DEA administrative subpoenas are NOT self-enforcing. This creates leverage that most people – including alot of lawyers – dont fully appreciate.

The enforcement process works like this:

1. DEA issues administrative subpoena
2. If pharmacy refuses or challenges, DEA must petition federal court
3. Court reviews and may modify scope
4. Court orders compliance (if appropriate)
5. Only after court order can contempt apply

Third… actualy, Ill come back to that. The important point is: you have time. You can consult counsel. You can challenge scope. You can negotiate limitations. You can seek protective orders.

Most pharmacies just comply immediately because their scared. But thier are legitimate reasons to push back:

• Overbreadth – subpoena requests too much
• Lack of relevance – some records dont relate to investigation
• Undue burden – production would be unduly expensive or disruptive
• Privilige protections – attorney-client communications, work product

I should say – I dont want to suggest you should always fight subpoenas. Sometimes quick compliance is the best strategy. But you should make that decision wiht counsel, not out of fear.

Consent vs. Warrant: DEA Form 82

When DEA inspectors show up at your pharmacy for an inspection, they typically present DEA Form 82 – the “Notice of Inspection of Controlled Premises.” This form has specific requirements under 21 CFR 1316.08 that most pharmacists dont understand.

The form must include explicit disclosure that:

• You have a constitutional right to refuse the inspection
• Consent is voluntary
• You may withdraw consent at any time during the inspection
• Any incriminating evidence found can be used against you

This is important: you’re pharmacy CAN refuse a consent inspection. Refusing is NOT obstruction. Its exercising your constitutional rights. If you refuse, DEA must then obtain an administrative inspection warrant – which requires them to show a court that the inspection is reasonable.

But heres the privilige that refusing gives you:

• Time to consult attorney
• Opportunity to conduct privileged internal audit
• Time to prepare staff
• Time to organize records

When should you refuse? Good question. Generally, if you have known compliance deficiencies, refusing buys time to address them under attorney supervision. If you have no concerns about compliance, consenting may be the faster path to resolution.

And heres another thing – administrative inspection warrants have limits. Their scope is supposed to be limited to regulatory purposes. If inspectors find evidence of crime during an administrative inspection, it may be subject to suppression arguments. This is actualy a complex area of law that requires specialized counsel.

HIPAA Framework for Pharmacy Subpoenas

Pharmacies are covered entities under HIPAA, which creates additional considerations when responding to DEA subpoenas. The HIPAA rules is kinda confusing in this area, but heres the framework.

Under 45 CFR 164.512(f), pharmacies may disclose Protected Health Information (PHI) – or as some people call it, health info – without patient authorization for law enforcement purposes in specific circumstances:

• Court orders
• Grand jury subpoenas
• Administrative subpoenas meeting the three-part test

The three-part test for administrative subpoenas requires:

1. Information is relevant and material to legitimate law enforcement inquiry
2. Request is specific and limited in scope
3. De-identified information could not reasonably be used

Most DEA administrative subpoenas will meet this test. But patient notification requirements is something pharmacies often overlook. Generally, when disclosing PHI pursuant to a subpoena (not a court order), you should:

• Make reasonable efforts to notify patient, OR
• Obtain qualified protective order, OR
• Receive satisfactory assurance from requesting party

In practice, most pharmacy chains dont notify patients. A Congressional investigation found that major chains process thousands of law enforcement requests annually wihtout patient notification.

Civil Penalties Have Skyrocketed

The civil penalties for controlled substance violations were updated in February 2024, and the numbers are genuinley shocking. Most competitor articles cite outdated penalty amounts.

Current penalty amounts:

• $18,759 per recordkeeping violation
• $80,850 per prescription violation
• $1,951,000 maximum for pattern of flagrant violations

Serious. Very serious.

Think about what this means for a pharmacy investigation. If DEA identifies problems with 100 prescriptions, thats potentially $8 million in civil penalty exposure. Thats not including criminal liability. Thats not including registration revocation. Thats just civil penalties.

And the penalties are calculated per violation. Every prescription that failed to meet corresponding responsibility requirements. Every recordkeeping deficiency. Every inventory discrepancy. They add up fast.

In the Walgreens settlement, the $350 million covered approximately eleven years of conduct. Do the math – thats alot of individual violations aggregated.

Recent Enforcement Actions 2024-2025

DEA enforcement against pharmacies has intensified dramatically in recent years. Understanding the enforcement landscape helps you understand the risk your facing.

Major Settlements

Walgreens – $350 million (April 2025): Illegally filled millions of controlled substance prescriptions from August 2012 through March 2023. The settlement included a 7-year DEA Memorandum of Agreement and 5-year Corporate Integrity Agreement with HHS-OIG. Compliance officials had ignored “substantial evidence” of unlawful prescriptions.

Rite Aid – $410 million (July 2024): Combined False Claims Act and CSA violations. Included “trinity” prescriptions, early fentanyl fills, and prescriptions from flagged prescribers that were filled anyway. This case shows that audit and compliance failures have massive financial consequences.

OptumRx – $20 million (June 2024): First-ever settlement with a pharmacy benefit manager. Shows DEA is extremley expanding enforcement across the entire supply chain – not just traditional brick-and-mortar pharmacies.

Registration Revocations

Recent revocations include:

• Just Here II Pharmacy (Philadelphia, 2025)
• Eagle Pharmacy (Houston, 2025)
• Coconut Grove Pharmacy (Florida, 2024)
• Awesome Care Pharmacy (Houston, 2024)
• Xubex Community Pharmacy (Florida, 2024)

The pattern across these cases: failure to adequetely document red flag resolution. Ive seen it happen – pharmacists who thought they were doing everything right, but their documentation was insufficient.

Criminal Prosecutions

There enforcing aggressively on the criminal side too. Recent cases include:

• Ruthia He and David Brody (DONE Global): Convicted for $100 million Adderall distribution scheme through telemedicine
• Joseph and Jenifer Huff: 3 years and 2 years respectively for diverting controlled substances
• Multiple pharmacists sentenced for pill mill involvement

Corresponding responsibility is now being used as a criminal theory, not just administrative.

Parallel State Board Proceedings

When DEA takes action against a pharmacy, state pharmacy boards almost always follow. Their is no double jeopardy protection for administrative proceedings – you can face both federal and state consequences for the same conduct.

For all intensive purposes, a DEA registration revocation means your state license is at serious risk too. State boards review DEA findings and often initiate their own proceedings. You may face:

• DEA registration revocation (federal)
• State pharmacy license suspension or revocation
• Civil monetary penalties (federal)
• State administrative penalties
• Potential criminal prosecution (federal and/or state)

All for the same conduct. This requires coordinated defense strategy across multiple forums. What you say in the DEA proceeding can be used in the state proceeding. Settlement terms in one forum may affect your options in another.

Some pharmacists try to handle these seperately – thats a mistake. You need counsel who understands both federal DEA proceedings and state pharmacy board practice.

Simultaneous OIG and DEA Subpoenas

This is something… wait, this is actualy one of the most important emerging trends – when pharmacies recieve subpoenas from BOTH DEA and HHS Office of Inspector General (OIG) at the same time. Trust me, this signals serious trouble.

Simultaneous subpoenas indicate:

• Their investigating both drug diversion AND fraudulent billing
• Multi-agency coordinated investigation
• Potential False Claims Act exposure (treble damages plus penalties)
• Both civil and criminal liability risk

The False Claims Act angle is particularly concerning. If your pharmacy billed Medicare or Medicaid for prescriptions that didnt meet corresponding responsibility requirements, thats potentially false claims. The damages are trebled – three times actual damages plus penalties per false claim.

Ive seen pharmacies face combined exposure in the hundreds of millions when you add FCA liability to CSA penalties. This is not hypothetical – the Rite Aid settlement included both.

Defense Strategies for Pharmacies

If your pharmacy has recieved a DEA administrative subpoena, what should you do? And what are your options?

Immediate Steps

1. Contact specialized counsel immediately
2. Do NOT destroy or alter any records
3. Document what you recieved and when
4. Preserve all communications with DEA
5. Begin privileged internal review under counsel

Motion to Quash Options

Subpoenas can be challenged on several grounds:

• Fourth Amendment: Unreasonable search (limited success)
• Overbreadth: Requests too much, beyond reasonable scope
• Relevance: Records dont relate to legitimate investigation
• Undue Burden: Production would be unreasonably expensive or disruptive
• Privilege: Attorney-client or work product protections

Probly will help to negotiate scope even if you dont file formal motion. I should say – I dont want to guarentee anything – but DEA is often willing to narrow requests when faced with legitimate concerns.

Privilege Assertions

Key privileges to consider:

• Attorney-client privilege: Conduct internal audits under counsel direction
• Work product doctrine: Materials prepared in anticipation of litigation
• Fifth Amendment: Individuals only, not available to corporations

The Fifth Amendment is complicated for pharmacies because the “required records doctrine” may limit its application. Some commentators believe pharmacy records fall within this exception – but its genuinley unsettled law.

Corrective Action Plans

If compliance deficiencies are identified, a Corrective Action Plan (CAP) may be the best path forward. CAPs typically include:

• Enhanced staff training on corresponding responsibility
• Policy changes for red flag identification and documentation
• Increased monitoring and auditing
• Designated compliance officer
• External compliance consulting

CAPs can mitigate civil, criminal, and administrative consequences – but they must be genuine, not just paper compliance.

Memorandum of Agreement

A Memorandum of Agreement (MOA) with DEA is a business agreement that defines ongoing compliance measures. The Walgreens settlement included a 7-year MOA. Key features:

• Not an admission of liability
• Defines specific compliance measures
• Establishes monitoring requirements
• Typical duration: 3-7 years
• Violation can result in registration revocation

Expert Witness Selection

The Neumann’s Pharmacy decision emphasized that expert testimony must start with “clear and robust articulation” of legal standards before applying principles to case facts. Expert witness credibility is often outcome-determinative.

DEA tends to give government experts significantly more weight than pharmacy owner testimony, which they consider “self-serving.” Your expert selection and preparation is critical to any contested proceeding.

What Happens If You Dont Respond

Some pharmacists think they can just ignore a DEA subpoena. This is a catastrophic mistake. Heres what happens:

1. DEA petitions federal court to compel compliance
2. Court issues order to comply
3. If you still dont comply – civil contempt
4. Potential criminal contempt charges
5. Registration revocation proceedings accelerate
6. Criminal referral becomes more likely

Your facing serious consequences for non-compliance. Permanent. Career-ending. Not worth it.

Even if you believe the subpoena is overbroad or improper, you must respond – either by compliance or by formal legal challenge. Ignoring it is never the right answer.

The contempt power means fines can accumulate daily until compliance. And once your in contempt posture, DEA has much less incentive to negotiate. You’ve lost your leverage.

Why You Need Specialized Counsel

DEA pharmacy investigations involve a genuinely complex intersection of federal controlled substance law, HIPAA, state pharmacy regulation, and potentially False Claims Act liability. General criminal defense attorneys – even good ones – often dont have the specialized knowledge required.

You need counsel who understands:

• Corresponding responsibility doctrine and recent case law
• Ruan v. United States defense implications
• DEA administrative procedures
• State pharmacy board proceedings
• HIPAA compliance obligations
• False Claims Act exposure
• Penalty calculation and mitigation
• Expert witness requirements

Bottom line: a DEA subpoena for pharmacy records is serious. It may be the beginning of a compliance inquiry that resolves quickly – or it may be the start of a multi-year investigation with career-ending consequences. The actions you take in the first days and weeks matter enormously.

At Spodek Law Group, we’ve helped pharmacies and pharmacists navigate DEA investigations at every stage. We understand the corresponding responsibility doctrine. We know how to leverage Ruan. We’ve negotiated successful resolutions that preserved licenses and avoided criminal charges.

If youve recieved a DEA subpoena, call us at 212-300-5196. Initial consultations are confidential. We can review your situation and help you understand your options.

Dont wait. The decisions you make now will determine how this ends. And I mean it.